All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5.10 000/717] 5.10.4-rc1 review
@ 2020-12-28 12:39 Greg Kroah-Hartman
  2020-12-28 12:39 ` [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs Greg Kroah-Hartman
                   ` (718 more replies)
  0 siblings, 719 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable

This is the start of the stable review cycle for the 5.10.4 release.
There are 717 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.4-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.10.4-rc1

Damien Le Moal <damien.lemoal@wdc.com>
    null_blk: Fail zone append to conventional zones

Damien Le Moal <damien.lemoal@wdc.com>
    null_blk: Fix zone size initialization

Steven Rostedt (VMware) <rostedt@goodmis.org>
    Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"

Nikita Shubin <nikita.shubin@maquefel.me>
    rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time

Zhuguangqing <zhuguangqing@xiaomi.com>
    thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed

Bjorn Andersson <bjorn.andersson@linaro.org>
    remoteproc: sysmon: Ensure remote notification ordering

DingHua Ma <dinghua.ma.sz@gmail.com>
    regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x

Jubin Zhong <zhongjubin@huawei.com>
    PCI: Fix pci_slot_release() NULL pointer dereference

Johan Hovold <johan@kernel.org>
    of: fix linker-section match-table corruption

Felix Fietkau <nbd@nbd.name>
    mt76: add back the SUPPORTS_REORDERING_BUFFER flag

Masami Hiramatsu <mhiramat@kernel.org>
    tracing: Disable ftrace selftests when any tracer is running

Carlos Garnacho <carlosg@gnome.org>
    platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12

Dan Williams <dan.j.williams@intel.com>
    libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer()

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    memory: jz4780_nemc: Fix an error pointer vs NULL check in probe()

SeongJae Park <sjpark@amazon.de>
    xenbus/xenbus_backend: Disallow pending watch messages

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Count pending messages for each watch

SeongJae Park <sjpark@amazon.de>
    xen/xenbus/xen_bus_type: Support will_handle watch callback

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Allow watches discard events before queueing

Pawel Wieczorkiewicz <wipawel@amazon.de>
    xen-blkback: set ring->xenblkd to NULL after kthread_stop()

Takashi Iwai <tiwai@suse.de>
    driver: core: Fix list corruption after device_del()

Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.

Wang Hai <wanghai38@huawei.com>
    device-dax/core: Fix memory leak when rmmod dax.ko

William Breathitt Gray <vilhelm.gray@gmail.com>
    counter: microchip-tcb-capture: Fix CMR value check

Nicolin Chen <nicoleotsuka@gmail.com>
    clk: tegra: Do not return 0 on failure

Terry Zhou <bjzhou@marvell.com>
    clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9

Paul Cercueil <paul@crapouillou.net>
    clk: ingenic: Fix divider calculation with div tables

Yangtao Li <frank@allwinnertech.com>
    pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler

Zhao Heming <heming.zhao@suse.com>
    md/cluster: fix deadlock when node is doing resync job

Zhao Heming <heming.zhao@suse.com>
    md/cluster: block reshape with remote resync job

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:adc:ti-ads124s08: Fix alignment and data leak issues.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:adc:ti-ads124s08: Fix buffer being too long.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:imu:bmi160: Fix alignment and data leak issues

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:imu:bmi160: Fix too large a buffer.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:pressure:mpl3115: Force alignment of buffer

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:magnetometer:mag3110: Fix alignment and data leak issues.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:rpr0521: Fix timestamp alignment and prevent data leak.

Lorenzo Bianconi <lorenzo@kernel.org>
    iio: imu: st_lsm6dsx: fix edge-trigger interrupts

Qinglang Miao <miaoqinglang@huawei.com>
    iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume

Nuno Sá <nuno.sa@analog.com>
    iio: buffer: Fix demux update

Aleksa Sarai <cyphar@cyphar.com>
    openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()

Arun Easi <aeasi@marvell.com>
    scsi: qla2xxx: Fix crash during driver load on big endian machines

Sergei Antonov <saproj@gmail.com>
    mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments

Praveenkumar I <ipkumar@codeaurora.org>
    mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read

Richard Weinberger <richard@nod.at>
    mtd: core: Fix refcounting for unpartitioned MTDs

Sven Eckelmann <sven@narfation.org>
    mtd: parser: cmdline: Fix parsing of part-names with colons

Miquel Raynal <miquel.raynal@bootlin.com>
    mtd: spinand: Fix OOB read

Evan Green <evgreen@chromium.org>
    soc: qcom: smp2p: Safely acquire spinlock without IRQs

Tudor Ambarus <tudor.ambarus@microchip.com>
    spi: atmel-quadspi: Fix AHB memory accesses

Lukas Wunner <lukas@wunner.de>
    spi: atmel-quadspi: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mt7621: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mt7621: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: synquacer: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: spi-qcom-qspi: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: spi-geni-qcom: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: sc18is602: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: rpc-if: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: rb4xx: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: pic32: Don't leak DMA channels in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: npcm-fiu: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mxic: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: gpio: Don't leak SPI master in probe error path

Rasmus Villemoes <rasmus.villemoes@prevas.dk>
    spi: fsl: fix use of spisel_boot signal on MPC8309

Lukas Wunner <lukas@wunner.de>
    spi: davinci: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: ar934x: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: spi-mtk-nor: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: atmel-quadspi: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: spi-sh: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: pxa2xx: Fix use-after-free on unbind

Lars-Peter Clausen <lars@metafoo.de>
    iio: ad_sigma_delta: Don't put SPI transfer buffer on the stack

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915: Fix mismatch between misplaced vma check and vma insert

Zwane Mwaikambo <zwane@yosper.io>
    drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()

Stylon Wang <stylon.wang@amd.com>
    drm/amd/display: Fix memory leaks in S3 resume

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: only set DP subconnector type on DP and eDP connectors

Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
    drm/amd/display: Honor the offset for plane 0.

Boris Brezillon <boris.brezillon@collabora.com>
    drm/panfrost: Move the GPU reset bits outside the timeout handler

Boris Brezillon <boris.brezillon@collabora.com>
    drm/panfrost: Fix job timeout handling

Dave Kleikamp <dave.kleikamp@oracle.com>
    jfs: Fix array index bounds check in dbAdjTree

Amir Goldstein <amir73il@gmail.com>
    fsnotify: fix events reported to watching parent and child

Amir Goldstein <amir73il@gmail.com>
    inotify: convert to handle_inode_event() interface

Amir Goldstein <amir73il@gmail.com>
    fsnotify: generalize handle_inode_event()

lizhe <lizhe67@huawei.com>
    jffs2: Fix ignoring mounting options problem during remounting

Zhe Li <lizhe67@huawei.com>
    jffs2: Fix GC exit abnormally

Richard Weinberger <richard@nod.at>
    ubifs: wbuf: Don't leak kernel memory to flash

Steve French <stfrench@microsoft.com>
    SMB3.1.1: do not log warning message if server doesn't populate salt

Steve French <stfrench@microsoft.com>
    SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp

Steve French <stfrench@microsoft.com>
    SMB3: avoid confusing warning message on mount to Azure

Luis Henriques <lhenriques@suse.de>
    ceph: fix race in concurrent __ceph_remove_cap invocations

Johannes Berg <johannes.berg@intel.com>
    um: Fix time-travel mode

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Remove use of asprinf in umid.c

Roberto Sassu <roberto.sassu@huawei.com>
    ima: Don't modify file descriptor mode on the fly

Miklos Szeredi <mszeredi@redhat.com>
    ovl: make ioctl() safe

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Don't leak kernel memory to user space

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/mm: Fix verification of MMU_FTR_TYPE_44x

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/8xx: Fix early debug when SMC1 is relocated

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/xmon: Change printk() to pr_cont()

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()

Tyrel Datwyler <tyreld@linux.ibm.com>
    powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter

Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Fix XDRBUF_SPARSE_PAGES support

Jon Hunter <jonathanh@nvidia.com>
    ARM: tegra: Populate OPP table for Tegra20 Ventana

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: dts: at91: sama5d2: fix CAN message ram offset and size

H. Nikolaus Schaller <hns@goldelico.com>
    ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES

Bjorn Andersson <bjorn.andersson@linaro.org>
    iommu/arm-smmu-qcom: Implement S2CR quirk

Bjorn Andersson <bjorn.andersson@linaro.org>
    iommu/arm-smmu-qcom: Read back stream mappings

Bjorn Andersson <bjorn.andersson@linaro.org>
    iommu/arm-smmu: Allow implementation specific write_s2cr

Tom Lendacky <thomas.lendacky@amd.com>
    KVM: SVM: Remove the call to sev_platform_status() during setup

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Introduce handling of AArch32 TTBCR2 traps

Tomasz Nowicki <tn@semihalf.com>
    arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040

Tomi Valkeinen <tomi.valkeinen@ti.com>
    arm64: dts: ti: k3-am65: mark dss as dma-coherent

Atish Patra <atish.patra@wdc.com>
    RISC-V: Fix usage of memblock_enforce_memory_limit

Jan Kara <jack@suse.cz>
    ext4: don't remount read-only with errors=continue on reboot

Jan Kara <jack@suse.cz>
    ext4: fix deadlock with fs freezing and EA inodes

Chunguang Xu <brookxu@tencent.com>
    ext4: fix a memory leak of ext4_free_data

Dan Carpenter <dan.carpenter@oracle.com>
    ext4: fix an IS_ERR() vs NULL check

Filipe Manana <fdmanana@suse.com>
    btrfs: fix race when defragmenting leads to unnecessary IO

Josef Bacik <josef@toxicpanda.com>
    btrfs: update last_byte_to_unpin in switch_commit_roots

Josef Bacik <josef@toxicpanda.com>
    btrfs: do not shorten unpin len for caching block groups

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write unthrottling

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix tx-unthrottle use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write-wakeup use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix stalled writes

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write deadlock

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix dropped unthrottle interrupts

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix write-wakeup deadlocks

Johan Hovold <johan@kernel.org>
    USB: serial: mos7720: fix parallel-port state restore

Jim Cromie <jim.cromie@gmail.com>
    dyndbg: fix use before null check

Daniel Jordan <daniel.m.jordan@oracle.com>
    cpuset: fix race between hotplug work and later CPU offline

Borislav Petkov <bp@suse.de>
    EDAC/amd64: Fix PCI component registration

Qiuxu Zhuo <qiuxu.zhuo@intel.com>
    EDAC/i10nm: Use readl() to access MMIO registers

Ahmed S. Darwish <a.darwish@linutronix.de>
    Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g

Finn Thain <fthain@telegraphics.com.au>
    m68k: Fix WARNING splat in pmac_zilog driver

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata

Ard Biesheuvel <ardb@kernel.org>
    crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    cpufreq: intel_pstate: Use most recent guaranteed performance values

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Exclude kernel samples while counting events in user space.

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY

Vitaly Wool <vitaly.wool@konsulko.com>
    z3fold: stricter locking and more careful reclaim

Vitaly Wool <vitaly.wool@konsulko.com>
    z3fold: simplify freeing slots

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: mf6x4: Fix AI end-of-conversion detection

Jaroslav Kysela <perex@perex.cz>
    ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)

Jaroslav Kysela <perex@perex.cz>
    ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS)

Takashi Iwai <tiwai@suse.de>
    ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams

Todd Kjos <tkjos@google.com>
    binder: add flag to clear buffer on txn complete

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of lcu list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of pavgroup group list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: prevent inconsistent LCU device data

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix hanging device offline processing

Sven Schnelle <svens@linux.ibm.com>
    s390/idle: fix accounting with machine checks

Sven Schnelle <svens@linux.ibm.com>
    s390/idle: add missing mt_cycles calculation

Philipp Rudo <prudo@linux.ibm.com>
    s390/kexec_file: fix diag308 subcode when loading crash kernel

Sven Schnelle <svens@linux.ibm.com>
    s390/smp: perform initial CPU reset also for SMT siblings

Robin Gong <yibin.gong@nxp.com>
    ALSA: core: memalloc: add page alignment for iram

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Disable sample read check if firmware doesn't give back

Amadej Kastelic <amadejkastelic7@gmail.com>
    ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Supported Dell fixed type headset

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek: Apply jack fixup for Quanta NL3

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Add quirk for MSI-GP73

Chris Chiu <chiu@endlessos.org>
    ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: oss: Fix a few more UBSAN fixes

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256

Hui Wang <hui.wang@canonical.com>
    ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.

Takashi Iwai <tiwai@suse.de>
    ALSA: hda: Fix regressions on clear and reconfig sysfs

Hui Wang <hui.wang@canonical.com>
    ACPI: PNP: compare the string length in the matching_id()

Daniel Scally <djrscally@gmail.com>
    Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()

Dan Williams <dan.j.williams@intel.com>
    ACPI: NFIT: Fix input validation of bus-family

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Change Input Source enum strings.

Arnd Bergmann <arnd@arndb.de>
    Input: cyapa_gen6 - fix out-of-bounds stack access

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Validate mbus format in setting subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Serialise access to pad format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Return actual subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Remove traces of returned buffers

Lukas Wunner <lukas@wunner.de>
    media: netup_unidvb: Don't leak SPI master in probe error path

Sean Young <sean@mess.org>
    media: sunxi-cir: ensure IR is handled when it is continuous

Jens Axboe <axboe@kernel.dk>
    io_uring: make ctx cancel on exit targeted to actual ctx

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix double io_uring free

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix ignoring xa_store errors

Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
    io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix 0-iov read buffer select

Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
    io_uring: fix io_wqe->work_list corruption

Alan Stern <stern@rowland.harvard.edu>
    media: gspca: Fix memory leak in probe

Alexey Kardashevskiy <aik@ozlabs.ru>
    vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU

Eric Auger <eric.auger@redhat.com>
    vfio/pci: Move dummy_resources_list init in vfio_pci_probe()

Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
    io_uring: always let io_iopoll_complete() complete polled io

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix racy IOPOLL completions

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix io_cqring_events()'s noflush

Linus Torvalds <torvalds@linux-foundation.org>
    proc mountinfo: make splice available again

Casey Schaufler <casey@schaufler-ca.com>
    Smack: Handle io_uring kernel thread privileges

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: cancel reqs shouldn't kill overflow list

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fix racy IOPOLL flush overflow

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf probe: Fix memory leak when synthesizing SDT probes

Geert Uytterhoeven <geert+renesas@glider.be>
    ARM: 9036/1: uncompress: Fix dbgadtb size parameter name

Ard Biesheuvel <ardb@kernel.org>
    ARM: 9044/1: vfp: use undef hook for VFP support detection

Cédric Le Goater <clg@kaod.org>
    powerpc/smp: Add __init to init_big_cores()

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/boot: Fix build of dts/fsl

Masahiro Yamada <masahiroy@kernel.org>
    kconfig: fix return value of do_error_if()

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts"

Jernej Skrabec <jernej.skrabec@siol.net>
    clk: sunxi-ng: Make sure divider tables have sentinel

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    clk: s2mps11: Fix a resource leak in error handling paths in the probe function

Alexandre Belloni <alexandre.belloni@bootlin.com>
    clk: at91: sam9x60: remove atmel,osc-bypass support

Claudiu Beznea <claudiu.beznea@microchip.com>
    clk: at91: sama7g5: fix compilation error

Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
    clk: bcm: dvp: Add MODULE_DEVICE_TABLE()

Soheil Hassas Yeganeh <soheil@google.com>
    epoll: check for events when removing a timed out thread from the wait queue

Zhang Changzhong <zhangchangzhong@huawei.com>
    vhost scsi: fix error return code in vhost_scsi_set_endpoint()

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_ring: Fix two use after free bugs

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_net: Fix error code in probe()

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()

Eli Cohen <elic@nvidia.com>
    vdpa/mlx5: Use write memory barrier after updating CQ index

Simon Horman <simon.horman@netronome.com>
    nfp: move indirect block cleanup to flower app stop callback

Dan Carpenter <dan.carpenter@oracle.com>
    qlcnic: Fix error code in probe

Zheng Zengkai <zhengzengkai@huawei.com>
    perf record: Fix memory leak when using '--user-regs=?' to list registers

Jiri Olsa <jolsa@kernel.org>
    tools build: Add missing libcap to test-all.bin target

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: cancel only requests of current task

Thierry Reding <thierry.reding@gmail.com>
    pwm: sun4i: Remove erroneous else branch

Uwe Kleine-König <uwe@kleine-koenig.org>
    pwm: imx27: Fix overflow for bigger periods

Lokesh Vutla <lokeshvutla@ti.com>
    pwm: lp3943: Dynamically allocate PWM chip base

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    pwm: zx: Add missing cleanup in error path

Zhang Qilong <zhangqilong3@huawei.com>
    clk: ti: Fix memleak in ti_fapll_synth_setup

Arnd Bergmann <arnd@arndb.de>
    watchdog: coh901327: add COMMON_CLK dependency

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    watchdog: qcom: Avoid context switch in restart handler

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug

Zhang Qilong <zhangqilong3@huawei.com>
    libnvdimm/label: Return -ENXIO for no slot in __blk_label_update

Tobias Klauser <tklauser@distanz.ch>
    devlink: use _BITUL() macro instead of BIT() in the UAPI header

Vincent Stehlé <vincent.stehle@laposte.net>
    net: korina: fix return value

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()

Jack Wang <jinpu.wang@cloud.ionos.com>
    block/rnbd-clt: Fix possible memleak

Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
    block/rnbd-clt: Get rid of warning regarding size argument in strlcpy

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: bcmgenet: Fix a resource leak in an error handling path in the probe functin

Ioana Ciornei <ioana.ciornei@nxp.com>
    dpaa2-eth: fix the size of the mapped SGT buffer

Oleksij Rempel <linux@rempel-privat.de>
    net: dsa: qca: ar9331: fix sleeping function called from invalid context bug

Björn Töpel <bjorn.topel@intel.com>
    i40e, xsk: clear the status bits for the next_to_use descriptor

Björn Töpel <bjorn.topel@intel.com>
    ice, xsk: clear the status bits for the next_to_use descriptor

Sven Van Asbroeck <thesven73@gmail.com>
    lan743x: fix rx_napi_poll/interrupt ping-pong

Heiko Carstens <hca@linux.ibm.com>
    s390/test_unwind: fix CALL_ON_STACK tests

Dwaipayan Ray <dwaipayanray1@gmail.com>
    checkpatch: fix unescaped left brace

Alexey Dobriyan <adobriyan@gmail.com>
    proc: fix lookup in /proc/net subdirectories after setns(2)

Johannes Weiner <hannes@cmpxchg.org>
    mm: don't wake kswapd prematurely when watermark boosting is disabled

Dan Carpenter <dan.carpenter@oracle.com>
    hugetlb: fix an error code in hugetlb_reserve_pages()

Oscar Salvador <osalvador@suse.de>
    mm,memory_failure: always pin the page in madvise_inject_error

Vincenzo Frascino <vincenzo.frascino@arm.com>
    mm/vmalloc.c: fix kasan shadow poisoning size

Waiman Long <longman@redhat.com>
    mm/vmalloc: Fix unlock order in s_stop()

Matthew Wilcox (Oracle) <willy@infradead.org>
    sparc: fix handling of page table constructor failure

Shakeel Butt <shakeelb@google.com>
    mm/rmap: always do TTU_IGNORE_ACCESS

Muchun Song <songmuchun@bytedance.com>
    mm: memcg/slab: fix use after free in obj_cgroup_charge

Muchun Song <songmuchun@bytedance.com>
    mm: memcg/slab: fix return of child memcg objcg for root memcg

Jason Gunthorpe <jgg@ziepe.ca>
    mm/gup: combine put_compound_head() and unpin_user_page()

Jason Gunthorpe <jgg@ziepe.ca>
    mm/gup: prevent gup_fast from racing with COW during fork

Jason Gunthorpe <jgg@ziepe.ca>
    mm/gup: reorganize internal_get_user_pages_fast()

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: fix regression in vbios reservation handling on headless

Kajol Jain <kjain@linux.ibm.com>
    perf test: Fix metric parsing test

Vincent Stehlé <vincent.stehle@laposte.net>
    powerpc/ps3: use dma_mapping_error()

Madhavan Srinivasan <maddy@linux.ibm.com>
    powerpc/perf: Fix Threshold Event Counter Multiplier width for P10

Guido Günther <agx@sigxcpu.org>
    drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge

Bongsu Jeon <bongsu.jeon@samsung.com>
    nfc: s3fwrn5: Release the nfc firmware

Leon Romanovsky <leon@kernel.org>
    RDMA/cma: Don't overwrite sgid_attr after device is released

Maor Gottlieb <maorg@nvidia.com>
    RDMA/mlx5: Fix MR cache memory leak

Dan Aloni <dan@kernelim.com>
    sunrpc: fix xs_read_xdr_buf for partial pages receive

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: chan_xterm: Fix fd leak

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: tty: Fix handling of close in tty lines

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Monitor error events in IRQ controller

Wang ShaoBo <bobo.shaobowang@huawei.com>
    ubifs: Fix error return code in ubifs_init_authentication()

Wang Wensheng <wangwensheng4@huawei.com>
    watchdog: Fix potential dereferencing of null pointer

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: check busy bit before new loading rather than after that

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: remove watchdog disable from resume fail path

Guenter Roeck <linux@roeck-us.net>
    watchdog: sirfsoc: Add missing dependency on HAS_IOMEM

Guenter Roeck <linux@roeck-us.net>
    watchdog: armada_37xx: Add missing dependency on HAS_IOMEM

Douglas Anderson <dianders@chromium.org>
    irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling

Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
    ath11k: Fix incorrect tlvs in scan start command

Nikita Shubin <nikita.shubin@maquefel.me>
    gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Do shift on traffic class when using RoCEv2

Wenpeng Liang <liangwenpeng@huawei.com>
    RDMA/hns: Normalization the judgment of some features

Wenpeng Liang <liangwenpeng@huawei.com>
    RDMA/hns: Limit the length of data copied between kernel and userspace

Peter Ujfalusi <peter.ujfalusi@ti.com>
    dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0

Lokesh Vutla <lokeshvutla@ti.com>
    irqchip/ti-sci-intr: Fix freeing of irqs

Lokesh Vutla <lokeshvutla@ti.com>
    irqchip/ti-sci-inta: Fix printing of inta id on probe success

Marc Zyngier <maz@kernel.org>
    irqchip/alpine-msi: Fix freeing of interrupts on allocation error path

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()

Wen Gong <wgong@codeaurora.org>
    mac80211: fix a mistake check for rx_stats update

Johannes Berg <johannes.berg@intel.com>
    mac80211: don't set set TDLS STA bandwidth wider than possible

Arnd Bergmann <arnd@arndb.de>
    crypto: atmel-i2c - select CONFIG_BITREVERSE

Marek Szyprowski <m.szyprowski@samsung.com>
    extcon: max77693: Fix modalias string

Hao Li <lihao2018.fnst@cn.fujitsu.com>
    fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()

Magnus Karlsson <magnus.karlsson@intel.com>
    samples/bpf: Fix possible hang in xdpsock with multiple threads

Han Xu <han.xu@nxp.com>
    mtd: rawnand: gpmi: Fix the random DMA timeout issue

Dan Carpenter <dan.carpenter@oracle.com>
    mtd: rawnand: meson: Fix a resource leak in init

Zhang Qilong <zhangqilong3@huawei.com>
    mtd: rawnand: gpmi: fix reference count leak in gpmi ops

Dmitry Osipenko <digetx@gmail.com>
    clk: tegra: Fix duplicated SE clock entry

Douglas Anderson <dianders@chromium.org>
    clk: qcom: gcc-sc7180: Use floor ops for sdcc clks

Tzung-Bi Shih <tzungbi@google.com>
    remoteproc/mediatek: unprepare clk if scp_before_load fails

Zhang Changzhong <zhangchangzhong@huawei.com>
    remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()

YueHaibing <yuehaibing@huawei.com>
    remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories()

Zhang Qilong <zhangqilong3@huawei.com>
    remoteproc: qcom: pas: fix error handling in adsp_pds_enable

Zhang Qilong <zhangqilong3@huawei.com>
    remoteproc: qcom: fix reference leak in adsp_start

Zhang Qilong <zhangqilong3@huawei.com>
    remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable

Alexandre Courbot <acourbot@chromium.org>
    remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF

Tzung-Bi Shih <tzungbi@google.com>
    remoteproc/mediatek: change MT8192 CFG register base

Avihai Horon <avihaih@nvidia.com>
    RDMA/uverbs: Fix incorrect variable type

Jack Morgenstein <jackm@dev.mellanox.co.il>
    RDMA/core: Do not indicate device ready when device enablement fails

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ALSA: hda/hdmi: fix silent stream for first playback to DP

Zhang Changzhong <zhangchangzhong@huawei.com>
    slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    powerpc/sstep: Cover new VSX instructions under CONFIG_VSX

Balamuruhan S <bala24@linux.ibm.com>
    powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set

Sean Nyekjaer <sean@geanix.com>
    can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: renesas: r8a779a0: Fix R and OSC clocks

Huang Jianan <huangjianan@oppo.com>
    erofs: avoid using generic_block_bmap

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: mvm: hook up missing RX handlers

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()

Qinglang Miao <miaoqinglang@huawei.com>
    s390/cio: fix use-after-free in ccw_device_destroy_console

Eddie James <eajames@linux.ibm.com>
    fsi: Aspeed: Add mutex to protect HW access

Zhang Changzhong <zhangchangzhong@huawei.com>
    bus: fsl-mc: fix error return code in fsl_mc_object_allocate()

Laurentiu Tudor <laurentiu.tudor@nxp.com>
    bus: fsl-mc: add back accidentally dropped error check

Xiongfeng Wang <wangxiongfeng2@huawei.com>
    misc: pci_endpoint_test: fix return value of error branch

Stephen Boyd <swboyd@chromium.org>
    platform/chrome: cros_ec_spi: Don't overwrite spi::mode

Quinn Tran <qutran@marvell.com>
    scsi: qla2xxx: Fix N2N and NVMe connect retry failure

Arun Easi <aeasi@marvell.com>
    scsi: qla2xxx: Fix FW initialization error on big endian machines

Masami Hiramatsu <mhiramat@kernel.org>
    x86/kprobes: Restore BTF if the single-stepping is cancelled

Cheng Lin <cheng.lin130@zte.com.cn>
    nfs_common: need lock during iterate through the list

Dai Ngo <dai.ngo@oracle.com>
    NFSD: Fix 5 seconds delay when doing inter server copy

kazuo ito <kzpn200@gmail.com>
    nfsd: Fix message level for normal termination

Yang Yingliang <yangyingliang@huawei.com>
    speakup: fix uninitialized flush_lock

Zhang Qilong <zhangqilong3@huawei.com>
    usb: oxu210hp-hcd: Fix memory leak in oxu_create

Zhang Qilong <zhangqilong3@huawei.com>
    usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: max98390: Fix error codes in max98390_dsm_init()

Arnd Bergmann <arnd@arndb.de>
    coresight: remove broken __exit annotations

Chuhong Yuan <hslester96@gmail.com>
    ASoC: amd: change clk_get() to devm_clk_get() and add missed checks

Colin Ian King <colin.king@canonical.com>
    drm/mediatek: avoid dereferencing a null hdmi_phy on an error message

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: remove redundant cacheinfo update

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops

Ard Biesheuvel <ardb@kernel.org>
    ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems

Zhang Changzhong <zhangchangzhong@huawei.com>
    scsi: fnic: Fix error return code in fnic_probe()

Arnd Bergmann <arnd@arndb.de>
    seq_buf: Avoid type mismatch for seq_buf_init

Qinglang Miao <miaoqinglang@huawei.com>
    scsi: iscsi: Fix inappropriate use of put_device()

Zhang Qilong <zhangqilong3@huawei.com>
    scsi: pm80xx: Fix error return in pm8001_pci_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe

Michael Walle <michael@walle.cc>
    clk: fsl-sai: fix memory leak

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: g12b: w400: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    ARM: dts: meson: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements

Michael Walle <michael@walle.cc>
    mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040

Michael Walle <michael@walle.cc>
    mtd: spi-nor: atmel: remove global protection flag

Michael Walle <michael@walle.cc>
    mtd: spi-nor: ignore errors in spi_nor_unlock_all()

Michael Walle <michael@walle.cc>
    mtd: spi-nor: sst: fix BPn bits for the SST25VF064C

Zhang Changzhong <zhangchangzhong@huawei.com>
    adm8211: fix error return code in adm8211_probe()

Hans de Goede <hdegoede@redhat.com>
    platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models

Hans de Goede <hdegoede@redhat.com>
    Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134

Colin Ian King <colin.king@canonical.com>
    block/rnbd: fix a null pointer dereference on dev->blk_symlink_name

Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
    block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name

Wei Yongjun <weiyongjun1@huawei.com>
    Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option

Jing Xiangfeng <jingxiangfeng@huawei.com>
    Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()

Jing Xiangfeng <jingxiangfeng@huawei.com>
    Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()

Zhang Changzhong <zhangchangzhong@huawei.com>
    spi: dw: Fix error return code in dw_spi_bt1_probe()

Wang Hai <wanghai38@huawei.com>
    staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls

Arnd Bergmann <arnd@arndb.de>
    staging: bcm2835: fix vchiq_mmal dependencies

Finn Thain <fthain@telegraphics.com.au>
    macintosh/adb-iop: Send correct poll command

Finn Thain <fthain@telegraphics.com.au>
    macintosh/adb-iop: Always wait for reply message from IOP

Arnd Bergmann <arnd@arndb.de>
    cpufreq: imx: fix NVMEM_IMX_OCOTP dependency

Pali Rohár <pali@kernel.org>
    cpufreq: vexpress-spc: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: scpi: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: loongson1: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: st: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: qcom: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: highbank: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: ap806: Add missing MODULE_DEVICE_TABLE

Keqian Zhu <zhukeqian1@huawei.com>
    clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI

Keqian Zhu <zhukeqian1@huawei.com>
    clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne

Arnd Bergmann <arnd@arndb.de>
    drm/msm: add IOMMU_SUPPORT dependency

Marijn Suijten <marijn.suijten@somainline.org>
    drm/msm: a5xx: Make preemption reset case reentrant

Zhang Changzhong <zhangchangzhong@huawei.com>
    memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe()

Arnd Bergmann <arnd@arndb.de>
    memory: ti-emif-sram: only build for ARMv7

Wang Li <wangli74@huawei.com>
    phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure

Arnd Bergmann <arnd@arndb.de>
    phy: mediatek: allow compile-testing the hdmi phy

Arnd Bergmann <arnd@arndb.de>
    ASoC: qcom: fix QDSP6 dependencies, attempt #3

Arnd Bergmann <arnd@arndb.de>
    ASoC: atmel: mchp-spdifrx needs COMMON_CLK

Arnd Bergmann <arnd@arndb.de>
    ASoC: cros_ec_codec: fix uninitialized memory read

Qinglang Miao <miaoqinglang@huawei.com>
    dm ioctl: fix error return code in target_message

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    ASoC: q6afe-clocks: Add missing parent clock rate

Chuhong Yuan <hslester96@gmail.com>
    ASoC: jz4740-i2s: add missed checks for clk_get()

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: fix tkip configuration for mt7615/7663 devices

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: fix memory leak if device probing fails

Leon Romanovsky <leon@kernel.org>
    net/mlx5: Properly convey driver version to firmware

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: dma: fix possible deadlock running mt76_dma_cleanup

Taehee Yoo <ap420073@gmail.com>
    mt76: set fops_tx_stats.owner to THIS_MODULE

Taehee Yoo <ap420073@gmail.com>
    mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7663s: fix a possible ple quota underflow

Alexander Sverdlin <alexander.sverdlin@nokia.com>
    MIPS: Don't round up kernel sections size for memblock_add()

Jing Xiangfeng <jingxiangfeng@huawei.com>
    memstick: r592: Fix error return in r592_probe()

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Fix UART pull-ups on rk3328

Zhang Changzhong <zhangchangzhong@huawei.com>
    soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe()

Yu Kuai <yukuai3@huawei.com>
    pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()

Andrii Nakryiko <andrii@kernel.org>
    selftests/bpf: Fix invalid use of strncat in test_sockmap

Andrii Nakryiko <andrii@kernel.org>
    bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()

Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    scripts: kernel-doc: fix parsing function-like typedefs

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: dts: at91: sama5d2: map securam as device

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: dts: at91: sam9x60ek: remove bypass property

Toke Høiland-Jørgensen <toke@redhat.com>
    libbpf: Sanitise map names before pinning

Lars-Peter Clausen <lars@metafoo.de>
    iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context

Peter Collingbourne <pcc@google.com>
    arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE

Kefeng Wang <wangkefeng.wang@huawei.com>
    clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI

Daniel Lezcano <daniel.lezcano@linaro.org>
    clocksource/drivers/ingenic: Fix section mismatch

Yu Kuai <yukuai3@huawei.com>
    clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()

Yang Yingliang <yangyingliang@huawei.com>
    clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix the PMU group constraints for threshold events in power10

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Update the PMU group constraints for l2l3 events in power10

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix to update radix_scope_qual in power10

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    powerpc/xmon: Fix build failure for 8xx

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix crash with is_sier_available when pmu is not set

Dan Carpenter <dan.carpenter@oracle.com>
    media: saa7146: fix array overflow in vidioc_s_audio()

Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
    media: tvp5150: Fix wrong return value of tvp5150_parse_dt()

Hyeongseok Kim <hyeongseok@gmail.com>
    f2fs: fix double free of unicode map

Zhang Qilong <zhangqilong3@huawei.com>
    hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable

Jason Gunthorpe <jgg@ziepe.ca>
    vfio-pci: Use io_remap_pfn_range() for PCI IO memory

Mickaël Salaün <mic@linux.microsoft.com>
    selftests/seccomp: Update kernel config

NeilBrown <neilb@suse.de>
    NFS: switch nfsiod to be an UNBOUND workqueue.

Calum Mackay <calum.mackay@oracle.com>
    lockd: don't use interval-based rebinding over TCP

Fedor Tokarev <ftokarev@gmail.com>
    net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4: Fix the alignment of page data in the getdeviceinfo reply

Trond Myklebust <trond.myklebust@hammerspace.com>
    SUNRPC: xprt_load_transport() needs to support the netid "rdma6"

Olga Kornievskaia <kolga@netapp.com>
    NFSv4.2: condition READDIR's mask for security label based on LSM state

Trond Myklebust <trond.myklebust@hammerspace.com>
    SUNRPC: rpc_wake_up() should wake up tasks in the correct order

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Release some resources in an error handling path

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Fix an error handling path

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: Fix the parsing error in service available event

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath11k: Fix an error handling path

Sven Eckelmann <sven@narfation.org>
    ath11k: Reset ath11k_skb_cb before setting new flags

Sven Eckelmann <sven@narfation.org>
    ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control

Hans Verkuil <hverkuil-cisco@xs4all.nl>
    media: i2c: imx219: Selection compliance fixes

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: rdacm20: Enable GPIO1 explicitly

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: max9271: Fix GPIO enable/disable

Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
    ASoC: Intel: Boards: tgl_max98373: update TDM slot_width

Qinglang Miao <miaoqinglang@huawei.com>
    platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    soundwire: master: use pm_runtime_set_active() on add

Sudeep Holla <sudeep.holla@arm.com>
    mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree

Yangyang Li <liyangyang20@huawei.com>
    RDMA/hns: Bugfix for calculation of extended sge

Lang Cheng <chenglang@huawei.com>
    RDMA/hns: Fix 0-length sge calculation error

Alexandre Belloni <alexandre.belloni@bootlin.com>
    ARM: dts: at91: at91sam9rl: fix ADC triggers

Maxim Kochetkov <fido_max@inbox.ru>
    spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR

Ahmed S. Darwish <a.darwish@linutronix.de>
    scsi: pm80xx: Do not sleep in atomic context

Xiang Chen <chenxiang66@hisilicon.com>
    scsi: hisi_sas: Fix up probe error handling for v3 hw

Yu Kuai <yukuai3@huawei.com>
    soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()

Dongjin Kim <tobetter@gmail.com>
    arm64: dts: meson-sm1: fix typo in opp table

Artem Lapkin <art@khadas.com>
    arm64: dts: meson: fix spi-max-frequency on Khadas VIM2

Roman Bacik <roman.bacik@broadcom.com>
    PCI: iproc: Invalidate correct PAXB inbound windows

Bharat Gooty <bharat.gooty@broadcom.com>
    PCI: iproc: Fix out-of-bound array accesses

Colin Ian King <colin.king@canonical.com>
    PCI: Fix overflow in command-line resource alignment requests

Bjorn Helgaas <bhelgaas@google.com>
    PCI: Bounds-check command-line resource alignment requests

Bjorn Andersson <bjorn.andersson@linaro.org>
    arm64: dts: qcom: c630: Fix pinctrl pins properties

Bjorn Andersson <bjorn.andersson@linaro.org>
    arm64: dts: qcom: c630: Polish i2c-hid devices

JC Kuo <jckuo@nvidia.com>
    phy: tegra: xusb: Fix usb_phy device driver field

Michael Walle <michael@walle.cc>
    arm64: dts: freescale: sl28: combine SPI MTD partitions

Michael Walle <michael@walle.cc>
    arm64: dts: ls1028a: fix FlexSPI clock input

Michael Walle <michael@walle.cc>
    arm64: dts: ls1028a: fix ENETC PTP clock input

Marc Zyngier <maz@kernel.org>
    genirq/irqdomain: Don't try to free an interrupt that has no mapping

Zhang Qilong <zhangqilong3@huawei.com>
    power: supply: bq24190_charger: fix reference leak

Hans de Goede <hdegoede@redhat.com>
    power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching

Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
    power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc

Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
    power: supply: bq25890: Use the correct range for IILIM register

Marek Behún <kabel@kernel.org>
    arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name

Chris Packham <chris.packham@alliedtelesis.co.nz>
    ARM: dts: Remove non-existent i2c1 from 98dx3236

Jing Xiangfeng <jingxiangfeng@huawei.com>
    HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()

Enric Balletbo i Serra <enric.balletbo@collabora.com>
    drm/mediatek: Use correct aliases name for ovl

Leon Romanovsky <leon@kernel.org>
    RDMA/core: Track device memory MRs

Bjorn Andersson <bjorn.andersson@linaro.org>
    slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI

Dan Carpenter <dan.carpenter@oracle.com>
    media: max2175: fix max2175_set_csm_mode() error code

Qinglang Miao <miaoqinglang@huawei.com>
    mips: cdmm: fix use-after-free in mips_cdmm_bus_discover

Daniel Gomez <daniel@qtec.com>
    media: imx214: Fix stop streaming

Daniel T. Lee <danieltimlee@gmail.com>
    samples: bpf: Fix lwt_len_hist reusing previous BPF map

Zhang Qilong <zhangqilong3@huawei.com>
    serial: 8250-mtk: Fix reference leak in mtk8250_probe

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Avoid setting loopback indicator when smac is same as dmac

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Fix missing fields in address vector

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Only record vlan info for HIP08

Alex Elder <elder@linaro.org>
    arm64: dts: qcom: sc7180: limit IPA iommu streams

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    media: siano: fix memory leak of debugfs members in smsdvb_hotplug

Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
    drm/imx/dcss: fix rotations for Vivante tiled formats

Vinod Koul <vkoul@kernel.org>
    soundwire: qcom: Fix build failure when slimbus is module

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind

Vidya Sagar <vidyas@nvidia.com>
    arm64: tegra: Fix DT binding for IO High Voltage entry

Marek Behún <kabel@kernel.org>
    leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    leds: lp50xx: Fix an error handling path in 'lp50xx_probe_dt()'

Yu Kuai <yukuai3@huawei.com>
    leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()

Bjorn Andersson <bjorn.andersson@linaro.org>
    arm64: dts: qcom: sdm845: Limit ipa iommu streams

Zhihao Cheng <chengzhihao1@huawei.com>
    dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    cw1200: fix missing destroy_workqueue() on error in cw1200_init_common

Zhang Changzhong <zhangchangzhong@huawei.com>
    rsi: fix error return code in rsi_reset_card()

Wang Hai <wanghai38@huawei.com>
    qtnfmac: fix error return code in qtnf_pcie_probe()

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    orinoco: Move context allocation after processing the skb

Zhang Changzhong <zhangchangzhong@huawei.com>
    brcmfmac: fix error return code in brcmf_cfg80211_connect()

Zhihao Cheng <chengzhihao1@huawei.com>
    mmc: pxamci: Fix error return code in pxamci_probe

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sam9x60: add pincontrol for USB Host

Qinglang Miao <miaoqinglang@huawei.com>
    memstick: fix a double-free bug in memstick_check

Yangtao Li <frank@allwinnertech.com>
    pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute

Kamal Heib <kamalheib1@gmail.com>
    RDMA/cxgb4: Validate the number of CQEs

Maharaja Kennadyrajan <mkenna@codeaurora.org>
    ath11k: Fix the rx_filter flag setting for peer rssi stats

Wang Hai <wanghai38@huawei.com>
    staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe()

Kevin Hilman <khilman@baylibre.com>
    clk: meson: Kconfig: fix dependency for G12A

Zhang Qilong <zhangqilong3@huawei.com>
    Input: omap4-keypad - fix runtime PM error handling

Nikita Travkin <nikitos.tr@gmail.com>
    arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp

Tom Rix <trix@redhat.com>
    soc: qcom: initialize local variable

Zhihao Cheng <chengzhihao1@huawei.com>
    drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: Fix reference imbalance in knav_dma_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: knav_qmss: fix reference leak in knav_queue_probe

Jim Quinlan <james.quinlan@broadcom.com>
    PCI: brcmstb: Initialize "tmp" before use

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    PCI: Disable MSI for Pericom PCIe-USB adapter

Marc Zyngier <maz@kernel.org>
    drm/meson: dw-hdmi: Enable the iahb clock early enough

Marc Zyngier <maz@kernel.org>
    drm/meson: dw-hdmi: Disable clocks on driver teardown

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    spi: fix resource leak for drivers without .remove callback

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun8i-ce - fix two error path's memory leak

Zhang Qilong <zhangqilong3@huawei.com>
    crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe

Nathan Chancellor <natechancellor@gmail.com>
    crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd

Uladzislau Rezki (Sony) <urezki@gmail.com>
    rcu/tree: Defer kvfree_rcu() allocation to a clean context

Peter Zijlstra <peterz@infradead.org>
    rcu,ftrace: Fix ftrace recursion

Peter Zijlstra <peterz@infradead.org>
    rcu: Allow rcu_irq_enter_check_tick() from NMI

Jaegeuk Kim <jaegeuk@kernel.org>
    scsi: ufs: Fix clkgating on/off

Jaegeuk Kim <jaegeuk@kernel.org>
    scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF

Yazen Ghannam <yazen.ghannam@amd.com>
    EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId

Tony Lindgren <tony@atomide.com>
    mfd: cpcap: Fix interrupt regression with regmap clear_ack

Amelie Delaunay <amelie.delaunay@st.com>
    mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()

Geert Uytterhoeven <geert+renesas@glider.be>
    mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE

Jing Xiangfeng <jingxiangfeng@huawei.com>
    mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c()

Kaixu Xia <kaixuxia@tencent.com>
    powerpc/powernv/sriov: fix unsigned int win compared to less than zero

Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
    Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"

Andrew Jeffery <andrew@aj.id.au>
    ARM: dts: tacoma: Fix node vs reg mismatch for flash memory

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32

Ard Biesheuvel <ardb@kernel.org>
    powerpc: Avoid broken GCC __attribute__((optimize))

Björn Töpel <bjorn.topel@gmail.com>
    selftests/bpf: Fix broken riscv build

Zhang Qilong <zhangqilong3@huawei.com>
    spi: mxs: fix reference leak in mxs_spi_probe

Yang Yingliang <yangyingliang@huawei.com>
    usb/max3421: fix return error code in max3421_probe()

Carl Yin <carl.yin@quectel.com>
    bus: mhi: core: Fix null pointer access when parsing MHI configuration

Bhaumik Bhatt <bbhatt@codeaurora.org>
    bus: mhi: core: Remove double locking from mhi_driver_remove()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: ads7846 - fix unaligned access on 7845

Oleksij Rempel <linux@rempel-privat.de>
    Input: ads7846 - fix integer overflow on Rt calculation

David Jander <david@protonic.nl>
    Input: ads7846 - fix race that causes missing releases

Lukas Bulwahn <lukas.bulwahn@gmail.com>
    iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM

Geert Uytterhoeven <geert+renesas@glider.be>
    ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY

Marc Zyngier <maz@kernel.org>
    drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers

Marc Zyngier <maz@kernel.org>
    drm/meson: dw-hdmi: Register a callback to disable the regulator

Marc Zyngier <maz@kernel.org>
    drm/meson: Unbind all connectors on module removal

Marc Zyngier <maz@kernel.org>
    drm/meson: Free RDMA resources after tearing down DRM

Yang Yingliang <yangyingliang@huawei.com>
    drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()

Wolfram Sang <wsa+renesas@sang-engineering.com>
    mmc: sdhci: tegra: fix wrong unit with busy_timeout

Yang Yingliang <yangyingliang@huawei.com>
    video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()

Qinglang Miao <miaoqinglang@huawei.com>
    media: solo6x10: fix missing snd_card_free in error handling case

Mansur Alisha Shaik <mansur@codeaurora.org>
    media: venus: put dummy vote on video-mem path after last session release

Martin Wilck <mwilck@suse.com>
    scsi: core: Fix VPD LUN ID designator priorities

Randy Dunlap <rdunlap@infradead.org>
    spi: dw: fix build error by selecting MULTIPLEXER

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: meson: fix COMPILE_TEST error

Leon Romanovsky <leon@kernel.org>
    RDMA/cma: Add missing error handling of listen_id

Mansur Alisha Shaik <mansur@codeaurora.org>
    media: venus: core: vote with average bandwidth and peak bandwidth as zero

Mansur Alisha Shaik <mansur@codeaurora.org>
    media: venus: core: vote for video-mem path

Mansur Alisha Shaik <mansur@codeaurora.org>
    media: venus: core: change clk enable and disable order in resume and suspend

Yu Kuai <yukuai3@huawei.com>
    media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove()

Zhang Qilong <zhangqilong3@huawei.com>
    media: cedrus: fix reference leak in cedrus_start_streaming

Zhang Qilong <zhangqilong3@huawei.com>
    media: staging: rkisp1: cap: fix runtime PM imbalance on error

Hugues Fruchet <hugues.fruchet@st.com>
    media: ov5640: fix support of BT656 bus mode

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: v4l2-fwnode: Return -EINVAL for invalid bus-type

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()

Yu Kuai <yukuai3@huawei.com>
    media: platform: add missing put_device() call in mtk_jpeg_clk_init()

Colin Ian King <colin.king@canonical.com>
    media: tm6000: Fix sizeof() mismatches

Shannon Nelson <snelson@pensando.io>
    ionic: change set_rx_mode from_ndo to can_sleep

Shannon Nelson <snelson@pensando.io>
    ionic: flatten calls to ionic_lif_rx_mode

Shannon Nelson <snelson@pensando.io>
    ionic: use mc sync for multicast filters

Hanjun Guo <guohanjun@huawei.com>
    drm/amdkfd: Put ACPI table after using it

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    scripts: kernel-doc: Restore anonymous enum parsing

Jing Xiangfeng <jingxiangfeng@huawei.com>
    staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c

Zhang Qilong <zhangqilong3@huawei.com>
    staging: greybus: codecs: Fix reference counter leak in error handling

Dan Carpenter <dan.carpenter@oracle.com>
    drm/udl: Fix missing error code in udl_handle_damage()

Qinglang Miao <miaoqinglang@huawei.com>
    firmware: arm_scmi: Fix missing destroy_workqueue()

Jack Xu <jack.xu@intel.com>
    crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()

Jason A. Donenfeld <Jason@zx2c4.com>
    crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager

Tony Lindgren <tony@atomide.com>
    soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted

Nirmoy Das <nirmoy.das@amd.com>
    drm/amdgpu: fix compute queue priority if num_kcq is less than 4

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA

Nishanth Menon <nm@ti.com>
    arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG

Arnd Bergmann <arnd@arndb.de>
    RDMa/mthca: Work around -Wenum-conversion warning

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: arizona: Fix a wrong free in wm8997_probe

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipv4.conf.all.proxy_arp_pvlan

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown

Miklos Szeredi <mszeredi@redhat.com>
    virtiofs fix leak in setup

Zhang Qilong <zhangqilong3@huawei.com>
    spi: sprd: fix reference leak in sprd_spi_remove

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: wm8998: Fix PM disable depth imbalance on error

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: wm8994: Fix PM disable depth imbalance on error

Hangbin Liu <liuhangbin@gmail.com>
    selftest/bpf: Add missed ip6ip6 test back

Hangbin Liu <liuhangbin@gmail.com>
    selftests/run_kselftest.sh: fix dry-run typo

Abhinav Kumar <abhinavk@codeaurora.org>
    drm/msm/dp: do not notify audio subsystem if sink doesn't support audio

Kuogee Hsieh <khsieh@codeaurora.org>
    drm/msm/dp: skip checking LINK_STATUS_UPDATED bit

Kuogee Hsieh <khsieh@codeaurora.org>
    drm/msm/dp: return correct connection status after suspend

Arnd Bergmann <arnd@arndb.de>
    firmware: tegra: fix strncpy()/strncat() confusion

Rob Clark <robdclark@chromium.org>
    drm/msm/a5xx: Clear shadow on suspend

Rob Clark <robdclark@chromium.org>
    drm/msm/a6xx: Clear shadow on suspend

Tsuchiya Yuto <kitakar@gmail.com>
    mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure

Alex Dewar <alex.dewar90@gmail.com>
    ath11k: Handle errors if peer creation fails

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()

Zhang Qilong <zhangqilong3@huawei.com>
    spi: imx: fix reference leak in two imx operations

Qinglang Miao <miaoqinglang@huawei.com>
    spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra114: fix reference leak in tegra spi ops

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-sflash: fix reference leak in tegra_sflash_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-slink: fix reference leak in slink ops of tegra20

Qinglang Miao <miaoqinglang@huawei.com>
    spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe

Zhang Qilong <zhangqilong3@huawei.com>
    spi: spi-ti-qspi: fix reference leak in ti_qspi_setup

Zhang Qilong <zhangqilong3@huawei.com>
    spi: stm32-qspi: fix reference leak in stm32 qspi operations

Anant Thazhemadam <anant.thazhemadam@gmail.com>
    Bluetooth: hci_h5: fix memory leak in h5_close

Sathish Narasimman <nsathish41@gmail.com>
    Bluetooth: Fix: LL PRivacy BLE device fails to connect

Anmol Karn <anmol.karan123@gmail.com>
    Bluetooth: Fix null pointer dereference in hci_event_packet()

Stephen Boyd <swboyd@chromium.org>
    drm/panel: simple: Add flags to boe_nv133fhm_n61

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Correct psci compatible used on Exynos7

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7

Seung-Woo Kim <sw0312.kim@samsung.com>
    brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}

Karthikeyan Periyasamy <periyasa@codeaurora.org>
    ath11k: fix wmi init configuration

Sven Eckelmann <sven@narfation.org>
    ath11k: Fix number of rules in filtered ETSI regdomain

Sven Eckelmann <sven@narfation.org>
    ath11k: Initialize complete alpha2 for regulatory change

Lyude Paul <lyude@redhat.com>
    drm/edid: Fix uninitialized variable in drm_cvt_modes()

Zhen Lei <thunder.leizhen@huawei.com>
    x86/mce: Correct the detection of invalid notifier priorities

KP Singh <kpsingh@google.com>
    bpf: Fix tests for local_storage

Zhang Qilong <zhangqilong3@huawei.com>
    spi: stm32: fix reference leak in stm32_spi_resume

Colin Ian King <colin.king@canonical.com>
    nl80211/cfg80211: fix potential infinite loop

Paul Moore <paul@paul-moore.com>
    selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling

Horia Geantă <horia.geanta@nxp.com>
    crypto: caam - fix printing on xts fallback allocation error path

Horia Geantă <horia.geanta@nxp.com>
    crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm64/poly1305-neon - reorder PAC authentication with SP update

Andrii Nakryiko <andrii@kernel.org>
    libbpf: Fix BTF data layout checks and allow empty BTF

YueHaibing <yuehaibing@huawei.com>
    drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: pcm: DRAIN support reactivation

He Zhe <zhe.he@windriver.com>
    pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB

Arnd Bergmann <arnd@arndb.de>
    scsi: aacraid: Improve compat_ioctl handlers

Zhang Qilong <zhangqilong3@huawei.com>
    spi: spi-mem: fix reference leak in spi_mem_access_start

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dpu: fix clock scaling on non-sc7180 board

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dsi_pll_10nm: restore VCO rate during restore_state

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dsi_pll_7nm: restore VCO rate during restore_state

Tanmay Shah <tanmay@codeaurora.org>
    drm/msm/dp: DisplayPort PHY compliance tests fixup

Namhyung Kim <namhyung@kernel.org>
    perf test: Use generic event for expand_libpfm_events()

Jason Gunthorpe <jgg@ziepe.ca>
    RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: call f2fs_get_meta_page_retry for nat page

Zhang Qilong <zhangqilong3@huawei.com>
    spi: img-spfi: fix reference leak in img_spfi_resume

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64: Set up a kernel stack for secondaries before cpu_restore()

Arnd Bergmann <arnd@arndb.de>
    drm/amdgpu: fix build_coefficients() argument

Vijay Khemka <vijaykhemka@fb.com>
    ARM: dts: aspeed: tiogapass: Remove vuart

Robin Murphy <robin.murphy@arm.com>
    drm/msm: Add missing stub definition

Clément Péron <peron.clem@gmail.com>
    ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode

Colin Ian King <colin.king@canonical.com>
    crypto: inside-secure - Fix sizeof() mismatch

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Fix return type of current_desc_hdr()

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Endianess in current_desc_hdr()

Arnd Bergmann <arnd@arndb.de>
    drm/amdgpu: fix incorrect enum type

Thomas Gleixner <tglx@linutronix.de>
    sched: Reenable interrupts in do_sched_yield()

Peng Liu <iwtbavbm@gmail.com>
    sched/deadline: Fix sched_dl_global_validate()

Colin Ian King <colin.king@canonical.com>
    ASoC: qcom: fix unsigned int bitwidth compared to less than zero

David Woodhouse <dwmw@amazon.co.uk>
    x86/apic: Fix x2apic enablement without interrupt remapping

Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
    RDMA/rtrs-srv: Don't guard the whole __alloc_srv with srv_mutex

Gioh Kim <gi-oh.kim@cloud.ionos.com>
    RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established

Danil Kipnis <danil.kipnis@cloud.ionos.com>
    RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed

Ard Biesheuvel <ardb@kernel.org>
    ARM: p2v: fix handling of LPAE translation in BE mode

Arvind Sankar <nivedita@alum.mit.edu>
    x86/mm/ident_map: Check for errors from ident_pud_init()

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Compute PSN windows correctly

Jing Xiangfeng <jingxiangfeng@huawei.com>
    RDMA/core: Fix error return in _ib_modify_qp()

Joel Stanley <joel@jms.id.au>
    ARM: dts: aspeed: s2600wf: Fix VGA memory region location

Billy Tsai <billy_tsai@aspeedtech.com>
    ARM: dts: aspeed-g6: Fix the GPIO memory size

Tianyue Ren <rentianyue@kylinos.cn>
    selinux: fix error initialization in inode_doinit_with_dentry()

Selvin Xavier <selvin.xavier@broadcom.com>
    RDMA/bnxt_re: Fix entry size during SRQ create

Dan Carpenter <dan.carpenter@oracle.com>
    rtc: pcf2127: fix pcf2127_nvmem_read/write() returns

Kamal Heib <kamalheib1@gmail.com>
    RDMA/bnxt_re: Set queue pair state when being queried

Douglas Anderson <dianders@chromium.org>
    Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"

Douglas Anderson <dianders@chromium.org>
    soc: qcom: geni: More properly switch to DMA mode

Douglas Anderson <dianders@chromium.org>
    arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference

Kathiravan T <kathirav@codeaurora.org>
    arm64: dts: ipq6018: update the reserved-memory node

Fabien Parent <fparent@baylibre.com>
    arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value

Nicolas Boichat <drinkcat@chromium.org>
    soc: mediatek: Check if power domains can be powered on at boot time

Dan Carpenter <dan.carpenter@oracle.com>
    soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()

Biju Das <biju.das.jz@bp.renesas.com>
    arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node

Biju Das <biju.das.jz@bp.renesas.com>
    arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node

Krzysztof Kozlowski <krzk@kernel.org>
    drm/tve200: Fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    drm/mcde: Fix handling of platform_get_irq() error

Randy Dunlap <rdunlap@infradead.org>
    drm/aspeed: Fix Kconfig warning & subsequent build errors

Alexandru Ardelean <alexandru.ardelean@analog.com>
    iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr()

Tom Rix <trix@redhat.com>
    drm/gma500: fix double free of gma_connector

Guenter Roeck <linux@roeck-us.net>
    hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs


-------------

Diffstat:

 Documentation/locking/seqlock.rst                  |  21 +-
 Documentation/networking/ip-sysctl.rst             |   3 +
 Makefile                                           |   4 +-
 arch/Kconfig                                       |  16 ++
 arch/arm/boot/compressed/head.S                    |   4 +-
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi          |   5 -
 .../arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts |   5 -
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts     |   4 +-
 arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts        |   2 +-
 arch/arm/boot/dts/aspeed-g6.dtsi                   |   2 +-
 arch/arm/boot/dts/at91-sam9x60ek.dts               |  13 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |   7 +
 arch/arm/boot/dts/at91-sama5d4_xplained.dts        |   7 +
 arch/arm/boot/dts/at91sam9rl.dtsi                  |  19 +-
 arch/arm/boot/dts/meson8b-odroidc1.dts             |   2 +-
 arch/arm/boot/dts/meson8m2-mxiii-plus.dts          |   2 +-
 arch/arm/boot/dts/omap4-panda-es.dts               |   2 +-
 arch/arm/boot/dts/sama5d2.dtsi                     |   7 +-
 arch/arm/boot/dts/tegra20-ventana.dts              |  11 ++
 arch/arm/crypto/aes-ce-core.S                      |  32 ++-
 arch/arm/crypto/aes-neonbs-glue.c                  |   8 +-
 arch/arm/kernel/entry-armv.S                       |  25 +--
 arch/arm/kernel/head.S                             |   6 +-
 arch/arm/vfp/entry.S                               |  17 --
 arch/arm/vfp/vfphw.S                               |   5 -
 arch/arm/vfp/vfpmodule.c                           |  72 ++++++-
 arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts |   2 +-
 .../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi     |   2 +-
 arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi   |   2 +-
 .../boot/dts/amlogic/meson-gxbb-nanopi-k2.dts      |   2 +-
 .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts |   2 +-
 .../boot/dts/amlogic/meson-gxbb-vega-s95.dtsi      |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi  |   2 +-
 .../boot/dts/amlogic/meson-gxl-s905d-p230.dts      |   2 +-
 .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts     |   4 +-
 .../arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts     |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts |   2 +-
 arch/arm64/boot/dts/amlogic/meson-sm1.dtsi         |   2 +-
 arch/arm64/boot/dts/exynos/exynos7.dtsi            |  12 +-
 .../dts/freescale/fsl-ls1028a-kontron-sl28.dts     |  12 +-
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi     |   4 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |   2 +-
 arch/arm64/boot/dts/marvell/armada-7040.dtsi       |   4 -
 arch/arm64/boot/dts/marvell/armada-8040.dtsi       |   4 -
 arch/arm64/boot/dts/mediatek/mt8183.dtsi           |   2 +-
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   4 +-
 arch/arm64/boot/dts/qcom/ipq6018.dtsi              |   6 +-
 .../dts/qcom/msm8916-samsung-a2015-common.dtsi     |  11 ++
 arch/arm64/boot/dts/qcom/sc7180.dtsi               |   5 +-
 arch/arm64/boot/dts/qcom/sdm845.dtsi               |   3 +-
 .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts      |  39 ++--
 arch/arm64/boot/dts/qcom/sm8250-mtp.dts            |   2 +-
 arch/arm64/boot/dts/renesas/cat875.dtsi            |   1 -
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi    |   1 -
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts     |   1 +
 arch/arm64/boot/dts/rockchip/rk3328.dtsi           |  16 +-
 arch/arm64/boot/dts/ti/k3-am65-main.dtsi           |   4 +-
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi          |   2 +-
 arch/arm64/crypto/poly1305-armv8.pl                |   2 +-
 arch/arm64/crypto/poly1305-core.S_shipped          |   2 +-
 arch/arm64/include/asm/kvm_host.h                  |   1 +
 arch/arm64/kernel/mte.c                            |   3 +-
 arch/arm64/kvm/sys_regs.c                          |   1 +
 arch/m68k/mac/config.c                             |  17 +-
 arch/mips/bcm47xx/Kconfig                          |   1 +
 arch/mips/kernel/setup.c                           |   4 +-
 arch/powerpc/boot/Makefile                         |   2 +
 arch/powerpc/include/asm/bitops.h                  |  23 ++-
 arch/powerpc/include/asm/book3s/32/mmu-hash.h      |   1 +
 arch/powerpc/include/asm/book3s/32/pgtable.h       |   4 +-
 arch/powerpc/include/asm/cpm1.h                    |   1 +
 arch/powerpc/include/asm/cputable.h                |   7 +-
 arch/powerpc/include/asm/nohash/pgtable.h          |   4 +-
 arch/powerpc/kernel/Makefile                       |   3 +
 arch/powerpc/kernel/head_32.h                      |  25 ++-
 arch/powerpc/kernel/head_64.S                      |  10 +-
 arch/powerpc/kernel/paca.c                         |   4 +-
 arch/powerpc/kernel/rtas.c                         |   2 +-
 arch/powerpc/kernel/setup-common.c                 |   4 +-
 arch/powerpc/kernel/setup.h                        |   6 -
 arch/powerpc/kernel/setup_64.c                     |   2 +-
 arch/powerpc/kernel/smp.c                          |   2 +-
 arch/powerpc/lib/sstep.c                           |  10 +-
 arch/powerpc/mm/fault.c                            |   8 +-
 arch/powerpc/mm/mem.c                              |   2 +-
 arch/powerpc/perf/core-book3s.c                    |  13 ++
 arch/powerpc/perf/isa207-common.c                  |  30 ++-
 arch/powerpc/perf/isa207-common.h                  |  20 +-
 arch/powerpc/perf/power10-pmu.c                    |  11 +-
 arch/powerpc/platforms/8xx/micropatch.c            |  11 ++
 arch/powerpc/platforms/Kconfig.cputype             |   2 +-
 arch/powerpc/platforms/powermac/sleep.S            | 132 ++++++-------
 arch/powerpc/platforms/powernv/memtrace.c          |  44 ++++-
 arch/powerpc/platforms/powernv/npu-dma.c           |  16 +-
 arch/powerpc/platforms/powernv/pci-sriov.c         |   2 +-
 arch/powerpc/platforms/pseries/hotplug-cpu.c       |   1 +
 arch/powerpc/platforms/pseries/suspend.c           |   4 -
 arch/powerpc/xmon/nonstdio.c                       |   2 +-
 arch/powerpc/xmon/xmon.c                           |   2 +
 arch/riscv/mm/init.c                               |   2 +-
 arch/s390/kernel/entry.S                           |  44 +++--
 arch/s390/kernel/smp.c                             |  18 +-
 arch/s390/lib/test_unwind.c                        |   7 +-
 arch/s390/purgatory/head.S                         |   9 +-
 arch/sparc/mm/init_64.c                            |   2 +-
 arch/um/drivers/chan_user.c                        |   4 +-
 arch/um/drivers/xterm.c                            |   5 +
 arch/um/kernel/time.c                              |   5 -
 arch/um/os-Linux/irq.c                             |   2 +-
 arch/um/os-Linux/umid.c                            |  17 +-
 arch/x86/events/intel/core.c                       |   5 +-
 arch/x86/events/intel/lbr.c                        |   2 +-
 arch/x86/include/asm/apic.h                        |   1 +
 arch/x86/include/asm/mce.h                         |   3 +-
 arch/x86/kernel/apic/apic.c                        |  14 +-
 arch/x86/kernel/apic/x2apic_phys.c                 |   9 +
 arch/x86/kernel/cpu/mce/core.c                     |   3 +-
 arch/x86/kernel/kprobes/core.c                     |   5 +
 arch/x86/kernel/tboot.c                            |   1 +
 arch/x86/kvm/cpuid.h                               |  14 ++
 arch/x86/kvm/svm/sev.c                             |  22 +--
 arch/x86/kvm/svm/svm.c                             |  14 +-
 arch/x86/kvm/vmx/vmx.c                             |   8 +-
 arch/x86/mm/ident_map.c                            |  12 +-
 crypto/Kconfig                                     |   2 +-
 crypto/ecdh.c                                      |   9 +-
 drivers/accessibility/speakup/speakup_dectlk.c     |   2 +-
 drivers/acpi/acpi_pnp.c                            |   3 +
 drivers/acpi/device_pm.c                           |  41 ++--
 drivers/acpi/nfit/core.c                           |   6 +-
 drivers/acpi/resource.c                            |   2 +-
 drivers/android/binder.c                           |   1 +
 drivers/android/binder_alloc.c                     |  48 +++++
 drivers/android/binder_alloc.h                     |   4 +-
 drivers/base/core.c                                |   2 +-
 drivers/block/null_blk_zoned.c                     |  28 ++-
 drivers/block/rnbd/rnbd-clt-sysfs.c                |  17 +-
 drivers/block/rnbd/rnbd-clt.c                      |  13 +-
 drivers/block/rnbd/rnbd-clt.h                      |   4 +-
 drivers/block/xen-blkback/xenbus.c                 |   4 +-
 drivers/bluetooth/btmtksdio.c                      |   2 +-
 drivers/bluetooth/btusb.c                          |  10 +-
 drivers/bluetooth/hci_h5.c                         |   3 +
 drivers/bus/fsl-mc/fsl-mc-allocator.c              |   4 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   5 +-
 drivers/bus/mhi/core/init.c                        |   6 +-
 drivers/bus/mips_cdmm.c                            |   4 +-
 drivers/clk/at91/sam9x60.c                         |   6 +-
 drivers/clk/at91/sama7g5.c                         |   6 +-
 drivers/clk/bcm/clk-bcm2711-dvp.c                  |   1 +
 drivers/clk/clk-fsl-sai.c                          |  12 ++
 drivers/clk/clk-s2mps11.c                          |   1 +
 drivers/clk/clk-versaclock5.c                      |   4 +-
 drivers/clk/ingenic/cgu.c                          |  14 +-
 drivers/clk/meson/Kconfig                          |   1 +
 drivers/clk/mvebu/armada-37xx-xtal.c               |   4 +-
 drivers/clk/qcom/gcc-sc7180.c                      |   4 +-
 drivers/clk/renesas/r8a779a0-cpg-mssr.c            |  13 +-
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c              |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c                |   1 +
 drivers/clk/tegra/clk-dfll.c                       |   4 +-
 drivers/clk/tegra/clk-id.h                         |   1 +
 drivers/clk/tegra/clk-tegra-periph.c               |   2 +-
 drivers/clk/ti/fapll.c                             |  11 +-
 drivers/clocksource/Kconfig                        |   2 +-
 drivers/clocksource/arm_arch_timer.c               |  27 ++-
 drivers/clocksource/ingenic-timer.c                |   2 +-
 drivers/clocksource/timer-cadence-ttc.c            |  18 +-
 drivers/clocksource/timer-orion.c                  |  11 +-
 drivers/counter/microchip-tcb-capture.c            |  16 +-
 drivers/cpufreq/Kconfig.arm                        |   2 +-
 drivers/cpufreq/armada-8k-cpufreq.c                |   6 +
 drivers/cpufreq/highbank-cpufreq.c                 |   7 +
 drivers/cpufreq/intel_pstate.c                     |  16 +-
 drivers/cpufreq/loongson1-cpufreq.c                |   1 +
 drivers/cpufreq/mediatek-cpufreq.c                 |   1 +
 drivers/cpufreq/qcom-cpufreq-nvmem.c               |   1 +
 drivers/cpufreq/scpi-cpufreq.c                     |   1 +
 drivers/cpufreq/sti-cpufreq.c                      |   7 +
 drivers/cpufreq/sun50i-cpufreq-nvmem.c             |   1 +
 drivers/cpufreq/vexpress-spc-cpufreq.c             |   1 +
 drivers/crypto/Kconfig                             |   1 +
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c  |  20 +-
 drivers/crypto/amcc/crypto4xx_core.c               |   2 +-
 drivers/crypto/caam/caamalg.c                      |   4 +-
 drivers/crypto/caam/caamalg_qi.c                   |   4 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   3 +-
 drivers/crypto/inside-secure/safexcel.c            |   2 +-
 drivers/crypto/omap-aes.c                          |   3 +-
 drivers/crypto/qat/qat_common/qat_hal.c            |   2 +-
 drivers/crypto/talitos.c                           |  10 +-
 drivers/dax/super.c                                |   1 +
 drivers/dma-buf/dma-resv.c                         |   2 +-
 drivers/dma/mv_xor_v2.c                            |   4 +-
 drivers/dma/ti/k3-udma.c                           |   3 +-
 drivers/edac/amd64_edac.c                          |  26 +--
 drivers/edac/i10nm_base.c                          |  11 +-
 drivers/edac/mce_amd.c                             |   2 +-
 drivers/extcon/extcon-max77693.c                   |   2 +-
 drivers/firmware/arm_scmi/notify.c                 |  10 +-
 drivers/firmware/efi/efi.c                         |   1 +
 drivers/firmware/tegra/bpmp-debugfs.c              |   6 +-
 drivers/fsi/fsi-master-aspeed.c                    |  45 +++--
 drivers/gpio/gpiolib.c                             |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c     |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |   9 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |   6 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |   6 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   7 +-
 drivers/gpu/drm/amd/amdkfd/kfd_crat.c              |  13 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  17 +-
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c   |   4 +-
 .../drm/amd/display/modules/color/color_gamma.c    |   2 +-
 drivers/gpu/drm/aspeed/Kconfig                     |   1 +
 drivers/gpu/drm/bridge/ti-tpd12s015.c              |   2 +-
 drivers/gpu/drm/drm_dp_aux_dev.c                   |   2 +-
 drivers/gpu/drm/drm_edid.c                         |   2 +
 drivers/gpu/drm/gma500/cdv_intel_dp.c              |   2 +-
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c     |   2 +-
 drivers/gpu/drm/imx/dcss/dcss-plane.c              |  11 +-
 drivers/gpu/drm/mcde/mcde_drv.c                    |   4 +-
 drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c        |   2 +-
 drivers/gpu/drm/meson/meson_drv.c                  |  12 +-
 drivers/gpu/drm/meson/meson_dw_hdmi.c              |  60 ++++--
 drivers/gpu/drm/msm/Kconfig                        |   2 +-
 drivers/gpu/drm/msm/adreno/a5xx_gpu.c              |  24 ++-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c              |  11 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c      |   6 +-
 drivers/gpu/drm/msm/dp/dp_catalog.c                |  13 ++
 drivers/gpu/drm/msm/dp/dp_catalog.h                |   1 +
 drivers/gpu/drm/msm/dp/dp_ctrl.c                   |  28 ++-
 drivers/gpu/drm/msm/dp/dp_display.c                | 154 ++++++++-------
 drivers/gpu/drm/msm/dp/dp_link.c                   |  41 ++--
 drivers/gpu/drm/msm/dp/dp_link.h                   |   1 +
 drivers/gpu/drm/msm/dp/dp_reg.h                    |   2 +
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c         |   8 +
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c          |   8 +
 drivers/gpu/drm/msm/msm_drv.h                      |   5 +
 drivers/gpu/drm/mxsfb/mxsfb_drv.c                  |  10 +-
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c           |   1 +
 drivers/gpu/drm/panel/panel-simple.c               |   1 +
 drivers/gpu/drm/panfrost/panfrost_device.c         |   1 -
 drivers/gpu/drm/panfrost/panfrost_device.h         |   6 +-
 drivers/gpu/drm/panfrost/panfrost_job.c            | 183 +++++++++++++----
 drivers/gpu/drm/tve200/tve200_drv.c                |   4 +-
 drivers/gpu/drm/udl/udl_modeset.c                  |   4 +-
 drivers/hsi/controllers/omap_ssi_core.c            |   2 +-
 drivers/hwmon/ina3221.c                            |   2 +-
 drivers/hwmon/k10temp.c                            |  98 ---------
 drivers/hwtracing/coresight/coresight-catu.c       |   2 +-
 drivers/hwtracing/coresight/coresight-cti-core.c   |   2 +-
 drivers/hwtracing/coresight/coresight-etb10.c      |   2 +-
 drivers/hwtracing/coresight/coresight-etm3x-core.c |   4 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |   4 +-
 drivers/hwtracing/coresight/coresight-funnel.c     |   6 +-
 drivers/hwtracing/coresight/coresight-replicator.c |   6 +-
 drivers/hwtracing/coresight/coresight-stm.c        |   2 +-
 drivers/hwtracing/coresight/coresight-tmc-core.c   |   2 +-
 drivers/hwtracing/coresight/coresight-tpiu.c       |   2 +-
 drivers/i2c/busses/i2c-qcom-geni.c                 |   6 +-
 drivers/iio/adc/Kconfig                            |   2 +-
 drivers/iio/adc/ad_sigma_delta.c                   |  18 +-
 drivers/iio/adc/at91_adc.c                         |   2 +-
 drivers/iio/adc/rockchip_saradc.c                  |   2 +-
 drivers/iio/adc/ti-ads124s08.c                     |  13 +-
 drivers/iio/imu/bmi160/bmi160.h                    |   7 +
 drivers/iio/imu/bmi160/bmi160_core.c               |   6 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |  26 ++-
 drivers/iio/industrialio-buffer.c                  |   6 +-
 drivers/iio/light/rpr0521.c                        |  17 +-
 drivers/iio/light/st_uvis25.h                      |   5 +
 drivers/iio/light/st_uvis25_core.c                 |   8 +-
 drivers/iio/magnetometer/mag3110.c                 |  13 +-
 drivers/iio/pressure/mpl3115.c                     |   9 +-
 drivers/iio/trigger/iio-trig-hrtimer.c             |   4 +-
 drivers/infiniband/core/cma.c                      | 195 ++++++++++--------
 drivers/infiniband/core/device.c                   |   7 +-
 drivers/infiniband/core/uverbs_std_types_device.c  |  14 +-
 drivers/infiniband/core/uverbs_std_types_mr.c      |   4 +
 drivers/infiniband/core/verbs.c                    |   4 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   5 +-
 drivers/infiniband/hw/cxgb4/cq.c                   |   3 +
 drivers/infiniband/hw/hns/hns_roce_ah.c            |  61 +++---
 drivers/infiniband/hw/hns/hns_roce_cq.c            |   5 +-
 drivers/infiniband/hw/hns/hns_roce_device.h        |  10 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |   4 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  56 +++---
 drivers/infiniband/hw/hns/hns_roce_main.c          |  11 +-
 drivers/infiniband/hw/hns/hns_roce_pd.c            |  11 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  18 +-
 drivers/infiniband/hw/hns/hns_roce_srq.c           |  10 +-
 drivers/infiniband/hw/mlx5/mr.c                    |  21 +-
 drivers/infiniband/hw/mthca/mthca_cq.c             |   2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h            |   1 -
 drivers/infiniband/sw/rxe/rxe_req.c                |   3 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |   8 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |  86 ++++----
 drivers/input/keyboard/omap4-keypad.c              |  89 +++++----
 drivers/input/mouse/cyapa_gen6.c                   |   2 +-
 drivers/input/touchscreen/ads7846.c                |  52 +++--
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |  90 +++++++++
 drivers/iommu/arm/arm-smmu/arm-smmu.c              |  13 +-
 drivers/iommu/arm/arm-smmu/arm-smmu.h              |   1 +
 drivers/iommu/intel/iommu.c                        |   2 +-
 drivers/irqchip/irq-alpine-msi.c                   |   3 +-
 drivers/irqchip/irq-ti-sci-inta.c                  |   2 +-
 drivers/irqchip/irq-ti-sci-intr.c                  |  14 +-
 drivers/irqchip/qcom-pdc.c                         |  21 +-
 drivers/leds/leds-lp50xx.c                         |   6 +-
 drivers/leds/leds-netxbig.c                        |  35 ++--
 drivers/leds/leds-turris-omnia.c                   |   4 +-
 drivers/macintosh/adb-iop.c                        |  56 ++++--
 drivers/mailbox/arm_mhu_db.c                       |   2 +-
 drivers/md/dm-ioctl.c                              |   1 +
 drivers/md/md-cluster.c                            |  67 ++++---
 drivers/md/md.c                                    |  14 +-
 drivers/media/common/siano/smsdvb-main.c           |   5 +-
 drivers/media/i2c/imx214.c                         |   2 +-
 drivers/media/i2c/imx219.c                         |  17 +-
 drivers/media/i2c/max2175.c                        |   2 +-
 drivers/media/i2c/max9271.c                        |   8 +-
 drivers/media/i2c/ov5640.c                         |  82 ++++----
 drivers/media/i2c/rdacm20.c                        |  13 +-
 drivers/media/i2c/tvp5150.c                        |   1 +
 drivers/media/pci/intel/ipu3/ipu3-cio2.c           |  62 +++---
 drivers/media/pci/intel/ipu3/ipu3-cio2.h           |   1 +
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c  |   5 +-
 drivers/media/pci/saa7146/mxb.c                    |  19 +-
 drivers/media/pci/solo6x10/solo6x10-g723.c         |   2 +-
 drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c    |   9 +
 .../media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c  |  19 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c  |  26 ++-
 drivers/media/platform/qcom/venus/core.c           |  32 ++-
 drivers/media/platform/qcom/venus/pm_helpers.c     |  10 +
 drivers/media/rc/sunxi-cir.c                       |   2 +
 drivers/media/usb/gspca/gspca.c                    |   1 +
 drivers/media/usb/tm6000/tm6000-video.c            |   5 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   6 +-
 drivers/memory/Kconfig                             |   2 +-
 drivers/memory/jz4780-nemc.c                       |   6 +-
 drivers/memory/renesas-rpc-if.c                    |   7 +-
 drivers/memstick/core/memstick.c                   |   1 -
 drivers/memstick/host/r592.c                       |  12 +-
 drivers/mfd/Kconfig                                |   1 +
 drivers/mfd/htc-i2cpld.c                           |   2 +
 drivers/mfd/motorola-cpcap.c                       |   6 +-
 drivers/mfd/stmfx.c                                |  10 +-
 drivers/misc/pci_endpoint_test.c                   |   8 +-
 drivers/mmc/host/pxamci.c                          |   1 +
 drivers/mmc/host/sdhci-tegra.c                     |   2 +-
 drivers/mtd/mtdcore.c                              |   4 +
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c         |  38 ++--
 drivers/mtd/nand/raw/meson_nand.c                  |   7 +-
 drivers/mtd/nand/raw/qcom_nandc.c                  |   2 +
 drivers/mtd/nand/spi/core.c                        |   4 +
 drivers/mtd/parsers/cmdlinepart.c                  |  14 +-
 drivers/mtd/spi-nor/atmel.c                        |  77 ++++++--
 drivers/mtd/spi-nor/core.c                         |  25 +--
 drivers/mtd/spi-nor/core.h                         |   1 +
 drivers/mtd/spi-nor/sst.c                          |   3 +-
 drivers/net/can/m_can/m_can.c                      |   4 -
 drivers/net/dsa/qca/ar9331.c                       |  33 +++-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   7 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   4 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c   |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_xsk.c         |   5 +-
 drivers/net/ethernet/intel/ice/ice_xsk.c           |   5 +-
 drivers/net/ethernet/korina.c                      |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   6 +-
 drivers/net/ethernet/microchip/lan743x_main.c      |  43 ++--
 drivers/net/ethernet/mscc/ocelot_vsc7514.c         |   8 +-
 drivers/net/ethernet/netronome/nfp/flower/main.c   |   6 +-
 drivers/net/ethernet/pensando/ionic/ionic_lif.c    |  63 +++---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c   |   1 +
 drivers/net/virtio_net.c                           |   1 +
 drivers/net/wireless/admtek/adm8211.c              |   6 +-
 drivers/net/wireless/ath/ath10k/usb.c              |   7 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   4 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |   9 +-
 drivers/net/wireless/ath/ath10k/wmi.h              |   1 +
 drivers/net/wireless/ath/ath11k/core.h             |   2 +
 drivers/net/wireless/ath/ath11k/dp_tx.c            |   5 +-
 drivers/net/wireless/ath/ath11k/hw.c               |   4 +-
 drivers/net/wireless/ath/ath11k/mac.c              |  54 +++--
 drivers/net/wireless/ath/ath11k/qmi.c              |   6 +-
 drivers/net/wireless/ath/ath11k/reg.c              |   6 +-
 drivers/net/wireless/ath/ath11k/wmi.c              |  31 ---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   3 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   6 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   1 +
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |   6 +
 .../net/wireless/intersil/orinoco/orinoco_usb.c    |  14 +-
 drivers/net/wireless/marvell/mwifiex/main.c        |   2 +
 drivers/net/wireless/mediatek/mt76/dma.c           |   2 +
 drivers/net/wireless/mediatek/mt76/mac80211.c      |   1 +
 drivers/net/wireless/mediatek/mt76/mt7603/pci.c    |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |  14 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mmio.c   |   3 +-
 .../net/wireless/mediatek/mt76/mt7615/sdio_txrx.c  |   2 +-
 drivers/net/wireless/mediatek/mt76/mt76x0/pci.c    |   3 +-
 drivers/net/wireless/mediatek/mt76/mt76x2/pci.c    |   3 +-
 .../net/wireless/mediatek/mt76/mt7915/debugfs.c    |   2 +
 drivers/net/wireless/mediatek/mt76/mt7915/pci.c    |   5 +-
 drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c |   6 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c             |  30 +--
 drivers/net/wireless/st/cw1200/main.c              |   2 +
 drivers/net/xen-netback/xenbus.c                   |   6 +-
 drivers/nfc/s3fwrn5/firmware.c                     |   4 +-
 drivers/nvdimm/label.c                             |  13 +-
 drivers/pci/controller/pcie-brcmstb.c              |   1 +
 drivers/pci/controller/pcie-iproc.c                |  23 ++-
 drivers/pci/pci-acpi.c                             |   4 +-
 drivers/pci/pci.c                                  |  14 +-
 drivers/pci/quirks.c                               |  17 +-
 drivers/pci/slot.c                                 |   6 +-
 drivers/phy/mediatek/Kconfig                       |   4 +-
 drivers/phy/mediatek/phy-mtk-hdmi.c                |   5 +-
 drivers/phy/renesas/phy-rcar-gen3-usb2.c           |   6 +-
 drivers/phy/tegra/xusb.c                           |   2 +-
 drivers/pinctrl/core.c                             |   2 +
 drivers/pinctrl/pinctrl-falcon.c                   |  14 +-
 drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c        |   2 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |   6 +-
 drivers/platform/chrome/cros_ec_spi.c              |   1 -
 drivers/platform/x86/dell-smbios-base.c            |   1 +
 drivers/platform/x86/intel-vbtn.c                  |  18 +-
 drivers/platform/x86/mlx-platform.c                |  20 +-
 drivers/power/supply/axp288_charger.c              |  28 +--
 drivers/power/supply/bq24190_charger.c             |  20 +-
 drivers/power/supply/bq25890_charger.c             |   2 +-
 drivers/power/supply/max17042_battery.c            |   3 +-
 drivers/ps3/ps3stor_lib.c                          |   2 +-
 drivers/pwm/pwm-imx27.c                            |   3 +-
 drivers/pwm/pwm-lp3943.c                           |   1 +
 drivers/pwm/pwm-sun4i.c                            |   6 +-
 drivers/pwm/pwm-zx.c                               |   1 +
 drivers/regulator/axp20x-regulator.c               |   2 +-
 drivers/remoteproc/mtk_common.h                    |  26 +--
 drivers/remoteproc/mtk_scp.c                       |   5 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |  13 +-
 drivers/remoteproc/qcom_q6v5_mss.c                 |   5 +-
 drivers/remoteproc/qcom_q6v5_pas.c                 |   5 +-
 drivers/remoteproc/qcom_sysmon.c                   |  25 ++-
 drivers/remoteproc/ti_k3_dsp_remoteproc.c          |   4 +-
 drivers/rtc/rtc-ep93xx.c                           |   6 +-
 drivers/rtc/rtc-pcf2127.c                          |  12 +-
 drivers/s390/block/dasd_alias.c                    |  22 ++-
 drivers/s390/cio/device.c                          |   4 +-
 drivers/scsi/aacraid/commctrl.c                    |  22 ++-
 drivers/scsi/aacraid/linit.c                       |  61 +-----
 drivers/scsi/fnic/fnic_main.c                      |   1 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |  26 ++-
 drivers/scsi/lpfc/lpfc.h                           |   2 +-
 drivers/scsi/lpfc/lpfc_disc.h                      |   2 +
 drivers/scsi/lpfc/lpfc_hbadisc.c                   |  35 ++++
 drivers/scsi/lpfc/lpfc_init.c                      |  46 +++--
 drivers/scsi/lpfc/lpfc_mem.c                       |  11 +-
 drivers/scsi/lpfc/lpfc_nvme.c                      |  18 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |  74 +++++--
 drivers/scsi/lpfc/lpfc_sli4.h                      |   6 +-
 drivers/scsi/pm8001/pm8001_init.c                  |   3 +-
 drivers/scsi/pm8001/pm80xx_hwi.c                   |   2 +-
 drivers/scsi/qedi/qedi_main.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |  71 +++++--
 drivers/scsi/qla2xxx/qla_mbx.c                     |   9 +-
 drivers/scsi/qla2xxx/qla_tmpl.c                    |   9 +-
 drivers/scsi/qla2xxx/qla_tmpl.h                    |   2 +-
 drivers/scsi/scsi_lib.c                            | 126 ++++++++----
 drivers/scsi/scsi_transport_iscsi.c                |   4 +-
 drivers/scsi/ufs/ufshcd.c                          |   5 +-
 drivers/slimbus/qcom-ctrl.c                        |   9 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |   6 +
 drivers/soc/amlogic/meson-canvas.c                 |   4 +-
 drivers/soc/mediatek/mtk-scpsys.c                  |   5 +-
 drivers/soc/qcom/pdr_interface.c                   |   2 +-
 drivers/soc/qcom/qcom-geni-se.c                    |  17 +-
 drivers/soc/qcom/smp2p.c                           |   5 +-
 drivers/soc/renesas/rmobile-sysc.c                 |   1 +
 drivers/soc/rockchip/io-domain.c                   |   1 +
 drivers/soc/ti/knav_dma.c                          |  13 +-
 drivers/soc/ti/knav_qmss_queue.c                   |   4 +-
 drivers/soc/ti/omap_prm.c                          |   4 +
 drivers/soundwire/master.c                         |  14 ++
 drivers/soundwire/qcom.c                           |   2 +-
 drivers/soundwire/sysfs_slave_dpn.c                |   1 +
 drivers/spi/Kconfig                                |   1 +
 drivers/spi/atmel-quadspi.c                        |  27 ++-
 drivers/spi/spi-ar934x.c                           |  14 +-
 drivers/spi/spi-bcm63xx-hsspi.c                    |   4 +-
 drivers/spi/spi-davinci.c                          |   2 +-
 drivers/spi/spi-dw-bt1.c                           |   4 +-
 drivers/spi/spi-fsl-dspi.c                         |   6 +-
 drivers/spi/spi-fsl-spi.c                          |  11 +-
 drivers/spi/spi-geni-qcom.c                        |   3 +-
 drivers/spi/spi-gpio.c                             |  15 +-
 drivers/spi/spi-img-spfi.c                         |   4 +-
 drivers/spi/spi-imx.c                              |   2 +
 drivers/spi/spi-mem.c                              |   1 +
 drivers/spi/spi-mt7621.c                           |  11 +-
 drivers/spi/spi-mtk-nor.c                          |   2 +-
 drivers/spi/spi-mxic.c                             |  10 +-
 drivers/spi/spi-mxs.c                              |   1 +
 drivers/spi/spi-npcm-fiu.c                         |   8 +-
 drivers/spi/spi-pic32.c                            |   1 +
 drivers/spi/spi-pxa2xx.c                           |   5 +-
 drivers/spi/spi-qcom-qspi.c                        |  42 ++--
 drivers/spi/spi-rb4xx.c                            |   2 +-
 drivers/spi/spi-rpc-if.c                           |   9 +-
 drivers/spi/spi-sc18is602.c                        |  13 +-
 drivers/spi/spi-sh.c                               |  13 +-
 drivers/spi/spi-sprd.c                             |   1 +
 drivers/spi/spi-st-ssc4.c                          |   5 +-
 drivers/spi/spi-stm32-qspi.c                       |   8 +-
 drivers/spi/spi-stm32.c                            |   1 +
 drivers/spi/spi-synquacer.c                        |  15 +-
 drivers/spi/spi-tegra114.c                         |   2 +
 drivers/spi/spi-tegra20-sflash.c                   |   1 +
 drivers/spi/spi-tegra20-slink.c                    |   2 +
 drivers/spi/spi-ti-qspi.c                          |   1 +
 drivers/spi/spi.c                                  |  19 +-
 drivers/staging/comedi/drivers/mf6x4.c             |   3 +-
 drivers/staging/gasket/gasket_interrupt.c          |  15 +-
 drivers/staging/greybus/audio_codec.c              |   2 +
 drivers/staging/greybus/audio_helper.c             |   3 +-
 drivers/staging/hikey9xx/hi6421-spmi-pmic.c        |   4 +-
 drivers/staging/media/rkisp1/rkisp1-capture.c      |   1 +
 drivers/staging/media/sunxi/cedrus/cedrus_video.c  |   4 +-
 drivers/staging/vc04_services/vchiq-mmal/Kconfig   |   2 +-
 drivers/thermal/cpufreq_cooling.c                  |   4 +-
 drivers/tty/serial/8250/8250_mtk.c                 |  13 +-
 drivers/tty/serial/pmac_zilog.c                    |  14 +-
 drivers/usb/host/ehci-omap.c                       |   1 +
 drivers/usb/host/max3421-hcd.c                     |   3 +-
 drivers/usb/host/oxu210hp-hcd.c                    |   4 +-
 drivers/usb/serial/digi_acceleport.c               |  45 ++---
 drivers/usb/serial/keyspan_pda.c                   |  63 +++---
 drivers/usb/serial/mos7720.c                       |   2 +
 drivers/vdpa/mlx5/net/mlx5_vnet.c                  |   5 +
 drivers/vfio/pci/vfio_pci.c                        |   7 +-
 drivers/vfio/pci/vfio_pci_nvlink2.c                |   7 +-
 drivers/vhost/scsi.c                               |   3 +-
 drivers/video/fbdev/atmel_lcdfb.c                  |   2 +-
 drivers/virtio/virtio_ring.c                       |   8 +-
 drivers/watchdog/Kconfig                           |   4 +-
 drivers/watchdog/qcom-wdt.c                        |   2 +-
 drivers/watchdog/sprd_wdt.c                        |  34 ++--
 drivers/watchdog/watchdog_core.c                   |  22 ++-
 drivers/xen/xen-pciback/xenbus.c                   |   2 +-
 drivers/xen/xenbus/xenbus.h                        |   2 +
 drivers/xen/xenbus/xenbus_client.c                 |   8 +-
 drivers/xen/xenbus/xenbus_probe.c                  |   1 +
 drivers/xen/xenbus/xenbus_probe_backend.c          |   7 +
 drivers/xen/xenbus/xenbus_xs.c                     |  34 ++--
 fs/btrfs/ctree.h                                   |   1 -
 fs/btrfs/extent-tree.c                             |  33 +---
 fs/btrfs/ioctl.c                                   |  39 ++++
 fs/btrfs/transaction.c                             |  42 +++-
 fs/ceph/caps.c                                     |  11 +-
 fs/cifs/smb2misc.c                                 |  16 +-
 fs/cifs/smb2ops.c                                  |   3 +-
 fs/cifs/smb2pdu.c                                  |   7 +-
 fs/cifs/smb2pdu.h                                  |  14 +-
 fs/erofs/data.c                                    |  26 +--
 fs/eventpoll.c                                     |  25 ++-
 fs/ext4/extents.c                                  |   4 +-
 fs/ext4/inode.c                                    |  19 +-
 fs/ext4/mballoc.c                                  |   1 +
 fs/ext4/super.c                                    |  14 +-
 fs/f2fs/node.c                                     |   2 +-
 fs/f2fs/super.c                                    |   1 +
 fs/fuse/virtio_fs.c                                |   2 +
 fs/inode.c                                         |   4 +-
 fs/io-wq.h                                         |   1 +
 fs/io_uring.c                                      | 178 ++++++++++-------
 fs/jffs2/readinode.c                               |  16 ++
 fs/jffs2/super.c                                   |  17 ++
 fs/jfs/jfs_dmap.h                                  |   2 +-
 fs/lockd/host.c                                    |  20 +-
 fs/nfs/flexfilelayout/flexfilelayout.c             |   2 +-
 fs/nfs/inode.c                                     |   2 +-
 fs/nfs/nfs4proc.c                                  |  10 +-
 fs/nfs/nfs4xdr.c                                   |  10 +-
 fs/nfs_common/grace.c                              |   6 +-
 fs/nfsd/filecache.c                                |   2 +-
 fs/nfsd/nfs4state.c                                |   1 +
 fs/nfsd/nfssvc.c                                   |   3 +-
 fs/notify/dnotify/dnotify.c                        |   2 +-
 fs/notify/fanotify/fanotify.c                      |   7 +-
 fs/notify/fsnotify.c                               | 107 ++++++----
 fs/notify/inotify/inotify.h                        |   9 +-
 fs/notify/inotify/inotify_fsnotify.c               |  51 +----
 fs/notify/inotify/inotify_user.c                   |   8 +-
 fs/open.c                                          |   4 +
 fs/overlayfs/file.c                                |  87 ++------
 fs/proc/generic.c                                  |  24 ++-
 fs/proc/internal.h                                 |   7 +
 fs/proc/proc_net.c                                 |  16 --
 fs/proc_namespace.c                                |   9 +-
 fs/ubifs/auth.c                                    |   4 +-
 fs/ubifs/io.c                                      |  13 +-
 include/acpi/acpi_bus.h                            |   5 -
 include/linux/fs.h                                 |   3 +-
 include/linux/fsnotify_backend.h                   |   9 +-
 include/linux/iio/adc/ad_sigma_delta.h             |   6 +-
 include/linux/inetdevice.h                         |   4 +-
 include/linux/mm_types.h                           |   8 +
 include/linux/of.h                                 |   1 +
 include/linux/proc_fs.h                            |   8 +-
 include/linux/rmap.h                               |   1 -
 include/linux/seq_buf.h                            |   2 +-
 include/linux/sunrpc/xprt.h                        |   1 +
 include/linux/trace_seq.h                          |   4 +-
 include/media/v4l2-fwnode.h                        |   6 +
 include/media/v4l2-mediabus.h                      |   2 +
 include/rdma/uverbs_ioctl.h                        |  10 +
 include/uapi/linux/android/binder.h                |   1 +
 include/uapi/linux/devlink.h                       |   2 +-
 include/xen/xenbus.h                               |  15 +-
 kernel/audit_fsnotify.c                            |   2 +-
 kernel/audit_tree.c                                |   2 +-
 kernel/audit_watch.c                               |   2 +-
 kernel/cgroup/cpuset.c                             |  33 +++-
 kernel/fork.c                                      |   1 +
 kernel/irq/irqdomain.c                             |  11 +-
 kernel/rcu/tree.c                                  | 118 ++++++-----
 kernel/sched/core.c                                |   6 +-
 kernel/sched/deadline.c                            |   5 +-
 kernel/sched/sched.h                               |  42 ++--
 kernel/trace/bpf_trace.c                           |   8 +-
 kernel/trace/ring_buffer.c                         |  17 +-
 kernel/trace/trace.c                               |  19 +-
 kernel/trace/trace.h                               |   5 +
 kernel/trace/trace_boot.c                          |   2 +
 kernel/trace/trace_events.c                        |   2 +-
 kernel/trace/trace_kprobe.c                        |   9 +-
 kernel/trace/trace_selftest.c                      |   2 +-
 lib/dynamic_debug.c                                |   9 +-
 mm/gup.c                                           | 220 +++++++++------------
 mm/huge_memory.c                                   |   2 +-
 mm/hugetlb.c                                       |   1 +
 mm/init-mm.c                                       |   1 +
 mm/madvise.c                                       |   9 +-
 mm/memcontrol.c                                    |   5 +-
 mm/memory-failure.c                                |   8 +-
 mm/memory.c                                        |  13 +-
 mm/memory_hotplug.c                                |   2 +-
 mm/migrate.c                                       |   8 +-
 mm/page_alloc.c                                    |  13 +-
 mm/rmap.c                                          |   9 -
 mm/vmalloc.c                                       |   6 +-
 mm/vmscan.c                                        |  14 +-
 mm/z3fold.c                                        | 174 ++++++++--------
 net/bluetooth/hci_event.c                          |   5 +
 net/bluetooth/hci_request.c                        |  12 +-
 net/bluetooth/sco.c                                |   5 +
 net/mac80211/rx.c                                  |   2 +-
 net/mac80211/vht.c                                 |  14 +-
 net/sunrpc/debugfs.c                               |   4 +-
 net/sunrpc/sched.c                                 |  65 +++---
 net/sunrpc/xprt.c                                  |  65 ++++--
 net/sunrpc/xprtrdma/module.c                       |   1 +
 net/sunrpc/xprtrdma/rpc_rdma.c                     |  40 +++-
 net/sunrpc/xprtrdma/transport.c                    |   1 +
 net/sunrpc/xprtsock.c                              |   7 +-
 net/wireless/scan.c                                |   2 +-
 samples/bpf/lwt_len_hist.sh                        |   2 +
 samples/bpf/test_lwt_bpf.sh                        |   0
 samples/bpf/xdpsock_user.c                         |   2 +
 scripts/checkpatch.pl                              |   2 +-
 scripts/kconfig/preprocess.c                       |   2 +-
 scripts/kernel-doc                                 |   4 +-
 security/integrity/ima/ima_crypto.c                |  20 +-
 security/selinux/hooks.c                           |  16 +-
 security/smack/smack_access.c                      |   5 +-
 sound/core/memalloc.c                              |   3 +-
 sound/core/oss/pcm_oss.c                           |  22 ++-
 sound/pci/hda/hda_codec.c                          |   2 +-
 sound/pci/hda/hda_sysfs.c                          |   2 +-
 sound/pci/hda/patch_ca0132.c                       |   4 +-
 sound/pci/hda/patch_hdmi.c                         |  98 +++++++--
 sound/pci/hda/patch_realtek.c                      |  46 +++++
 sound/soc/amd/acp-da7219-max98357a.c               |   9 +-
 sound/soc/amd/raven/pci-acp3x.c                    |   4 +
 sound/soc/amd/renoir/rn-pci-acp3x.c                |  32 ++-
 sound/soc/atmel/Kconfig                            |   1 +
 sound/soc/codecs/cros_ec_codec.c                   |   2 +-
 sound/soc/codecs/cx2072x.c                         |   4 +-
 sound/soc/codecs/max98390.c                        |   2 +
 sound/soc/codecs/wm8994.c                          |   6 +-
 sound/soc/codecs/wm8997.c                          |   2 +
 sound/soc/codecs/wm8998.c                          |   4 +-
 sound/soc/codecs/wm_adsp.c                         |   5 +-
 sound/soc/intel/Kconfig                            |   2 +-
 sound/soc/intel/boards/sof_maxim_common.c          |   4 +-
 sound/soc/jz4740/jz4740-i2s.c                      |   4 +
 sound/soc/meson/Kconfig                            |   2 +-
 sound/soc/qcom/Kconfig                             |   1 +
 sound/soc/qcom/common.c                            |  13 +-
 sound/soc/qcom/lpass-hdmi.c                        |   2 +-
 sound/soc/qcom/qdsp6/q6afe-clocks.c                |   1 +
 sound/soc/soc-pcm.c                                |   2 +
 sound/soc/sof/intel/Kconfig                        |   2 +-
 sound/soc/sunxi/sun4i-i2s.c                        |   4 +-
 sound/usb/card.c                                   |   3 +
 sound/usb/clock.c                                  |   6 +
 sound/usb/quirks.c                                 |   1 +
 tools/build/feature/Makefile                       |   2 +-
 tools/lib/bpf/btf.c                                |  16 +-
 tools/lib/bpf/libbpf.c                             |  12 ++
 tools/perf/tests/expand-cgroup.c                   |   2 +-
 tools/perf/tests/pmu-events.c                      |   2 +-
 tools/perf/util/parse-regs-options.c               |   2 +-
 tools/perf/util/probe-file.c                       |  13 +-
 tools/testing/selftests/bpf/Makefile               |   3 +-
 tools/testing/selftests/bpf/progs/local_storage.c  |  24 ++-
 .../testing/selftests/bpf/progs/test_tunnel_kern.c |  42 +---
 tools/testing/selftests/bpf/test_sockmap.c         |  36 ++--
 tools/testing/selftests/bpf/test_tunnel.sh         |  43 +++-
 tools/testing/selftests/run_kselftest.sh           |   2 +-
 tools/testing/selftests/seccomp/config             |   1 +
 724 files changed, 5412 insertions(+), 3411 deletions(-)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:39 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 002/717] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
                   ` (717 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:39 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem S. Tashkinov, Wei Huang, Guenter Roeck

From: Guenter Roeck <linux@roeck-us.net>

commit 0a4e668b5d52eed8026f5d717196b02b55fb2dc6 upstream.

Voltages and current are reported by Zen CPUs. However, the means
to do so is undocumented, changes from CPU to CPU, and the raw data
is not calibrated. Calibration information is available, but again
not documented. This results in less than perfect user experience,
up to concerns that loading the driver might possibly damage
the hardware (by reporting out-of range voltages). Effectively
support for reporting voltages and current is not maintainable.
Drop it.

Cc: Artem S. Tashkinov <aros@gmx.com>
Cc: Wei Huang <wei.huang2@amd.com>
Tested-by: Wei Huang <wei.huang2@amd.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/k10temp.c |   98 ------------------------------------------------
 1 file changed, 98 deletions(-)

--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -11,13 +11,6 @@
  *   convert raw register values is from https://github.com/ocerman/zenpower.
  *   The information is not confirmed from chip datasheets, but experiments
  *   suggest that it provides reasonable temperature values.
- * - Register addresses to read chip voltage and current are also from
- *   https://github.com/ocerman/zenpower, and not confirmed from chip
- *   datasheets. Current calibration is board specific and not typically
- *   shared by board vendors. For this reason, current values are
- *   normalized to report 1A/LSB for core current and and 0.25A/LSB for SoC
- *   current. Reported values can be adjusted using the sensors configuration
- *   file.
  */
 
 #include <linux/bitops.h>
@@ -109,10 +102,7 @@ struct k10temp_data {
 	int temp_offset;
 	u32 temp_adjust_mask;
 	u32 show_temp;
-	u32 svi_addr[2];
 	bool is_zen;
-	bool show_current;
-	int cfactor[2];
 };
 
 #define TCTL_BIT	0
@@ -137,16 +127,6 @@ static const struct tctl_offset tctl_off
 	{ 0x17, "AMD Ryzen Threadripper 29", 27000 }, /* 29{20,50,70,90}[W]X */
 };
 
-static bool is_threadripper(void)
-{
-	return strstr(boot_cpu_data.x86_model_id, "Threadripper");
-}
-
-static bool is_epyc(void)
-{
-	return strstr(boot_cpu_data.x86_model_id, "EPYC");
-}
-
 static void read_htcreg_pci(struct pci_dev *pdev, u32 *regval)
 {
 	pci_read_config_dword(pdev, REG_HARDWARE_THERMAL_CONTROL, regval);
@@ -211,16 +191,6 @@ static const char *k10temp_temp_label[]
 	"Tccd8",
 };
 
-static const char *k10temp_in_label[] = {
-	"Vcore",
-	"Vsoc",
-};
-
-static const char *k10temp_curr_label[] = {
-	"Icore",
-	"Isoc",
-};
-
 static int k10temp_read_labels(struct device *dev,
 			       enum hwmon_sensor_types type,
 			       u32 attr, int channel, const char **str)
@@ -229,50 +199,6 @@ static int k10temp_read_labels(struct de
 	case hwmon_temp:
 		*str = k10temp_temp_label[channel];
 		break;
-	case hwmon_in:
-		*str = k10temp_in_label[channel];
-		break;
-	case hwmon_curr:
-		*str = k10temp_curr_label[channel];
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int k10temp_read_curr(struct device *dev, u32 attr, int channel,
-			     long *val)
-{
-	struct k10temp_data *data = dev_get_drvdata(dev);
-	u32 regval;
-
-	switch (attr) {
-	case hwmon_curr_input:
-		amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
-			     data->svi_addr[channel], &regval);
-		*val = DIV_ROUND_CLOSEST(data->cfactor[channel] *
-					 (regval & 0xff),
-					 1000);
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int k10temp_read_in(struct device *dev, u32 attr, int channel, long *val)
-{
-	struct k10temp_data *data = dev_get_drvdata(dev);
-	u32 regval;
-
-	switch (attr) {
-	case hwmon_in_input:
-		amd_smn_read(amd_pci_dev_to_node_id(data->pdev),
-			     data->svi_addr[channel], &regval);
-		regval = (regval >> 16) & 0xff;
-		*val = DIV_ROUND_CLOSEST(155000 - regval * 625, 100);
-		break;
 	default:
 		return -EOPNOTSUPP;
 	}
@@ -331,10 +257,6 @@ static int k10temp_read(struct device *d
 	switch (type) {
 	case hwmon_temp:
 		return k10temp_read_temp(dev, attr, channel, val);
-	case hwmon_in:
-		return k10temp_read_in(dev, attr, channel, val);
-	case hwmon_curr:
-		return k10temp_read_curr(dev, attr, channel, val);
 	default:
 		return -EOPNOTSUPP;
 	}
@@ -383,11 +305,6 @@ static umode_t k10temp_is_visible(const
 			return 0;
 		}
 		break;
-	case hwmon_in:
-	case hwmon_curr:
-		if (!data->show_current)
-			return 0;
-		break;
 	default:
 		return 0;
 	}
@@ -517,20 +434,10 @@ static int k10temp_probe(struct pci_dev
 		case 0x8:	/* Zen+ */
 		case 0x11:	/* Zen APU */
 		case 0x18:	/* Zen+ APU */
-			data->show_current = !is_threadripper() && !is_epyc();
-			data->svi_addr[0] = F17H_M01H_SVI_TEL_PLANE0;
-			data->svi_addr[1] = F17H_M01H_SVI_TEL_PLANE1;
-			data->cfactor[0] = F17H_M01H_CFACTOR_ICORE;
-			data->cfactor[1] = F17H_M01H_CFACTOR_ISOC;
 			k10temp_get_ccd_support(pdev, data, 4);
 			break;
 		case 0x31:	/* Zen2 Threadripper */
 		case 0x71:	/* Zen2 */
-			data->show_current = !is_threadripper() && !is_epyc();
-			data->cfactor[0] = F17H_M31H_CFACTOR_ICORE;
-			data->cfactor[1] = F17H_M31H_CFACTOR_ISOC;
-			data->svi_addr[0] = F17H_M31H_SVI_TEL_PLANE0;
-			data->svi_addr[1] = F17H_M31H_SVI_TEL_PLANE1;
 			k10temp_get_ccd_support(pdev, data, 8);
 			break;
 		}
@@ -542,11 +449,6 @@ static int k10temp_probe(struct pci_dev
 
 		switch (boot_cpu_data.x86_model) {
 		case 0x0 ... 0x1:	/* Zen3 */
-			data->show_current = true;
-			data->svi_addr[0] = F19H_M01_SVI_TEL_PLANE0;
-			data->svi_addr[1] = F19H_M01_SVI_TEL_PLANE1;
-			data->cfactor[0] = F19H_M01H_CFACTOR_ICORE;
-			data->cfactor[1] = F19H_M01H_CFACTOR_ISOC;
 			k10temp_get_ccd_support(pdev, data, 8);
 			break;
 		}



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 002/717] drm/gma500: fix double free of gma_connector
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
  2020-12-28 12:39 ` [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 003/717] iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr() Greg Kroah-Hartman
                   ` (716 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Daniel Vetter, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]

clang static analysis reports this problem:

cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
        kfree(gma_connector);
        ^~~~~~~~~~~~~~~~~~~~

In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
fails, the handler calls cdv_intel_dp_destroy(connector) which does
the first free of gma_connector. So adjust the goto label and skip
the second free.

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index 720a767118c9c..deb4fd13591d2 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2083,7 +2083,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			drm_encoder_cleanup(encoder);
 			cdv_intel_dp_destroy(connector);
-			goto err_priv;
+			goto err_connector;
 		} else {
         		DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
 				intel_dp->dpcd[0], intel_dp->dpcd[1], 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 003/717] iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
  2020-12-28 12:39 ` [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 002/717] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40   ` Greg Kroah-Hartman
                   ` (715 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot,
	Alexandru Ardelean, Alexandre Belloni, Jonathan Cameron,
	Sasha Levin

From: Alexandru Ardelean <alexandru.ardelean@analog.com>

[ Upstream commit f091d7c5fe6cc39e916b50f90e3cac67a032d0be ]

This tries to solve a warning reported by the lkp bot:

>> drivers/iio/adc/at91_adc.c:1439:34: warning: unused variable
>> 'at91_adc_dt_ids' [-Wunused-const-variable]
   static const struct of_device_id at91_adc_dt_ids[] = {
                                    ^
   1 warning generated.

This warning has appeared after the AT91_ADC driver compilation has been
enabled via the COMPILE_TEST symbol dependency.

The warning is caused by the 'of_match_ptr()' helper which returns NULL if
OF is undefined. This driver should build only for device-tree context, so
a dependency on the OF Kconfig symbol has been added.
Also, the usage of of_match_ptr() helper has been removed since it
shouldn't ever return NULL (because the driver should not be built for the
non-OF context).

Fixes: 4027860dcc4c ("iio: Kconfig: at91_adc: add COMPILE_TEST dependency to driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20200930135048.11530-4-alexandru.ardelean@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/Kconfig    | 2 +-
 drivers/iio/adc/at91_adc.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 91ae90514aff4..17e9ceb9c6c48 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -295,7 +295,7 @@ config ASPEED_ADC
 config AT91_ADC
 	tristate "Atmel AT91 ADC"
 	depends on ARCH_AT91 || COMPILE_TEST
-	depends on INPUT && SYSFS
+	depends on INPUT && SYSFS && OF
 	select IIO_BUFFER
 	select IIO_TRIGGERED_BUFFER
 	help
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 9b2c548fae957..0a793e7cd53ee 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -1469,7 +1469,7 @@ static struct platform_driver at91_adc_driver = {
 	.id_table = at91_adc_ids,
 	.driver = {
 		   .name = DRIVER_NAME,
-		   .of_match_table = of_match_ptr(at91_adc_dt_ids),
+		   .of_match_table = at91_adc_dt_ids,
 		   .pm = &at91_adc_pm_ops,
 	},
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 004/717] drm/aspeed: Fix Kconfig warning & subsequent build errors
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
  2020-12-28 12:39 ` [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs Greg Kroah-Hartman
@ 2020-12-28 12:40   ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 003/717] iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr() Greg Kroah-Hartman
                     ` (716 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Joel Stanley, Andrew Jeffery, Daniel Vetter, Michal Simek,
	Andrew Morton, Mike Rapoport, linux-mm, linux-aspeed,
	linux-arm-kernel, David Airlie, dri-devel, Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 004/717] drm/aspeed: Fix Kconfig warning & subsequent build errors
@ 2020-12-28 12:40   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: dri-devel, Sasha Levin, Michal Simek, kernel test robot,
	linux-aspeed, Andrew Jeffery, Greg Kroah-Hartman, David Airlie,
	Randy Dunlap, stable, Mike Rapoport, linux-mm, Joel Stanley,
	Daniel Vetter, Andrew Morton, linux-arm-kernel

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 004/717] drm/aspeed: Fix Kconfig warning & subsequent build errors
@ 2020-12-28 12:40   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: dri-devel, Sasha Levin, Michal Simek, kernel test robot,
	linux-aspeed, Andrew Jeffery, Greg Kroah-Hartman, David Airlie,
	Randy Dunlap, stable, Mike Rapoport, linux-mm, Joel Stanley,
	Daniel Vetter, Andrew Morton, linux-arm-kernel

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0



_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 005/717] drm/mcde: Fix handling of platform_get_irq() error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-12-28 12:40   ` Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 006/717] drm/tve200: " Greg Kroah-Hartman
                   ` (713 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit e2dae672a9d5e11856fe30ede63467c65f999a81 ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mcde/mcde_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c
index 92f8bd907193f..210f5e1630081 100644
--- a/drivers/gpu/drm/mcde/mcde_drv.c
+++ b/drivers/gpu/drm/mcde/mcde_drv.c
@@ -331,8 +331,8 @@ static int mcde_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		ret = -EINVAL;
+	if (irq < 0) {
+		ret = irq;
 		goto clk_disable;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 006/717] drm/tve200: Fix handling of platform_get_irq() error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 005/717] drm/mcde: Fix handling of platform_get_irq() error Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 007/717] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
                   ` (712 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tve200/tve200_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
index c3aa39bd38ecd..b5259cb1383fc 100644
--- a/drivers/gpu/drm/tve200/tve200_drv.c
+++ b/drivers/gpu/drm/tve200/tve200_drv.c
@@ -200,8 +200,8 @@ static int tve200_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		ret = -EINVAL;
+	if (irq < 0) {
+		ret = irq;
 		goto clk_disable;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 007/717] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 006/717] drm/tve200: " Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 008/717] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
                   ` (711 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Lad Prabhakar,
	Geert Uytterhoeven, Sasha Levin

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit 67d3dcf12a3d245b6fd6ca5672893f7ae4e137ed ]

HiHope RZG2[HMN] boards uses Realtek phy and the driver does not support
rxc-skew-ps property. So remove rxc-skew-ps from ethernet-phy node.

Fixes: 7433f1fb8ec8fe ("arm64: dts: renesas: Add HiHope RZ/G2M sub board support")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20201015132350.8360-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
index 178401a34cbf8..b9e46aed53362 100644
--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
@@ -23,7 +23,6 @@
 	status = "okay";
 
 	phy0: ethernet-phy@0 {
-		rxc-skew-ps = <1500>;
 		reg = <0>;
 		interrupt-parent = <&gpio2>;
 		interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 008/717] arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 007/717] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 009/717] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
                   ` (710 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Lad Prabhakar,
	Geert Uytterhoeven, Sasha Levin

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit 53e573dc39fba1834f3e4fa002cb754b61a30701 ]

The CAT875 sub board from Silicon Linux uses Realtek phy and the driver
does not support rxc-skew-ps property.

Fixes: 6b170cd3ed02949f ("arm64: dts: renesas: cat875: Add ethernet support")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20201015132350.8360-2-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/cat875.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi
index 33daa95706840..801ea54b027c4 100644
--- a/arch/arm64/boot/dts/renesas/cat875.dtsi
+++ b/arch/arm64/boot/dts/renesas/cat875.dtsi
@@ -21,7 +21,6 @@
 	status = "okay";
 
 	phy0: ethernet-phy@0 {
-		rxc-skew-ps = <1500>;
 		reg = <0>;
 		interrupt-parent = <&gpio2>;
 		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 009/717] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 008/717] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 010/717] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
                   ` (709 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Geert Uytterhoeven,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]

This code needs to call iounmap() on one error path.

Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/renesas/rmobile-sysc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/renesas/rmobile-sysc.c b/drivers/soc/renesas/rmobile-sysc.c
index 54b616ad4a62a..beb1c7211c3d6 100644
--- a/drivers/soc/renesas/rmobile-sysc.c
+++ b/drivers/soc/renesas/rmobile-sysc.c
@@ -327,6 +327,7 @@ static int __init rmobile_init_pm_domains(void)
 
 		pmd = of_get_child_by_name(np, "pm-domains");
 		if (!pmd) {
+			iounmap(base);
 			pr_warn("%pOF lacks pm-domains node\n", np);
 			continue;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 010/717] soc: mediatek: Check if power domains can be powered on at boot time
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 009/717] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 011/717] arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value Greg Kroah-Hartman
                   ` (708 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Matthias Brugger,
	Sasha Levin

From: Nicolas Boichat <drinkcat@chromium.org>

[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]

In the error case, where a power domain cannot be powered on
successfully at boot time (in mtk_register_power_domains),
pm_genpd_init would still be called with is_off=false, and the
system would later try to disable the power domain again, triggering
warnings as disabled clocks are disabled again (and other potential
issues).

Also print a warning splat in that case, as this should never
happen.

Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
index f669d3754627d..ca75b14931ec9 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -524,6 +524,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 	for (i = 0; i < num; i++) {
 		struct scp_domain *scpd = &scp->domains[i];
 		struct generic_pm_domain *genpd = &scpd->genpd;
+		bool on;
 
 		/*
 		 * Initially turn on all domains to make the domains usable
@@ -531,9 +532,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 		 * software.  The unused domains will be switched off during
 		 * late_init time.
 		 */
-		genpd->power_on(genpd);
+		on = !WARN_ON(genpd->power_on(genpd) < 0);
 
-		pm_genpd_init(genpd, NULL, false);
+		pm_genpd_init(genpd, NULL, !on);
 	}
 
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 011/717] arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 010/717] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 012/717] arm64: dts: ipq6018: update the reserved-memory node Greg Kroah-Hartman
                   ` (707 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabien Parent, Matthias Brugger, Sasha Levin

From: Fabien Parent <fparent@baylibre.com>

[ Upstream commit e55c56df43dd11de4a6c08e3ea52ca45b51c8800 ]

The binding documentation says:
- #mbox-cells: Should be 2.
	<&phandle channel priority>
	phandle: Label name of a gce node.
	channel: Channel of mailbox. Be equal to the thread id of GCE.
	priority: Priority of GCE thread.

Fix the value of #mbox-cells.

Fixes: d3c306e31bc7 ("arm64: dts: add gce node for mt8183")
Signed-off-by: Fabien Parent <fparent@baylibre.com>
Link: https://lore.kernel.org/r/20201018194225.3361182-1-fparent@baylibre.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/mediatek/mt8183.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
index 9cfd961c45eb3..08a914d3a6435 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -363,7 +363,7 @@
 			compatible = "mediatek,mt8183-gce";
 			reg = <0 0x10238000 0 0x4000>;
 			interrupts = <GIC_SPI 162 IRQ_TYPE_LEVEL_LOW>;
-			#mbox-cells = <3>;
+			#mbox-cells = <2>;
 			clocks = <&infracfg CLK_INFRA_GCE>;
 			clock-names = "gce";
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 012/717] arm64: dts: ipq6018: update the reserved-memory node
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 011/717] arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 013/717] arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference Greg Kroah-Hartman
                   ` (706 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kathiravan T, Bjorn Andersson, Sasha Levin

From: Kathiravan T <kathirav@codeaurora.org>

[ Upstream commit 4af5c6dc255ca64e5263a5254bb7553f05bb682c ]

Memory region reserved for the TZ is changed long back. Let's
update the same to align with the corret region. Its size also
increased to 4MB from 2MB.

Along with that, bump the Q6 region size to 85MB.

Fixes: 1e8277854b49 ("arm64: dts: Add ipq6018 SoC and CP01 board support")
Signed-off-by: Kathiravan T <kathirav@codeaurora.org>
Link: https://lore.kernel.org/r/1602690377-21304-1-git-send-email-kathirav@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq6018.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
index 59e0cbfa22143..cdc1e3d60c58e 100644
--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -156,8 +156,8 @@
 			no-map;
 		};
 
-		tz: tz@48500000 {
-			reg = <0x0 0x48500000 0x0 0x00200000>;
+		tz: memory@4a600000 {
+			reg = <0x0 0x4a600000 0x0 0x00400000>;
 			no-map;
 		};
 
@@ -167,7 +167,7 @@
 		};
 
 		q6_region: memory@4ab00000 {
-			reg = <0x0 0x4ab00000 0x0 0x02800000>;
+			reg = <0x0 0x4ab00000 0x0 0x05500000>;
 			no-map;
 		};
 	};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 013/717] arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 012/717] arm64: dts: ipq6018: update the reserved-memory node Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 014/717] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
                   ` (705 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Georgi Djakov, Rob Clark,
	Douglas Anderson, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 228813aaa71113d7a12313b87c4905a9d3f9df37 ]

In commit e23b1220a246 ("arm64: dts: qcom: sc7180: Increase the number
of interconnect cells") we missed increasing the cells on one
interconnect.  That's no bueno.  Fix it.

NOTE: it appears that things aren't totally broken without this fix,
but clearly something isn't going to be working right.  If nothing
else, without this fix I see this in the logs:

  OF: /soc@0/mdss@ae00000: could not get #interconnect-cells for /soc@0/interrupt-controller@17a00000

Fixes: e23b1220a246 ("arm64: dts: qcom: sc7180: Increase the number of interconnect cells")
Reviewed-by: Georgi Djakov <georgi.djakov@linaro.org>
Reviewed-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20201001141838.1.I08054d1d976eed64ffa1b0e21d568e0dc6040b54@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
index 6678f1e8e3958..a02776ce77a10 100644
--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
@@ -2811,7 +2811,7 @@
 			interrupt-controller;
 			#interrupt-cells = <1>;
 
-			interconnects = <&mmss_noc MASTER_MDP0 &mc_virt SLAVE_EBI1>;
+			interconnects = <&mmss_noc MASTER_MDP0 0 &mc_virt SLAVE_EBI1 0>;
 			interconnect-names = "mdp0-mem";
 
 			iommus = <&apps_smmu 0x800 0x2>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 014/717] soc: qcom: geni: More properly switch to DMA mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 013/717] arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 015/717] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
                   ` (704 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Akash Asthana, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ]

On geni-i2c transfers using DMA, it was seen that if you program the
command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
cause interrupts to fire.  If we get unlucky, these interrupts can
just keep firing (and not be handled) blocking further progress and
hanging the system.

In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
we avoided that by making sure we didn't program the command until
after geni_se_rx_dma_prep() was called.  While that avoided the
problems, it also turns out to be invalid.  At least in the TX case we
started seeing sporadic corrupted transfers.  This is easily seen by
adding an msleep() between the DMA prep and the writing of the
command, which makes the problem worse.  That means we need to revert
that commit and find another way to fix the bogus IRQs.

Specifically, after reverting commit 02b9aec59243 ("i2c:
i2c-qcom-geni: Fix DMA transfer race"), I put some traces in.  I found
that the when the interrupts were firing like crazy:
- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
- "dma" was set.

Further debugging showed that I could make the problem happen more
reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
ran up until geni_se_rx_dma_prep() programmed the length.

A rather simple fix is to change geni_se_select_dma_mode() so it's a
true inverse of geni_se_select_fifo_mode() and disables all the FIFO
related interrupts.  Now the problematic interrupts can't fire and we
can program things in the correct order without worrying.

As part of this, let's also change the writel_relaxed() in the prepare
function to a writel() so that our DMA is guaranteed to be prepared
now that we can't rely on geni_se_setup_m_cmd()'s writel().

NOTE: the only current user of GENI_SE_DMA in mainline is i2c.

Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index d0e4f520cff8c..751a49f6534f4 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -289,10 +289,23 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
 
 static void geni_se_select_dma_mode(struct geni_se *se)
 {
+	u32 proto = geni_se_read_proto(se);
 	u32 val;
 
 	geni_se_irq_clear(se);
 
+	val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
+	if (proto != GENI_SE_UART) {
+		val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
+		val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
+	}
+	writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
+
+	val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
+	if (proto != GENI_SE_UART)
+		val &= ~S_CMD_DONE_EN;
+	writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
+
 	val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
 	val |= GENI_DMA_MODE_EN;
 	writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
@@ -651,7 +664,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
 	writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_TX_LEN);
+	writel(len, se->base + SE_DMA_TX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_tx_dma_prep);
@@ -688,7 +701,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
 	/* RX does not have EOT buffer type bit. So just reset RX_ATTR */
 	writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_RX_LEN);
+	writel(len, se->base + SE_DMA_RX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_rx_dma_prep);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 015/717] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 014/717] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 016/717] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
                   ` (703 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Akash Asthana, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 9cb4c67d7717135d6f4600a49ab07b470ea4ee2f ]

This reverts commit 02b9aec59243c6240fc42884acc958602146ddf6.

As talked about in the patch ("soc: qcom: geni: More properly switch
to DMA mode"), swapping the order of geni_se_setup_m_cmd() and
geni_se_xx_dma_prep() can sometimes cause corrupted transfers.  Thus
we traded one problem for another.  Now that we've debugged the
problem further and fixed the geni helper functions to more disable
FIFO interrupts when we move to DMA mode we can revert it and end up
with (hopefully) zero problems!

To be explicit, the patch ("soc: qcom: geni: More properly switch
to DMA mode") is a prerequisite for this one.

Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20201013142448.v2.2.I7b22281453b8a18ab16ef2bfd4c641fb1cc6a92c@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-qcom-geni.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
index 8b4c35f47a70f..dce75b85253c1 100644
--- a/drivers/i2c/busses/i2c-qcom-geni.c
+++ b/drivers/i2c/busses/i2c-qcom-geni.c
@@ -366,6 +366,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
+	geni_se_setup_m_cmd(se, I2C_READ, m_param);
 
 	if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -373,8 +374,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
-	geni_se_setup_m_cmd(se, I2C_READ, m_param);
-
 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
 	if (!time_left)
 		geni_i2c_abort_xfer(gi2c);
@@ -408,6 +407,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
+	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
 
 	if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -415,8 +415,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
-	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
-
 	if (!dma_buf) /* Get FIFO IRQ */
 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 016/717] RDMA/bnxt_re: Set queue pair state when being queried
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 015/717] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 017/717] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
                   ` (702 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Selvin Xavier,
	Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]

The API for ib_query_qp requires the driver to set cur_qp_state on return,
add the missing set.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index cf3db96283976..f9c999d5ba28e 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -2078,6 +2078,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 		goto out;
 	}
 	qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+	qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
 	qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
 	qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
 	qp_attr->pkey_index = qplib_qp->pkey_index;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 017/717] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 016/717] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 018/717] RDMA/bnxt_re: Fix entry size during SRQ create Greg Kroah-Hartman
                   ` (701 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alexandre Belloni,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ba1c30bf3f2536f248d262c6f257b5a787305991 ]

These functions should return zero on success.  Non-zero returns are
treated as error.  On some paths, this doesn't matter but in
nvmem_cell_read() a non-zero return would be passed to ERR_PTR() and
lead to an Oops.

Fixes: d6c3029f32f7 ("rtc: pcf2127: add support for accessing internal static RAM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201022070451.GA2817669@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf2127.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 07a5630ec841f..4d9711d51f8f3 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -243,10 +243,8 @@ static int pcf2127_nvmem_read(void *priv, unsigned int offset,
 	if (ret)
 		return ret;
 
-	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
-			       val, bytes);
-
-	return ret ?: bytes;
+	return regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
+				val, bytes);
 }
 
 static int pcf2127_nvmem_write(void *priv, unsigned int offset,
@@ -261,10 +259,8 @@ static int pcf2127_nvmem_write(void *priv, unsigned int offset,
 	if (ret)
 		return ret;
 
-	ret = regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
-				val, bytes);
-
-	return ret ?: bytes;
+	return regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
+				 val, bytes);
 }
 
 /* watchdog driver */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 018/717] RDMA/bnxt_re: Fix entry size during SRQ create
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 017/717] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 019/717] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
                   ` (700 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Devesh Sharma, Selvin Xavier,
	Jason Gunthorpe, Sasha Levin

From: Selvin Xavier <selvin.xavier@broadcom.com>

[ Upstream commit b898d5c50cab1f985e77d053eb5c4d2c4a7694ae ]

Only static WQE is supported for SRQ. So always use the max supported SGEs
while calculating SRQ entry size.

Fixes: 2bb3c32c5c5f ("RDMA/bnxt_re: Change wr posting logic to accommodate variable wqes")
Link: https://lore.kernel.org/r/1602569752-12745-1-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index f9c999d5ba28e..266de55f57192 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1657,8 +1657,8 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
 	srq->qplib_srq.max_wqe = entries;
 
 	srq->qplib_srq.max_sge = srq_init_attr->attr.max_sge;
-	srq->qplib_srq.wqe_size =
-			bnxt_re_get_rwqe_size(srq->qplib_srq.max_sge);
+	 /* 128 byte wqe size for SRQ . So use max sges */
+	srq->qplib_srq.wqe_size = bnxt_re_get_rwqe_size(dev_attr->max_srq_sges);
 	srq->qplib_srq.threshold = srq_init_attr->attr.srq_limit;
 	srq->srq_limit = srq_init_attr->attr.srq_limit;
 	srq->qplib_srq.eventq_hw_ring_id = rdev->nq[0].ring_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 019/717] selinux: fix error initialization in inode_doinit_with_dentry()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 018/717] RDMA/bnxt_re: Fix entry size during SRQ create Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 020/717] ARM: dts: aspeed-g6: Fix the GPIO memory size Greg Kroah-Hartman
                   ` (699 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tianyue Ren, Paul Moore, Sasha Levin

From: Tianyue Ren <rentianyue@kylinos.cn>

[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]

Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6b1826fc3658e..158fc47d8620d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1451,7 +1451,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			goto out;
+			isec->initialized = LABEL_INVALID;
+			/*
+			 * There is nothing useful to jump to the "out"
+			 * label, except a needless spin lock/unlock
+			 * cycle.
+			 */
+			return 0;
 		}
 
 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1507,8 +1513,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry)
-				goto out;
+			if (!dentry) {
+				isec->initialized = LABEL_INVALID;
+				/*
+				 * There is nothing useful to jump to the "out"
+				 * label, except a needless spin lock/unlock
+				 * cycle.
+				 */
+				return 0;
+			}
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			if (rc) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 020/717] ARM: dts: aspeed-g6: Fix the GPIO memory size
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 019/717] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 021/717] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
                   ` (698 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Billy Tsai, Andrew Jeffery,
	Joel Stanley, Sasha Levin

From: Billy Tsai <billy_tsai@aspeedtech.com>

[ Upstream commit 886f82ce9f1f4559c139fdb2d79d158999ca38cd ]

The GPIO controller is a GPIO controller followed by some SGPIO
controllers, which are a different type of device with their own binding
and drivers.

Make the gpio node cover the only conventional GPIO controller.

Fixes: 8dbcb5b709b9 ("ARM: dts: aspeed-g6: Add gpio devices")
Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201012033150.21056-2-billy_tsai@aspeedtech.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-g6.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed-g6.dtsi
index b58220a49cbd8..bf97aaad7be9b 100644
--- a/arch/arm/boot/dts/aspeed-g6.dtsi
+++ b/arch/arm/boot/dts/aspeed-g6.dtsi
@@ -357,7 +357,7 @@
 				#gpio-cells = <2>;
 				gpio-controller;
 				compatible = "aspeed,ast2600-gpio";
-				reg = <0x1e780000 0x800>;
+				reg = <0x1e780000 0x400>;
 				interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
 				gpio-ranges = <&pinctrl 0 0 208>;
 				ngpios = <208>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 021/717] ARM: dts: aspeed: s2600wf: Fix VGA memory region location
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 020/717] ARM: dts: aspeed-g6: Fix the GPIO memory size Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 022/717] RDMA/core: Fix error return in _ib_modify_qp() Greg Kroah-Hartman
                   ` (697 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Wang, Joel Stanley, Sasha Levin

From: Joel Stanley <joel@jms.id.au>

[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ]

The VGA memory region is always from the top of RAM. On this board, that
is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000.

This was not an issue in practice as the region is "reserved" by the
vendor's u-boot reducing the amount of available RAM, and the only user
is the host VGA device poking at RAM over PCIe. That is, nothing from
the ARM touches it.

It is worth fixing as developers copy existing device trees when
building their machines, and the XDMA driver does use the memory region
from the ARM side.

Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine")
Reported-by: John Wang <wangzhiqiang.bj@bytedance.com>
Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
index 1deb30ec912cf..6e9baf3bba531 100644
--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
@@ -22,9 +22,9 @@
 		#size-cells = <1>;
 		ranges;
 
-		vga_memory: framebuffer@7f000000 {
+		vga_memory: framebuffer@9f000000 {
 			no-map;
-			reg = <0x7f000000 0x01000000>;
+			reg = <0x9f000000 0x01000000>; /* 16M */
 		};
 	};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 022/717] RDMA/core: Fix error return in _ib_modify_qp()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 021/717] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 023/717] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
                   ` (696 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Maor Gottlieb,
	Jason Gunthorpe, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit 5333499c6014224756e97fa1a1047dfa592d76d3 ]

Fix to return error code PTR_ERR() from the error handling case instead of
0.

Fixes: 51aab12631dd ("RDMA/core: Get xmit slave for LAG")
Link: https://lore.kernel.org/r/20201016075845.129562-1-jingxiangfeng@huawei.com
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 740f8454b6b46..3d895cc41c3ad 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1698,8 +1698,10 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
 			slave = rdma_lag_get_ah_roce_slave(qp->device,
 							   &attr->ah_attr,
 							   GFP_KERNEL);
-			if (IS_ERR(slave))
+			if (IS_ERR(slave)) {
+				ret = PTR_ERR(slave);
 				goto out_av;
+			}
 			attr->xmit_slave = slave;
 		}
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 023/717] RDMA/rxe: Compute PSN windows correctly
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 022/717] RDMA/core: Fix error return in _ib_modify_qp() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 024/717] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
                   ` (695 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bob Pearson, Jason Gunthorpe, Sasha Levin

From: Bob Pearson <rpearsonhpe@gmail.com>

[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]

The code which limited the number of unacknowledged PSNs was incorrect.
The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
The test was computing a 32 bit value which wraps at 32 bits so that
qp->req.psn can appear smaller than the limit when it is actually larger.

Replace '>' test with psn_compare which is used for other PSN comparisons
and correctly handles the 24 bit size.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
Signed-off-by: Bob Pearson <rpearson@hpe.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index af3923bf0a36b..d4917646641aa 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -634,7 +634,8 @@ next_wqe:
 	}
 
 	if (unlikely(qp_type(qp) == IB_QPT_RC &&
-		     qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
+		psn_compare(qp->req.psn, (qp->comp.psn +
+				RXE_MAX_UNACKED_PSNS)) > 0)) {
 		qp->req.wait_psn = 1;
 		goto exit;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 024/717] x86/mm/ident_map: Check for errors from ident_pud_init()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 023/717] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 025/717] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
                   ` (694 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov,
	Joerg Roedel, Kirill A. Shutemov, Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]

Commit

  ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")

added ident_p4d_init() to support 5-level paging, but this function
doesn't check and return errors from ident_pud_init().

For example, the decompressor stub uses this code to create an identity
mapping. If it runs out of pages while trying to allocate a PMD
pagetable, the error will be currently ignored.

Fix this to propagate errors.

 [ bp: Space out statements for better readability. ]

Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/ident_map.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index fe7a12599d8eb..968d7005f4a72 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 			  unsigned long addr, unsigned long end)
 {
 	unsigned long next;
+	int result;
 
 	for (; addr < end; addr = next) {
 		p4d_t *p4d = p4d_page + p4d_index(addr);
@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 
 		if (p4d_present(*p4d)) {
 			pud = pud_offset(p4d, 0);
-			ident_pud_init(info, pud, addr, next);
+			result = ident_pud_init(info, pud, addr, next);
+			if (result)
+				return result;
+
 			continue;
 		}
 		pud = (pud_t *)info->alloc_pgt_page(info->context);
 		if (!pud)
 			return -ENOMEM;
-		ident_pud_init(info, pud, addr, next);
+
+		result = ident_pud_init(info, pud, addr, next);
+		if (result)
+			return result;
+
 		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 025/717] ARM: p2v: fix handling of LPAE translation in BE mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 024/717] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 026/717] RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed Greg Kroah-Hartman
                   ` (693 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Pitre, Linus Walleij,
	Ard Biesheuvel, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]

When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.

Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.

Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/head.S | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f8904227e7fdc..98c1e68bdfcbb 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -671,12 +671,8 @@ ARM_BE8(rev16	ip, ip)
 	ldrcc	r7, [r4], #4	@ use branch for delay slot
 	bcc	1b
 	bx	lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
-	moveq	r0, #0x00004000	@ set bit 22, mov to mvn instruction
 #else
 	moveq	r0, #0x400000	@ set bit 22, mov to mvn instruction
-#endif
 	b	2f
 1:	ldr	ip, [r7, r3]
 #ifdef CONFIG_CPU_ENDIAN_BE8
@@ -685,7 +681,7 @@ ARM_BE8(rev16	ip, ip)
 	tst	ip, #0x000f0000	@ check the rotation field
 	orrne	ip, ip, r6, lsl #24 @ mask in offset bits 31-24
 	biceq	ip, ip, #0x00004000 @ clear bit 22
-	orreq	ip, ip, r0      @ mask in offset bits 7-0
+	orreq	ip, ip, r0, ror #8  @ mask in offset bits 7-0
 #else
 	bic	ip, ip, #0x000000ff
 	tst	ip, #0xf00	@ check the rotation field
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 026/717] RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 025/717] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 027/717] RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established Greg Kroah-Hartman
                   ` (692 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Danil Kipnis, Jack Wang,
	Jason Gunthorpe, Sasha Levin

From: Danil Kipnis <danil.kipnis@cloud.ionos.com>

[ Upstream commit 2b3062e4d997f201c1ad2bbde88b7271dd9ef35f ]

We call destroy_con_cq_qp(con) in rtrs_rdma_addr_resolved() in case route
couldn't be resolved and then again in create_cm() because nothing
happens.

Don't call destroy_con_cq_qp from rtrs_rdma_addr_resolved, create_cm()
does the clean up already.

Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Link: https://lore.kernel.org/r/20201023074353.21946-2-jinpu.wang@cloud.ionos.com
Signed-off-by: Danil Kipnis <danil.kipnis@cloud.ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index f298adc02acba..3cc957fea93ee 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -1640,10 +1640,8 @@ static int rtrs_rdma_addr_resolved(struct rtrs_clt_con *con)
 		return err;
 	}
 	err = rdma_resolve_route(con->c.cm_id, RTRS_CONNECT_TIMEOUT_MS);
-	if (err) {
+	if (err)
 		rtrs_err(s, "Resolving route failed, err: %d\n", err);
-		destroy_con_cq_qp(con);
-	}
 
 	return err;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 027/717] RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 026/717] RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 028/717] RDMA/rtrs-srv: Dont guard the whole __alloc_srv with srv_mutex Greg Kroah-Hartman
                   ` (691 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gioh Kim, Jack Wang, Jason Gunthorpe,
	Sasha Levin

From: Gioh Kim <gi-oh.kim@cloud.ionos.com>

[ Upstream commit f553e7601df9566ba7644541fc09152a3a81f793 ]

When rtrs_rdma_conn_established returns error (non-zero value), the error
value is stored in con->cm_err and it cannot trigger
rtrs_rdma_error_recovery. Finally the error of rtrs_rdma_con_established
will be forgot.

Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Link: https://lore.kernel.org/r/20201023074353.21946-5-jinpu.wang@cloud.ionos.com
Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index 3cc957fea93ee..d54a77ebe1184 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -1835,8 +1835,8 @@ static int rtrs_clt_rdma_cm_handler(struct rdma_cm_id *cm_id,
 		cm_err = rtrs_rdma_route_resolved(con);
 		break;
 	case RDMA_CM_EVENT_ESTABLISHED:
-		con->cm_err = rtrs_rdma_conn_established(con, ev);
-		if (likely(!con->cm_err)) {
+		cm_err = rtrs_rdma_conn_established(con, ev);
+		if (likely(!cm_err)) {
 			/*
 			 * Report success and wake up. Here we abuse state_wq,
 			 * i.e. wake up without state change, but we set cm_err.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 028/717] RDMA/rtrs-srv: Dont guard the whole __alloc_srv with srv_mutex
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 027/717] RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 029/717] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
                   ` (690 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guoqing Jiang, Jack Wang,
	Jason Gunthorpe, Sasha Levin

From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>

[ Upstream commit d715ff8acbd5876549ef2b21b755ed919f40dcc1 ]

The purpose of srv_mutex is to protect srv_list as in put_srv, so no need
to hold it when allocate memory for srv since it could be time consuming.

Otherwise if one machine has limited memory, rsrv_close_work could be
blocked for a longer time due to the mutex is held by get_or_create_srv
since it can't get memory in time.

  INFO: task kworker/1:1:27478 blocked for more than 120 seconds.
        Tainted: G           O    4.14.171-1-storage #4.14.171-1.3~deb9
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  kworker/1:1     D    0 27478      2 0x80000000
  Workqueue: rtrs_server_wq rtrs_srv_close_work [rtrs_server]
  Call Trace:
   ? __schedule+0x38c/0x7e0
   schedule+0x32/0x80
   schedule_preempt_disabled+0xa/0x10
   __mutex_lock.isra.2+0x25e/0x4d0
   ? put_srv+0x44/0x100 [rtrs_server]
   put_srv+0x44/0x100 [rtrs_server]
   rtrs_srv_close_work+0x16c/0x280 [rtrs_server]
   process_one_work+0x1c5/0x3c0
   worker_thread+0x47/0x3e0
   kthread+0xfc/0x130
   ? trace_event_raw_event_workqueue_execute_start+0xa0/0xa0
   ? kthread_create_on_node+0x70/0x70
   ret_from_fork+0x1f/0x30

Let's move all the logics from __find_srv_and_get and __alloc_srv to
get_or_create_srv, and remove the two functions. Then it should be safe
for multiple processes to access the same srv since it is protected with
srv_mutex.

And since we don't want to allocate chunks with srv_mutex held, let's
check the srv->refcount after get srv because the chunks could not be
allocated yet.

Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
Link: https://lore.kernel.org/r/20201023074353.21946-6-jinpu.wang@cloud.ionos.com
Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 86 +++++++++++---------------
 1 file changed, 37 insertions(+), 49 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
index d6f93601712e4..1cb778aff3c59 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -1328,17 +1328,42 @@ static void rtrs_srv_dev_release(struct device *dev)
 	kfree(srv);
 }
 
-static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
-				     const uuid_t *paths_uuid)
+static void free_srv(struct rtrs_srv *srv)
+{
+	int i;
+
+	WARN_ON(refcount_read(&srv->refcount));
+	for (i = 0; i < srv->queue_depth; i++)
+		mempool_free(srv->chunks[i], chunk_pool);
+	kfree(srv->chunks);
+	mutex_destroy(&srv->paths_mutex);
+	mutex_destroy(&srv->paths_ev_mutex);
+	/* last put to release the srv structure */
+	put_device(&srv->dev);
+}
+
+static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+					   const uuid_t *paths_uuid)
 {
 	struct rtrs_srv *srv;
 	int i;
 
+	mutex_lock(&ctx->srv_mutex);
+	list_for_each_entry(srv, &ctx->srv_list, ctx_list) {
+		if (uuid_equal(&srv->paths_uuid, paths_uuid) &&
+		    refcount_inc_not_zero(&srv->refcount)) {
+			mutex_unlock(&ctx->srv_mutex);
+			return srv;
+		}
+	}
+
+	/* need to allocate a new srv */
 	srv = kzalloc(sizeof(*srv), GFP_KERNEL);
-	if  (!srv)
+	if  (!srv) {
+		mutex_unlock(&ctx->srv_mutex);
 		return NULL;
+	}
 
-	refcount_set(&srv->refcount, 1);
 	INIT_LIST_HEAD(&srv->paths_list);
 	mutex_init(&srv->paths_mutex);
 	mutex_init(&srv->paths_ev_mutex);
@@ -1347,6 +1372,8 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
 	srv->ctx = ctx;
 	device_initialize(&srv->dev);
 	srv->dev.release = rtrs_srv_dev_release;
+	list_add(&srv->ctx_list, &ctx->srv_list);
+	mutex_unlock(&ctx->srv_mutex);
 
 	srv->chunks = kcalloc(srv->queue_depth, sizeof(*srv->chunks),
 			      GFP_KERNEL);
@@ -1358,7 +1385,7 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
 		if (!srv->chunks[i])
 			goto err_free_chunks;
 	}
-	list_add(&srv->ctx_list, &ctx->srv_list);
+	refcount_set(&srv->refcount, 1);
 
 	return srv;
 
@@ -1369,52 +1396,9 @@ err_free_chunks:
 
 err_free_srv:
 	kfree(srv);
-
 	return NULL;
 }
 
-static void free_srv(struct rtrs_srv *srv)
-{
-	int i;
-
-	WARN_ON(refcount_read(&srv->refcount));
-	for (i = 0; i < srv->queue_depth; i++)
-		mempool_free(srv->chunks[i], chunk_pool);
-	kfree(srv->chunks);
-	mutex_destroy(&srv->paths_mutex);
-	mutex_destroy(&srv->paths_ev_mutex);
-	/* last put to release the srv structure */
-	put_device(&srv->dev);
-}
-
-static inline struct rtrs_srv *__find_srv_and_get(struct rtrs_srv_ctx *ctx,
-						   const uuid_t *paths_uuid)
-{
-	struct rtrs_srv *srv;
-
-	list_for_each_entry(srv, &ctx->srv_list, ctx_list) {
-		if (uuid_equal(&srv->paths_uuid, paths_uuid) &&
-		    refcount_inc_not_zero(&srv->refcount))
-			return srv;
-	}
-
-	return NULL;
-}
-
-static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
-					   const uuid_t *paths_uuid)
-{
-	struct rtrs_srv *srv;
-
-	mutex_lock(&ctx->srv_mutex);
-	srv = __find_srv_and_get(ctx, paths_uuid);
-	if (!srv)
-		srv = __alloc_srv(ctx, paths_uuid);
-	mutex_unlock(&ctx->srv_mutex);
-
-	return srv;
-}
-
 static void put_srv(struct rtrs_srv *srv)
 {
 	if (refcount_dec_and_test(&srv->refcount)) {
@@ -1813,7 +1797,11 @@ static int rtrs_rdma_connect(struct rdma_cm_id *cm_id,
 	}
 	recon_cnt = le16_to_cpu(msg->recon_cnt);
 	srv = get_or_create_srv(ctx, &msg->paths_uuid);
-	if (!srv) {
+	/*
+	 * "refcount == 0" happens if a previous thread calls get_or_create_srv
+	 * allocate srv, but chunks of srv are not allocated yet.
+	 */
+	if (!srv || refcount_read(&srv->refcount) == 0) {
 		err = -ENOMEM;
 		goto reject_w_err;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 029/717] x86/apic: Fix x2apic enablement without interrupt remapping
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 028/717] RDMA/rtrs-srv: Dont guard the whole __alloc_srv with srv_mutex Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 030/717] ASoC: qcom: fix unsigned int bitwidth compared to less than zero Greg Kroah-Hartman
                   ` (689 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
	Sasha Levin

From: David Woodhouse <dwmw@amazon.co.uk>

[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ]

Currently, Linux as a hypervisor guest will enable x2apic only if there are
no CPUs present at boot time with an APIC ID above 255.

Hotplugging a CPU later with a higher APIC ID would result in a CPU which
cannot be targeted by external interrupts.

Add a filter in x2apic_apic_id_valid() which can be used to prevent such
CPUs from coming online, and allow x2apic to be enabled even if they are
present at boot time.

Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/apic.h        |  1 +
 arch/x86/kernel/apic/apic.c        | 14 ++++++++------
 arch/x86/kernel/apic/x2apic_phys.c |  9 +++++++++
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 4e3099d9ae625..57af25cb44f63 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -259,6 +259,7 @@ static inline u64 native_x2apic_icr_read(void)
 
 extern int x2apic_mode;
 extern int x2apic_phys;
+extern void __init x2apic_set_max_apicid(u32 apicid);
 extern void __init check_x2apic(void);
 extern void x2apic_setup(void);
 static inline int x2apic_enabled(void)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index b3eef1d5c9037..113f6ca7b8284 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1841,20 +1841,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
 		return;
 
 	if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
-		/* IR is required if there is APIC ID > 255 even when running
-		 * under KVM
+		/*
+		 * Using X2APIC without IR is not architecturally supported
+		 * on bare metal but may be supported in guests.
 		 */
-		if (max_physical_apicid > 255 ||
-		    !x86_init.hyper.x2apic_available()) {
+		if (!x86_init.hyper.x2apic_available()) {
 			pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
 			x2apic_disable();
 			return;
 		}
 
 		/*
-		 * without IR all CPUs can be addressed by IOAPIC/MSI
-		 * only in physical mode
+		 * Without IR, all CPUs can be addressed by IOAPIC/MSI only
+		 * in physical mode, and CPUs with an APIC ID that cannnot
+		 * be addressed must not be brought online.
 		 */
+		x2apic_set_max_apicid(255);
 		x2apic_phys = 1;
 	}
 	x2apic_enable();
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index bc9693841353c..e14eae6d6ea71 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -8,6 +8,12 @@
 int x2apic_phys;
 
 static struct apic apic_x2apic_phys;
+static u32 x2apic_max_apicid __ro_after_init;
+
+void __init x2apic_set_max_apicid(u32 apicid)
+{
+	x2apic_max_apicid = apicid;
+}
 
 static int __init set_x2apic_phys_mode(char *arg)
 {
@@ -98,6 +104,9 @@ static int x2apic_phys_probe(void)
 /* Common x2apic functions, also used by x2apic_cluster */
 int x2apic_apic_id_valid(u32 apicid)
 {
+	if (x2apic_max_apicid && apicid > x2apic_max_apicid)
+		return 0;
+
 	return 1;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 030/717] ASoC: qcom: fix unsigned int bitwidth compared to less than zero
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 029/717] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 031/717] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
                   ` (688 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Mark Brown, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit bcc96dc3cf8048c80af7c487af17e19be27ac57d ]

The check for an error return from the call to snd_pcm_format_width
is never true as the unsigned int bitwidth can never be less than
zero. Fix this by making bitwidth an int.

Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201028115112.109017-1-colin.king@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/lpass-hdmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/qcom/lpass-hdmi.c b/sound/soc/qcom/lpass-hdmi.c
index 172952d3a5d66..abfb8737a89f4 100644
--- a/sound/soc/qcom/lpass-hdmi.c
+++ b/sound/soc/qcom/lpass-hdmi.c
@@ -24,7 +24,7 @@ static int lpass_hdmi_daiops_hw_params(struct snd_pcm_substream *substream,
 	unsigned int rate = params_rate(params);
 	unsigned int channels = params_channels(params);
 	unsigned int ret;
-	unsigned int bitwidth;
+	int bitwidth;
 	unsigned int word_length;
 	unsigned int ch_sts_buf0;
 	unsigned int ch_sts_buf1;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 031/717] sched/deadline: Fix sched_dl_global_validate()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 030/717] ASoC: qcom: fix unsigned int bitwidth compared to less than zero Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 032/717] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
                   ` (687 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peng Liu, Peter Zijlstra (Intel),
	Daniel Bristot de Oliveira, Juri Lelli, Sasha Levin

From: Peng Liu <iwtbavbm@gmail.com>

[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]

When change sched_rt_{runtime, period}_us, we validate that the new
settings should at least accommodate the currently allocated -dl
bandwidth:

  sched_rt_handler()
    -->	sched_dl_bandwidth_validate()
	{
		new_bw = global_rt_runtime()/global_rt_period();

		for_each_possible_cpu(cpu) {
			dl_b = dl_bw_of(cpu);
			if (new_bw < dl_b->total_bw)    <-------
				ret = -EBUSY;
		}
	}

But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
dl_b->total_bw is the allocated bandwidth of the whole root domain.
Instead, we should compare dl_b->total_bw against "cpus*new_bw",
where 'cpus' is the number of CPUs of the root domain.

Also, below annotation(in kernel/sched/sched.h) implied implementation
only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
evolving till got merged(v9), but the annotation remains unchanged,
meaningless and misleading, update it.

* With respect to SMP, the bandwidth is given on a per-CPU basis,
* meaning that:
*  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
*  - dl_total_bw array contains, in the i-eth element, the currently
*    allocated bandwidth on the i-eth CPU.

[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/

Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/deadline.c |  5 +++--
 kernel/sched/sched.h    | 42 ++++++++++++++++++-----------------------
 2 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 1d3c97268ec0d..8d06d1f4e2f7b 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2547,7 +2547,7 @@ int sched_dl_global_validate(void)
 	u64 period = global_rt_period();
 	u64 new_bw = to_ratio(period, runtime);
 	struct dl_bw *dl_b;
-	int cpu, ret = 0;
+	int cpu, cpus, ret = 0;
 	unsigned long flags;
 
 	/*
@@ -2562,9 +2562,10 @@ int sched_dl_global_validate(void)
 	for_each_possible_cpu(cpu) {
 		rcu_read_lock_sched();
 		dl_b = dl_bw_of(cpu);
+		cpus = dl_bw_cpus(cpu);
 
 		raw_spin_lock_irqsave(&dl_b->lock, flags);
-		if (new_bw < dl_b->total_bw)
+		if (new_bw * cpus < dl_b->total_bw)
 			ret = -EBUSY;
 		raw_spin_unlock_irqrestore(&dl_b->lock, flags);
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index df80bfcea92eb..c122176c627ec 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -257,30 +257,6 @@ struct rt_bandwidth {
 
 void __dl_clear_params(struct task_struct *p);
 
-/*
- * To keep the bandwidth of -deadline tasks and groups under control
- * we need some place where:
- *  - store the maximum -deadline bandwidth of the system (the group);
- *  - cache the fraction of that bandwidth that is currently allocated.
- *
- * This is all done in the data structure below. It is similar to the
- * one used for RT-throttling (rt_bandwidth), with the main difference
- * that, since here we are only interested in admission control, we
- * do not decrease any runtime while the group "executes", neither we
- * need a timer to replenish it.
- *
- * With respect to SMP, the bandwidth is given on a per-CPU basis,
- * meaning that:
- *  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
- *  - dl_total_bw array contains, in the i-eth element, the currently
- *    allocated bandwidth on the i-eth CPU.
- * Moreover, groups consume bandwidth on each CPU, while tasks only
- * consume bandwidth on the CPU they're running on.
- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
- * that will be shown the next time the proc or cgroup controls will
- * be red. It on its turn can be changed by writing on its own
- * control.
- */
 struct dl_bandwidth {
 	raw_spinlock_t		dl_runtime_lock;
 	u64			dl_runtime;
@@ -292,6 +268,24 @@ static inline int dl_bandwidth_enabled(void)
 	return sysctl_sched_rt_runtime >= 0;
 }
 
+/*
+ * To keep the bandwidth of -deadline tasks under control
+ * we need some place where:
+ *  - store the maximum -deadline bandwidth of each cpu;
+ *  - cache the fraction of bandwidth that is currently allocated in
+ *    each root domain;
+ *
+ * This is all done in the data structure below. It is similar to the
+ * one used for RT-throttling (rt_bandwidth), with the main difference
+ * that, since here we are only interested in admission control, we
+ * do not decrease any runtime while the group "executes", neither we
+ * need a timer to replenish it.
+ *
+ * With respect to SMP, bandwidth is given on a per root domain basis,
+ * meaning that:
+ *  - bw (< 100%) is the deadline bandwidth of each CPU;
+ *  - total_bw is the currently allocated bandwidth in each root domain;
+ */
 struct dl_bw {
 	raw_spinlock_t		lock;
 	u64			bw;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 032/717] sched: Reenable interrupts in do_sched_yield()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 031/717] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 033/717] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
                   ` (686 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]

do_sched_yield() invokes schedule() with interrupts disabled which is
not allowed. This goes back to the pre git era to commit a6efb709806c
("[PATCH] irqlock patch 2.5.27-H6") in the history tree.

Reenable interrupts and remove the misleading comment which "explains" it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e7e453492cffc..77aa0e788b9b7 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6100,12 +6100,8 @@ static void do_sched_yield(void)
 	schedstat_inc(rq->yld_count);
 	current->sched_class->yield_task(rq);
 
-	/*
-	 * Since we are going to call schedule() anyway, there's
-	 * no need to preempt or enable interrupts:
-	 */
 	preempt_disable();
-	rq_unlock(rq, &rf);
+	rq_unlock_irq(rq, &rf);
 	sched_preempt_enable_no_resched();
 
 	schedule();
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 033/717] drm/amdgpu: fix incorrect enum type
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 032/717] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 034/717] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
                   ` (685 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Alex Deucher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit a110f3750bf8b93764f13bd1402c7cba03d15d61 ]

core_link_write_dpcd() returns enum dc_status, not ddc_result:

display/dc/core/dc_link_dp.c: In function 'dp_set_panel_mode':
display/dc/core/dc_link_dp.c:4237:11: warning: implicit conversion from 'enum dc_status' to 'enum ddc_result'
[-Wenum-conversion]

Avoid the warning by using the correct enum in the caller.

Fixes: 0b226322434c ("drm/amd/display: Synchronous DisplayPort Link Training")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index ff1e9963ec7a2..98464886341f6 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -4230,7 +4230,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
 
 		if (edp_config_set.bits.PANEL_MODE_EDP
 			!= panel_mode_edp) {
-			enum ddc_result result = DDC_RESULT_UNKNOWN;
+			enum dc_status result = DC_ERROR_UNEXPECTED;
 
 			edp_config_set.bits.PANEL_MODE_EDP =
 			panel_mode_edp;
@@ -4240,7 +4240,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
 				&edp_config_set.raw,
 				sizeof(edp_config_set.raw));
 
-			ASSERT(result == DDC_RESULT_SUCESSFULL);
+			ASSERT(result == DC_OK);
 		}
 	}
 	DC_LOG_DETECTION_DP_CAPS("Link: %d eDP panel mode supported: %d "
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 034/717] crypto: talitos - Endianess in current_desc_hdr()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 033/717] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 035/717] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
                   ` (684 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ]

current_desc_hdr() compares the value of the current descriptor
with the next_desc member of the talitos_desc struct.

While the current descriptor is obtained from in_be32() which
return CPU ordered bytes, next_desc member is in big endian order.

Convert the current descriptor into big endian before comparing it
with next_desc.

This fixes a sparse warning.

Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 66773892f665d..1de6b01381268 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -478,7 +478,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 
 	iter = tail;
 	while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
-	       priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
+	       priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
 		iter = (iter + 1) & (priv->fifo_len - 1);
 		if (iter == tail) {
 			dev_err(dev, "couldn't locate current descriptor\n");
@@ -486,7 +486,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 		}
 	}
 
-	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
+	if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
 		struct talitos_edesc *edesc;
 
 		edesc = container_of(priv->chan[ch].fifo[iter].desc,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 035/717] crypto: talitos - Fix return type of current_desc_hdr()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 034/717] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 036/717] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
                   ` (683 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]

current_desc_hdr() returns a u32 but in fact this is a __be32,
leading to a lot of sparse warnings.

Change the return type to __be32 and ensure it is handled as
sure by the caller.

Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 1de6b01381268..a713a35dc5022 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -460,7 +460,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
 /*
  * locate current (offending) descriptor
  */
-static u32 current_desc_hdr(struct device *dev, int ch)
+static __be32 current_desc_hdr(struct device *dev, int ch)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int tail, iter;
@@ -501,13 +501,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 /*
  * user diagnostics; report root cause of error based on execution unit status
  */
-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
+static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int i;
 
 	if (!desc_hdr)
-		desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
+		desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
 
 	switch (desc_hdr & DESC_HDR_SEL0_MASK) {
 	case DESC_HDR_SEL0_AFEU:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 036/717] crypto: inside-secure - Fix sizeof() mismatch
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 035/717] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 037/717] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
                   ` (682 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Antoine Tenart,
	Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ]

An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is
not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that
since the size of ** is the same size as * this is not causing any
issues.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/inside-secure/safexcel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index eb2418450f120..2e1562108a858 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -1639,7 +1639,7 @@ static int safexcel_probe_generic(void *pdev,
 
 		priv->ring[i].rdr_req = devm_kcalloc(dev,
 			EIP197_DEFAULT_RING_SIZE,
-			sizeof(priv->ring[i].rdr_req),
+			sizeof(*priv->ring[i].rdr_req),
 			GFP_KERNEL);
 		if (!priv->ring[i].rdr_req)
 			return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 037/717] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 036/717] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 038/717] drm/msm: Add missing stub definition Greg Kroah-Hartman
                   ` (681 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Clément Péron,
	Maxime Ripard, Mark Brown, Sasha Levin

From: Clément Péron <peron.clem@gmail.com>

[ Upstream commit 93c0210671d8f3ec2262da703fab93a1497158a8 ]

Left and Right justified mode are computed using the same formula
as DSP_A and DSP_B mode.
Which is wrong and the user manual explicitly says:

LRCK_PERDIOD:
PCM Mode: Number of BCLKs within (Left + Right) channel width.
I2S/Left-Justified/Right-Justified Mode: Number of BCLKs within each
individual channel width(Left or Right)

Fix this by using the same formula as the I2S mode.

Fixes: 7ae7834ec446 ("ASoC: sun4i-i2s: Add support for DSP formats")
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20201030144648.397824-2-peron.clem@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun4i-i2s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index f23ff29e7c1d3..a994b5cf87b31 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -450,11 +450,11 @@ static int sun8i_i2s_set_chan_cfg(const struct sun4i_i2s *i2s,
 	switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_DSP_A:
 	case SND_SOC_DAIFMT_DSP_B:
-	case SND_SOC_DAIFMT_LEFT_J:
-	case SND_SOC_DAIFMT_RIGHT_J:
 		lrck_period = params_physical_width(params) * slots;
 		break;
 
+	case SND_SOC_DAIFMT_LEFT_J:
+	case SND_SOC_DAIFMT_RIGHT_J:
 	case SND_SOC_DAIFMT_I2S:
 		lrck_period = params_physical_width(params);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 038/717] drm/msm: Add missing stub definition
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 037/717] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 039/717] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
                   ` (680 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Rob Clark, Rob Clark,
	Sasha Levin

From: Robin Murphy <robin.murphy@arm.com>

[ Upstream commit a0b21e0ad29420b04911a98d360b9586168eeae5 ]

DRM_MSM fails to build with DRM_MSM_DP=n; add the missing stub.

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_drv.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index b9dd8f8f48872..0b2686b060c73 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -423,6 +423,11 @@ static inline int msm_dp_display_disable(struct msm_dp *dp,
 {
 	return -EINVAL;
 }
+static inline int msm_dp_display_pre_disable(struct msm_dp *dp,
+					struct drm_encoder *encoder)
+{
+	return -EINVAL;
+}
 static inline void msm_dp_display_mode_set(struct msm_dp *dp,
 				struct drm_encoder *encoder,
 				struct drm_display_mode *mode,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 039/717] ARM: dts: aspeed: tiogapass: Remove vuart
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 038/717] drm/msm: Add missing stub definition Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 040/717] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
                   ` (679 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vijay Khemka, Joel Stanley, Sasha Levin

From: Vijay Khemka <vijaykhemka@fb.com>

[ Upstream commit 14f100c00f1e35e5890340d4c6a64bda5dff4320 ]

Removed vuart for facebook tiogapass platform as it uses uart2 and
uart3 pin with aspeed uart routing feature.

Signed-off-by: Vijay Khemka <vijaykhemka@fb.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Fixes: ffdbf494821d ("ARM: dts: aspeed: tiogapass: Enable VUART")
Link: https://lore.kernel.org/r/20200813190431.3331026-1-vijaykhemka@fb.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
index 2d44d9ad4e400..e6ad821a86359 100644
--- a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
@@ -82,11 +82,6 @@
 	status = "okay";
 };
 
-&vuart {
-	// VUART Host Console
-	status = "okay";
-};
-
 &uart1 {
 	// Host Console
 	status = "okay";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 040/717] drm/amdgpu: fix build_coefficients() argument
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 039/717] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 041/717] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
                   ` (678 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, Arnd Bergmann,
	Alex Deucher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]

gcc -Wextra warns about a function taking an enum argument
being called with a bool:

drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
 1617 |  build_coefficients(&coeff, true);

It appears that a patch was added using the old calling conventions
after the type was changed, and the value should actually be 0
(TRANSFER_FUNCTION_SRGB) here instead of 1 (true).

Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module")
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index b8695660b480e..09bc2c249e1af 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1614,7 +1614,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
 	struct pwl_float_data_ex *rgb = rgb_regamma;
 	const struct hw_x_point *coord_x = coordinates_x;
 
-	build_coefficients(&coeff, true);
+	build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
 
 	i = 0;
 	while (i != hw_points_num + 1) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 041/717] powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 040/717] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 042/717] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
                   ` (677 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jordan Niethe, Michael Ellerman, Sasha Levin

From: Jordan Niethe <jniethe5@gmail.com>

[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]

Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
is called before a stack has been set up in r1. This was previously fine
as the cpu_restore() functions were implemented in assembly and did not
use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
device tree binding for discovering CPU features") used
__restore_cpu_cpufeatures() as the cpu_restore() function for a
device-tree features based cputable entry. This is a C function and
hence uses a stack in r1.

generic_secondary_smp_init() is entered on the secondary cpus via the
primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
thread has its own stack. The OPAL call is ran in the primary's hardware
thread. During the call, a job is scheduled on a secondary cpu that will
start executing at the address of generic_secondary_smp_init().  Hence
the value that will be left in r1 when the secondary cpu enters the
kernel is part of that secondary cpu's individual OPAL stack. This means
that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
not horribly bad as each hardware thread has its own stack and the call
that enters the kernel from OPAL never returns, but it is still wrong
and should be corrected.

Create the temp kernel stack before calling cpu_restore().

As noted by mpe, for a kexec boot, the secondary CPUs are released from
the spin loop at address 0x60 by smp_release_cpus() and then jump to
generic_secondary_smp_init(). The call to smp_release_cpus() is in
setup_arch(), and it comes before the call to emergency_stack_init().
emergency_stack_init() allocates an emergency stack in the PACA for each
CPU.  This address in the PACA is what is used to set up the temp kernel
stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
to after the PACAs have been allocated an emergency stack, otherwise the
PACA stack pointer will contain garbage and hence the temp kernel stack
created from it will be broken.

Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/head_64.S      | 8 ++++----
 arch/powerpc/kernel/setup-common.c | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 1510b2a56669f..7b7c8c5ee6602 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -417,6 +417,10 @@ generic_secondary_common_init:
 	/* From now on, r24 is expected to be logical cpuid */
 	mr	r24,r5
 
+	/* Create a temp kernel stack for use before relocation is on.	*/
+	ld	r1,PACAEMERGSP(r13)
+	subi	r1,r1,STACK_FRAME_OVERHEAD
+
 	/* See if we need to call a cpu state restore handler */
 	LOAD_REG_ADDR(r23, cur_cpu_spec)
 	ld	r23,0(r23)
@@ -445,10 +449,6 @@ generic_secondary_common_init:
 	sync				/* order paca.run and cur_cpu_spec */
 	isync				/* In case code patching happened */
 
-	/* Create a temp kernel stack for use before relocation is on.	*/
-	ld	r1,PACAEMERGSP(r13)
-	subi	r1,r1,STACK_FRAME_OVERHEAD
-
 	b	__secondary_start
 #endif /* SMP */
 
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 808ec9fab6052..da8c71f321ad3 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -919,8 +919,6 @@ void __init setup_arch(char **cmdline_p)
 
 	/* On BookE, setup per-core TLB data structures. */
 	setup_tlb_core_data();
-
-	smp_release_cpus();
 #endif
 
 	/* Print various info about the machine that has been gathered so far. */
@@ -944,6 +942,8 @@ void __init setup_arch(char **cmdline_p)
 	exc_lvl_early_init();
 	emergency_stack_init();
 
+	smp_release_cpus();
+
 	initmem_init();
 
 	early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 042/717] spi: img-spfi: fix reference leak in img_spfi_resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 041/717] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 043/717] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
                   ` (676 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.

Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-img-spfi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index b068537375d60..5f05d519fbbd0 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -731,8 +731,10 @@ static int img_spfi_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(dev);
 		return ret;
+	}
 	spfi_reset(spfi);
 	pm_runtime_put(dev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 043/717] f2fs: call f2fs_get_meta_page_retry for nat page
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 042/717] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 044/717] RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr() Greg Kroah-Hartman
                   ` (675 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit 3acc4522d89e0a326db69e9d0afaad8cf763a54c ]

When running fault injection test, if we don't stop checkpoint, some stale
NAT entries were flushed which breaks consistency.

Fixes: 86f33603f8c5 ("f2fs: handle errors of f2fs_get_meta_page_nofail")
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/node.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index d5d8ce077f295..42394de6c7eb1 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -109,7 +109,7 @@ static void clear_node_page_dirty(struct page *page)
 
 static struct page *get_current_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
 {
-	return f2fs_get_meta_page(sbi, current_nat_addr(sbi, nid));
+	return f2fs_get_meta_page_retry(sbi, current_nat_addr(sbi, nid));
 }
 
 static struct page *get_next_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 044/717] RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 043/717] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 045/717] perf test: Use generic event for expand_libpfm_events() Greg Kroah-Hartman
                   ` (674 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe,
	Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit fc3325701a6353594083f08e297d4c1965c601aa ]

reg_pages should always contain mr->npage since when the mr is finally
de-reg'd it is always subtracted out.

If there were any error exits then mlx5_ib_rereg_user_mr() would leave the
reg_pages adjusted and this will cause it to be double subtracted
eventually.

The manipulation of reg_pages is inherently connected to the umem, so lift
it out of set_mr_fields() and only adjust it around creating/destroying a
umem.

reg_pages is only used for diagnostics in sysfs.

Fixes: 7d0cc6edcc70 ("IB/mlx5: Add MR cache for large UMR regions")
Link: https://lore.kernel.org/r/20201026131936.1335664-3-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index b261797b258fd..3468ae804eaee 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1247,10 +1247,8 @@ err_1:
 }
 
 static void set_mr_fields(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
-			  int npages, u64 length, int access_flags)
+			  u64 length, int access_flags)
 {
-	mr->npages = npages;
-	atomic_add(npages, &dev->mdev->priv.reg_pages);
 	mr->ibmr.lkey = mr->mmkey.key;
 	mr->ibmr.rkey = mr->mmkey.key;
 	mr->ibmr.length = length;
@@ -1290,8 +1288,7 @@ static struct ib_mr *mlx5_ib_get_dm_mr(struct ib_pd *pd, u64 start_addr,
 
 	kfree(in);
 
-	mr->umem = NULL;
-	set_mr_fields(dev, mr, 0, length, acc);
+	set_mr_fields(dev, mr, length, acc);
 
 	return &mr->ibmr;
 
@@ -1419,7 +1416,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	mlx5_ib_dbg(dev, "mkey 0x%x\n", mr->mmkey.key);
 
 	mr->umem = umem;
-	set_mr_fields(dev, mr, npages, length, access_flags);
+	mr->npages = npages;
+	atomic_add(mr->npages, &dev->mdev->priv.reg_pages);
+	set_mr_fields(dev, mr, length, access_flags);
 
 	if (xlt_with_umr && !(access_flags & IB_ACCESS_ON_DEMAND)) {
 		/*
@@ -1531,8 +1530,6 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
 	mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
 		    start, virt_addr, length, access_flags);
 
-	atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
-
 	if (!mr->umem)
 		return -EINVAL;
 
@@ -1553,12 +1550,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
 		 * used.
 		 */
 		flags |= IB_MR_REREG_TRANS;
+		atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
+		mr->npages = 0;
 		ib_umem_release(mr->umem);
 		mr->umem = NULL;
+
 		err = mr_umem_get(dev, addr, len, access_flags, &mr->umem,
 				  &npages, &page_shift, &ncont, &order);
 		if (err)
 			goto err;
+		mr->npages = ncont;
+		atomic_add(mr->npages, &dev->mdev->priv.reg_pages);
 	}
 
 	if (!mlx5_ib_can_reconfig_with_umr(dev, mr->access_flags,
@@ -1609,7 +1611,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
 			goto err;
 	}
 
-	set_mr_fields(dev, mr, npages, len, access_flags);
+	set_mr_fields(dev, mr, len, access_flags);
 
 	return 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 045/717] perf test: Use generic event for expand_libpfm_events()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 044/717] RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 046/717] drm/msm/dp: DisplayPort PHY compliance tests fixup Greg Kroah-Hartman
                   ` (673 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Ian Rogers,
	Alexander Shishkin, Andi Kleen, Jiri Olsa, Mark Rutland,
	Peter Zijlstra, Stephane Eranian, Arnaldo Carvalho de Melo,
	Sasha Levin

From: Namhyung Kim <namhyung@kernel.org>

[ Upstream commit 9b0a7836359443227c9af101f7aea8412e739458 ]

I found that the UNHALTED_CORE_CYCLES event is only available in the
Intel machines and it makes other vendors/archs fail on the test.  As
libpfm4 can parse the generic events like cycles, let's use them.

Fixes: 40b74c30ffb9 ("perf test: Add expand cgroup event test")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lore.kernel.org/lkml/20201027072855.655449-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/expand-cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/expand-cgroup.c b/tools/perf/tests/expand-cgroup.c
index d5771e4d094f8..4c59f3ae438fc 100644
--- a/tools/perf/tests/expand-cgroup.c
+++ b/tools/perf/tests/expand-cgroup.c
@@ -145,7 +145,7 @@ static int expand_libpfm_events(void)
 	int ret;
 	struct evlist *evlist;
 	struct rblist metric_events;
-	const char event_str[] = "UNHALTED_CORE_CYCLES";
+	const char event_str[] = "CYCLES";
 	struct option opt = {
 		.value = &evlist,
 	};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 046/717] drm/msm/dp: DisplayPort PHY compliance tests fixup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 045/717] perf test: Use generic event for expand_libpfm_events() Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 047/717] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state Greg Kroah-Hartman
                   ` (672 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tanmay Shah, Stephen Boyd, Rob Clark,
	Sasha Levin

From: Tanmay Shah <tanmay@codeaurora.org>

[ Upstream commit 6625e2637d93d2f52ef0d17656f21bfa2cb4983a ]

Bandwidth code was being used as test link rate. Fix this by converting
bandwidth code to test link rate

Do not reset voltage and pre-emphasis level during IRQ HPD attention
interrupt. Also fix pre-emphasis parsing during test link status process

Signed-off-by: Tanmay Shah <tanmay@codeaurora.org>
Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c    |  3 ---
 drivers/gpu/drm/msm/dp/dp_display.c |  1 +
 drivers/gpu/drm/msm/dp/dp_link.c    | 12 +++++++++++-
 drivers/gpu/drm/msm/dp/dp_link.h    |  1 +
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 2e3e1917351f0..872b12689e317 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1643,9 +1643,6 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
 	if (rc)
 		return rc;
 
-	ctrl->link->phy_params.p_level = 0;
-	ctrl->link->phy_params.v_level = 0;
-
 	while (--link_train_max_retries &&
 		!atomic_read(&ctrl->dp_ctrl.aborted)) {
 		rc = dp_ctrl_reinitialize_mainlink(ctrl);
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index e175aa3fd3a93..ae9989ece73f4 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -335,6 +335,7 @@ static int dp_display_process_hpd_high(struct dp_display_private *dp)
 	dp->dp_display.max_pclk_khz = DP_MAX_PIXEL_CLK_KHZ;
 	dp->dp_display.max_dp_lanes = dp->parser->max_dp_lanes;
 
+	dp_link_reset_phy_params_vx_px(dp->link);
 	rc = dp_ctrl_on_link(dp->ctrl);
 	if (rc) {
 		DRM_ERROR("failed to complete DP link training\n");
diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c
index c811da515fb3b..49d7fad36fc4e 100644
--- a/drivers/gpu/drm/msm/dp/dp_link.c
+++ b/drivers/gpu/drm/msm/dp/dp_link.c
@@ -869,6 +869,9 @@ static int dp_link_parse_vx_px(struct dp_link_private *link)
 		drm_dp_get_adjust_request_voltage(link->link_status, 0);
 	link->dp_link.phy_params.p_level =
 		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 0);
+
+	link->dp_link.phy_params.p_level >>= DP_TRAIN_PRE_EMPHASIS_SHIFT;
+
 	DRM_DEBUG_DP("Requested: v_level = 0x%x, p_level = 0x%x\n",
 			link->dp_link.phy_params.v_level,
 			link->dp_link.phy_params.p_level);
@@ -911,7 +914,8 @@ static int dp_link_process_phy_test_pattern_request(
 			link->request.test_lane_count);
 
 	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
-	link->dp_link.link_params.rate = link->request.test_link_rate;
+	link->dp_link.link_params.rate =
+		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
 
 	ret = dp_link_parse_vx_px(link);
 
@@ -1156,6 +1160,12 @@ int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status)
 	return 0;
 }
 
+void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link)
+{
+	dp_link->phy_params.v_level = 0;
+	dp_link->phy_params.p_level = 0;
+}
+
 u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp)
 {
 	u32 tbd;
diff --git a/drivers/gpu/drm/msm/dp/dp_link.h b/drivers/gpu/drm/msm/dp/dp_link.h
index 49811b6221e53..9dd4dd9265304 100644
--- a/drivers/gpu/drm/msm/dp/dp_link.h
+++ b/drivers/gpu/drm/msm/dp/dp_link.h
@@ -135,6 +135,7 @@ static inline u32 dp_link_bit_depth_to_bpc(u32 tbd)
 	}
 }
 
+void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link);
 u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp);
 int dp_link_process_request(struct dp_link *dp_link);
 int dp_link_get_colorimetry_config(struct dp_link *dp_link);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 047/717] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 046/717] drm/msm/dp: DisplayPort PHY compliance tests fixup Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 048/717] drm/msm/dsi_pll_10nm: " Greg Kroah-Hartman
                   ` (671 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit 5047ab95bb7db0e7b2ecfd5e9bcafc7fd822c652 ]

PHY disable/enable resets PLL registers to default values. Thus in
addition to restoring several registers we also need to restore VCO rate
settings.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
index de0dfb8151258..93bf142e4a4e6 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
@@ -585,6 +585,7 @@ static int dsi_pll_7nm_restore_state(struct msm_dsi_pll *pll)
 	struct pll_7nm_cached_state *cached = &pll_7nm->cached_state;
 	void __iomem *phy_base = pll_7nm->phy_cmn_mmio;
 	u32 val;
+	int ret;
 
 	val = pll_read(pll_7nm->mmio + REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE);
 	val &= ~0x3;
@@ -599,6 +600,13 @@ static int dsi_pll_7nm_restore_state(struct msm_dsi_pll *pll)
 	val |= cached->pll_mux;
 	pll_write(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, val);
 
+	ret = dsi_pll_7nm_vco_set_rate(&pll->clk_hw, pll_7nm->vco_current_rate, pll_7nm->vco_ref_clk_rate);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_7nm->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
 	DBG("DSI PLL%d", pll_7nm->id);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 048/717] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 047/717] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 049/717] drm/msm/dpu: fix clock scaling on non-sc7180 board Greg Kroah-Hartman
                   ` (670 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]

PHY disable/enable resets PLL registers to default values. Thus in
addition to restoring several registers we also need to restore VCO rate
settings.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index 6ac04fc303f56..e4e9bf04b7368 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -559,6 +559,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
 	void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
 	u32 val;
+	int ret;
 
 	val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
 	val &= ~0x3;
@@ -573,6 +574,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	val |= cached->pll_mux;
 	pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
 
+	ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_10nm->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
 	DBG("DSI PLL%d", pll_10nm->id);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 049/717] drm/msm/dpu: fix clock scaling on non-sc7180 board
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 048/717] drm/msm/dsi_pll_10nm: " Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 050/717] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
                   ` (669 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Abhinav Kumar,
	Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit cccdeda362fafd0613b571affe7199eb7d8f3fba ]

c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for
display") has added support for handling bandwidth voting in kms path in
addition to old mdss path. However this broke all other platforms since
_dpu_core_perf_crtc_update_bus() will now error out instead of properly
calculating bandwidth and core clocks. Fix
_dpu_core_perf_crtc_update_bus() to just skip bandwidth setting instead
of returning an error in case kms->num_paths == 0 (MDSS is used for
bandwidth management).

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display")
Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
index 393858ef8a832..37c8270681c23 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
@@ -219,9 +219,6 @@ static int _dpu_core_perf_crtc_update_bus(struct dpu_kms *kms,
 	int i, ret = 0;
 	u64 avg_bw;
 
-	if (!kms->num_paths)
-		return -EINVAL;
-
 	drm_for_each_crtc(tmp_crtc, crtc->dev) {
 		if (tmp_crtc->enabled &&
 			curr_client_type ==
@@ -239,6 +236,9 @@ static int _dpu_core_perf_crtc_update_bus(struct dpu_kms *kms,
 		}
 	}
 
+	if (!kms->num_paths)
+		return 0;
+
 	avg_bw = perf.bw_ctl;
 	do_div(avg_bw, (kms->num_paths * 1000)); /*Bps_to_icc*/
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 050/717] spi: spi-mem: fix reference leak in spi_mem_access_start
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 049/717] drm/msm/dpu: fix clock scaling on non-sc7180 board Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 051/717] scsi: aacraid: Improve compat_ioctl handlers Greg Kroah-Hartman
                   ` (668 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit c02bb16b0e826bf0e19aa42c3ae60ea339f32cf5 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in spi_mem_access_start, so we should fix it.

Fixes: f86c24f479530 ("spi: spi-mem: Split spi_mem_exec_op() code")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140910.3482-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index ef53290b7d24d..4682f49dc7330 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -243,6 +243,7 @@ static int spi_mem_access_start(struct spi_mem *mem)
 
 		ret = pm_runtime_get_sync(ctlr->dev.parent);
 		if (ret < 0) {
+			pm_runtime_put_noidle(ctlr->dev.parent);
 			dev_err(&ctlr->dev, "Failed to power device: %d\n",
 				ret);
 			return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 051/717] scsi: aacraid: Improve compat_ioctl handlers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 050/717] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 052/717] pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB Greg Kroah-Hartman
                   ` (667 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Arnd Bergmann,
	Martin K. Petersen, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 077054215a7f787e389a807ece8a39247abbbc1e ]

The use of compat_alloc_user_space() can be easily replaced by handling
compat arguments in the regular handler, and this will make it work for
big-endian kernels as well, which at the moment get an invalid indirect
pointer argument.

Calling aac_ioctl() instead of aac_compat_do_ioctl() means the compat and
native code paths behave the same way again, which they stopped when the
adapter health check was added only in the native function.

Link: https://lore.kernel.org/r/20201030164450.1253641-1-arnd@kernel.org
Fixes: 572ee53a9bad ("scsi: aacraid: check adapter health")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/aacraid/commctrl.c | 22 ++++++++++--
 drivers/scsi/aacraid/linit.c    | 61 ++-------------------------------
 2 files changed, 22 insertions(+), 61 deletions(-)

diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index e3e157a749880..1b1da162f5f6b 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -25,6 +25,7 @@
 #include <linux/completion.h>
 #include <linux/dma-mapping.h>
 #include <linux/blkdev.h>
+#include <linux/compat.h>
 #include <linux/delay.h> /* ssleep prototype */
 #include <linux/kthread.h>
 #include <linux/uaccess.h>
@@ -226,6 +227,12 @@ static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	return status;
 }
 
+struct compat_fib_ioctl {
+	u32	fibctx;
+	s32	wait;
+	compat_uptr_t fib;
+};
+
 /**
  *	next_getadapter_fib	-	get the next fib
  *	@dev: adapter to use
@@ -243,8 +250,19 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	struct list_head * entry;
 	unsigned long flags;
 
-	if(copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
-		return -EFAULT;
+	if (in_compat_syscall()) {
+		struct compat_fib_ioctl cf;
+
+		if (copy_from_user(&cf, arg, sizeof(struct compat_fib_ioctl)))
+			return -EFAULT;
+
+		f.fibctx = cf.fibctx;
+		f.wait = cf.wait;
+		f.fib = compat_ptr(cf.fib);
+	} else {
+		if (copy_from_user(&f, arg, sizeof(struct fib_ioctl)))
+			return -EFAULT;
+	}
 	/*
 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext
 	 *
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 8f3772480582c..0a82afaf40285 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1182,63 +1182,6 @@ static long aac_cfg_ioctl(struct file *file,
 	return aac_do_ioctl(aac, cmd, (void __user *)arg);
 }
 
-#ifdef CONFIG_COMPAT
-static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long arg)
-{
-	long ret;
-	switch (cmd) {
-	case FSACTL_MINIPORT_REV_CHECK:
-	case FSACTL_SENDFIB:
-	case FSACTL_OPEN_GET_ADAPTER_FIB:
-	case FSACTL_CLOSE_GET_ADAPTER_FIB:
-	case FSACTL_SEND_RAW_SRB:
-	case FSACTL_GET_PCI_INFO:
-	case FSACTL_QUERY_DISK:
-	case FSACTL_DELETE_DISK:
-	case FSACTL_FORCE_DELETE_DISK:
-	case FSACTL_GET_CONTAINERS:
-	case FSACTL_SEND_LARGE_FIB:
-		ret = aac_do_ioctl(dev, cmd, (void __user *)arg);
-		break;
-
-	case FSACTL_GET_NEXT_ADAPTER_FIB: {
-		struct fib_ioctl __user *f;
-
-		f = compat_alloc_user_space(sizeof(*f));
-		ret = 0;
-		if (clear_user(f, sizeof(*f)))
-			ret = -EFAULT;
-		if (copy_in_user(f, (void __user *)arg, sizeof(struct fib_ioctl) - sizeof(u32)))
-			ret = -EFAULT;
-		if (!ret)
-			ret = aac_do_ioctl(dev, cmd, f);
-		break;
-	}
-
-	default:
-		ret = -ENOIOCTLCMD;
-		break;
-	}
-	return ret;
-}
-
-static int aac_compat_ioctl(struct scsi_device *sdev, unsigned int cmd,
-			    void __user *arg)
-{
-	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
-	if (!capable(CAP_SYS_RAWIO))
-		return -EPERM;
-	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
-}
-
-static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg)
-{
-	if (!capable(CAP_SYS_RAWIO))
-		return -EPERM;
-	return aac_compat_do_ioctl(file->private_data, cmd, arg);
-}
-#endif
-
 static ssize_t aac_show_model(struct device *device,
 			      struct device_attribute *attr, char *buf)
 {
@@ -1523,7 +1466,7 @@ static const struct file_operations aac_cfg_fops = {
 	.owner		= THIS_MODULE,
 	.unlocked_ioctl	= aac_cfg_ioctl,
 #ifdef CONFIG_COMPAT
-	.compat_ioctl   = aac_compat_cfg_ioctl,
+	.compat_ioctl   = aac_cfg_ioctl,
 #endif
 	.open		= aac_cfg_open,
 	.llseek		= noop_llseek,
@@ -1536,7 +1479,7 @@ static struct scsi_host_template aac_driver_template = {
 	.info				= aac_info,
 	.ioctl				= aac_ioctl,
 #ifdef CONFIG_COMPAT
-	.compat_ioctl			= aac_compat_ioctl,
+	.compat_ioctl			= aac_ioctl,
 #endif
 	.queuecommand			= aac_queuecommand,
 	.bios_param			= aac_biosparm,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 052/717] pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 051/717] scsi: aacraid: Improve compat_ioctl handlers Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 053/717] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
                   ` (666 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, He Zhe, Andy Shevchenko,
	Linus Walleij, Sasha Levin

From: He Zhe <zhe.he@windriver.com>

[ Upstream commit b507cb92477ad85902783a183c5ce01d16296687 ]

To fix the following build warnings when CONFIG_GPIOLIB=n.

drivers/pinctrl/core.c:1607:20: warning: unused variable 'chip' [-Wunused-variable]
 1608 |  struct gpio_chip *chip;
      |                    ^~~~
drivers/pinctrl/core.c:1606:15: warning: unused variable 'gpio_num' [-Wunused-variable]
 1607 |  unsigned int gpio_num;
      |               ^~~~~~~~
drivers/pinctrl/core.c:1605:29: warning: unused variable 'range' [-Wunused-variable]
 1606 |  struct pinctrl_gpio_range *range;
      |                             ^~~~~

Fixes: f1b206cf7c57 ("pinctrl: core: print gpio in pins debugfs file")
Signed-off-by: He Zhe <zhe.he@windriver.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20201028103921.22486-1-zhe.he@windriver.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 3663d87f51a01..9fc4433fece4f 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1602,9 +1602,11 @@ static int pinctrl_pins_show(struct seq_file *s, void *what)
 	struct pinctrl_dev *pctldev = s->private;
 	const struct pinctrl_ops *ops = pctldev->desc->pctlops;
 	unsigned i, pin;
+#ifdef CONFIG_GPIOLIB
 	struct pinctrl_gpio_range *range;
 	unsigned int gpio_num;
 	struct gpio_chip *chip;
+#endif
 
 	seq_printf(s, "registered pins: %d\n", pctldev->desc->npins);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 053/717] ASoC: pcm: DRAIN support reactivation
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 052/717] pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 054/717] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe Greg Kroah-Hartman
                   ` (665 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Ranjani Sridharan,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]

soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
v5.4 where explicit switch(cmd) has been introduced which takes into
account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
switch statement to reactive support for it.

As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
behaviour of dpcm_fe_dai_do_trigger() for said command back to its
pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.

Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index dcab9527ba3d7..91bf339581590 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2231,6 +2231,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
@@ -2248,6 +2249,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 054/717] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 053/717] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 055/717] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
                   ` (664 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Laurent Pinchart,
	Sam Ravnborg, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit c2530cc9610d84a5a0118ba40d0f09309605047f ]

gpiod_to_irq() return negative value in case of error,
the existing code doesn't handle negative error codes.
If the HPD gpio supports IRQs (gpiod_to_irq returns a
valid number), we use the IRQ. If it doesn't (gpiod_to_irq
returns an error), it gets polled via detect().

Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20201102143024.26216-1-yuehaibing@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-tpd12s015.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c
index 514cbf0eac75a..e0e015243a602 100644
--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c
+++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c
@@ -160,7 +160,7 @@ static int tpd12s015_probe(struct platform_device *pdev)
 
 	/* Register the IRQ if the HPD GPIO is IRQ-capable. */
 	tpd->hpd_irq = gpiod_to_irq(tpd->hpd_gpio);
-	if (tpd->hpd_irq) {
+	if (tpd->hpd_irq >= 0) {
 		ret = devm_request_threaded_irq(&pdev->dev, tpd->hpd_irq, NULL,
 						tpd12s015_hpd_isr,
 						IRQF_TRIGGER_RISING |
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 055/717] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 054/717] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 056/717] crypto: arm64/poly1305-neon - reorder PAC authentication with SP update Greg Kroah-Hartman
                   ` (663 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]

Make data section layout checks stricter, disallowing overlap of types and
strings data.

Additionally, allow BTFs with no type data. There is nothing inherently wrong
with having BTF with no types (put potentially with some strings). This could
be a situation with kernel module BTFs, if module doesn't introduce any new
type information.

Also fix invalid offset alignment check for btf->hdr->type_off.

Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 231b07203e3d2..987c1515b828b 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -215,22 +215,18 @@ static int btf_parse_hdr(struct btf *btf)
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->type_off) {
-		pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
+	if (meta_left < hdr->str_off + hdr->str_len) {
+		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->str_off) {
-		pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off);
+	if (hdr->type_off + hdr->type_len > hdr->str_off) {
+		pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
+			 hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
 		return -EINVAL;
 	}
 
-	if (hdr->type_off >= hdr->str_off) {
-		pr_debug("BTF type section offset >= string section offset. No type?\n");
-		return -EINVAL;
-	}
-
-	if (hdr->type_off & 0x02) {
+	if (hdr->type_off % 4) {
 		pr_debug("BTF type section is not aligned to 4 bytes\n");
 		return -EINVAL;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 056/717] crypto: arm64/poly1305-neon - reorder PAC authentication with SP update
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 055/717] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 057/717] crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback Greg Kroah-Hartman
                   ` (662 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 519a0d7e495a6d3ce62594e485aea2a3a4a2ca0a ]

PAC pointer authentication signs the return address against the value
of the stack pointer, to prevent stack overrun exploits from corrupting
the control flow. However, this requires that the AUTIASP is issued with
SP holding the same value as it held when the PAC value was generated.
The Poly1305 NEON code got this wrong, resulting in crashes on PAC
capable hardware.

Fixes: f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
 arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/crypto/poly1305-armv8.pl b/arch/arm64/crypto/poly1305-armv8.pl
index 6e5576d19af8f..cbc980fb02e33 100644
--- a/arch/arm64/crypto/poly1305-armv8.pl
+++ b/arch/arm64/crypto/poly1305-armv8.pl
@@ -840,7 +840,6 @@ poly1305_blocks_neon:
 	 ldp	d14,d15,[sp,#64]
 	addp	$ACC2,$ACC2,$ACC2
 	 ldr	x30,[sp,#8]
-	 .inst	0xd50323bf		// autiasp
 
 	////////////////////////////////////////////////////////////////
 	// lazy reduction, but without narrowing
@@ -882,6 +881,7 @@ poly1305_blocks_neon:
 	str	x4,[$ctx,#8]		// set is_base2_26
 
 	ldr	x29,[sp],#80
+	 .inst	0xd50323bf		// autiasp
 	ret
 .size	poly1305_blocks_neon,.-poly1305_blocks_neon
 
diff --git a/arch/arm64/crypto/poly1305-core.S_shipped b/arch/arm64/crypto/poly1305-core.S_shipped
index 8d1c4e420ccdc..fb2822abf63aa 100644
--- a/arch/arm64/crypto/poly1305-core.S_shipped
+++ b/arch/arm64/crypto/poly1305-core.S_shipped
@@ -779,7 +779,6 @@ poly1305_blocks_neon:
 	 ldp	d14,d15,[sp,#64]
 	addp	v21.2d,v21.2d,v21.2d
 	 ldr	x30,[sp,#8]
-	 .inst	0xd50323bf		// autiasp
 
 	////////////////////////////////////////////////////////////////
 	// lazy reduction, but without narrowing
@@ -821,6 +820,7 @@ poly1305_blocks_neon:
 	str	x4,[x0,#8]		// set is_base2_26
 
 	ldr	x29,[sp],#80
+	 .inst	0xd50323bf		// autiasp
 	ret
 .size	poly1305_blocks_neon,.-poly1305_blocks_neon
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 057/717] crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 056/717] crypto: arm64/poly1305-neon - reorder PAC authentication with SP update Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 058/717] crypto: caam - fix printing on xts fallback allocation error path Greg Kroah-Hartman
                   ` (661 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Horia Geantă, Herbert Xu, Sasha Levin

From: Horia Geantă <horia.geanta@nxp.com>

[ Upstream commit a2715fbdc6fc387e85211df917a4778761ec693d ]

Loading the module deadlocks since:
-local cbc(aes) implementation needs a fallback and
-crypto API tries to find one but the request_module() resolves back to
the same module

Fix this by changing the module alias for cbc(aes) and
using the NEED_FALLBACK flag when requesting for a fallback algorithm.

Fixes: 00b99ad2bac2 ("crypto: arm/aes-neonbs - Use generic cbc encryption path")
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/crypto/aes-neonbs-glue.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c
index bda8bf17631e1..f70af1d0514b9 100644
--- a/arch/arm/crypto/aes-neonbs-glue.c
+++ b/arch/arm/crypto/aes-neonbs-glue.c
@@ -19,7 +19,7 @@ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
 MODULE_LICENSE("GPL v2");
 
 MODULE_ALIAS_CRYPTO("ecb(aes)");
-MODULE_ALIAS_CRYPTO("cbc(aes)");
+MODULE_ALIAS_CRYPTO("cbc(aes)-all");
 MODULE_ALIAS_CRYPTO("ctr(aes)");
 MODULE_ALIAS_CRYPTO("xts(aes)");
 
@@ -191,7 +191,8 @@ static int cbc_init(struct crypto_skcipher *tfm)
 	struct aesbs_cbc_ctx *ctx = crypto_skcipher_ctx(tfm);
 	unsigned int reqsize;
 
-	ctx->enc_tfm = crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	ctx->enc_tfm = crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC |
+					     CRYPTO_ALG_NEED_FALLBACK);
 	if (IS_ERR(ctx->enc_tfm))
 		return PTR_ERR(ctx->enc_tfm);
 
@@ -441,7 +442,8 @@ static struct skcipher_alg aes_algs[] = { {
 	.base.cra_blocksize	= AES_BLOCK_SIZE,
 	.base.cra_ctxsize	= sizeof(struct aesbs_cbc_ctx),
 	.base.cra_module	= THIS_MODULE,
-	.base.cra_flags		= CRYPTO_ALG_INTERNAL,
+	.base.cra_flags		= CRYPTO_ALG_INTERNAL |
+				  CRYPTO_ALG_NEED_FALLBACK,
 
 	.min_keysize		= AES_MIN_KEY_SIZE,
 	.max_keysize		= AES_MAX_KEY_SIZE,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 058/717] crypto: caam - fix printing on xts fallback allocation error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 057/717] crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 059/717] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
                   ` (660 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Horia Geantă,
	Iuliana Prodan, Herbert Xu, Sasha Levin

From: Horia Geantă <horia.geanta@nxp.com>

[ Upstream commit ab95bd2aa904e4f53b7358efeea1d57693fb7889 ]

At the time xts fallback tfm allocation fails the device struct
hasn't been enabled yet in the caam xts tfm's private context.

Fix this by using the device struct from xts algorithm's private context
or, when not available, by replacing dev_err with pr_err.

Fixes: 9d9b14dbe077 ("crypto: caam/jr - add fallback for XTS with more than 8B IV")
Fixes: 83e8aa912138 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
Fixes: 36e2d7cfdcf1 ("crypto: caam/qi2 - add fallback for XTS with more than 8B IV")
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caamalg.c     | 4 ++--
 drivers/crypto/caam/caamalg_qi.c  | 4 ++--
 drivers/crypto/caam/caamalg_qi2.c | 3 ++-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index cf5bd7666dfcd..8697ae53b0633 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -3404,8 +3404,8 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
 		fallback = crypto_alloc_skcipher(tfm_name, 0,
 						 CRYPTO_ALG_NEED_FALLBACK);
 		if (IS_ERR(fallback)) {
-			dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
-				tfm_name, PTR_ERR(fallback));
+			pr_err("Failed to allocate %s fallback: %ld\n",
+			       tfm_name, PTR_ERR(fallback));
 			return PTR_ERR(fallback);
 		}
 
diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
index 66f60d78bdc84..a24ae966df4a3 100644
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -2502,8 +2502,8 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
 		fallback = crypto_alloc_skcipher(tfm_name, 0,
 						 CRYPTO_ALG_NEED_FALLBACK);
 		if (IS_ERR(fallback)) {
-			dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
-				tfm_name, PTR_ERR(fallback));
+			pr_err("Failed to allocate %s fallback: %ld\n",
+			       tfm_name, PTR_ERR(fallback));
 			return PTR_ERR(fallback);
 		}
 
diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 98c1ff1744bb1..a780e627838ae 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -1611,7 +1611,8 @@ static int caam_cra_init_skcipher(struct crypto_skcipher *tfm)
 		fallback = crypto_alloc_skcipher(tfm_name, 0,
 						 CRYPTO_ALG_NEED_FALLBACK);
 		if (IS_ERR(fallback)) {
-			dev_err(ctx->dev, "Failed to allocate %s fallback: %ld\n",
+			dev_err(caam_alg->caam.dev,
+				"Failed to allocate %s fallback: %ld\n",
 				tfm_name, PTR_ERR(fallback));
 			return PTR_ERR(fallback);
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 059/717] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 058/717] crypto: caam - fix printing on xts fallback allocation error path Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 060/717] nl80211/cfg80211: fix potential infinite loop Greg Kroah-Hartman
                   ` (659 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Ondrej Mosnacek,
	Paul Moore, Sasha Levin

From: Paul Moore <paul@paul-moore.com>

[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]

A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded.  Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem.  The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.

This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.

Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 158fc47d8620d..c46312710e73e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1451,13 +1451,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			isec->initialized = LABEL_INVALID;
-			/*
-			 * There is nothing useful to jump to the "out"
-			 * label, except a needless spin lock/unlock
-			 * cycle.
-			 */
-			return 0;
+			goto out_invalid;
 		}
 
 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1513,15 +1507,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry) {
-				isec->initialized = LABEL_INVALID;
-				/*
-				 * There is nothing useful to jump to the "out"
-				 * label, except a needless spin lock/unlock
-				 * cycle.
-				 */
-				return 0;
-			}
+			if (!dentry)
+				goto out_invalid;
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			if (rc) {
@@ -1546,11 +1533,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 out:
 	spin_lock(&isec->lock);
 	if (isec->initialized == LABEL_PENDING) {
-		if (!sid || rc) {
+		if (rc) {
 			isec->initialized = LABEL_INVALID;
 			goto out_unlock;
 		}
-
 		isec->initialized = LABEL_INITIALIZED;
 		isec->sid = sid;
 	}
@@ -1558,6 +1544,15 @@ out:
 out_unlock:
 	spin_unlock(&isec->lock);
 	return rc;
+
+out_invalid:
+	spin_lock(&isec->lock);
+	if (isec->initialized == LABEL_PENDING) {
+		isec->initialized = LABEL_INVALID;
+		isec->sid = sid;
+	}
+	spin_unlock(&isec->lock);
+	return 0;
 }
 
 /* Convert a Linux signal to an access vector. */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 060/717] nl80211/cfg80211: fix potential infinite loop
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 059/717] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:40 ` [PATCH 5.10 061/717] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
                   ` (658 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Johannes Berg, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit ba5c25236bc3d399df82ebe923490ea8d2d35cf2 ]

The for-loop iterates with a u8 loop counter and compares this
with the loop upper limit of request->n_ssids which is an int type.
There is a potential infinite loop if n_ssids is larger than the
u8 loop counter, so fix this by making the loop counter an int.

Addresses-Coverity: ("Infinite loop")
Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201029222407.390218-1-colin.king@canonical.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 8d0e49c46db37..3409f37d838b3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -694,7 +694,7 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
 				     struct cfg80211_scan_request *request)
 {
-	u8 i;
+	int i;
 	u32 s_ssid;
 
 	for (i = 0; i < request->n_ssids; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 061/717] spi: stm32: fix reference leak in stm32_spi_resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 060/717] nl80211/cfg80211: fix potential infinite loop Greg Kroah-Hartman
@ 2020-12-28 12:40 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 062/717] bpf: Fix tests for local_storage Greg Kroah-Hartman
                   ` (657 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:40 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Alain Volmat,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 900ccdcb79bb61471df1566a70b2b39687a628d5 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in stm32_spi_resume, so we should fix it.

Fixes: db96bf976a4fc ("spi: stm32: fixes suspend/resume management")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Alain Volmat <alain.volmat@st.com>
Link: https://lore.kernel.org/r/20201106015217.140476-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-stm32.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 2cc850eb8922d..471dedf3d3392 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -2062,6 +2062,7 @@ static int stm32_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "Unable to power device:%d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 062/717] bpf: Fix tests for local_storage
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-12-28 12:40 ` [PATCH 5.10 061/717] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 063/717] x86/mce: Correct the detection of invalid notifier priorities Greg Kroah-Hartman
                   ` (656 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, KP Singh, Alexei Starovoitov,
	Song Liu, Sasha Levin

From: KP Singh <kpsingh@google.com>

[ Upstream commit f0e5ba0bc481df77cf0afac2b33e420b33eeb463 ]

The {inode,sk}_storage_result checking if the correct value was retrieved
was being clobbered unconditionally by the return value of the
bpf_{inode,sk}_storage_delete call.

Also, consistently use the newly added BPF_LOCAL_STORAGE_GET_F_CREATE
flag.

Fixes: cd324d7abb3d ("bpf: Add selftests for local_storage")
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20201106103747.2780972-7-kpsingh@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/progs/local_storage.c       | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
index 0758ba229ae0e..09529e33be982 100644
--- a/tools/testing/selftests/bpf/progs/local_storage.c
+++ b/tools/testing/selftests/bpf/progs/local_storage.c
@@ -58,20 +58,22 @@ int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
 {
 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
 	struct dummy_storage *storage;
+	int err;
 
 	if (pid != monitored_pid)
 		return 0;
 
 	storage = bpf_inode_storage_get(&inode_storage_map, victim->d_inode, 0,
-				     BPF_SK_STORAGE_GET_F_CREATE);
+					BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
-	if (storage->value == DUMMY_STORAGE_VALUE)
+	if (storage->value != DUMMY_STORAGE_VALUE)
 		inode_storage_result = -1;
 
-	inode_storage_result =
-		bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
+	err = bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
+	if (!err)
+		inode_storage_result = err;
 
 	return 0;
 }
@@ -82,19 +84,23 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address,
 {
 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
 	struct dummy_storage *storage;
+	int err;
 
 	if (pid != monitored_pid)
 		return 0;
 
 	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
-				     BPF_SK_STORAGE_GET_F_CREATE);
+				     BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
-	if (storage->value == DUMMY_STORAGE_VALUE)
+	if (storage->value != DUMMY_STORAGE_VALUE)
 		sk_storage_result = -1;
 
-	sk_storage_result = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
+	err = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
+	if (!err)
+		sk_storage_result = err;
+
 	return 0;
 }
 
@@ -109,7 +115,7 @@ int BPF_PROG(socket_post_create, struct socket *sock, int family, int type,
 		return 0;
 
 	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
-				     BPF_SK_STORAGE_GET_F_CREATE);
+				     BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
@@ -131,7 +137,7 @@ int BPF_PROG(file_open, struct file *file)
 		return 0;
 
 	storage = bpf_inode_storage_get(&inode_storage_map, file->f_inode, 0,
-				     BPF_LOCAL_STORAGE_GET_F_CREATE);
+					BPF_LOCAL_STORAGE_GET_F_CREATE);
 	if (!storage)
 		return 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 063/717] x86/mce: Correct the detection of invalid notifier priorities
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 062/717] bpf: Fix tests for local_storage Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes() Greg Kroah-Hartman
                   ` (655 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhen Lei, Borislav Petkov, Sasha Levin

From: Zhen Lei <thunder.leizhen@huawei.com>

[ Upstream commit 15af36596ae305aefc8c502c2d3e8c58221709eb ]

Commit

  c9c6d216ed28 ("x86/mce: Rename "first" function as "early"")

changed the enumeration of MCE notifier priorities. Correct the check
for notifier priorities to cover the new range.

 [ bp: Rewrite commit message, remove superfluous brackets in
   conditional. ]

Fixes: c9c6d216ed28 ("x86/mce: Rename "first" function as "early"")
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201106141216.2062-2-thunder.leizhen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/mce.h     | 3 ++-
 arch/x86/kernel/cpu/mce/core.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index a0f147893a041..fc25c88c7ff29 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -177,7 +177,8 @@ enum mce_notifier_prios {
 	MCE_PRIO_EXTLOG,
 	MCE_PRIO_UC,
 	MCE_PRIO_EARLY,
-	MCE_PRIO_CEC
+	MCE_PRIO_CEC,
+	MCE_PRIO_HIGHEST = MCE_PRIO_CEC
 };
 
 struct notifier_block;
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 32b7099e35111..311688202ea51 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -162,7 +162,8 @@ EXPORT_SYMBOL_GPL(mce_log);
 
 void mce_register_decode_chain(struct notifier_block *nb)
 {
-	if (WARN_ON(nb->priority > MCE_PRIO_MCELOG && nb->priority < MCE_PRIO_EDAC))
+	if (WARN_ON(nb->priority < MCE_PRIO_LOWEST ||
+		    nb->priority > MCE_PRIO_HIGHEST))
 		return;
 
 	blocking_notifier_chain_register(&x86_mce_decoder_chain, nb);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 063/717] x86/mce: Correct the detection of invalid notifier priorities Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 14:09   ` Ilia Mirkin
  2020-12-28 12:41 ` [PATCH 5.10 065/717] ath11k: Initialize complete alpha2 for regulatory change Greg Kroah-Hartman
                   ` (654 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lyude Paul, Ilia Mirkin, Sasha Levin

From: Lyude Paul <lyude@redhat.com>

[ Upstream commit 991fcb77f490390bcad89fa67d95763c58cdc04c ]

Noticed this when trying to compile with -Wall on a kernel fork. We
potentially don't set width here, which causes the compiler to complain
about width potentially being uninitialized in drm_cvt_modes(). So, let's
fix that.

Changes since v1:
* Don't emit an error as this code isn't reachable, just mark it as such
Changes since v2:
* Remove now unused variable

Fixes: 3f649ab728cd ("treewide: Remove uninitialized_var() usage")
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105235703.1328115-1-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_edid.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 631125b46e04c..b84efd538a702 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -3114,6 +3114,8 @@ static int drm_cvt_modes(struct drm_connector *connector,
 		case 0x0c:
 			width = height * 15 / 9;
 			break;
+		default:
+			unreachable();
 		}
 
 		for (j = 1; j < 5; j++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 065/717] ath11k: Initialize complete alpha2 for regulatory change
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 066/717] ath11k: Fix number of rules in filtered ETSI regdomain Greg Kroah-Hartman
                   ` (653 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 383a32cde4172db19d4743d4c782c00af39ff275 ]

The function ath11k_wmi_send_init_country_cmd is taking 3 byte from alpha2
of the structure wmi_init_country_params. But the function
ath11k_reg_notifier is only initializing 2 bytes. The third byte is
therefore always an uninitialized value.

The command can happen to look like

  0c 00 87 02 01 00 00 00 00 00 00 00 43 41 f8 00

instead of

  0c 00 87 02 01 00 00 00 00 00 00 00 43 41 00 00

Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01161-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2
Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00019-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201021140555.4114715-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/reg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index f6a1f0352989d..83f75f8855ebe 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -80,6 +80,7 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
 	 */
 	init_country_param.flags = ALPHA_IS_SET;
 	memcpy(&init_country_param.cc_info.alpha2, request->alpha2, 2);
+	init_country_param.cc_info.alpha2[2] = 0;
 
 	ret = ath11k_wmi_send_init_country_cmd(ar, init_country_param);
 	if (ret)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 066/717] ath11k: Fix number of rules in filtered ETSI regdomain
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 065/717] ath11k: Initialize complete alpha2 for regulatory change Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 067/717] ath11k: fix wmi init configuration Greg Kroah-Hartman
                   ` (652 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 6189be7d145c3a2d48514eb8755483602ff5a4b4 ]

The ath11k code will try to insert wheather rader related limits when the
DFS region is set to ETSI. For this reason, it will add two more entries in
the array of reg_rules. But the 2.4.0.1 firmware is prefiltering the list
of reg rules it returns for 2.4GHz PHYs. They will then not contain the
list of 5GHz rules and thus no wheather radar band rules were inserted by
this code.

But the code didn't fix the n_reg_rules for this regulatory domain and PHY
when this happened. This resulted in a rejection by is_valid_rd because it
found rules which start and end at 0khz. This resulted in a splat like:

  Invalid regulatory domain detected
  ------------[ cut here ]------------
  WARNING: at backports-20200628-4.4.60-9a94b73e75/net/wireless/reg.c:3721
  [...]
  ath11k c000000.wifi1: failed to perform regd update : -22

The number of rules must therefore be saved after they were converted from
the ath11k format to the ieee80211_regdomain format and not before.

Tested with IPQ8074 WLAN.HK.2.4.0.1.r1-00019-QCAHKSWPL_SILICONZ-1

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201030101940.2387952-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/reg.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index 83f75f8855ebe..678d0885fcee7 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -585,7 +585,6 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
 	if (!tmp_regd)
 		goto ret;
 
-	tmp_regd->n_reg_rules = num_rules;
 	memcpy(tmp_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
 	memcpy(alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
 	alpha2[2] = '\0';
@@ -598,7 +597,7 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
 	/* Update reg_rules[] below. Firmware is expected to
 	 * send these rules in order(2G rules first and then 5G)
 	 */
-	for (; i < tmp_regd->n_reg_rules; i++) {
+	for (; i < num_rules; i++) {
 		if (reg_info->num_2g_reg_rules &&
 		    (i < reg_info->num_2g_reg_rules)) {
 			reg_rule = reg_info->reg_rules_2g_ptr + i;
@@ -653,6 +652,8 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
 			   flags);
 	}
 
+	tmp_regd->n_reg_rules = i;
+
 	if (intersect) {
 		default_regd = ab->default_regd[reg_info->phy_id];
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 067/717] ath11k: fix wmi init configuration
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 066/717] ath11k: Fix number of rules in filtered ETSI regdomain Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 068/717] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
                   ` (651 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Karthikeyan Periyasamy, Kalle Valo,
	Sasha Levin

From: Karthikeyan Periyasamy <periyasa@codeaurora.org>

[ Upstream commit 36c7c640ffeb87168e5ff79b7a36ae3a020bd378 ]

Assign the correct hw_op ath11k_init_wmi_config_ipq8074 to
the hw IPQ8074. Also update the correct TWT radio count.
Incorrect TWT radio count cause TWT feature fails on radio2
because physical device count is hardcoded to 2. so set
the value dynamically.

Found this during code review.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2

Fixes: 2d4bcbed5b7d53e1 ("ath11k: initialize wmi config based on hw_params")
Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1604512020-25197-1-git-send-email-periyasa@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/hw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c
index 11a411b76fe42..66331da350129 100644
--- a/drivers/net/wireless/ath/ath11k/hw.c
+++ b/drivers/net/wireless/ath/ath11k/hw.c
@@ -127,7 +127,7 @@ static void ath11k_init_wmi_config_ipq8074(struct ath11k_base *ab,
 	config->beacon_tx_offload_max_vdev = ab->num_radios * TARGET_MAX_BCN_OFFLD;
 	config->rx_batchmode = TARGET_RX_BATCHMODE;
 	config->peer_map_unmap_v2_support = 1;
-	config->twt_ap_pdev_count = 2;
+	config->twt_ap_pdev_count = ab->num_radios;
 	config->twt_ap_sta_count = 1000;
 }
 
@@ -157,7 +157,7 @@ static int ath11k_hw_mac_id_to_srng_id_qca6390(struct ath11k_hw_params *hw,
 
 const struct ath11k_hw_ops ipq8074_ops = {
 	.get_hw_mac_from_pdev_id = ath11k_hw_ipq8074_mac_from_pdev_id,
-	.wmi_init_config = ath11k_init_wmi_config_qca6390,
+	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
 	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
 	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 068/717] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 067/717] ath11k: fix wmi init configuration Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 069/717] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
                   ` (650 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jaehoon Chung, Seung-Woo Kim,
	Arend van Spriel, Kalle Valo, Sasha Levin

From: Seung-Woo Kim <sw0312.kim@samsung.com>

[ Upstream commit 9db946284e07bb27309dd546b7fee528664ba82a ]

There are missig brcmf_free() for brcmf_alloc(). Fix memory leak
by adding missed brcmf_free().

Reported-by: Jaehoon Chung <jh80.chung@samsung.com>
Fixes: a1f5aac1765a ("brcmfmac: don't realloc wiphy during PCIe reset")
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1603849967-22817-1-git-send-email-sw0312.kim@samsung.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++--
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 39381cbde89e6..d8db0dbcfe091 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1936,16 +1936,18 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
 	if (!fwreq) {
 		ret = -ENOMEM;
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 
 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
 	if (ret < 0) {
 		kfree(fwreq);
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 	return 0;
 
+fail_brcmf:
+	brcmf_free(&devinfo->pdev->dev);
 fail_bus:
 	kfree(bus->msgbuf);
 	kfree(bus);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 99987a789e7e3..59c2b2b6027da 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4541,6 +4541,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
 		brcmf_sdiod_intr_unregister(bus->sdiodev);
 
 		brcmf_detach(bus->sdiodev->dev);
+		brcmf_free(bus->sdiodev->dev);
 
 		cancel_work_sync(&bus->datawork);
 		if (bus->brcmf_wq)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 069/717] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 068/717] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 070/717] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
                   ` (649 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ]

Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos
SoCs, so instead of duplicating code we can just include common dtsi
file, which already contains definitions of them. After this change,
poweroff node will be also available, previously this dts file did
contain only reboot node.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index b9ed6a33e2901..545e67901938a 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -481,13 +481,6 @@
 		pmu_system_controller: system-controller@105c0000 {
 			compatible = "samsung,exynos7-pmu", "syscon";
 			reg = <0x105c0000 0x5000>;
-
-			reboot: syscon-reboot {
-				compatible = "syscon-reboot";
-				regmap = <&pmu_system_controller>;
-				offset = <0x0400>;
-				mask = <0x1>;
-			};
 		};
 
 		rtc: rtc@10590000 {
@@ -687,3 +680,4 @@
 };
 
 #include "exynos7-pinctrl.dtsi"
+#include "arm/exynos-syscon-restart.dtsi"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 070/717] arm64: dts: exynos: Correct psci compatible used on Exynos7
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 069/717] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 071/717] drm/panel: simple: Add flags to boe_nv133fhm_n61 Greg Kroah-Hartman
                   ` (648 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]

It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
we need to use syscon reboot/poweroff drivers, like it's done for other
Exynos SoCs. This was confirmed by checking vendor source and testing it
on Samsung Galaxy S6 device based on this SoC.

To be able to use custom restart/poweroff handlers instead of PSCI
functions, we need to correct psci compatible. This also requires us to
provide function ids for CPU_ON and CPU_OFF.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 545e67901938a..7599e1a00ff51 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -79,8 +79,10 @@
 	};
 
 	psci {
-		compatible = "arm,psci-0.2";
+		compatible = "arm,psci";
 		method = "smc";
+		cpu_off = <0x84000002>;
+		cpu_on = <0xC4000003>;
 	};
 
 	soc: soc@0 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 071/717] drm/panel: simple: Add flags to boe_nv133fhm_n61
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 070/717] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 072/717] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
                   ` (647 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Bjorn Andersson,
	Stephen Boyd, Sam Ravnborg, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit ab6fd5d44aa21ede9e566f89132f7bdda7f33093 ]

Reading the EDID of this panel shows that these flags should be set. Set
them so that we match what is in the EDID.

Cc: Douglas Anderson <dianders@chromium.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Fixes: b0c664cc80e8 ("panel: simple: Add BOE NV133FHM-N61")
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20201106182333.3080124-1-swboyd@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 2be358fb46f7d..204674fccd646 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -1327,6 +1327,7 @@ static const struct drm_display_mode boe_nv133fhm_n61_modes = {
 	.vsync_start = 1080 + 3,
 	.vsync_end = 1080 + 3 + 6,
 	.vtotal = 1080 + 3 + 6 + 31,
+	.flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC,
 };
 
 /* Also used for boe_nv133fhm_n62 */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 072/717] Bluetooth: Fix null pointer dereference in hci_event_packet()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 071/717] drm/panel: simple: Add flags to boe_nv133fhm_n61 Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 073/717] Bluetooth: Fix: LL PRivacy BLE device fails to connect Greg Kroah-Hartman
                   ` (646 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anmol Karn, Marcel Holtmann,
	Sasha Levin, syzbot+0bef568258653cff272f

From: Anmol Karn <anmol.karan123@gmail.com>

[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index cbdf2a5559754..17a72695865b5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4941,6 +4941,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		return;
 	}
 
+	if (!hcon->amp_mgr) {
+		hci_dev_unlock(hdev);
+		return;
+	}
+
 	if (ev->status) {
 		hci_conn_del(hcon);
 		hci_dev_unlock(hdev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 073/717] Bluetooth: Fix: LL PRivacy BLE device fails to connect
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 072/717] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 074/717] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
                   ` (645 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sathish Narasimman, Marcel Holtmann,
	Sasha Levin

From: Sathish Narasimman <nsathish41@gmail.com>

[ Upstream commit 1fb17dfc258ff6208f7873cc7b8e40e27515d2d5 ]

When adding device to white list the device is added to resolving list
also. It has to be added only when HCI_ENABLE_LL_PRIVACY flag is set.
HCI_ENABLE_LL_PRIVACY flag has to be tested before adding/deleting devices
to resolving list. use_ll_privacy macro is used only to check if controller
supports LL_Privacy.

https://bugzilla.kernel.org/show_bug.cgi?id=209745

Fixes: 0eee35bdfa3b ("Bluetooth: Update resolving list when updating whitelist")
Signed-off-by: Sathish Narasimman <sathish.narasimman@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_request.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 6f12bab4d2fa6..610ed0817bd77 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -698,7 +698,8 @@ static void del_from_white_list(struct hci_request *req, bdaddr_t *bdaddr,
 		   cp.bdaddr_type);
 	hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(cp), &cp);
 
-	if (use_ll_privacy(req->hdev)) {
+	if (use_ll_privacy(req->hdev) &&
+	    hci_dev_test_flag(req->hdev, HCI_ENABLE_LL_PRIVACY)) {
 		struct smp_irk *irk;
 
 		irk = hci_find_irk_by_addr(req->hdev, bdaddr, bdaddr_type);
@@ -732,7 +733,8 @@ static int add_to_white_list(struct hci_request *req,
 		return -1;
 
 	/* White list can not be used with RPAs */
-	if (!allow_rpa && !use_ll_privacy(hdev) &&
+	if (!allow_rpa &&
+	    !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
 	    hci_find_irk_by_addr(hdev, &params->addr, params->addr_type)) {
 		return -1;
 	}
@@ -750,7 +752,8 @@ static int add_to_white_list(struct hci_request *req,
 		   cp.bdaddr_type);
 	hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
 
-	if (use_ll_privacy(hdev)) {
+	if (use_ll_privacy(hdev) &&
+	    hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) {
 		struct smp_irk *irk;
 
 		irk = hci_find_irk_by_addr(hdev, &params->addr,
@@ -812,7 +815,8 @@ static u8 update_white_list(struct hci_request *req)
 		}
 
 		/* White list can not be used with RPAs */
-		if (!allow_rpa && !use_ll_privacy(hdev) &&
+		if (!allow_rpa &&
+		    !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
 		    hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
 			return 0x00;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 074/717] Bluetooth: hci_h5: fix memory leak in h5_close
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 073/717] Bluetooth: Fix: LL PRivacy BLE device fails to connect Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 075/717] spi: stm32-qspi: fix reference leak in stm32 qspi operations Greg Kroah-Hartman
                   ` (644 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+6ce141c55b2f7aafd1c4,
	Anant Thazhemadam, Hans de Goede, Marcel Holtmann, Sasha Levin

From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ]

When h5_close() is called, h5 is directly freed when !hu->serdev.
However, h5->rx_skb is not freed, which causes a memory leak.

Freeing h5->rx_skb and setting it to NULL, fixes this memory leak.

Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_h5.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 981d96cc76959..78d635f1d1567 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -245,6 +245,9 @@ static int h5_close(struct hci_uart *hu)
 	skb_queue_purge(&h5->rel);
 	skb_queue_purge(&h5->unrel);
 
+	kfree_skb(h5->rx_skb);
+	h5->rx_skb = NULL;
+
 	if (h5->vnd && h5->vnd->close)
 		h5->vnd->close(h5);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 075/717] spi: stm32-qspi: fix reference leak in stm32 qspi operations
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 074/717] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 076/717] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
                   ` (643 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Patrice Chotard,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 88e1419b5ee30cc50e0c4d5265bdee1ba04af539 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(stm32_qspi_exec_op and
stm32_qspi_setup), so we should fix it.

Fixes: 9d282c17b023a ("spi: stm32-qspi: Add pm_runtime support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Patrice Chotard <patrice.chotard@st.com>
Link: https://lore.kernel.org/r/20201106015357.141235-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-stm32-qspi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
index a900962b4336e..947e6b9dc9f4d 100644
--- a/drivers/spi/spi-stm32-qspi.c
+++ b/drivers/spi/spi-stm32-qspi.c
@@ -434,8 +434,10 @@ static int stm32_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
 	int ret;
 
 	ret = pm_runtime_get_sync(qspi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		return ret;
+	}
 
 	mutex_lock(&qspi->lock);
 	ret = stm32_qspi_send(mem, op);
@@ -462,8 +464,10 @@ static int stm32_qspi_setup(struct spi_device *spi)
 		return -EINVAL;
 
 	ret = pm_runtime_get_sync(qspi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		return ret;
+	}
 
 	presc = DIV_ROUND_UP(qspi->clk_rate, spi->max_speed_hz) - 1;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 076/717] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 075/717] spi: stm32-qspi: fix reference leak in stm32 qspi operations Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 077/717] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
                   ` (642 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.

Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ti-qspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 3c41649698a5b..9417385c09217 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -174,6 +174,7 @@ static int ti_qspi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(qspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 077/717] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 076/717] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 078/717] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
                   ` (641 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Mark Brown, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 702b15cb97123cedcec56a39d9a21c5288eb9ae1 ]

Fix the missing clk_disable_unprepare() before return
from mt7621_spi_probe in the error handling case.

Fixes: cbd66c626e16 ("spi: mt7621: Move SPI driver out of staging")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074912.195576-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mt7621.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c
index 2c3b7a2a1ec77..2cdae7994e2aa 100644
--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -353,6 +353,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
 	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
 	if (!master) {
 		dev_info(&pdev->dev, "master allocation failed\n");
+		clk_disable_unprepare(clk);
 		return -ENOMEM;
 	}
 
@@ -377,6 +378,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
 	ret = device_reset(&pdev->dev);
 	if (ret) {
 		dev_err(&pdev->dev, "SPI reset failed!\n");
+		clk_disable_unprepare(clk);
 		return ret;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 078/717] spi: tegra20-slink: fix reference leak in slink ops of tegra20
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 077/717] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 079/717] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
                   ` (640 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.

Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-slink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index a0810765d4e52..f7c832fd40036 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -751,6 +751,7 @@ static int tegra_slink_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1188,6 +1189,7 @@ static int tegra_slink_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 079/717] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 078/717] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 080/717] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
                   ` (639 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.

Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-sflash.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index b59015c7c8a80..cfb7de7379376 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -552,6 +552,7 @@ static int tegra_sflash_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 080/717] spi: tegra114: fix reference leak in tegra spi ops
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 079/717] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 081/717] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
                   ` (638 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.

Fixes: f333a331adfac ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index ca6886aaa5197..a2e5907276e7f 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -966,6 +966,7 @@ static int tegra_spi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		if (cdata)
 			tegra_spi_cleanup(spi);
@@ -1474,6 +1475,7 @@ static int tegra_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 081/717] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 080/717] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 082/717] spi: imx: fix reference leak in two imx operations Greg Kroah-Hartman
                   ` (637 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Mark Brown, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]

Fix the missing clk_disable_unprepare() before return
from bcm63xx_hsspi_resume in the error handling case when
fails to prepare and enable bs->pll_clk.

Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx-hsspi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index 9909b18f3c5a5..1f08d7553f079 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -494,8 +494,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
 
 	if (bs->pll_clk) {
 		ret = clk_prepare_enable(bs->pll_clk);
-		if (ret)
+		if (ret) {
+			clk_disable_unprepare(bs->clk);
 			return ret;
+		}
 	}
 
 	spi_master_resume(master);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 082/717] spi: imx: fix reference leak in two imx operations
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 081/717] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 083/717] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of() Greg Kroah-Hartman
                   ` (636 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 1dcbdd944824369d4569959f8130336fe6fe5f39 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in callers(spi_imx_prepare_message and
spi_imx_remove), so we should fix it.

Fixes: 525c9e5a32bd7 ("spi: imx: enable runtime pm support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145835.4765-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-imx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 0b597905ee72c..8df5e973404f0 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -1538,6 +1538,7 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
 
 	ret = pm_runtime_get_sync(spi_imx->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(spi_imx->dev);
 		dev_err(spi_imx->dev, "failed to enable clock\n");
 		return ret;
 	}
@@ -1748,6 +1749,7 @@ static int spi_imx_remove(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(spi_imx->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(spi_imx->dev);
 		dev_err(spi_imx->dev, "failed to enable clock\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 083/717] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 082/717] spi: imx: fix reference leak in two imx operations Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 084/717] ath11k: Handle errors if peer creation fails Greg Kroah-Hartman
                   ` (635 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4e59dd249cd513a211e2ecce2cb31f4e29a5ce5b ]

There are two issues in this function.

1) We can't drop the refrences on "cpu", "codec" and "platform" before
   we take the reference.  This doesn't cause a problem on the first
   iteration because those pointers start as NULL so the of_node_put()
   is a no-op.  But on the subsequent iterations, it will lead to a use
   after free.

2) If the devm_kzalloc() allocation failed then the code returned
   directly instead of cleaning up.

Fixes: c1e6414cdc37 ("ASoC: qcom: common: Fix refcount imbalance on error")
Fixes: 1e36ea360ab9 ("ASoC: qcom: common: use modern dai_link style")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20201105125154.GA176426@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/common.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
index 54660f126d09e..09af007007007 100644
--- a/sound/soc/qcom/common.c
+++ b/sound/soc/qcom/common.c
@@ -58,7 +58,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
 		dlc = devm_kzalloc(dev, 2 * sizeof(*dlc), GFP_KERNEL);
 		if (!dlc) {
 			ret = -ENOMEM;
-			goto err;
+			goto err_put_np;
 		}
 
 		link->cpus	= &dlc[0];
@@ -70,7 +70,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
 		ret = of_property_read_string(np, "link-name", &link->name);
 		if (ret) {
 			dev_err(card->dev, "error getting codec dai_link name\n");
-			goto err;
+			goto err_put_np;
 		}
 
 		cpu = of_get_child_by_name(np, "cpu");
@@ -130,8 +130,10 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
 		} else {
 			/* DPCM frontend */
 			dlc = devm_kzalloc(dev, sizeof(*dlc), GFP_KERNEL);
-			if (!dlc)
-				return -ENOMEM;
+			if (!dlc) {
+				ret = -ENOMEM;
+				goto err;
+			}
 
 			link->codecs	 = dlc;
 			link->num_codecs = 1;
@@ -158,10 +160,11 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
 
 	return 0;
 err:
-	of_node_put(np);
 	of_node_put(cpu);
 	of_node_put(codec);
 	of_node_put(platform);
+err_put_np:
+	of_node_put(np);
 	return ret;
 }
 EXPORT_SYMBOL(qcom_snd_parse_of);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 084/717] ath11k: Handle errors if peer creation fails
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 083/717] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 085/717] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
                   ` (634 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Dewar, Kalle Valo, Sasha Levin

From: Alex Dewar <alex.dewar90@gmail.com>

[ Upstream commit c134d1f8c436d96b3f62896c630278e3ec001280 ]

ath11k_peer_create() is called without its return value being checked,
meaning errors will be unhandled. Add missing check and, as the mutex is
unconditionally unlocked on leaving this function, simplify the exit
path.

Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201004100218.311653-1-alex.dewar90@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 7f8dd47d23333..7a2c9708693ec 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5225,20 +5225,26 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
 	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
 		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
-		mutex_unlock(&ar->conf_mutex);
-		return 0;
+		ret = 0;
+		goto out;
 	}
 
 	if (WARN_ON(arvif->is_started)) {
-		mutex_unlock(&ar->conf_mutex);
-		return -EBUSY;
+		ret = -EBUSY;
+		goto out;
 	}
 
 	if (ab->hw_params.vdev_start_delay) {
 		param.vdev_id = arvif->vdev_id;
 		param.peer_type = WMI_PEER_TYPE_DEFAULT;
 		param.peer_addr = ar->mac_addr;
+
 		ret = ath11k_peer_create(ar, arvif, NULL, &param);
+		if (ret) {
+			ath11k_warn(ab, "failed to create peer after vdev start delay: %d",
+				    ret);
+			goto out;
+		}
 	}
 
 	ret = ath11k_mac_vdev_start(arvif, &ctx->def);
@@ -5246,23 +5252,21 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
 			    arvif->vdev_id, vif->addr,
 			    ctx->def.chan->center_freq, ret);
-		goto err;
+		goto out;
 	}
 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
 		if (ret)
-			goto err;
+			goto out;
 	}
 
 	arvif->is_started = true;
 
 	/* TODO: Setup ps and cts/rts protection */
 
-	mutex_unlock(&ar->conf_mutex);
-
-	return 0;
+	ret = 0;
 
-err:
+out:
 	mutex_unlock(&ar->conf_mutex);
 
 	return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 085/717] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 084/717] ath11k: Handle errors if peer creation fails Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 086/717] drm/msm/a6xx: Clear shadow on suspend Greg Kroah-Hartman
                   ` (633 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Kalle Valo, Sasha Levin

From: Tsuchiya Yuto <kitakar@gmail.com>

[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]

When a PCIe function level reset (FLR) is performed but without fw reset for
some reasons (e.g., on Microsoft Surface devices, fw reset requires other
quirks), it fails to reset wifi properly. You can trigger the issue on such
devices via debugfs entry for reset:

    $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset

and the resulting dmesg log:

    [   45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
    [   45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
    [   45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
    [   45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
    [   53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
    [   75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
    [   87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [  111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [  111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [...]

When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
lacks mwifiex_init_shutdown_fw().

This commit fixes mwifiex_shutdown_sw() by adding the missing
mwifiex_init_shutdown_fw().

Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index 9ba8a8f64976b..6283df5aaaf8b 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1471,6 +1471,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
 	priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
 	mwifiex_deauthenticate(priv, NULL);
 
+	mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
+
 	mwifiex_uninit_sw(adapter);
 	adapter->is_up = false;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 086/717] drm/msm/a6xx: Clear shadow on suspend
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 085/717] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 087/717] drm/msm/a5xx: " Greg Kroah-Hartman
                   ` (632 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rob Clark, Sasha Levin

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit e8b0b994c3a5881f0648d53f90435120089c56ad ]

Clear the shadow rptr on suspend.  Otherwise, when we resume, we can
have a stale value until CP_WHERE_AM_I executes.  If we suspend near
the ringbuffer wraparound point, this can lead to a chicken/egg
situation where we are waiting for ringbuffer space to write the
CP_WHERE_AM_I (or CP_INIT) packet, because we mistakenly believe that
the ringbuffer is full (due to stale rptr value in the shadow).

Fixes errors like:

  [drm:adreno_wait_ring [msm]] *ERROR* timeout waiting for space in ringbuffer 0

in the resume path.

Fixes: d3a569fccfa0 ("drm/msm: a6xx: Use WHERE_AM_I for eligible targets")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index 948f3656c20ca..420ca4a0eb5f7 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -1045,12 +1045,21 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
 	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+	int i, ret;
 
 	trace_msm_gpu_suspend(0);
 
 	devfreq_suspend_device(gpu->devfreq.devfreq);
 
-	return a6xx_gmu_stop(a6xx_gpu);
+	ret = a6xx_gmu_stop(a6xx_gpu);
+	if (ret)
+		return ret;
+
+	if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami)
+		for (i = 0; i < gpu->nr_rings; i++)
+			a6xx_gpu->shadow[i] = 0;
+
+	return 0;
 }
 
 static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 087/717] drm/msm/a5xx: Clear shadow on suspend
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 086/717] drm/msm/a6xx: Clear shadow on suspend Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 088/717] firmware: tegra: fix strncpy()/strncat() confusion Greg Kroah-Hartman
                   ` (631 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rob Clark, Sasha Levin

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit 5771de5d5b3bfaf279e5c262a113d4b6fbe54355 ]

Similar to the previous patch, clear shadow on suspend to avoid timeouts
waiting for ringbuffer space.

Fixes: 8907afb476ac ("drm/msm: Allow a5xx to mark the RPTR shadow as privileged")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index d6804a8023555..8aa08976aad17 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -1207,7 +1207,9 @@ static int a5xx_pm_resume(struct msm_gpu *gpu)
 static int a5xx_pm_suspend(struct msm_gpu *gpu)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
 	u32 mask = 0xf;
+	int i, ret;
 
 	/* A510 has 3 XIN ports in VBIF */
 	if (adreno_is_a510(adreno_gpu))
@@ -1227,7 +1229,15 @@ static int a5xx_pm_suspend(struct msm_gpu *gpu)
 	gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x003C0000);
 	gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x00000000);
 
-	return msm_gpu_pm_suspend(gpu);
+	ret = msm_gpu_pm_suspend(gpu);
+	if (ret)
+		return ret;
+
+	if (a5xx_gpu->has_whereami)
+		for (i = 0; i < gpu->nr_rings; i++)
+			a5xx_gpu->shadow[i] = 0;
+
+	return 0;
 }
 
 static int a5xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 088/717] firmware: tegra: fix strncpy()/strncat() confusion
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 087/717] drm/msm/a5xx: " Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 089/717] drm/msm/dp: return correct connection status after suspend Greg Kroah-Hartman
                   ` (630 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jon Hunter,
	Thierry Reding, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 9294996f0be40e9da818ed891c82397ab63c00d0 ]

The way that bpmp_populate_debugfs_inband() uses strncpy()
and strncat() makes no sense since the size argument for
the first is insufficient to contain the trailing '/'
and the second passes the length of the input rather than
the output, which triggers a warning:

In function 'strncat',
    inlined from 'bpmp_populate_debugfs_inband' at ../drivers/firmware/tegra/bpmp-debugfs.c:422:4:
include/linux/string.h:289:30: warning: '__builtin_strncat' specified bound depends on the length of the source argument [-Wstringop-overflow=]
  289 | #define __underlying_strncat __builtin_strncat
      |                              ^
include/linux/string.h:367:10: note: in expansion of macro '__underlying_strncat'
  367 |   return __underlying_strncat(p, q, count);
      |          ^~~~~~~~~~~~~~~~~~~~
drivers/firmware/tegra/bpmp-debugfs.c: In function 'bpmp_populate_debugfs_inband':
include/linux/string.h:288:29: note: length computed here
  288 | #define __underlying_strlen __builtin_strlen
      |                             ^
include/linux/string.h:321:10: note: in expansion of macro '__underlying_strlen'
  321 |   return __underlying_strlen(p);

Simplify this to use an snprintf() instead.

Fixes: 5e37b9c137ee ("firmware: tegra: Add support for in-band debug")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/tegra/bpmp-debugfs.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/firmware/tegra/bpmp-debugfs.c b/drivers/firmware/tegra/bpmp-debugfs.c
index c1bbba9ee93a3..440d99c63638b 100644
--- a/drivers/firmware/tegra/bpmp-debugfs.c
+++ b/drivers/firmware/tegra/bpmp-debugfs.c
@@ -412,16 +412,12 @@ static int bpmp_populate_debugfs_inband(struct tegra_bpmp *bpmp,
 				goto out;
 			}
 
-			len = strlen(ppath) + strlen(name) + 1;
+			len = snprintf(pathbuf, pathlen, "%s%s/", ppath, name);
 			if (len >= pathlen) {
 				err = -EINVAL;
 				goto out;
 			}
 
-			strncpy(pathbuf, ppath, pathlen);
-			strncat(pathbuf, name, strlen(name));
-			strcat(pathbuf, "/");
-
 			err = bpmp_populate_debugfs_inband(bpmp, dentry,
 							   pathbuf);
 			if (err < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 089/717] drm/msm/dp: return correct connection status after suspend
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 088/717] firmware: tegra: fix strncpy()/strncat() confusion Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 090/717] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit Greg Kroah-Hartman
                   ` (629 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Kuogee Hsieh,
	Rob Clark, Sasha Levin

From: Kuogee Hsieh <khsieh@codeaurora.org>

[ Upstream commit 19e52bcb27c2ba140699d2230d722366d7d048a1 ]

During suspend, dp host controller and hpd block are disabled due to
both ahb and aux clock are disabled. Therefore hpd plug/unplug interrupts
will not be generated. At dp_pm_resume(), reinitialize both dp host
controller and hpd block so that hpd plug/unplug interrupts will be
generated and handled by driver so that hpd connection state is updated
correctly. This patch will fix link training flaky issues.

Changes in v2:
-- use container_of to cast correct dp_display_private pointer
   at both dp_pm_suspend() and dp_pm_resume().

Changes in v3:
-- replace hpd_state atomic_t  with u32

Changes in v4
-- call dp_display_host_deinit() at dp_pm_suspend()
-- call dp_display_host_init() at msm_dp_display_enable()
-- fix phy->init_count unbalance which causes link training failed

Changes in v5
--  add Fixes tag

Fixes:  8ede2ecc3e5e (drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets)
Tested-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_catalog.c |  13 +++
 drivers/gpu/drm/msm/dp/dp_catalog.h |   1 +
 drivers/gpu/drm/msm/dp/dp_ctrl.c    |   5 +
 drivers/gpu/drm/msm/dp/dp_display.c | 144 +++++++++++++++-------------
 drivers/gpu/drm/msm/dp/dp_reg.h     |   2 +
 5 files changed, 97 insertions(+), 68 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c
index b15b4ce4ba35a..4963bfe6a4726 100644
--- a/drivers/gpu/drm/msm/dp/dp_catalog.c
+++ b/drivers/gpu/drm/msm/dp/dp_catalog.c
@@ -572,6 +572,19 @@ void dp_catalog_ctrl_hpd_config(struct dp_catalog *dp_catalog)
 	dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, DP_DP_HPD_CTRL_HPD_EN);
 }
 
+u32 dp_catalog_hpd_get_state_status(struct dp_catalog *dp_catalog)
+{
+	struct dp_catalog_private *catalog = container_of(dp_catalog,
+				struct dp_catalog_private, dp_catalog);
+	u32 status;
+
+	status = dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
+	status >>= DP_DP_HPD_STATE_STATUS_BITS_SHIFT;
+	status &= DP_DP_HPD_STATE_STATUS_BITS_MASK;
+
+	return status;
+}
+
 u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog)
 {
 	struct dp_catalog_private *catalog = container_of(dp_catalog,
diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.h b/drivers/gpu/drm/msm/dp/dp_catalog.h
index 4b7666f1fe6fe..6d257dbebf294 100644
--- a/drivers/gpu/drm/msm/dp/dp_catalog.h
+++ b/drivers/gpu/drm/msm/dp/dp_catalog.h
@@ -97,6 +97,7 @@ void dp_catalog_ctrl_enable_irq(struct dp_catalog *dp_catalog, bool enable);
 void dp_catalog_hpd_config_intr(struct dp_catalog *dp_catalog,
 			u32 intr_mask, bool en);
 void dp_catalog_ctrl_hpd_config(struct dp_catalog *dp_catalog);
+u32 dp_catalog_hpd_get_state_status(struct dp_catalog *dp_catalog);
 u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog);
 void dp_catalog_ctrl_phy_reset(struct dp_catalog *dp_catalog);
 int dp_catalog_ctrl_update_vx_px(struct dp_catalog *dp_catalog, u8 v_level,
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 872b12689e317..cee161c8ecc67 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1400,6 +1400,8 @@ int dp_ctrl_host_init(struct dp_ctrl *dp_ctrl, bool flip)
 void dp_ctrl_host_deinit(struct dp_ctrl *dp_ctrl)
 {
 	struct dp_ctrl_private *ctrl;
+	struct dp_io *dp_io;
+	struct phy *phy;
 
 	if (!dp_ctrl) {
 		DRM_ERROR("Invalid input data\n");
@@ -1407,8 +1409,11 @@ void dp_ctrl_host_deinit(struct dp_ctrl *dp_ctrl)
 	}
 
 	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
+	dp_io = &ctrl->parser->io;
+	phy = dp_io->phy;
 
 	dp_catalog_ctrl_enable_irq(ctrl->catalog, false);
+	phy_exit(phy);
 
 	DRM_DEBUG_DP("Host deinitialized successfully\n");
 }
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index ae9989ece73f4..8703c63d85c87 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -108,14 +108,12 @@ struct dp_display_private {
 	/* event related only access by event thread */
 	struct mutex event_mutex;
 	wait_queue_head_t event_q;
-	atomic_t hpd_state;
+	u32 hpd_state;
 	u32 event_pndx;
 	u32 event_gndx;
 	struct dp_event event_list[DP_EVENT_Q_MAX];
 	spinlock_t event_lock;
 
-	struct completion resume_comp;
-
 	struct dp_audio *audio;
 };
 
@@ -367,6 +365,20 @@ static void dp_display_host_init(struct dp_display_private *dp)
 	dp->core_initialized = true;
 }
 
+static void dp_display_host_deinit(struct dp_display_private *dp)
+{
+	if (!dp->core_initialized) {
+		DRM_DEBUG_DP("DP core not initialized\n");
+		return;
+	}
+
+	dp_ctrl_host_deinit(dp->ctrl);
+	dp_aux_deinit(dp->aux);
+	dp_power_deinit(dp->power);
+
+	dp->core_initialized = false;
+}
+
 static int dp_display_usbpd_configure_cb(struct device *dev)
 {
 	int rc = 0;
@@ -491,7 +503,7 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data)
 
 	mutex_lock(&dp->event_mutex);
 
-	state =  atomic_read(&dp->hpd_state);
+	state =  dp->hpd_state;
 	if (state == ST_SUSPEND_PENDING) {
 		mutex_unlock(&dp->event_mutex);
 		return 0;
@@ -509,17 +521,14 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data)
 		return 0;
 	}
 
-	if (state == ST_SUSPENDED)
-		tout = DP_TIMEOUT_NONE;
-
-	atomic_set(&dp->hpd_state, ST_CONNECT_PENDING);
+	dp->hpd_state = ST_CONNECT_PENDING;
 
 	hpd->hpd_high = 1;
 
 	ret = dp_display_usbpd_configure_cb(&dp->pdev->dev);
 	if (ret) {	/* failed */
 		hpd->hpd_high = 0;
-		atomic_set(&dp->hpd_state, ST_DISCONNECTED);
+		dp->hpd_state = ST_DISCONNECTED;
 	}
 
 	/* start sanity checking */
@@ -540,10 +549,10 @@ static int dp_connect_pending_timeout(struct dp_display_private *dp, u32 data)
 
 	mutex_lock(&dp->event_mutex);
 
-	state =  atomic_read(&dp->hpd_state);
+	state = dp->hpd_state;
 	if (state == ST_CONNECT_PENDING) {
 		dp_display_enable(dp, 0);
-		atomic_set(&dp->hpd_state, ST_CONNECTED);
+		dp->hpd_state = ST_CONNECTED;
 	}
 
 	mutex_unlock(&dp->event_mutex);
@@ -568,7 +577,7 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
 
 	mutex_lock(&dp->event_mutex);
 
-	state = atomic_read(&dp->hpd_state);
+	state = dp->hpd_state;
 	if (state == ST_SUSPEND_PENDING) {
 		mutex_unlock(&dp->event_mutex);
 		return 0;
@@ -586,7 +595,7 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
 		return 0;
 	}
 
-	atomic_set(&dp->hpd_state, ST_DISCONNECT_PENDING);
+	dp->hpd_state = ST_DISCONNECT_PENDING;
 
 	/* disable HPD plug interrupt until disconnect is done */
 	dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK
@@ -621,10 +630,10 @@ static int dp_disconnect_pending_timeout(struct dp_display_private *dp, u32 data
 
 	mutex_lock(&dp->event_mutex);
 
-	state =  atomic_read(&dp->hpd_state);
+	state =  dp->hpd_state;
 	if (state == ST_DISCONNECT_PENDING) {
 		dp_display_disable(dp, 0);
-		atomic_set(&dp->hpd_state, ST_DISCONNECTED);
+		dp->hpd_state = ST_DISCONNECTED;
 	}
 
 	mutex_unlock(&dp->event_mutex);
@@ -639,7 +648,7 @@ static int dp_irq_hpd_handle(struct dp_display_private *dp, u32 data)
 	mutex_lock(&dp->event_mutex);
 
 	/* irq_hpd can happen at either connected or disconnected state */
-	state =  atomic_read(&dp->hpd_state);
+	state =  dp->hpd_state;
 	if (state == ST_SUSPEND_PENDING) {
 		mutex_unlock(&dp->event_mutex);
 		return 0;
@@ -790,17 +799,10 @@ static int dp_display_enable(struct dp_display_private *dp, u32 data)
 
 	dp_display = g_dp_display;
 
-	if (dp_display->power_on) {
-		DRM_DEBUG_DP("Link already setup, return\n");
-		return 0;
-	}
-
 	rc = dp_ctrl_on_stream(dp->ctrl);
 	if (!rc)
 		dp_display->power_on = true;
 
-	/* complete resume_comp regardless it is armed or not */
-	complete(&dp->resume_comp);
 	return rc;
 }
 
@@ -829,9 +831,6 @@ static int dp_display_disable(struct dp_display_private *dp, u32 data)
 
 	dp_display = g_dp_display;
 
-	if (!dp_display->power_on)
-		return -EINVAL;
-
 	/* wait only if audio was enabled */
 	if (dp_display->audio_enabled) {
 		if (!wait_for_completion_timeout(&dp->audio_comp,
@@ -1152,9 +1151,6 @@ static int dp_display_probe(struct platform_device *pdev)
 	}
 
 	mutex_init(&dp->event_mutex);
-
-	init_completion(&dp->resume_comp);
-
 	g_dp_display = &dp->dp_display;
 
 	/* Store DP audio handle inside DP display */
@@ -1190,20 +1186,54 @@ static int dp_display_remove(struct platform_device *pdev)
 
 static int dp_pm_resume(struct device *dev)
 {
+	struct platform_device *pdev = to_platform_device(dev);
+	struct msm_dp *dp_display = platform_get_drvdata(pdev);
+	struct dp_display_private *dp;
+	u32 status;
+
+	dp = container_of(dp_display, struct dp_display_private, dp_display);
+
+	mutex_lock(&dp->event_mutex);
+
+	/* start from disconnected state */
+	dp->hpd_state = ST_DISCONNECTED;
+
+	/* turn on dp ctrl/phy */
+	dp_display_host_init(dp);
+
+	dp_catalog_ctrl_hpd_config(dp->catalog);
+
+	status = dp_catalog_hpd_get_state_status(dp->catalog);
+
+	if (status) {
+		dp->dp_display.is_connected = true;
+	} else {
+		dp->dp_display.is_connected = false;
+		/* make sure next resume host_init be called */
+		dp->core_initialized = false;
+	}
+
+	mutex_unlock(&dp->event_mutex);
+
 	return 0;
 }
 
 static int dp_pm_suspend(struct device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	struct dp_display_private *dp = platform_get_drvdata(pdev);
+	struct msm_dp *dp_display = platform_get_drvdata(pdev);
+	struct dp_display_private *dp;
 
-	if (!dp) {
-		DRM_ERROR("DP driver bind failed. Invalid driver data\n");
-		return -EINVAL;
-	}
+	dp = container_of(dp_display, struct dp_display_private, dp_display);
 
-	atomic_set(&dp->hpd_state, ST_SUSPENDED);
+	mutex_lock(&dp->event_mutex);
+
+	if (dp->core_initialized == true)
+		dp_display_host_deinit(dp);
+
+	dp->hpd_state = ST_SUSPENDED;
+
+	mutex_unlock(&dp->event_mutex);
 
 	return 0;
 }
@@ -1318,19 +1348,6 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
 	return 0;
 }
 
-static int dp_display_wait4resume_done(struct dp_display_private *dp)
-{
-	int ret = 0;
-
-	reinit_completion(&dp->resume_comp);
-	if (!wait_for_completion_timeout(&dp->resume_comp,
-				WAIT_FOR_RESUME_TIMEOUT_JIFFIES)) {
-		DRM_ERROR("wait4resume_done timedout\n");
-		ret = -ETIMEDOUT;
-	}
-	return ret;
-}
-
 int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
 {
 	int rc = 0;
@@ -1345,6 +1362,8 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
 
 	mutex_lock(&dp_display->event_mutex);
 
+	dp_del_event(dp_display, EV_CONNECT_PENDING_TIMEOUT);
+
 	rc = dp_display_set_mode(dp, &dp_display->dp_mode);
 	if (rc) {
 		DRM_ERROR("Failed to perform a mode set, rc=%d\n", rc);
@@ -1359,15 +1378,10 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
 		return rc;
 	}
 
-	state =  atomic_read(&dp_display->hpd_state);
-	if (state == ST_SUSPENDED) {
-		/* start link training */
-		dp_add_event(dp_display, EV_HPD_PLUG_INT, 0, 0);
-		mutex_unlock(&dp_display->event_mutex);
+	state =  dp_display->hpd_state;
 
-		/* wait until dp interface is up */
-		goto resume_done;
-	}
+	if (state == ST_SUSPEND_PENDING)
+		dp_display_host_init(dp_display);
 
 	dp_display_enable(dp_display, 0);
 
@@ -1378,21 +1392,15 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
 		dp_display_unprepare(dp);
 	}
 
-	dp_del_event(dp_display, EV_CONNECT_PENDING_TIMEOUT);
-
 	if (state == ST_SUSPEND_PENDING)
 		dp_add_event(dp_display, EV_IRQ_HPD_INT, 0, 0);
 
 	/* completed connection */
-	atomic_set(&dp_display->hpd_state, ST_CONNECTED);
+	dp_display->hpd_state = ST_CONNECTED;
 
 	mutex_unlock(&dp_display->event_mutex);
 
 	return rc;
-
-resume_done:
-	dp_display_wait4resume_done(dp_display);
-	return rc;
 }
 
 int msm_dp_display_pre_disable(struct msm_dp *dp, struct drm_encoder *encoder)
@@ -1416,20 +1424,20 @@ int msm_dp_display_disable(struct msm_dp *dp, struct drm_encoder *encoder)
 
 	mutex_lock(&dp_display->event_mutex);
 
+	dp_del_event(dp_display, EV_DISCONNECT_PENDING_TIMEOUT);
+
 	dp_display_disable(dp_display, 0);
 
 	rc = dp_display_unprepare(dp);
 	if (rc)
 		DRM_ERROR("DP display unprepare failed, rc=%d\n", rc);
 
-	dp_del_event(dp_display, EV_DISCONNECT_PENDING_TIMEOUT);
-
-	state =  atomic_read(&dp_display->hpd_state);
+	state =  dp_display->hpd_state;
 	if (state == ST_DISCONNECT_PENDING) {
 		/* completed disconnection */
-		atomic_set(&dp_display->hpd_state, ST_DISCONNECTED);
+		dp_display->hpd_state = ST_DISCONNECTED;
 	} else {
-		atomic_set(&dp_display->hpd_state, ST_SUSPEND_PENDING);
+		dp_display->hpd_state = ST_SUSPEND_PENDING;
 	}
 
 	mutex_unlock(&dp_display->event_mutex);
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index 43042ff90a199..268602803d9a3 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -32,6 +32,8 @@
 #define DP_DP_IRQ_HPD_INT_ACK			(0x00000002)
 #define DP_DP_HPD_REPLUG_INT_ACK		(0x00000004)
 #define DP_DP_HPD_UNPLUG_INT_ACK		(0x00000008)
+#define DP_DP_HPD_STATE_STATUS_BITS_MASK	(0x0000000F)
+#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT	(0x1C)
 
 #define REG_DP_DP_HPD_INT_MASK			(0x0000000C)
 #define DP_DP_HPD_PLUG_INT_MASK			(0x00000001)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 090/717] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 089/717] drm/msm/dp: return correct connection status after suspend Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 091/717] drm/msm/dp: do not notify audio subsystem if sink doesnt support audio Greg Kroah-Hartman
                   ` (628 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuogee Hsieh, Rob Clark, Sasha Levin

From: Kuogee Hsieh <khsieh@codeaurora.org>

[ Upstream commit ea530388e64bd584645f2d89e40ca7dffade8eff ]

Some dongle will not clear LINK_STATUS_UPDATED bit after
DPCD read which cause link training failed. This patch
just read 6 bytes of DPCD link status from sink and return
without checking LINK_STATUS_UPDATED bit.
Only 8 bits are used to represent link rate at sinker DPCD.
The really link rate is 2.7Mb times the 8 bits value.
For example, 0x0A at DPCD is equal to 2.7Gb (10 * 2.7Mb).
This patch also convert 8 bits value of DPCD to really link
rate to fix worng link rate error during phy compliance test.

Fixes: 6625e2637d93 ("drm/msm/dp: DisplayPort PHY compliance tests fixup")
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 20 ++++++--------------
 drivers/gpu/drm/msm/dp/dp_link.c | 29 ++++++++++++++---------------
 2 files changed, 20 insertions(+), 29 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index cee161c8ecc67..c83a1650437da 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1061,23 +1061,15 @@ static bool dp_ctrl_train_pattern_set(struct dp_ctrl_private *ctrl,
 static int dp_ctrl_read_link_status(struct dp_ctrl_private *ctrl,
 				    u8 *link_status)
 {
-	int len = 0;
-	u32 const offset = DP_LANE_ALIGN_STATUS_UPDATED - DP_LANE0_1_STATUS;
-	u32 link_status_read_max_retries = 100;
-
-	while (--link_status_read_max_retries) {
-		len = drm_dp_dpcd_read_link_status(ctrl->aux,
-			link_status);
-		if (len != DP_LINK_STATUS_SIZE) {
-			DRM_ERROR("DP link status read failed, err: %d\n", len);
-			return len;
-		}
+	int ret = 0, len;
 
-		if (!(link_status[offset] & DP_LINK_STATUS_UPDATED))
-			return 0;
+	len = drm_dp_dpcd_read_link_status(ctrl->aux, link_status);
+	if (len != DP_LINK_STATUS_SIZE) {
+		DRM_ERROR("DP link status read failed, err: %d\n", len);
+		ret = -EINVAL;
 	}
 
-	return -ETIMEDOUT;
+	return ret;
 }
 
 static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c
index 49d7fad36fc4e..be986da78c4a5 100644
--- a/drivers/gpu/drm/msm/dp/dp_link.c
+++ b/drivers/gpu/drm/msm/dp/dp_link.c
@@ -773,7 +773,8 @@ static int dp_link_process_link_training_request(struct dp_link_private *link)
 			link->request.test_lane_count);
 
 	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
-	link->dp_link.link_params.rate = link->request.test_link_rate;
+	link->dp_link.link_params.rate = 
+		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
 
 	return 0;
 }
@@ -943,22 +944,20 @@ static u8 get_link_status(const u8 link_status[DP_LINK_STATUS_SIZE], int r)
  */
 static int dp_link_process_link_status_update(struct dp_link_private *link)
 {
-	if (!(get_link_status(link->link_status,
-				DP_LANE_ALIGN_STATUS_UPDATED) &
-				DP_LINK_STATUS_UPDATED) ||
-			(drm_dp_clock_recovery_ok(link->link_status,
-					link->dp_link.link_params.num_lanes) &&
-			drm_dp_channel_eq_ok(link->link_status,
-					link->dp_link.link_params.num_lanes)))
-		return -EINVAL;
+       bool channel_eq_done = drm_dp_channel_eq_ok(link->link_status,
+                       link->dp_link.link_params.num_lanes);
 
-	DRM_DEBUG_DP("channel_eq_done = %d, clock_recovery_done = %d\n",
-			drm_dp_clock_recovery_ok(link->link_status,
-			link->dp_link.link_params.num_lanes),
-			drm_dp_clock_recovery_ok(link->link_status,
-			link->dp_link.link_params.num_lanes));
+       bool clock_recovery_done = drm_dp_clock_recovery_ok(link->link_status,
+                       link->dp_link.link_params.num_lanes);
 
-	return 0;
+       DRM_DEBUG_DP("channel_eq_done = %d, clock_recovery_done = %d\n",
+                        channel_eq_done, clock_recovery_done);
+
+       if (channel_eq_done && clock_recovery_done)
+               return -EINVAL;
+
+
+       return 0;
 }
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 091/717] drm/msm/dp: do not notify audio subsystem if sink doesnt support audio
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 090/717] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 092/717] selftests/run_kselftest.sh: fix dry-run typo Greg Kroah-Hartman
                   ` (627 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abhinav Kumar, Rob Clark, Sasha Levin

From: Abhinav Kumar <abhinavk@codeaurora.org>

[ Upstream commit e8c765811b1064c200829eacf237ac8c25e79cd0 ]

For sinks that do not support audio, there is no need to notify
audio subsystem of the connection event.

This will make sure that audio routes only to the primary display
when connected to such sinks.

changes in v2:
  - Added fixes tag
  - Removed nested if condition and removed usage of global pointer

Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM")
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_display.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 8703c63d85c87..fe0279542a1c2 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -563,7 +563,14 @@ static int dp_connect_pending_timeout(struct dp_display_private *dp, u32 data)
 static void dp_display_handle_plugged_change(struct msm_dp *dp_display,
 		bool plugged)
 {
-	if (dp_display->plugged_cb && dp_display->codec_dev)
+	struct dp_display_private *dp;
+
+	dp = container_of(dp_display,
+			struct dp_display_private, dp_display);
+
+	/* notify audio subsystem only if sink supports audio */
+	if (dp_display->plugged_cb && dp_display->codec_dev &&
+			dp->audio_supported)
 		dp_display->plugged_cb(dp_display->codec_dev, plugged);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 092/717] selftests/run_kselftest.sh: fix dry-run typo
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 091/717] drm/msm/dp: do not notify audio subsystem if sink doesnt support audio Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 093/717] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
                   ` (626 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Shuah Khan, Sasha Levin

From: Hangbin Liu <liuhangbin@gmail.com>

[ Upstream commit 93f20eff0cca972d74cb554a2e8b47730228be16 ]

Should be -d instead of -n for dry-run.

Fixes: 5da1918446a1 ("selftests/run_kselftest.sh: Make each test individually selectable")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/run_kselftest.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/run_kselftest.sh b/tools/testing/selftests/run_kselftest.sh
index 609a4ef9300e3..97165a83df632 100755
--- a/tools/testing/selftests/run_kselftest.sh
+++ b/tools/testing/selftests/run_kselftest.sh
@@ -48,7 +48,7 @@ while true; do
 		-l | --list)
 			echo "$available"
 			exit 0 ;;
-		-n | --dry-run)
+		-d | --dry-run)
 			dryrun="echo"
 			shift ;;
 		-h | --help)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 093/717] selftest/bpf: Add missed ip6ip6 test back
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 092/717] selftests/run_kselftest.sh: fix dry-run typo Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 094/717] ASoC: wm8994: Fix PM disable depth imbalance on error Greg Kroah-Hartman
                   ` (625 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Alexei Starovoitov, Sasha Levin

From: Hangbin Liu <liuhangbin@gmail.com>

[ Upstream commit 58cfa49c2ba7f815adccc27a775e7cf8a8f7f539 ]

In comment 173ca26e9b51 ("samples/bpf: add comprehensive ipip, ipip6,
ip6ip6 test") we added ip6ip6 test for bpf tunnel testing. But in commit
933a741e3b82 ("selftests/bpf: bpf tunnel test.") when we moved it to
the current folder, we didn't add it.

This patch add the ip6ip6 test back to bpf tunnel test. Update the ipip6's
topology for both IPv4 and IPv6 testing. Since iperf test is removed as
currect framework simplified it in purpose, I also removed unused tcp
checkings in test_tunnel_kern.c.

Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201110015013.1570716-2-liuhangbin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/progs/test_tunnel_kern.c    | 42 +++---------------
 tools/testing/selftests/bpf/test_tunnel.sh    | 43 +++++++++++++++++--
 2 files changed, 46 insertions(+), 39 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
index f48dbfe24ddc8..a621b58ab079d 100644
--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
@@ -15,7 +15,6 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/types.h>
-#include <linux/tcp.h>
 #include <linux/socket.h>
 #include <linux/pkt_cls.h>
 #include <linux/erspan.h>
@@ -528,12 +527,11 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
@@ -541,16 +539,6 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
 	key.tunnel_ttl = 64;
 	if (iph->protocol == IPPROTO_ICMP) {
 		key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
-	} else {
-		if (iph->protocol != IPPROTO_TCP || iph->ihl != 5)
-			return TC_ACT_SHOT;
-
-		if (tcp->dest == bpf_htons(5200))
-			key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
-		else if (tcp->dest == bpf_htons(5201))
-			key.remote_ipv4 = 0xac100165; /* 172.16.1.101 */
-		else
-			return TC_ACT_SHOT;
 	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);
@@ -585,19 +573,20 @@ int _ipip6_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
 
 	__builtin_memset(&key, 0x0, sizeof(key));
-	key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
 	key.tunnel_ttl = 64;
+	if (iph->protocol == IPPROTO_ICMP) {
+		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
+	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
 				     BPF_F_TUNINFO_IPV6);
@@ -634,35 +623,18 @@ int _ip6ip6_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct ipv6hdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
 
-	key.remote_ipv6[0] = bpf_htonl(0x2401db00);
 	key.tunnel_ttl = 64;
-
 	if (iph->nexthdr == 58 /* NEXTHDR_ICMP */) {
-		key.remote_ipv6[3] = bpf_htonl(1);
-	} else {
-		if (iph->nexthdr != 6 /* NEXTHDR_TCP */) {
-			ERROR(iph->nexthdr);
-			return TC_ACT_SHOT;
-		}
-
-		if (tcp->dest == bpf_htons(5200)) {
-			key.remote_ipv6[3] = bpf_htonl(1);
-		} else if (tcp->dest == bpf_htons(5201)) {
-			key.remote_ipv6[3] = bpf_htonl(2);
-		} else {
-			ERROR(tcp->dest);
-			return TC_ACT_SHOT;
-		}
+		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
 	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index bd12ec97a44df..1ccbe804e8e1c 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -24,12 +24,12 @@
 # Root namespace with metadata-mode tunnel + BPF
 # Device names and addresses:
 # 	veth1 IP: 172.16.1.200, IPv6: 00::22 (underlay)
-# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200 (overlay)
+# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200, IPv6: 1::22 (overlay)
 #
 # Namespace at_ns0 with native tunnel
 # Device names and addresses:
 # 	veth0 IPv4: 172.16.1.100, IPv6: 00::11 (underlay)
-# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100 (overlay)
+# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100, IPv6: 1::11 (overlay)
 #
 #
 # End-to-end ping packet flow
@@ -250,7 +250,7 @@ add_ipip_tunnel()
 	ip addr add dev $DEV 10.1.1.200/24
 }
 
-add_ipip6tnl_tunnel()
+add_ip6tnl_tunnel()
 {
 	ip netns exec at_ns0 ip addr add ::11/96 dev veth0
 	ip netns exec at_ns0 ip link set dev veth0 up
@@ -262,11 +262,13 @@ add_ipip6tnl_tunnel()
 		ip link add dev $DEV_NS type $TYPE \
 		local ::11 remote ::22
 	ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
+	ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96
 	ip netns exec at_ns0 ip link set dev $DEV_NS up
 
 	# root namespace
 	ip link add dev $DEV type $TYPE external
 	ip addr add dev $DEV 10.1.1.200/24
+	ip addr add dev $DEV 1::22/96
 	ip link set dev $DEV up
 }
 
@@ -534,7 +536,7 @@ test_ipip6()
 
 	check $TYPE
 	config_device
-	add_ipip6tnl_tunnel
+	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
 	attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel
 	# underlay
@@ -553,6 +555,34 @@ test_ipip6()
         echo -e ${GREEN}"PASS: $TYPE"${NC}
 }
 
+test_ip6ip6()
+{
+	TYPE=ip6tnl
+	DEV_NS=ip6ip6tnl00
+	DEV=ip6ip6tnl11
+	ret=0
+
+	check $TYPE
+	config_device
+	add_ip6tnl_tunnel
+	ip link set dev veth1 mtu 1500
+	attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel
+	# underlay
+	ping6 $PING_ARG ::11
+	# ip6 over ip6
+	ping6 $PING_ARG 1::11
+	check_err $?
+	ip netns exec at_ns0 ping6 $PING_ARG 1::22
+	check_err $?
+	cleanup
+
+	if [ $ret -ne 0 ]; then
+                echo -e ${RED}"FAIL: ip6$TYPE"${NC}
+                return 1
+        fi
+        echo -e ${GREEN}"PASS: ip6$TYPE"${NC}
+}
+
 setup_xfrm_tunnel()
 {
 	auth=0x$(printf '1%.0s' {1..40})
@@ -646,6 +676,7 @@ cleanup()
 	ip link del veth1 2> /dev/null
 	ip link del ipip11 2> /dev/null
 	ip link del ipip6tnl11 2> /dev/null
+	ip link del ip6ip6tnl11 2> /dev/null
 	ip link del gretap11 2> /dev/null
 	ip link del ip6gre11 2> /dev/null
 	ip link del ip6gretap11 2> /dev/null
@@ -742,6 +773,10 @@ bpf_tunnel_test()
 	test_ipip6
 	errors=$(( $errors + $? ))
 
+	echo "Testing IP6IP6 tunnel..."
+	test_ip6ip6
+	errors=$(( $errors + $? ))
+
 	echo "Testing IPSec tunnel..."
 	test_xfrm_tunnel
 	errors=$(( $errors + $? ))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 094/717] ASoC: wm8994: Fix PM disable depth imbalance on error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 093/717] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 095/717] ASoC: wm8998: " Greg Kroah-Hartman
                   ` (624 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Richard Fitzgerald,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b8161cbe55a1892a19a318eaebbda92438fa708c ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.

Fixes: 57e265c8d71fb ("ASoC: wm8994: Move runtime PM init to platform device init")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111041326.1257558-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8994.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index fc9ea198ac799..f57884113406b 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4645,8 +4645,12 @@ static int wm8994_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	pm_runtime_idle(&pdev->dev);
 
-	return devm_snd_soc_register_component(&pdev->dev, &soc_component_dev_wm8994,
+	ret = devm_snd_soc_register_component(&pdev->dev, &soc_component_dev_wm8994,
 			wm8994_dai, ARRAY_SIZE(wm8994_dai));
+	if (ret < 0)
+		pm_runtime_disable(&pdev->dev);
+
+	return ret;
 }
 
 static int wm8994_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 095/717] ASoC: wm8998: Fix PM disable depth imbalance on error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 094/717] ASoC: wm8994: Fix PM disable depth imbalance on error Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 096/717] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
                   ` (623 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Richard Fitzgerald,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8998.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
index f6c5cc80c970b..5413254295b70 100644
--- a/sound/soc/codecs/wm8998.c
+++ b/sound/soc/codecs/wm8998.c
@@ -1375,7 +1375,7 @@ static int wm8998_probe(struct platform_device *pdev)
 
 	ret = arizona_init_spk_irqs(arizona);
 	if (ret < 0)
-		return ret;
+		goto err_pm_disable;
 
 	ret = devm_snd_soc_register_component(&pdev->dev,
 					      &soc_component_dev_wm8998,
@@ -1390,6 +1390,8 @@ static int wm8998_probe(struct platform_device *pdev)
 
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 096/717] spi: sprd: fix reference leak in sprd_spi_remove
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 095/717] ASoC: wm8998: " Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 097/717] virtiofs fix leak in setup Greg Kroah-Hartman
                   ` (622 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Chunyan Zhang,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit e4062765bc2a41e025e29dd56bad798505036427 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in sprd_spi_remove, so we should fix it.

Fixes: e7d973a31c24b ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Chunyan Zhang <zhang.lyra@gmail.com>
Link: https://lore.kernel.org/r/20201106015035.139574-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-sprd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c
index 635738f54c731..b41a75749b498 100644
--- a/drivers/spi/spi-sprd.c
+++ b/drivers/spi/spi-sprd.c
@@ -1010,6 +1010,7 @@ static int sprd_spi_remove(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(ss->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(ss->dev);
 		dev_err(ss->dev, "failed to resume SPI controller\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 097/717] virtiofs fix leak in setup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 096/717] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
                   ` (621 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi, Sasha Levin

From: Miklos Szeredi <mszeredi@redhat.com>

[ Upstream commit 66ab33bf6d4341574f88b511e856a73f6f2a921e ]

This can be triggered for example by adding the "-omand" mount option,
which will be rejected and virtio_fs_fill_super() will return an error.

In such a case the allocations for fuse_conn and fuse_mount will leak due
to s_root not yet being set and so ->put_super() not being called.

Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/virtio_fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 21a9e534417c0..d2c0e58c6416f 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -1464,6 +1464,8 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
 	if (!sb->s_root) {
 		err = virtio_fs_fill_super(sb, fsc);
 		if (err) {
+			fuse_mount_put(fm);
+			sb->s_fs_info = NULL;
 			deactivate_locked_super(sb);
 			return err;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 097/717] virtiofs fix leak in setup Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 18:50   ` Jakub Kicinski
  2020-12-28 12:41 ` [PATCH 5.10 099/717] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
                   ` (620 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]

Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
ignores a route whose interface is down. It is provided as a
per-interface sysctl. However, while a "all" variant is exposed, it
was a noop since it was never evaluated. We use the usual "or" logic
for this kind of sysctls.

Tested with:

    ip link add type veth # veth0 + veth1
    ip link add type veth # veth1 + veth2
    ip link set up dev veth0
    ip link set up dev veth1 # link-status paired with veth0
    ip link set up dev veth2
    ip link set up dev veth3 # link-status paired with veth2

    # First available path
    ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
    ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0

    # Second available path
    ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
    ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2

    # More specific route through first path
    ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
    ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0

    # Less specific route through second path
    ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
    ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2

    # H1: enable on "all"
    # H2: enable on "veth0"
    for v in ipv4 ipv6; do
      case $uts in
        H1)
          sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
          ;;
        H2)
          sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
          ;;
      esac
    done

    set -xe
    # When veth0 is up, best route is through veth0
    ip -o route get 198.51.100.1 | grep -Fw veth0
    ip -o route get 2001:db8:3::1 | grep -Fw veth0

    # When veth0 is down, best route should be through veth2 on H1/H2,
    # but on veth0 on H2
    ip link set down dev veth1 # down veth0
    ip route show
    [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
    [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
    [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
    [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2

Without this patch, the two last lines would fail on H1 (the one using
the "all" sysctl). With the patch, everything succeeds as expected.

Also document the sysctl in `ip-sysctl.rst`.

Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/networking/ip-sysctl.rst | 3 +++
 include/linux/inetdevice.h             | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 25e6673a085a0..91069bf636235 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1554,6 +1554,9 @@ igmpv3_unsolicited_report_interval - INTEGER
 
 	Default: 1000 (1 seconds)
 
+ignore_routes_with_linkdown - BOOLEAN
+        Ignore routes whose link is down when performing a FIB lookup.
+
 promote_secondaries - BOOLEAN
 	When a primary IP address is removed from this interface
 	promote a corresponding secondary IP address instead of
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 3515ca64e638a..3bbcddd22df8c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 	  IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
 
 #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
-	IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+	IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
 
 #define IN_DEV_ARPFILTER(in_dev)	IN_DEV_ORCONF((in_dev), ARPFILTER)
 #define IN_DEV_ARP_ACCEPT(in_dev)	IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 099/717] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 100/717] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
                   ` (619 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]

Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
per-interface sysctl to tune proxy ARP support for private VLANs.
While the "all" variant is exposed, it was a noop and never evaluated.
We use the usual "or" logic for this kind of sysctls.

Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/inetdevice.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 3bbcddd22df8c..53aa0343bf694 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)	IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
 #define IN_DEV_PROXY_ARP(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP)
-#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
 #define IN_DEV_SHARED_MEDIA(in_dev)	IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
 #define IN_DEV_TX_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
 #define IN_DEV_SEC_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 100/717] ASoC: arizona: Fix a wrong free in wm8997_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 099/717] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 101/717] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
                   ` (618 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Zhang Qilong,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]

In the normal path, we should not free the arizona,
we should return immediately. It will be free when
call remove operation.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8997.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index 37e4bb3dbd8a9..229f2986cd96b 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1177,6 +1177,8 @@ static int wm8997_probe(struct platform_device *pdev)
 		goto err_spk_irqs;
 	}
 
+	return ret;
+
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 101/717] RDMa/mthca: Work around -Wenum-conversion warning
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 100/717] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 102/717] ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG Greg Kroah-Hartman
                   ` (617 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jason Gunthorpe, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]

gcc points out a suspicious mixing of enum types in a function that
converts from MTHCA_OPCODE_* values to IB_WC_* values:

drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
  607 |    entry->opcode    = MTHCA_OPCODE_INVALID;

Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
this is meaningful, but it seems harmless as it deals with an invalid
input.

Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
still bogus, but at least doesn't make compiler warnings.

Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mthca/mthca_cq.c  | 2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 119b2573c9a08..26c3408dcacae 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -604,7 +604,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
 			entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
 			break;
 		default:
-			entry->opcode    = MTHCA_OPCODE_INVALID;
+			entry->opcode = 0xFF;
 			break;
 		}
 	} else {
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 9dbbf4d16796a..a445160de3e16 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -105,7 +105,6 @@ enum {
 	MTHCA_OPCODE_ATOMIC_CS      = 0x11,
 	MTHCA_OPCODE_ATOMIC_FA      = 0x12,
 	MTHCA_OPCODE_BIND_MW        = 0x18,
-	MTHCA_OPCODE_INVALID        = 0xff
 };
 
 enum {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 102/717] ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 101/717] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 103/717] arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node Greg Kroah-Hartman
                   ` (616 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Pierre-Louis Bossart,
	Ranjani Sridharan, Mark Brown, Sasha Levin

From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>

[ Upstream commit 358f0ac1f2791c80c19cc26706cf34664c9fd756 ]

SND_INTEL_DSP_CONFIG is selected by the HDaudio, Skylake and SOF
drivers. When the HDaudio link is not selected as a option, this
Kconfig option is not touched and will default to whatever other
drivers selected. In the case e.g. where HDaudio is compiled as
built-in, the linker will complain:

ld: sound/soc/sof/sof-pci-dev.o: in function `sof_pci_probe':
sof-pci-dev.c:(.text+0x5c): undefined reference to
`snd_intel_dsp_driver_probe'

Adding the select for all HDaudio platforms, regardless of whether
they rely on the HDaudio link or not, solves the problem.

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Fixes: 82d9d54a6c0ee ('ALSA: hda: add Intel DSP configuration / probe code')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201112164425.25603-5-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/intel/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sof/intel/Kconfig b/sound/soc/sof/intel/Kconfig
index a066e08860cbf..5bfc2f8b13b90 100644
--- a/sound/soc/sof/intel/Kconfig
+++ b/sound/soc/sof/intel/Kconfig
@@ -271,6 +271,7 @@ config SND_SOC_SOF_JASPERLAKE
 
 config SND_SOC_SOF_HDA_COMMON
 	tristate
+	select SND_INTEL_DSP_CONFIG
 	select SND_SOC_SOF_INTEL_COMMON
 	select SND_SOC_SOF_HDA_LINK_BASELINE
 	help
@@ -330,7 +331,6 @@ config SND_SOC_SOF_HDA
 	tristate
 	select SND_HDA_EXT_CORE if SND_SOC_SOF_HDA_LINK
 	select SND_SOC_HDAC_HDA if SND_SOC_SOF_HDA_AUDIO_CODEC
-	select SND_INTEL_DSP_CONFIG
 	help
 	  This option is not user-selectable but automagically handled by
 	  'select' statements at a higher level
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 103/717] arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 102/717] ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 104/717] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
                   ` (615 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Jyri Sarha,
	Tomi Valkeinen, Sasha Levin

From: Nishanth Menon <nm@ti.com>

[ Upstream commit cfbf17e69ae82f647c287366b7573e532fc281ee ]

Fix the node address to follow the device tree convention.

This fixes the dtc warning:
<stdout>: Warning (simple_bus_reg): /bus@100000/dss@04a00000: simple-bus
unit address format error, expected "4a00000"

Fixes: 76921f15acc0 ("arm64: dts: ti: k3-j721e-main: Add DSS node")
Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
Signed-off-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Jyri Sarha <jsarha@ti.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://lore.kernel.org/r/20201104222519.12308-1-nm@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am65-main.dtsi  | 2 +-
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
index 533525229a8db..27f6fd9eaa0ab 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
@@ -834,7 +834,7 @@
 		};
 	};
 
-	dss: dss@04a00000 {
+	dss: dss@4a00000 {
 		compatible = "ti,am65x-dss";
 		reg =	<0x0 0x04a00000 0x0 0x1000>, /* common */
 			<0x0 0x04a02000 0x0 0x1000>, /* vidl1 */
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
index e2a96b2c423c4..c66ded9079be4 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
@@ -1278,7 +1278,7 @@
 		};
 	};
 
-	dss: dss@04a00000 {
+	dss: dss@4a00000 {
 		compatible = "ti,j721e-dss";
 		reg =
 			<0x00 0x04a00000 0x00 0x10000>, /* common_m */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 104/717] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 103/717] arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 105/717] drm/amdgpu: fix compute queue priority if num_kcq is less than 4 Greg Kroah-Hartman
                   ` (614 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran,
	Thomas Bogendoerfer, Sasha Levin

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]

When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
in the following Kbuild warning:

WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
  Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
  Selected by [y]:
  - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]

The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
depends on BCMA_DRIVER_PCI. This can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm47xx/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index 6889f74e06f54..490bb6da74b7e 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -27,6 +27,7 @@ config BCM47XX_BCMA
 	select BCMA
 	select BCMA_HOST_SOC
 	select BCMA_DRIVER_MIPS
+	select BCMA_DRIVER_PCI if PCI
 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
 	select BCMA_DRIVER_GPIO
 	default y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 105/717] drm/amdgpu: fix compute queue priority if num_kcq is less than 4
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 104/717] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 106/717] soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted Greg Kroah-Hartman
                   ` (613 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nirmoy Das, Felix Kuehling,
	Alex Deucher, Sasha Levin

From: Nirmoy Das <nirmoy.das@amd.com>

[ Upstream commit 3f66bf401e9fde1c35bb8b02dd7975659c40411d ]

Compute queues are configurable with module param, num_kcq.
amdgpu_gfx_is_high_priority_compute_queue was setting 1st 4 queues to
high priority queue leaving a null drm scheduler in
adev->gpu_sched[hw_ip]["normal_prio"].sched if num_kcq < 5.

This patch tries to fix it by alternating compute queue priority between
normal and high priority.

Fixes: 33abcb1f5a1719b1c (drm/amdgpu: set compute queue priority at mqd_init)
Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +++++++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h |  2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c  |  6 ++++--
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c   |  6 ++++--
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c   |  7 +++++--
 5 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
index 8c9bacfdbc300..c485ec86804e5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
@@ -193,10 +193,14 @@ static bool amdgpu_gfx_is_multipipe_capable(struct amdgpu_device *adev)
 }
 
 bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
-					       int queue)
+					       int pipe, int queue)
 {
-	/* Policy: make queue 0 of each pipe as high priority compute queue */
-	return (queue == 0);
+	bool multipipe_policy = amdgpu_gfx_is_multipipe_capable(adev);
+	int cond;
+	/* Policy: alternate between normal and high priority */
+	cond = multipipe_policy ? pipe : queue;
+
+	return ((cond % 2) != 0);
 
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 258498cbf1eba..f353a5b71804e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -373,7 +373,7 @@ void amdgpu_queue_mask_bit_to_mec_queue(struct amdgpu_device *adev, int bit,
 bool amdgpu_gfx_is_mec_queue_enabled(struct amdgpu_device *adev, int mec,
 				     int pipe, int queue);
 bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
-					       int queue);
+					       int pipe, int queue);
 int amdgpu_gfx_me_queue_to_bit(struct amdgpu_device *adev, int me,
 			       int pipe, int queue);
 void amdgpu_gfx_bit_to_me_queue(struct amdgpu_device *adev, int bit,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 55f4b8c3b9338..4ebb43e090999 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -4334,7 +4334,8 @@ static int gfx_v10_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
 	irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
 		+ ring->pipe;
-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
+	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+							    ring->queue) ?
 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
 	/* type-2 packets are deprecated on MEC, use type-3 instead */
 	r = amdgpu_ring_init(adev, ring, 1024,
@@ -6360,7 +6361,8 @@ static void gfx_v10_0_compute_mqd_set_priority(struct amdgpu_ring *ring, struct
 	struct amdgpu_device *adev = ring->adev;
 
 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
+		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+							      ring->queue)) {
 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
 			mqd->cp_hqd_queue_priority =
 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 94b7e0531d092..c36258d56b445 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -1915,7 +1915,8 @@ static int gfx_v8_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
 		+ ring->pipe;
 
-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
+	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+							    ring->queue) ?
 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_RING_PRIO_DEFAULT;
 	/* type-2 packets are deprecated on MEC, use type-3 instead */
 	r = amdgpu_ring_init(adev, ring, 1024,
@@ -4433,7 +4434,8 @@ static void gfx_v8_0_mqd_set_priority(struct amdgpu_ring *ring, struct vi_mqd *m
 	struct amdgpu_device *adev = ring->adev;
 
 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
+		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+							      ring->queue)) {
 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
 			mqd->cp_hqd_queue_priority =
 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 0d8e203b10efb..957c12b727676 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2228,7 +2228,8 @@ static int gfx_v9_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
 	irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
 		+ ring->pipe;
-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
+	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+							    ring->queue) ?
 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
 	/* type-2 packets are deprecated on MEC, use type-3 instead */
 	return amdgpu_ring_init(adev, ring, 1024,
@@ -3383,7 +3384,9 @@ static void gfx_v9_0_mqd_set_priority(struct amdgpu_ring *ring, struct v9_mqd *m
 	struct amdgpu_device *adev = ring->adev;
 
 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
+		if (amdgpu_gfx_is_high_priority_compute_queue(adev,
+							      ring->pipe,
+							      ring->queue)) {
 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
 			mqd->cp_hqd_queue_priority =
 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 106/717] soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 105/717] drm/amdgpu: fix compute queue priority if num_kcq is less than 4 Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 107/717] crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager Greg Kroah-Hartman
                   ` (612 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit c1995e5afaf6abf3922b5395ad1f4096951e3276 ]

If a rstctrl reset bit is already deasserted, we can just bail out early
not wait for rstst to clear. Otherwise we can have deassert fail for
already deasserted resets.

Fixes: c5117a78dd88 ("soc: ti: omap-prm: poll for reset complete during de-assert")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/omap_prm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
index 980b04c38fd94..4d41dc3cdce1f 100644
--- a/drivers/soc/ti/omap_prm.c
+++ b/drivers/soc/ti/omap_prm.c
@@ -484,6 +484,10 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,
 	struct ti_prm_platform_data *pdata = dev_get_platdata(reset->dev);
 	int ret = 0;
 
+	/* Nothing to do if the reset is already deasserted */
+	if (!omap_reset_status(rcdev, id))
+		return 0;
+
 	has_rstst = reset->prm->data->rstst ||
 		(reset->prm->data->flags & OMAP_PRM_HAS_RSTST);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 107/717] crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 106/717] soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 108/717] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
                   ` (611 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason A. Donenfeld, Herbert Xu, Sasha Levin

From: Jason A. Donenfeld <Jason@zx2c4.com>

[ Upstream commit 6569e3097f1c4a490bdf2b23d326855e04942dfd ]

The extra tests in the manager actually require the manager to be
selected too. Otherwise the linker gives errors like:

ld: arch/x86/crypto/chacha_glue.o: in function `chacha_simd_stream_xor':
chacha_glue.c:(.text+0x422): undefined reference to `crypto_simd_disabled_for_test'

Fixes: 2343d1529aff ("crypto: Kconfig - allow tests to be disabled when manager is disabled")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/Kconfig b/crypto/Kconfig
index 094ef56ab7b42..37de7d006858d 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -145,7 +145,7 @@ config CRYPTO_MANAGER_DISABLE_TESTS
 
 config CRYPTO_MANAGER_EXTRA_TESTS
 	bool "Enable extra run-time crypto self tests"
-	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS
+	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
 	help
 	  Enable extra run-time self tests of registered crypto algorithms,
 	  including randomized fuzz tests.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 108/717] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 107/717] crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 109/717] firmware: arm_scmi: Fix missing destroy_workqueue() Greg Kroah-Hartman
                   ` (610 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Xu, Giovanni Cabiddu,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Jack Xu <jack.xu@intel.com>

[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ]

The return value of qat_hal_rd_ae_csr() is always a CSR value and never
a status and should not be stored in the status variable of
qat_hal_put_rel_rd_xfer().

This removes the assignment as qat_hal_rd_ae_csr() is not expected to
fail.
A more comprehensive handling of the theoretical corner case which could
result in a fail will be submitted in a separate patch.

Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN")
Signed-off-by: Jack Xu <jack.xu@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index 6b9d47682d04d..52ef80efeddc6 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -1146,7 +1146,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
 	unsigned short mask;
 	unsigned short dr_offset = 0x10;
 
-	status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+	ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
 	if (CE_INUSE_CONTEXTS & ctx_enables) {
 		if (ctx & 0x1) {
 			pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 109/717] firmware: arm_scmi: Fix missing destroy_workqueue()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 108/717] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 110/717] drm/udl: Fix missing error code in udl_handle_damage() Greg Kroah-Hartman
                   ` (609 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Marussi, Qinglang Miao,
	Sudeep Holla, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 6bbdb46c4b1bd57839c9c0a110bd81b0be0a4046 ]

destroy_workqueue is required before the return from scmi_notification_init
in case devm_kcalloc fails to allocate registered_protocols. Fix this by
simply moving registered_protocols allocation before alloc_workqueue.

Link: https://lore.kernel.org/r/20201110074221.41235-1-miaoqinglang@huawei.com
Fixes: bd31b249692e ("firmware: arm_scmi: Add notification dispatch and delivery")
Suggested-by: Cristian Marussi <cristian.marussi@arm.com>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/arm_scmi/notify.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c
index ce336899d6366..66196b293b6c2 100644
--- a/drivers/firmware/arm_scmi/notify.c
+++ b/drivers/firmware/arm_scmi/notify.c
@@ -1474,17 +1474,17 @@ int scmi_notification_init(struct scmi_handle *handle)
 	ni->gid = gid;
 	ni->handle = handle;
 
+	ni->registered_protocols = devm_kcalloc(handle->dev, SCMI_MAX_PROTO,
+						sizeof(char *), GFP_KERNEL);
+	if (!ni->registered_protocols)
+		goto err;
+
 	ni->notify_wq = alloc_workqueue(dev_name(handle->dev),
 					WQ_UNBOUND | WQ_FREEZABLE | WQ_SYSFS,
 					0);
 	if (!ni->notify_wq)
 		goto err;
 
-	ni->registered_protocols = devm_kcalloc(handle->dev, SCMI_MAX_PROTO,
-						sizeof(char *), GFP_KERNEL);
-	if (!ni->registered_protocols)
-		goto err;
-
 	mutex_init(&ni->pending_mtx);
 	hash_init(ni->pending_events_handlers);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 110/717] drm/udl: Fix missing error code in udl_handle_damage()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 109/717] firmware: arm_scmi: Fix missing destroy_workqueue() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 111/717] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
                   ` (608 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Thomas Zimmermann,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit a7319c8f50c5e93a12997e2d0821a2f7946fb734 ]

If udl_get_urb() fails then this should return a negative error code
but currently it returns success.

Fixes: 798ce3fe1c3a ("drm/udl: Begin/end access to imported buffers in damage-handler")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201113101502.GD168908@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/udl/udl_modeset.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c
index fef43f4e3bac4..edcfd8c120c44 100644
--- a/drivers/gpu/drm/udl/udl_modeset.c
+++ b/drivers/gpu/drm/udl/udl_modeset.c
@@ -303,8 +303,10 @@ static int udl_handle_damage(struct drm_framebuffer *fb, int x, int y,
 	}
 
 	urb = udl_get_urb(dev);
-	if (!urb)
+	if (!urb) {
+		ret = -ENOMEM;
 		goto out_drm_gem_shmem_vunmap;
+	}
 	cmd = urb->transfer_buffer;
 
 	for (i = clip.y1; i < clip.y2; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 111/717] staging: greybus: codecs: Fix reference counter leak in error handling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 110/717] drm/udl: Fix missing error code in udl_handle_damage() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 112/717] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
                   ` (607 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]

gb_pm_runtime_get_sync has increased the usage counter of the device here.
Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
fixed it by adding it.

Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/audio_codec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index 494aa823e9984..42ce6c88ea753 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -490,6 +490,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
 	if (ret) {
 		dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
 				    ret);
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		return ret;
 	}
@@ -566,6 +567,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
 		break;
 	}
 	if (ret) {
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
 				    ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 112/717] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 111/717] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 113/717] scripts: kernel-doc: Restore anonymous enum parsing Greg Kroah-Hartman
                   ` (606 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ]

gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an
error path. We check interrupt is valid before calling
eventfd_ctx_fdget() to fix it.

There is the same issue in gasket_interrupt_clear_eventfd(), Add the
missed function call to fix it.

Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
index 2d6195f7300e9..864342acfd86e 100644
--- a/drivers/staging/gasket/gasket_interrupt.c
+++ b/drivers/staging/gasket/gasket_interrupt.c
@@ -487,14 +487,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
 int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
 				 int interrupt, int event_fd)
 {
-	struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
-
-	if (IS_ERR(ctx))
-		return PTR_ERR(ctx);
+	struct eventfd_ctx *ctx;
 
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
+	ctx = eventfd_ctx_fdget(event_fd);
+
+	if (IS_ERR(ctx))
+		return PTR_ERR(ctx);
+
 	interrupt_data->eventfd_ctxs[interrupt] = ctx;
 	return 0;
 }
@@ -505,6 +507,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
-	interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	if (interrupt_data->eventfd_ctxs[interrupt]) {
+		eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
+		interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	}
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 113/717] scripts: kernel-doc: Restore anonymous enum parsing
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 112/717] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 114/717] drm/amdkfd: Put ACPI table after using it Greg Kroah-Hartman
                   ` (605 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Andy Shevchenko,
	Mauro Carvalho Chehab, Jonathan Corbet, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit ae5b17e464146ddb8fee744fa2150922d6072916 ]

The commit d38c8cfb0571 ("scripts: kernel-doc: add support for typedef enum")
broke anonymous enum parsing. Restore it by relying on members rather than
its name.

Fixes: d38c8cfb0571 ("scripts: kernel-doc: add support for typedef enum")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/20201102170637.36138-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kernel-doc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index f699cf05d4098..9b6ddeb097e93 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1390,7 +1390,7 @@ sub dump_enum($$) {
 	$members = $2;
     }
 
-    if ($declaration_name) {
+    if ($members) {
 	my %_members;
 
 	$members =~ s/\s+$//;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 114/717] drm/amdkfd: Put ACPI table after using it
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 113/717] scripts: kernel-doc: Restore anonymous enum parsing Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 115/717] ionic: use mc sync for multicast filters Greg Kroah-Hartman
                   ` (604 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hanjun Guo, Felix Kuehling,
	Alex Deucher, Sasha Levin

From: Hanjun Guo <guohanjun@huawei.com>

[ Upstream commit c4cb773c702be5519442c8375a6476d08fe2cb46 ]

The acpi_get_table() should be coupled with acpi_put_table() if
the mapped table is not used at runtime to release the table
mapping which can prevent the memory leak.

In kfd_create_crat_image_acpi(), crat_table is copied to pcrat_image,
and in kfd_create_vcrat_image_cpu(), the acpi_table is only used to
get the OEM information, so those two table mappings need to be released
after using it.

Fixes: 174de876d6d0 ("drm/amdkfd: Group up CRAT related functions")
Fixes: 520b8fb755cc ("drm/amdkfd: Add topology support for CPUs")
Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index 3de5e14c5ae31..d7f67620f57ba 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -774,6 +774,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size)
 	struct acpi_table_header *crat_table;
 	acpi_status status;
 	void *pcrat_image;
+	int rc = 0;
 
 	if (!crat_image)
 		return -EINVAL;
@@ -798,14 +799,17 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size)
 	}
 
 	pcrat_image = kvmalloc(crat_table->length, GFP_KERNEL);
-	if (!pcrat_image)
-		return -ENOMEM;
+	if (!pcrat_image) {
+		rc = -ENOMEM;
+		goto out;
+	}
 
 	memcpy(pcrat_image, crat_table, crat_table->length);
 	*crat_image = pcrat_image;
 	*size = crat_table->length;
-
-	return 0;
+out:
+	acpi_put_table(crat_table);
+	return rc;
 }
 
 /* Memory required to create Virtual CRAT.
@@ -988,6 +992,7 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
 				CRAT_OEMID_LENGTH);
 		memcpy(crat_table->oem_table_id, acpi_table->oem_table_id,
 				CRAT_OEMTABLEID_LENGTH);
+		acpi_put_table(acpi_table);
 	}
 	crat_table->total_entries = 0;
 	crat_table->num_domains = 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 115/717] ionic: use mc sync for multicast filters
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 114/717] drm/amdkfd: Put ACPI table after using it Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 116/717] ionic: flatten calls to ionic_lif_rx_mode Greg Kroah-Hartman
                   ` (603 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Saeed Mahameed,
	Jakub Kicinski, Sasha Levin

From: Shannon Nelson <snelson@pensando.io>

[ Upstream commit e0243e1966592859da4c6ffe6d43e1576ec3c457 ]

We should be using the multicast sync routines for the multicast
filters.  Also, let's just flatten the logic a bit and pull
the small unicast routine back into ionic_set_rx_mode().

Fixes: 1800eee16676 ("net: ionic: Replace in_interrupt() usage.")
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/pensando/ionic/ionic_lif.c   | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index a12df3946a07c..724df18400165 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1149,15 +1149,6 @@ static void _ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode,
 	}
 }
 
-static void ionic_dev_uc_sync(struct net_device *netdev, bool from_ndo)
-{
-	if (from_ndo)
-		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
-	else
-		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
-
-}
-
 static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 {
 	struct ionic_lif *lif = netdev_priv(netdev);
@@ -1177,7 +1168,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 	 *       we remove our overflow flag and check the netdev flags
 	 *       to see if we can disable NIC PROMISC
 	 */
-	ionic_dev_uc_sync(netdev, from_ndo);
+	if (from_ndo)
+		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+	else
+		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
 	nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters);
 	if (netdev_uc_count(netdev) + 1 > nfilters) {
 		rx_mode |= IONIC_RX_MODE_F_PROMISC;
@@ -1189,7 +1183,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 	}
 
 	/* same for multicast */
-	ionic_dev_uc_sync(netdev, from_ndo);
+	if (from_ndo)
+		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+	else
+		__dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
 	nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters);
 	if (netdev_mc_count(netdev) > nfilters) {
 		rx_mode |= IONIC_RX_MODE_F_ALLMULTI;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 116/717] ionic: flatten calls to ionic_lif_rx_mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 115/717] ionic: use mc sync for multicast filters Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 117/717] ionic: change set_rx_mode from_ndo to can_sleep Greg Kroah-Hartman
                   ` (602 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Saeed Mahameed,
	Jakub Kicinski, Sasha Levin

From: Shannon Nelson <snelson@pensando.io>

[ Upstream commit e94f76bb206333efcd0c02da5dbb142518c941a2 ]

The _ionic_lif_rx_mode() is only used once and really doesn't
need to be broken out.

Signed-off-by: Shannon Nelson <snelson@pensando.io>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/pensando/ionic/ionic_lif.c   | 38 ++++++++-----------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 724df18400165..7ad9f0cc1af66 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1129,29 +1129,10 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
 		lif->rx_mode = rx_mode;
 }
 
-static void _ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode,
-			       bool from_ndo)
-{
-	struct ionic_deferred_work *work;
-
-	if (from_ndo) {
-		work = kzalloc(sizeof(*work), GFP_ATOMIC);
-		if (!work) {
-			netdev_err(lif->netdev, "%s OOM\n", __func__);
-			return;
-		}
-		work->type = IONIC_DW_TYPE_RX_MODE;
-		work->rx_mode = rx_mode;
-		netdev_dbg(lif->netdev, "deferred: rx_mode\n");
-		ionic_lif_deferred_enqueue(&lif->deferred, work);
-	} else {
-		ionic_lif_rx_mode(lif, rx_mode);
-	}
-}
-
 static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 {
 	struct ionic_lif *lif = netdev_priv(netdev);
+	struct ionic_deferred_work *work;
 	unsigned int nfilters;
 	unsigned int rx_mode;
 
@@ -1197,8 +1178,21 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 			rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI;
 	}
 
-	if (lif->rx_mode != rx_mode)
-		_ionic_lif_rx_mode(lif, rx_mode, from_ndo);
+	if (lif->rx_mode != rx_mode) {
+		if (from_ndo) {
+			work = kzalloc(sizeof(*work), GFP_ATOMIC);
+			if (!work) {
+				netdev_err(lif->netdev, "%s OOM\n", __func__);
+				return;
+			}
+			work->type = IONIC_DW_TYPE_RX_MODE;
+			work->rx_mode = rx_mode;
+			netdev_dbg(lif->netdev, "deferred: rx_mode\n");
+			ionic_lif_deferred_enqueue(&lif->deferred, work);
+		} else {
+			ionic_lif_rx_mode(lif, rx_mode);
+		}
+	}
 }
 
 static void ionic_ndo_set_rx_mode(struct net_device *netdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 117/717] ionic: change set_rx_mode from_ndo to can_sleep
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 116/717] ionic: flatten calls to ionic_lif_rx_mode Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 118/717] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
                   ` (601 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Saeed Mahameed,
	Jakub Kicinski, Sasha Levin

From: Shannon Nelson <snelson@pensando.io>

[ Upstream commit 81dbc24147f9250c186ae5875b3ed3136e9e293b ]

Instead of having two different ways of expressing the same
sleepability concept, using opposite logic, we can rework the
from_ndo to can_sleep for a more consistent usage.

Fixes: 1800eee16676 ("net: ionic: Replace in_interrupt() usage.")
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/pensando/ionic/ionic_lif.c   | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 7ad9f0cc1af66..c968c5c5a60a0 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1129,7 +1129,7 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
 		lif->rx_mode = rx_mode;
 }
 
-static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep)
 {
 	struct ionic_lif *lif = netdev_priv(netdev);
 	struct ionic_deferred_work *work;
@@ -1149,10 +1149,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 	 *       we remove our overflow flag and check the netdev flags
 	 *       to see if we can disable NIC PROMISC
 	 */
-	if (from_ndo)
-		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
-	else
+	if (can_sleep)
 		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
+	else
+		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
 	nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters);
 	if (netdev_uc_count(netdev) + 1 > nfilters) {
 		rx_mode |= IONIC_RX_MODE_F_PROMISC;
@@ -1164,10 +1164,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 	}
 
 	/* same for multicast */
-	if (from_ndo)
-		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
-	else
+	if (can_sleep)
 		__dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
+	else
+		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
 	nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters);
 	if (netdev_mc_count(netdev) > nfilters) {
 		rx_mode |= IONIC_RX_MODE_F_ALLMULTI;
@@ -1179,7 +1179,7 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 	}
 
 	if (lif->rx_mode != rx_mode) {
-		if (from_ndo) {
+		if (!can_sleep) {
 			work = kzalloc(sizeof(*work), GFP_ATOMIC);
 			if (!work) {
 				netdev_err(lif->netdev, "%s OOM\n", __func__);
@@ -1197,7 +1197,7 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
 
 static void ionic_ndo_set_rx_mode(struct net_device *netdev)
 {
-	ionic_set_rx_mode(netdev, true);
+	ionic_set_rx_mode(netdev, false);
 }
 
 static __le64 ionic_netdev_features_to_nic(netdev_features_t features)
@@ -1764,7 +1764,7 @@ static int ionic_txrx_init(struct ionic_lif *lif)
 	if (lif->netdev->features & NETIF_F_RXHASH)
 		ionic_lif_rss_init(lif);
 
-	ionic_set_rx_mode(lif->netdev, false);
+	ionic_set_rx_mode(lif->netdev, true);
 
 	return 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 118/717] media: tm6000: Fix sizeof() mismatches
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 117/717] ionic: change set_rx_mode from_ndo to can_sleep Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 119/717] media: platform: add missing put_device() call in mtk_jpeg_clk_init() Greg Kroah-Hartman
                   ` (600 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ]

The are two instances of sizeof() being used incorrectly. The
sizeof(void *) is incorrect because urb_buffer is a char ** pointer,
fix this by using sizeof(*dev->urb_buffer).  The sizeof(dma_addr_t *)
is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t
and not a dma_addr_t *.  This errors did not cause any issues because
it just so happens the sizes are the same.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")

Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-video.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index bfba06ea60e9d..2df736c029d6e 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -461,11 +461,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
 	if (dev->urb_buffer)
 		return 0;
 
-	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
+	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
+					GFP_KERNEL);
 	if (!dev->urb_buffer)
 		return -ENOMEM;
 
-	dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
+	dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
 				     GFP_KERNEL);
 	if (!dev->urb_dma)
 		return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 119/717] media: platform: add missing put_device() call in mtk_jpeg_clk_init()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 118/717] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 120/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
                   ` (599 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit f28a81a3b64270da3588174feff4628c36e0ff4e ]

if of_find_device_by_node() succeeds, mtk_jpeg_clk_init() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: 648372a87cee ("media: platform: Change the call functions of getting/enable/disable the jpeg's clock")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 227245ccaedc7..106543391c460 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -1306,6 +1306,7 @@ static int mtk_jpeg_clk_init(struct mtk_jpeg_dev *jpeg)
 				jpeg->variant->clks);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to get jpeg clock:%d\n", ret);
+		put_device(&pdev->dev);
 		return ret;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 120/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 119/717] media: platform: add missing put_device() call in mtk_jpeg_clk_init() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:41 ` [PATCH 5.10 121/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
                   ` (598 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 5d4fa2c50125c9cda9e380d89268757cc5fa743d ]

if of_find_device_by_node() succeed, mtk_vcodec_init_dec_pm() doesn't have
a corresponding put_device(). Thus add jump target to fix the exception
handling for this function implementation.

Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/mtk-vcodec/mtk_vcodec_dec_pm.c    | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 36dfe3fc056a4..f6a6b42865fbd 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -47,11 +47,14 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
 		dec_clk->clk_info = devm_kcalloc(&pdev->dev,
 			dec_clk->clk_num, sizeof(*clk_info),
 			GFP_KERNEL);
-		if (!dec_clk->clk_info)
-			return -ENOMEM;
+		if (!dec_clk->clk_info) {
+			ret = -ENOMEM;
+			goto put_device;
+		}
 	} else {
 		mtk_v4l2_err("Failed to get vdec clock count");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_device;
 	}
 
 	for (i = 0; i < dec_clk->clk_num; i++) {
@@ -60,19 +63,22 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
 			"clock-names", i, &clk_info->clk_name);
 		if (ret) {
 			mtk_v4l2_err("Failed to get clock name id = %d", i);
-			return ret;
+			goto put_device;
 		}
 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
 			clk_info->clk_name);
 		if (IS_ERR(clk_info->vcodec_clk)) {
 			mtk_v4l2_err("devm_clk_get (%d)%s fail", i,
 				clk_info->clk_name);
-			return PTR_ERR(clk_info->vcodec_clk);
+			ret = PTR_ERR(clk_info->vcodec_clk);
+			goto put_device;
 		}
 	}
 
 	pm_runtime_enable(&pdev->dev);
-
+	return 0;
+put_device:
+	put_device(pm->larbvdec);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 121/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 120/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:41 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 122/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
                   ` (597 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:41 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]

mtk_vcodec_release_dec_pm() will be called in two places:

a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
b. mtk_vcodec_dec_remove().

In both cases put_device() call is needed, since of_find_device_by_node()
was called in mtk_vcodec_init_dec_pm() previously.

Thus add put_devices() call in mtk_vcodec_release_dec_pm()

Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index f6a6b42865fbd..ddee7046ce422 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -85,6 +85,7 @@ put_device:
 void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
 {
 	pm_runtime_disable(dev->pm.dev);
+	put_device(dev->pm.larbvdec);
 }
 
 void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 122/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-12-28 12:41 ` [PATCH 5.10 121/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 123/717] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
                   ` (596 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 4affafd7bec7c65da31777f18bd20420f1aeb5f8 ]

if of_find_device_by_node() succeed, mtk_vcodec_init_enc_pm() doesn't have
a corresponding put_device(). Thus add jump target to fix the exception
handling for this function implementation.

Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/mtk-vcodec/mtk_vcodec_enc_pm.c   | 26 ++++++++++++++-----
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
index ee22902aaa71c..1a047c25679fa 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
@@ -47,14 +47,16 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_larbvenc;
 	}
 
 	pdev = of_find_device_by_node(node);
 	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_larbvenc;
 	}
 
 	pm->larbvenclt = &pdev->dev;
@@ -67,11 +69,14 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 		enc_clk->clk_info = devm_kcalloc(&pdev->dev,
 			enc_clk->clk_num, sizeof(*clk_info),
 			GFP_KERNEL);
-		if (!enc_clk->clk_info)
-			return -ENOMEM;
+		if (!enc_clk->clk_info) {
+			ret = -ENOMEM;
+			goto put_larbvenclt;
+		}
 	} else {
 		mtk_v4l2_err("Failed to get venc clock count");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_larbvenclt;
 	}
 
 	for (i = 0; i < enc_clk->clk_num; i++) {
@@ -80,17 +85,24 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 			"clock-names", i, &clk_info->clk_name);
 		if (ret) {
 			mtk_v4l2_err("venc failed to get clk name %d", i);
-			return ret;
+			goto put_larbvenclt;
 		}
 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
 			clk_info->clk_name);
 		if (IS_ERR(clk_info->vcodec_clk)) {
 			mtk_v4l2_err("venc devm_clk_get (%d)%s fail", i,
 				clk_info->clk_name);
-			return PTR_ERR(clk_info->vcodec_clk);
+			ret = PTR_ERR(clk_info->vcodec_clk);
+			goto put_larbvenclt;
 		}
 	}
 
+	return 0;
+
+put_larbvenclt:
+	put_device(pm->larbvenclt);
+put_larbvenc:
+	put_device(pm->larbvenc);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 123/717] media: v4l2-fwnode: Return -EINVAL for invalid bus-type
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 122/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 124/717] media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument Greg Kroah-Hartman
                   ` (595 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

[ Upstream commit 69baf338fc16a4d55c78da8874ce3f06feb38c78 ]

Return -EINVAL if invalid bus-type is detected while parsing endpoints.

Fixes: 26c1126c9b56 ("media: v4l: fwnode: Use media bus type for bus parser selection")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-fwnode.c | 6 +++++-
 include/media/v4l2-mediabus.h         | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index d7bbe33840cb4..dfc53d11053fc 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -93,7 +93,7 @@ v4l2_fwnode_bus_type_to_mbus(enum v4l2_fwnode_bus_type type)
 	const struct v4l2_fwnode_bus_conv *conv =
 		get_v4l2_fwnode_bus_conv_by_fwnode_bus(type);
 
-	return conv ? conv->mbus_type : V4L2_MBUS_UNKNOWN;
+	return conv ? conv->mbus_type : V4L2_MBUS_INVALID;
 }
 
 static const char *
@@ -436,6 +436,10 @@ static int __v4l2_fwnode_endpoint_parse(struct fwnode_handle *fwnode,
 		 v4l2_fwnode_mbus_type_to_string(vep->bus_type),
 		 vep->bus_type);
 	mbus_type = v4l2_fwnode_bus_type_to_mbus(bus_type);
+	if (mbus_type == V4L2_MBUS_INVALID) {
+		pr_debug("unsupported bus type %u\n", bus_type);
+		return -EINVAL;
+	}
 
 	if (vep->bus_type != V4L2_MBUS_UNKNOWN) {
 		if (mbus_type != V4L2_MBUS_UNKNOWN &&
diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h
index 59b1de1971142..c20e2dc6d4320 100644
--- a/include/media/v4l2-mediabus.h
+++ b/include/media/v4l2-mediabus.h
@@ -103,6 +103,7 @@
  * @V4L2_MBUS_CCP2:	CCP2 (Compact Camera Port 2)
  * @V4L2_MBUS_CSI2_DPHY: MIPI CSI-2 serial interface, with D-PHY
  * @V4L2_MBUS_CSI2_CPHY: MIPI CSI-2 serial interface, with C-PHY
+ * @V4L2_MBUS_INVALID:	invalid bus type (keep as last)
  */
 enum v4l2_mbus_type {
 	V4L2_MBUS_UNKNOWN,
@@ -112,6 +113,7 @@ enum v4l2_mbus_type {
 	V4L2_MBUS_CCP2,
 	V4L2_MBUS_CSI2_DPHY,
 	V4L2_MBUS_CSI2_CPHY,
+	V4L2_MBUS_INVALID,
 };
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 124/717] media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 123/717] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 125/717] media: ov5640: fix support of BT656 bus mode Greg Kroah-Hartman
                   ` (594 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Niklas Söderlund,
	Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin

From: Sakari Ailus <sakari.ailus@linux.intel.com>

[ Upstream commit b3cc73d2bf14e7c6e0376fa9433e708349e9ddfc ]

Document that the caller of v4l2_fwnode_endpoint_parse() must init the
fields of struct v4l2_fwnode_endpoint (vep argument) fields.

It used to be that the fields were zeroed by v4l2_fwnode_endpoint_parse
when bus type was set to V4L2_MBUS_UNKNOWN but with recent changes (Fixes:
line below) that no longer makes sense.

Fixes: bb4bba9232fc ("media: v4l2-fwnode: Make bus configuration a struct")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/media/v4l2-fwnode.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/media/v4l2-fwnode.h b/include/media/v4l2-fwnode.h
index c090742765431..ed0840f3d5dff 100644
--- a/include/media/v4l2-fwnode.h
+++ b/include/media/v4l2-fwnode.h
@@ -231,6 +231,9 @@ struct v4l2_fwnode_connector {
  * guessing @vep.bus_type between CSI-2 D-PHY, parallel and BT.656 busses is
  * supported. NEVER RELY ON GUESSING @vep.bus_type IN NEW DRIVERS!
  *
+ * The caller is required to initialise all fields of @vep, either with
+ * explicitly values, or by zeroing them.
+ *
  * The function does not change the V4L2 fwnode endpoint state if it fails.
  *
  * NOTE: This function does not parse properties the size of which is variable
@@ -273,6 +276,9 @@ void v4l2_fwnode_endpoint_free(struct v4l2_fwnode_endpoint *vep);
  * guessing @vep.bus_type between CSI-2 D-PHY, parallel and BT.656 busses is
  * supported. NEVER RELY ON GUESSING @vep.bus_type IN NEW DRIVERS!
  *
+ * The caller is required to initialise all fields of @vep, either with
+ * explicitly values, or by zeroing them.
+ *
  * The function does not change the V4L2 fwnode endpoint state if it fails.
  *
  * v4l2_fwnode_endpoint_alloc_parse() has two important differences to
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 125/717] media: ov5640: fix support of BT656 bus mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 124/717] media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 126/717] media: staging: rkisp1: cap: fix runtime PM imbalance on error Greg Kroah-Hartman
                   ` (593 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hugues Fruchet, Jacopo Mondi,
	Lad Prabhakar, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Hugues Fruchet <hugues.fruchet@st.com>

[ Upstream commit 68579b32e786f9680e7c6b6c7d17e26943bb02b3 ]

Fix PCLK polarity not being taken into account.
Add comments about BT656 register control.
Remove useless ov5640_set_stream_bt656() function.
Refine comments about MIPI IO register control.

Fixes: 4039b03720f7 ("media: i2c: ov5640: Add support for BT656 mode")
Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5640.c | 82 +++++++++++++++++++++-----------------
 1 file changed, 45 insertions(+), 37 deletions(-)

diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index 8d0254d0e5ea7..8f0812e859012 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -1216,20 +1216,6 @@ static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on)
 			      BIT(1), on ? 0 : BIT(1));
 }
 
-static int ov5640_set_stream_bt656(struct ov5640_dev *sensor, bool on)
-{
-	int ret;
-
-	ret = ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00,
-			       on ? 0x1 : 0x00);
-	if (ret)
-		return ret;
-
-	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
-				OV5640_REG_SYS_CTRL0_SW_PWUP :
-				OV5640_REG_SYS_CTRL0_SW_PWDN);
-}
-
 static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
 {
 	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
@@ -1994,13 +1980,13 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on)
 static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
 {
 	unsigned int flags = sensor->ep.bus.parallel.flags;
-	u8 pclk_pol = 0;
-	u8 hsync_pol = 0;
-	u8 vsync_pol = 0;
+	bool bt656 = sensor->ep.bus_type == V4L2_MBUS_BT656;
+	u8 polarities = 0;
 	int ret;
 
 	if (!on) {
 		/* Reset settings to their default values. */
+		ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00, 0x00);
 		ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58);
 		ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, 0x20);
 		ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00);
@@ -2024,7 +2010,35 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
 	 * - VSYNC:	active high
 	 * - HREF:	active low
 	 * - PCLK:	active low
+	 *
+	 * VSYNC & HREF are not configured if BT656 bus mode is selected
 	 */
+
+	/*
+	 * BT656 embedded synchronization configuration
+	 *
+	 * CCIR656 CTRL00
+	 * - [7]:	SYNC code selection (0: auto generate sync code,
+	 *		1: sync code from regs 0x4732-0x4735)
+	 * - [6]:	f value in CCIR656 SYNC code when fixed f value
+	 * - [5]:	Fixed f value
+	 * - [4:3]:	Blank toggle data options (00: data=1'h040/1'h200,
+	 *		01: data from regs 0x4736-0x4738, 10: always keep 0)
+	 * - [1]:	Clip data disable
+	 * - [0]:	CCIR656 mode enable
+	 *
+	 * Default CCIR656 SAV/EAV mode with default codes
+	 * SAV=0xff000080 & EAV=0xff00009d is enabled here with settings:
+	 * - CCIR656 mode enable
+	 * - auto generation of sync codes
+	 * - blank toggle data 1'h040/1'h200
+	 * - clip reserved data (0x00 & 0xff changed to 0x01 & 0xfe)
+	 */
+	ret = ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00,
+			       bt656 ? 0x01 : 0x00);
+	if (ret)
+		return ret;
+
 	/*
 	 * configure parallel port control lines polarity
 	 *
@@ -2035,29 +2049,26 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
 	 *		datasheet and hardware, 0 is active high
 	 *		and 1 is active low...)
 	 */
-	if (sensor->ep.bus_type == V4L2_MBUS_PARALLEL) {
-		if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING)
-			pclk_pol = 1;
+	if (!bt656) {
 		if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH)
-			hsync_pol = 1;
+			polarities |= BIT(1);
 		if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW)
-			vsync_pol = 1;
-
-		ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00,
-				       (pclk_pol << 5) | (hsync_pol << 1) |
-				       vsync_pol);
-
-		if (ret)
-			return ret;
+			polarities |= BIT(0);
 	}
+	if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING)
+		polarities |= BIT(5);
+
+	ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, polarities);
+	if (ret)
+		return ret;
 
 	/*
-	 * powerdown MIPI TX/RX PHY & disable MIPI
+	 * powerdown MIPI TX/RX PHY & enable DVP
 	 *
 	 * MIPI CONTROL 00
-	 * 4:	 PWDN PHY TX
-	 * 3:	 PWDN PHY RX
-	 * 2:	 MIPI enable
+	 * [4] = 1	: Power down MIPI HS Tx
+	 * [3] = 1	: Power down MIPI LS Rx
+	 * [2] = 0	: DVP enable (MIPI disable)
 	 */
 	ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x18);
 	if (ret)
@@ -2074,8 +2085,7 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
 	 * - [3:0]:	D[9:6] output enable
 	 */
 	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01,
-			       sensor->ep.bus_type == V4L2_MBUS_PARALLEL ?
-			       0x7f : 0x1f);
+			       bt656 ? 0x1f : 0x7f);
 	if (ret)
 		return ret;
 
@@ -2925,8 +2935,6 @@ static int ov5640_s_stream(struct v4l2_subdev *sd, int enable)
 
 		if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY)
 			ret = ov5640_set_stream_mipi(sensor, enable);
-		else if (sensor->ep.bus_type == V4L2_MBUS_BT656)
-			ret = ov5640_set_stream_bt656(sensor, enable);
 		else
 			ret = ov5640_set_stream_dvp(sensor, enable);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 126/717] media: staging: rkisp1: cap: fix runtime PM imbalance on error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 125/717] media: ov5640: fix support of BT656 bus mode Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 127/717] media: cedrus: fix reference leak in cedrus_start_streaming Greg Kroah-Hartman
                   ` (592 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 4cbbe2aaa0536b0e7b3dfbd7febc3bc2ec300559 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference imbalance in rkisp1_vb2_start_streaming, so we
should fix it.

Fixes: 56e3b29f9f6b2 ("media: staging: rkisp1: add streaming paths")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/rkisp1/rkisp1-capture.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/media/rkisp1/rkisp1-capture.c b/drivers/staging/media/rkisp1/rkisp1-capture.c
index b6f497ce3e95c..0c934ca5adaa3 100644
--- a/drivers/staging/media/rkisp1/rkisp1-capture.c
+++ b/drivers/staging/media/rkisp1/rkisp1-capture.c
@@ -992,6 +992,7 @@ rkisp1_vb2_start_streaming(struct vb2_queue *queue, unsigned int count)
 
 	ret = pm_runtime_get_sync(cap->rkisp1->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(cap->rkisp1->dev);
 		dev_err(cap->rkisp1->dev, "power up failed %d\n", ret);
 		goto err_destroy_dummy;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 127/717] media: cedrus: fix reference leak in cedrus_start_streaming
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 126/717] media: staging: rkisp1: cap: fix runtime PM imbalance on error Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 128/717] media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove() Greg Kroah-Hartman
                   ` (591 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 940727bf22f74cbdef8de327de34c4ae565c89ea ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in cedrus_start_streaming. We should fix it.

Fixes: d5aecd289babf ("media: cedrus: Implement runtime PM")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/sunxi/cedrus/cedrus_video.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
index 667b86dde1ee8..911f607d9b092 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
@@ -479,8 +479,10 @@ static int cedrus_start_streaming(struct vb2_queue *vq, unsigned int count)
 
 	if (V4L2_TYPE_IS_OUTPUT(vq->type)) {
 		ret = pm_runtime_get_sync(dev->dev);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_noidle(dev->dev);
 			goto err_cleanup;
+		}
 
 		if (dev->dec_ops[ctx->current_codec]->start) {
 			ret = dev->dec_ops[ctx->current_codec]->start(ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 128/717] media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 127/717] media: cedrus: fix reference leak in cedrus_start_streaming Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 129/717] media: venus: core: change clk enable and disable order in resume and suspend Greg Kroah-Hartman
                   ` (590 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 0d72f489995bb8565f6fe30539d4504c88356a9e ]

if mtk_jpeg_clk_init() succeed, mtk_jpeg_probe() and mtk_jpeg_remove()
doesn't have a corresponding put_device(). Thus add a new helper
mtk_jpeg_clk_release() to fix it.

Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 106543391c460..88a23bce569d9 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -1332,6 +1332,12 @@ static void mtk_jpeg_job_timeout_work(struct work_struct *work)
 	v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
 	v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
 }
+
+static inline void mtk_jpeg_clk_release(struct mtk_jpeg_dev *jpeg)
+{
+	put_device(jpeg->larb);
+}
+
 static int mtk_jpeg_probe(struct platform_device *pdev)
 {
 	struct mtk_jpeg_dev *jpeg;
@@ -1436,6 +1442,7 @@ err_m2m_init:
 	v4l2_device_unregister(&jpeg->v4l2_dev);
 
 err_dev_register:
+	mtk_jpeg_clk_release(jpeg);
 
 err_clk_init:
 
@@ -1453,6 +1460,7 @@ static int mtk_jpeg_remove(struct platform_device *pdev)
 	video_device_release(jpeg->vdev);
 	v4l2_m2m_release(jpeg->m2m_dev);
 	v4l2_device_unregister(&jpeg->v4l2_dev);
+	mtk_jpeg_clk_release(jpeg);
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 129/717] media: venus: core: change clk enable and disable order in resume and suspend
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 128/717] media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 130/717] media: venus: core: vote for video-mem path Greg Kroah-Hartman
                   ` (589 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik, Stephen Boyd,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Mansur Alisha Shaik <mansur@codeaurora.org>

[ Upstream commit 21926d466e3a4f35c2536244d1d56512cc81a0a9 ]

Currently video driver is voting after clk enable and un voting
before clk disable. This is incorrect, video driver should vote
before clk enable and unvote after clk disable.

Corrected this by changing the order of clk enable and clk disable.

suspend")

Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/core.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 6103aaf43987b..52a3886c496eb 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -355,13 +355,16 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
 	if (ret)
 		return ret;
 
+	if (pm_ops->core_power) {
+		ret = pm_ops->core_power(dev, POWER_OFF);
+		if (ret)
+			return ret;
+	}
+
 	ret = icc_set_bw(core->cpucfg_path, 0, 0);
 	if (ret)
 		return ret;
 
-	if (pm_ops->core_power)
-		ret = pm_ops->core_power(dev, POWER_OFF);
-
 	return ret;
 }
 
@@ -371,16 +374,16 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
 	const struct venus_pm_ops *pm_ops = core->pm_ops;
 	int ret;
 
+	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
+	if (ret)
+		return ret;
+
 	if (pm_ops->core_power) {
 		ret = pm_ops->core_power(dev, POWER_ON);
 		if (ret)
 			return ret;
 	}
 
-	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
-	if (ret)
-		return ret;
-
 	return hfi_core_resume(core, false);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 130/717] media: venus: core: vote for video-mem path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 129/717] media: venus: core: change clk enable and disable order in resume and suspend Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 131/717] media: venus: core: vote with average bandwidth and peak bandwidth as zero Greg Kroah-Hartman
                   ` (588 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik, Stephen Boyd,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Mansur Alisha Shaik <mansur@codeaurora.org>

[ Upstream commit 9e8efdb5787986cc0d0134925cf5c4f001bb3f2e ]

Currently video driver is voting for venus0-ebi path during buffer
processing with an average bandwidth of all the instances and
unvoting during session release.

While video streaming when we try to do XO-SD using the command
"echo mem > /sys/power/state command" , device is not entering
to suspend state and from interconnect summary seeing votes for venus0-ebi

Corrected this by voting for venus0-ebi path in venus_runtime_resume()
and unvote during venus_runtime_suspend().

suspend")

Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/core.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 52a3886c496eb..fa363b8ddc070 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -363,7 +363,18 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
 
 	ret = icc_set_bw(core->cpucfg_path, 0, 0);
 	if (ret)
-		return ret;
+		goto err_cpucfg_path;
+
+	ret = icc_set_bw(core->video_path, 0, 0);
+	if (ret)
+		goto err_video_path;
+
+	return ret;
+
+err_video_path:
+	icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
+err_cpucfg_path:
+	pm_ops->core_power(dev, POWER_ON);
 
 	return ret;
 }
@@ -374,6 +385,10 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
 	const struct venus_pm_ops *pm_ops = core->pm_ops;
 	int ret;
 
+	ret = icc_set_bw(core->video_path, 0, kbps_to_icc(1000));
+	if (ret)
+		return ret;
+
 	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
 	if (ret)
 		return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 131/717] media: venus: core: vote with average bandwidth and peak bandwidth as zero
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 130/717] media: venus: core: vote for video-mem path Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 132/717] RDMA/cma: Add missing error handling of listen_id Greg Kroah-Hartman
                   ` (587 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik, Stephen Boyd,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Mansur Alisha Shaik <mansur@codeaurora.org>

[ Upstream commit e44fb034b03231cd117d6db73fb8048deab6ea41 ]

As per bandwidth table video driver is voting with average bandwidth
for "video-mem" and "cpu-cfg" paths as peak bandwidth is zero
in bandwidth table.

suspend")

Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index fa363b8ddc070..d5bfd6fff85b4 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -385,11 +385,11 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
 	const struct venus_pm_ops *pm_ops = core->pm_ops;
 	int ret;
 
-	ret = icc_set_bw(core->video_path, 0, kbps_to_icc(1000));
+	ret = icc_set_bw(core->video_path, kbps_to_icc(20000), 0);
 	if (ret)
 		return ret;
 
-	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
+	ret = icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
 	if (ret)
 		return ret;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 132/717] RDMA/cma: Add missing error handling of listen_id
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 131/717] media: venus: core: vote with average bandwidth and peak bandwidth as zero Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 133/717] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
                   ` (586 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe,
	Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit c80a0c52d85c49a910d0dc0e342e8d8898677dc0 ]

Don't silently continue if rdma_listen() fails but destroy previously
created CM_ID and return an error to the caller.

Fixes: d02d1f5359e7 ("RDMA/cma: Fix deadlock destroying listen requests")
Link: https://lore.kernel.org/r/20201104144008.3808124-5-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 175 ++++++++++++++++++++--------------
 1 file changed, 101 insertions(+), 74 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index a77750b8954db..4585f654f8836 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2495,8 +2495,8 @@ static int cma_listen_handler(struct rdma_cm_id *id,
 	return id_priv->id.event_handler(id, event);
 }
 
-static void cma_listen_on_dev(struct rdma_id_private *id_priv,
-			      struct cma_device *cma_dev)
+static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+			     struct cma_device *cma_dev)
 {
 	struct rdma_id_private *dev_id_priv;
 	struct net *net = id_priv->id.route.addr.dev_addr.net;
@@ -2505,13 +2505,13 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv,
 	lockdep_assert_held(&lock);
 
 	if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1))
-		return;
+		return 0;
 
 	dev_id_priv =
 		__rdma_create_id(net, cma_listen_handler, id_priv,
 				 id_priv->id.ps, id_priv->id.qp_type, id_priv);
 	if (IS_ERR(dev_id_priv))
-		return;
+		return PTR_ERR(dev_id_priv);
 
 	dev_id_priv->state = RDMA_CM_ADDR_BOUND;
 	memcpy(cma_src_addr(dev_id_priv), cma_src_addr(id_priv),
@@ -2527,19 +2527,34 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv,
 
 	ret = rdma_listen(&dev_id_priv->id, id_priv->backlog);
 	if (ret)
-		dev_warn(&cma_dev->device->dev,
-			 "RDMA CMA: cma_listen_on_dev, error %d\n", ret);
+		goto err_listen;
+	return 0;
+err_listen:
+	list_del(&id_priv->listen_list);
+	dev_warn(&cma_dev->device->dev, "RDMA CMA: %s, error %d\n", __func__, ret);
+	rdma_destroy_id(&dev_id_priv->id);
+	return ret;
 }
 
-static void cma_listen_on_all(struct rdma_id_private *id_priv)
+static int cma_listen_on_all(struct rdma_id_private *id_priv)
 {
 	struct cma_device *cma_dev;
+	int ret;
 
 	mutex_lock(&lock);
 	list_add_tail(&id_priv->list, &listen_any_list);
-	list_for_each_entry(cma_dev, &dev_list, list)
-		cma_listen_on_dev(id_priv, cma_dev);
+	list_for_each_entry(cma_dev, &dev_list, list) {
+		ret = cma_listen_on_dev(id_priv, cma_dev);
+		if (ret)
+			goto err_listen;
+	}
+	mutex_unlock(&lock);
+	return 0;
+
+err_listen:
+	list_del(&id_priv->list);
 	mutex_unlock(&lock);
+	return ret;
 }
 
 void rdma_set_service_type(struct rdma_cm_id *id, int tos)
@@ -3692,8 +3707,11 @@ int rdma_listen(struct rdma_cm_id *id, int backlog)
 			ret = -ENOSYS;
 			goto err;
 		}
-	} else
-		cma_listen_on_all(id_priv);
+	} else {
+		ret = cma_listen_on_all(id_priv);
+		if (ret)
+			goto err;
+	}
 
 	return 0;
 err:
@@ -4773,69 +4791,6 @@ static struct notifier_block cma_nb = {
 	.notifier_call = cma_netdev_callback
 };
 
-static int cma_add_one(struct ib_device *device)
-{
-	struct cma_device *cma_dev;
-	struct rdma_id_private *id_priv;
-	unsigned int i;
-	unsigned long supported_gids = 0;
-	int ret;
-
-	cma_dev = kmalloc(sizeof *cma_dev, GFP_KERNEL);
-	if (!cma_dev)
-		return -ENOMEM;
-
-	cma_dev->device = device;
-	cma_dev->default_gid_type = kcalloc(device->phys_port_cnt,
-					    sizeof(*cma_dev->default_gid_type),
-					    GFP_KERNEL);
-	if (!cma_dev->default_gid_type) {
-		ret = -ENOMEM;
-		goto free_cma_dev;
-	}
-
-	cma_dev->default_roce_tos = kcalloc(device->phys_port_cnt,
-					    sizeof(*cma_dev->default_roce_tos),
-					    GFP_KERNEL);
-	if (!cma_dev->default_roce_tos) {
-		ret = -ENOMEM;
-		goto free_gid_type;
-	}
-
-	rdma_for_each_port (device, i) {
-		supported_gids = roce_gid_type_mask_support(device, i);
-		WARN_ON(!supported_gids);
-		if (supported_gids & (1 << CMA_PREFERRED_ROCE_GID_TYPE))
-			cma_dev->default_gid_type[i - rdma_start_port(device)] =
-				CMA_PREFERRED_ROCE_GID_TYPE;
-		else
-			cma_dev->default_gid_type[i - rdma_start_port(device)] =
-				find_first_bit(&supported_gids, BITS_PER_LONG);
-		cma_dev->default_roce_tos[i - rdma_start_port(device)] = 0;
-	}
-
-	init_completion(&cma_dev->comp);
-	refcount_set(&cma_dev->refcount, 1);
-	INIT_LIST_HEAD(&cma_dev->id_list);
-	ib_set_client_data(device, &cma_client, cma_dev);
-
-	mutex_lock(&lock);
-	list_add_tail(&cma_dev->list, &dev_list);
-	list_for_each_entry(id_priv, &listen_any_list, list)
-		cma_listen_on_dev(id_priv, cma_dev);
-	mutex_unlock(&lock);
-
-	trace_cm_add_one(device);
-	return 0;
-
-free_gid_type:
-	kfree(cma_dev->default_gid_type);
-
-free_cma_dev:
-	kfree(cma_dev);
-	return ret;
-}
-
 static void cma_send_device_removal_put(struct rdma_id_private *id_priv)
 {
 	struct rdma_cm_event event = { .event = RDMA_CM_EVENT_DEVICE_REMOVAL };
@@ -4898,6 +4853,78 @@ static void cma_process_remove(struct cma_device *cma_dev)
 	wait_for_completion(&cma_dev->comp);
 }
 
+static int cma_add_one(struct ib_device *device)
+{
+	struct cma_device *cma_dev;
+	struct rdma_id_private *id_priv;
+	unsigned int i;
+	unsigned long supported_gids = 0;
+	int ret;
+
+	cma_dev = kmalloc(sizeof(*cma_dev), GFP_KERNEL);
+	if (!cma_dev)
+		return -ENOMEM;
+
+	cma_dev->device = device;
+	cma_dev->default_gid_type = kcalloc(device->phys_port_cnt,
+					    sizeof(*cma_dev->default_gid_type),
+					    GFP_KERNEL);
+	if (!cma_dev->default_gid_type) {
+		ret = -ENOMEM;
+		goto free_cma_dev;
+	}
+
+	cma_dev->default_roce_tos = kcalloc(device->phys_port_cnt,
+					    sizeof(*cma_dev->default_roce_tos),
+					    GFP_KERNEL);
+	if (!cma_dev->default_roce_tos) {
+		ret = -ENOMEM;
+		goto free_gid_type;
+	}
+
+	rdma_for_each_port (device, i) {
+		supported_gids = roce_gid_type_mask_support(device, i);
+		WARN_ON(!supported_gids);
+		if (supported_gids & (1 << CMA_PREFERRED_ROCE_GID_TYPE))
+			cma_dev->default_gid_type[i - rdma_start_port(device)] =
+				CMA_PREFERRED_ROCE_GID_TYPE;
+		else
+			cma_dev->default_gid_type[i - rdma_start_port(device)] =
+				find_first_bit(&supported_gids, BITS_PER_LONG);
+		cma_dev->default_roce_tos[i - rdma_start_port(device)] = 0;
+	}
+
+	init_completion(&cma_dev->comp);
+	refcount_set(&cma_dev->refcount, 1);
+	INIT_LIST_HEAD(&cma_dev->id_list);
+	ib_set_client_data(device, &cma_client, cma_dev);
+
+	mutex_lock(&lock);
+	list_add_tail(&cma_dev->list, &dev_list);
+	list_for_each_entry(id_priv, &listen_any_list, list) {
+		ret = cma_listen_on_dev(id_priv, cma_dev);
+		if (ret)
+			goto free_listen;
+	}
+	mutex_unlock(&lock);
+
+	trace_cm_add_one(device);
+	return 0;
+
+free_listen:
+	list_del(&cma_dev->list);
+	mutex_unlock(&lock);
+
+	cma_process_remove(cma_dev);
+	kfree(cma_dev->default_roce_tos);
+free_gid_type:
+	kfree(cma_dev->default_gid_type);
+
+free_cma_dev:
+	kfree(cma_dev);
+	return ret;
+}
+
 static void cma_remove_one(struct ib_device *device, void *client_data)
 {
 	struct cma_device *cma_dev = client_data;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 133/717] ASoC: meson: fix COMPILE_TEST error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 132/717] RDMA/cma: Add missing error handling of listen_id Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER Greg Kroah-Hartman
                   ` (585 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Jerome Brunet,
	Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ]

When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the
clock API. This is usually selected by the platform and the sound drivers
should not really care about this. However COMPILE_TEST is special and the
platform required may not have been selected, leading to this type of
error:

> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent'

Since we need a sane provider of the API with COMPILE_TEST, depends on
COMMON_CLK.

Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
index 363dc3b1bbe47..ce0cbdc69b2ec 100644
--- a/sound/soc/meson/Kconfig
+++ b/sound/soc/meson/Kconfig
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 menu "ASoC support for Amlogic platforms"
-	depends on ARCH_MESON || COMPILE_TEST
+	depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
 
 config SND_MESON_AIU
 	tristate "Amlogic AIU"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 133/717] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-31  8:49   ` Serge Semin
  2020-12-28 12:42 ` [PATCH 5.10 135/717] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
                   ` (584 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Serge Semin, Ramil Zaripov, Mark Brown, linux-spi, Serge Semin,
	Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit 1241f0787578136ab58f49adc52f2dcd2bbc4bf2 ]

Fix build error for spi-dw-bt1.o by selecting MULTIPLEXER.

hppa-linux-ld: drivers/spi/spi-dw-bt1.o: in function `dw_spi_bt1_sys_init':
(.text+0x1ac): undefined reference to `devm_mux_control_get'

Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Cc: Ramil Zaripov <Ramil.Zaripov@baikalelectronics.ru>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20201116040721.8001-1-rdunlap@infradead.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 5cff60de8e834..3fd16b7f61507 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -255,6 +255,7 @@ config SPI_DW_MMIO
 config SPI_DW_BT1
 	tristate "Baikal-T1 SPI driver for DW SPI core"
 	depends on MIPS_BAIKAL_T1 || COMPILE_TEST
+	select MULTIPLEXER
 	help
 	  Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI
 	  controllers. Two of them are pretty much normal: with IRQ, DMA,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 135/717] scsi: core: Fix VPD LUN ID designator priorities
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 136/717] media: venus: put dummy vote on video-mem path after last session release Greg Kroah-Hartman
                   ` (583 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Martin Wilck,
	Martin K. Petersen, Sasha Levin

From: Martin Wilck <mwilck@suse.com>

[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]

The current implementation of scsi_vpd_lun_id() uses the designator length
as an implicit measure of priority. This works most of the time, but not
always. For example, some Hitachi storage arrays return this in VPD 0x83:

VPD INQUIRY: Device Identification page
  Designation descriptor number 1, descriptor length: 24
    designator_type: T10 vendor identification,  code_set: ASCII
    associated with the Addressed logical unit
      vendor id: HITACHI
      vendor specific: 5030C3502025
  Designation descriptor number 2, descriptor length: 6
    designator_type: vendor specific [0x0],  code_set: Binary
    associated with the Target port
      vendor specific: 08 03
  Designation descriptor number 3, descriptor length: 20
    designator_type: NAA,  code_set: Binary
    associated with the Addressed logical unit
      NAA 6, IEEE Company_id: 0x60e8
      Vendor Specific Identifier: 0x7c35000
      Vendor Specific Identifier Extension: 0x30c35000002025
      [0x60060e8007c350000030c35000002025]

The current code would use the first descriptor because it's longer than
the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
descriptors over T10 vendor ID. Designator length should only be used to
compare designators of the same type.

This patch addresses the issue by separating designator priority and
length.

Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
 1 file changed, 86 insertions(+), 40 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 03c6d0620bfd0..2d17137f8ff3b 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -2948,6 +2948,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
 }
 EXPORT_SYMBOL(sdev_enable_disk_events);
 
+static unsigned char designator_prio(const unsigned char *d)
+{
+	if (d[1] & 0x30)
+		/* not associated with LUN */
+		return 0;
+
+	if (d[3] == 0)
+		/* invalid length */
+		return 0;
+
+	/*
+	 * Order of preference for lun descriptor:
+	 * - SCSI name string
+	 * - NAA IEEE Registered Extended
+	 * - EUI-64 based 16-byte
+	 * - EUI-64 based 12-byte
+	 * - NAA IEEE Registered
+	 * - NAA IEEE Extended
+	 * - EUI-64 based 8-byte
+	 * - SCSI name string (truncated)
+	 * - T10 Vendor ID
+	 * as longer descriptors reduce the likelyhood
+	 * of identification clashes.
+	 */
+
+	switch (d[1] & 0xf) {
+	case 8:
+		/* SCSI name string, variable-length UTF-8 */
+		return 9;
+	case 3:
+		switch (d[4] >> 4) {
+		case 6:
+			/* NAA registered extended */
+			return 8;
+		case 5:
+			/* NAA registered */
+			return 5;
+		case 4:
+			/* NAA extended */
+			return 4;
+		case 3:
+			/* NAA locally assigned */
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case 2:
+		switch (d[3]) {
+		case 16:
+			/* EUI64-based, 16 byte */
+			return 7;
+		case 12:
+			/* EUI64-based, 12 byte */
+			return 6;
+		case 8:
+			/* EUI64-based, 8 byte */
+			return 3;
+		default:
+			break;
+		}
+		break;
+	case 1:
+		/* T10 vendor ID */
+		return 1;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 /**
  * scsi_vpd_lun_id - return a unique device identification
  * @sdev: SCSI device
@@ -2964,7 +3036,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
  */
 int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 {
-	u8 cur_id_type = 0xff;
+	u8 cur_id_prio = 0;
 	u8 cur_id_size = 0;
 	const unsigned char *d, *cur_id_str;
 	const struct scsi_vpd *vpd_pg83;
@@ -2977,20 +3049,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 		return -ENXIO;
 	}
 
-	/*
-	 * Look for the correct descriptor.
-	 * Order of preference for lun descriptor:
-	 * - SCSI name string
-	 * - NAA IEEE Registered Extended
-	 * - EUI-64 based 16-byte
-	 * - EUI-64 based 12-byte
-	 * - NAA IEEE Registered
-	 * - NAA IEEE Extended
-	 * - T10 Vendor ID
-	 * as longer descriptors reduce the likelyhood
-	 * of identification clashes.
-	 */
-
 	/* The id string must be at least 20 bytes + terminating NULL byte */
 	if (id_len < 21) {
 		rcu_read_unlock();
@@ -3000,8 +3058,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 	memset(id, 0, id_len);
 	d = vpd_pg83->data + 4;
 	while (d < vpd_pg83->data + vpd_pg83->len) {
-		/* Skip designators not referring to the LUN */
-		if ((d[1] & 0x30) != 0x00)
+		u8 prio = designator_prio(d);
+
+		if (prio == 0 || cur_id_prio > prio)
 			goto next_desig;
 
 		switch (d[1] & 0xf) {
@@ -3009,28 +3068,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 			/* T10 Vendor ID */
 			if (cur_id_size > d[3])
 				break;
-			/* Prefer anything */
-			if (cur_id_type > 0x01 && cur_id_type != 0xff)
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			if (cur_id_size + 4 > id_len)
 				cur_id_size = id_len - 4;
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			id_size = snprintf(id, id_len, "t10.%*pE",
 					   cur_id_size, cur_id_str);
 			break;
 		case 0x2:
 			/* EUI-64 */
-			if (cur_id_size > d[3])
-				break;
-			/* Prefer NAA IEEE Registered Extended */
-			if (cur_id_type == 0x3 &&
-			    cur_id_size == d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3048,17 +3098,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x3:
 			/* NAA */
-			if (cur_id_size > d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3071,26 +3118,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x8:
 			/* SCSI name string */
-			if (cur_id_size + 4 > d[3])
+			if (cur_id_size > d[3])
 				break;
 			/* Prefer others for truncated descriptor */
-			if (cur_id_size && d[3] > id_len)
-				break;
+			if (d[3] > id_len) {
+				prio = 2;
+				if (cur_id_prio > prio)
+					break;
+			}
+			cur_id_prio = prio;
 			cur_id_size = id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			if (cur_id_size >= id_len)
 				cur_id_size = id_len - 1;
 			memcpy(id, cur_id_str, cur_id_size);
-			/* Decrease priority for truncated descriptor */
-			if (cur_id_size != id_size)
-				cur_id_size = 6;
 			break;
 		default:
 			break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 136/717] media: venus: put dummy vote on video-mem path after last session release
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 135/717] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 137/717] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
                   ` (582 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik, Stephen Boyd,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Mansur Alisha Shaik <mansur@codeaurora.org>

[ Upstream commit eff5ce02e170125936c43ca96c7dc701a86681ed ]

As per current implementation, video driver is unvoting "videom-mem" path
for last video session during vdec_session_release().
While video playback when we try to suspend device, we see video clock
warnings since votes are already removed during vdec_session_release().

corrected this by putting dummy vote on "video-mem" after last video
session release and unvoting it during suspend.

suspend")

Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/pm_helpers.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
index a9538c2cc3c9d..2946547a0df4a 100644
--- a/drivers/media/platform/qcom/venus/pm_helpers.c
+++ b/drivers/media/platform/qcom/venus/pm_helpers.c
@@ -212,6 +212,16 @@ static int load_scale_bw(struct venus_core *core)
 	}
 	mutex_unlock(&core->lock);
 
+	/*
+	 * keep minimum bandwidth vote for "video-mem" path,
+	 * so that clks can be disabled during vdec_session_release().
+	 * Actual bandwidth drop will be done during device supend
+	 * so that device can power down without any warnings.
+	 */
+
+	if (!total_avg && !total_peak)
+		total_avg = kbps_to_icc(1000);
+
 	dev_dbg(core->dev, VDBGL "total: avg_bw: %u, peak_bw: %u\n",
 		total_avg, total_peak);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 137/717] media: solo6x10: fix missing snd_card_free in error handling case
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 136/717] media: venus: put dummy vote on video-mem path after last session release Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 138/717] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
                   ` (581 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]

Fix to goto snd_error in error handling case when fails
to do snd_ctl_add, as done elsewhere in this function.

Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
index 906ce86437ae3..d137b94869d82 100644
--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
+++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
@@ -385,7 +385,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
 
 	ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
 	if (ret < 0)
-		return ret;
+		goto snd_error;
 
 	ret = solo_snd_pcm_init(solo_dev);
 	if (ret < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 138/717] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 137/717] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 139/717] mmc: sdhci: tegra: fix wrong unit with busy_timeout Greg Kroah-Hartman
                   ` (580 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ]

If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init()
can't return -ENOMEM, fix this by putting the error code in loop.

Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/atmel_lcdfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 8c1d47e52b1a6..355b6120dc4f0 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -987,8 +987,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
 	}
 
 	INIT_LIST_HEAD(&pdata->pwr_gpios);
-	ret = -ENOMEM;
 	for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
+		ret = -ENOMEM;
 		gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
 					     i, GPIOD_ASIS);
 		if (IS_ERR(gpiod))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 139/717] mmc: sdhci: tegra: fix wrong unit with busy_timeout
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 138/717] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 140/717] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
                   ` (579 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Sowjanya Komatineni,
	Thierry Reding, Ulf Hansson, Sasha Levin

From: Wolfram Sang <wsa+renesas@sang-engineering.com>

[ Upstream commit fcc541fea394d67ad607ee41acfa891e79fe17a2 ]

'busy_timeout' is in msecs, not in jiffies. Use the correct factor.

Fixes: 5e958e4aacf4 ("sdhci: tegra: Implement Tegra specific set_timeout callback")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20201116132206.23518-1-wsa+renesas@sang-engineering.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-tegra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
index ed12aacb1c736..41d193fa77bbf 100644
--- a/drivers/mmc/host/sdhci-tegra.c
+++ b/drivers/mmc/host/sdhci-tegra.c
@@ -1272,7 +1272,7 @@ static void tegra_sdhci_set_timeout(struct sdhci_host *host,
 	 * busy wait mode.
 	 */
 	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_MISC_CTRL);
-	if (cmd && cmd->busy_timeout >= 11 * HZ)
+	if (cmd && cmd->busy_timeout >= 11 * MSEC_PER_SEC)
 		val |= SDHCI_MISC_CTRL_ERASE_TIMEOUT_LIMIT;
 	else
 		val &= ~SDHCI_MISC_CTRL_ERASE_TIMEOUT_LIMIT;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 140/717] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 139/717] mmc: sdhci: tegra: fix wrong unit with busy_timeout Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 141/717] drm/meson: Free RDMA resources after tearing down DRM Greg Kroah-Hartman
                   ` (578 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]

Return -ENOMEM when allocating refill memory failed.

Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 42ec51bb7b1b0..7f43172488123 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -889,6 +889,7 @@ static int omap_dmm_probe(struct platform_device *dev)
 					   &omap_dmm->refill_pa, GFP_KERNEL);
 	if (!omap_dmm->refill_va) {
 		dev_err(&dev->dev, "could not allocate refill memory\n");
+		ret = -ENOMEM;
 		goto fail;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 141/717] drm/meson: Free RDMA resources after tearing down DRM
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 140/717] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 142/717] drm/meson: Unbind all connectors on module removal Greg Kroah-Hartman
                   ` (577 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit fa62ee25280ff6ae1f720f363263cb5e7743a8c8 ]

Removing the meson DRM module results in the following splat:

[ 2179.451346] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
[ 2179.458316] Workqueue: events drm_mode_rmfb_work_fn [drm]
[ 2179.463597] pstate: 80c00009 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
[ 2179.469558] pc : meson_rdma_writel_sync+0x44/0xb0 [meson_drm]
[ 2179.475243] lr : meson_g12a_afbcd_reset+0x34/0x60 [meson_drm]
[ 2179.480930] sp : ffffffc01212bb70
[ 2179.484207] x29: ffffffc01212bb70 x28: ffffff8044f66f00
[ 2179.489469] x27: ffffff8045b13800 x26: 0000000000000001
[ 2179.494730] x25: 0000000000000000 x24: 0000000000000001
[ 2179.499991] x23: 0000000000000000 x22: 0000000000000000
[ 2179.505252] x21: 0000000000280000 x20: 0000000000001a01
[ 2179.510513] x19: ffffff8046029480 x18: 0000000000000000
[ 2179.515775] x17: 0000000000000000 x16: 0000000000000000
[ 2179.521036] x15: 0000000000000000 x14: 0000000000000000
[ 2179.526297] x13: 0040000000000326 x12: 0309030303260300
[ 2179.531558] x11: 03000000054004a0 x10: 0418054004000400
[ 2179.536820] x9 : ffffffc008fe4914 x8 : ffffff8040a1adc0
[ 2179.542081] x7 : 0000000000000000 x6 : ffffff8042aa0080
[ 2179.547342] x5 : ffffff8044f66f00 x4 : ffffffc008fe5bc8
[ 2179.552603] x3 : 0000000000010101 x2 : 0000000000000001
[ 2179.557865] x1 : 0000000000000000 x0 : 0000000000000000
[ 2179.563127] Call trace:
[ 2179.565548]  meson_rdma_writel_sync+0x44/0xb0 [meson_drm]
[ 2179.570894]  meson_g12a_afbcd_reset+0x34/0x60 [meson_drm]
[ 2179.576241]  meson_plane_atomic_disable+0x38/0xb0 [meson_drm]
[ 2179.581966]  drm_atomic_helper_commit_planes+0x1e0/0x21c [drm_kms_helper]
[ 2179.588684]  drm_atomic_helper_commit_tail_rpm+0x68/0xb0 [drm_kms_helper]
[ 2179.595410]  commit_tail+0xac/0x190 [drm_kms_helper]
[ 2179.600326]  drm_atomic_helper_commit+0x16c/0x390 [drm_kms_helper]
[ 2179.606484]  drm_atomic_commit+0x58/0x70 [drm]
[ 2179.610880]  drm_framebuffer_remove+0x398/0x434 [drm]
[ 2179.615881]  drm_mode_rmfb_work_fn+0x68/0x8c [drm]
[ 2179.620575]  process_one_work+0x1cc/0x49c
[ 2179.624538]  worker_thread+0x200/0x444
[ 2179.628246]  kthread+0x14c/0x160
[ 2179.631439]  ret_from_fork+0x10/0x38

caused by the fact that the RDMA buffer has already been freed,
resulting in meson_rdma_writel_sync() getting a NULL pointer.

Move the afbcd reset and meson_rdma_free calls after the DRM
unregistration is complete so that the teardown can safely complete.

Fixes: d1b5e41e13a7 ("drm/meson: Add AFBCD module driver")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-2-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_drv.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 8b9c8dd788c41..324fa489f1c46 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -389,15 +389,15 @@ static void meson_drv_unbind(struct device *dev)
 		meson_canvas_free(priv->canvas, priv->canvas_id_vd1_2);
 	}
 
-	if (priv->afbcd.ops) {
-		priv->afbcd.ops->reset(priv);
-		meson_rdma_free(priv);
-	}
-
 	drm_dev_unregister(drm);
 	drm_irq_uninstall(drm);
 	drm_kms_helper_poll_fini(drm);
 	drm_dev_put(drm);
+
+	if (priv->afbcd.ops) {
+		priv->afbcd.ops->reset(priv);
+		meson_rdma_free(priv);
+	}
 }
 
 static const struct component_master_ops meson_drv_master_ops = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 142/717] drm/meson: Unbind all connectors on module removal
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 141/717] drm/meson: Free RDMA resources after tearing down DRM Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 143/717] drm/meson: dw-hdmi: Register a callback to disable the regulator Greg Kroah-Hartman
                   ` (576 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit e78ad18ba3658fbc8c63629e034b68d8e51acbf1 ]

Removing the meson DRM module results in the following splats:

[   42.689228] WARNING: CPU: 0 PID: 572 at drivers/gpu/drm/drm_irq.c:192 drm_irq_uninstall+0x130/0x160 [drm]
[...]
[   42.812820] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
[   42.819723] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--)
[   42.825737] pc : drm_irq_uninstall+0x130/0x160 [drm]
[   42.830647] lr : drm_irq_uninstall+0xc4/0x160 [drm]
[...]
[   42.917614] Call trace:
[   42.920086]  drm_irq_uninstall+0x130/0x160 [drm]
[   42.924612]  meson_drv_unbind+0x68/0xa4 [meson_drm]
[   42.929436]  component_del+0xc0/0x180
[   42.933058]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]
[   42.938576]  platform_drv_remove+0x38/0x60
[   42.942628]  __device_release_driver+0x190/0x23c
[   42.947198]  driver_detach+0xcc/0x160
[   42.950822]  bus_remove_driver+0x68/0xe0
[   42.954702]  driver_unregister+0x3c/0x6c
[   42.958583]  platform_driver_unregister+0x20/0x2c
[   42.963243]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
[   42.970057]  __arm64_sys_delete_module+0x1bc/0x294
[   42.974801]  el0_svc_common.constprop.0+0x80/0x240
[   42.979542]  do_el0_svc+0x30/0xa0
[   42.982821]  el0_svc+0x18/0x50
[   42.985839]  el0_sync_handler+0x198/0x404
[   42.989806]  el0_sync+0x158/0x180

immediatelly followed by

[   43.002296] WARNING: CPU: 0 PID: 572 at drivers/gpu/drm/drm_mode_config.c:504 drm_mode_config_cleanup+0x2a8/0x304 [drm]
[...]
[   43.128150] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
[   43.135052] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[   43.141062] pc : drm_mode_config_cleanup+0x2a8/0x304 [drm]
[   43.146492] lr : drm_mode_config_cleanup+0xac/0x304 [drm]
[...]
[   43.233979] Call trace:
[   43.236451]  drm_mode_config_cleanup+0x2a8/0x304 [drm]
[   43.241538]  drm_mode_config_init_release+0x1c/0x2c [drm]
[   43.246886]  drm_managed_release+0xa8/0x120 [drm]
[   43.251543]  drm_dev_put+0x94/0xc0 [drm]
[   43.255380]  meson_drv_unbind+0x78/0xa4 [meson_drm]
[   43.260204]  component_del+0xc0/0x180
[   43.263829]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]
[   43.269344]  platform_drv_remove+0x38/0x60
[   43.273398]  __device_release_driver+0x190/0x23c
[   43.277967]  driver_detach+0xcc/0x160
[   43.281590]  bus_remove_driver+0x68/0xe0
[   43.285471]  driver_unregister+0x3c/0x6c
[   43.289352]  platform_driver_unregister+0x20/0x2c
[   43.294011]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
[   43.300826]  __arm64_sys_delete_module+0x1bc/0x294
[   43.305570]  el0_svc_common.constprop.0+0x80/0x240
[   43.310312]  do_el0_svc+0x30/0xa0
[   43.313590]  el0_svc+0x18/0x50
[   43.316608]  el0_sync_handler+0x198/0x404
[   43.320574]  el0_sync+0x158/0x180
[   43.323852] ---[ end trace d796a3072dab01da ]---
[   43.328561] [drm:drm_mode_config_cleanup [drm]] *ERROR* connector HDMI-A-1 leaked!

both triggered by the fact that the HDMI subsystem is still active,
and the DRM removal doesn't result in the connectors being torn down.

Call drm_atomic_helper_shutdown() and component_unbind_all() to safely
tear the module down.

Fixes: 2d8f92897ad8 ("drm/meson: Uninstall IRQ handler")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-3-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 324fa489f1c46..3d1de9cbb1c8d 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -390,8 +390,10 @@ static void meson_drv_unbind(struct device *dev)
 	}
 
 	drm_dev_unregister(drm);
-	drm_irq_uninstall(drm);
 	drm_kms_helper_poll_fini(drm);
+	drm_atomic_helper_shutdown(drm);
+	component_unbind_all(dev, drm);
+	drm_irq_uninstall(drm);
 	drm_dev_put(drm);
 
 	if (priv->afbcd.ops) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 143/717] drm/meson: dw-hdmi: Register a callback to disable the regulator
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 142/717] drm/meson: Unbind all connectors on module removal Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 144/717] drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers Greg Kroah-Hartman
                   ` (575 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 0405f94a1ae0586ca237aec0e859f1b796d6325d ]

Removing the meson-dw-hdmi module results in the following splat:

i[   43.340509] WARNING: CPU: 0 PID: 572 at drivers/regulator/core.c:2125 _regulator_put.part.0+0x16c/0x174
[...]
[   43.454870] CPU: 0 PID: 572 Comm: modprobe Tainted: G        W   E     5.10.0-rc4-00049-gd274813a4de3-dirty #2147
[   43.465042] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
[   43.471945] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[   43.477896] pc : _regulator_put.part.0+0x16c/0x174
[   43.482638] lr : regulator_put+0x44/0x60
[...]
[   43.568715] Call trace:
[   43.571132]  _regulator_put.part.0+0x16c/0x174
[   43.575529]  regulator_put+0x44/0x60
[   43.579067]  devm_regulator_release+0x20/0x2c
[   43.583380]  release_nodes+0x1c8/0x2b4
[   43.587087]  devres_release_all+0x44/0x6c
[   43.591056]  __device_release_driver+0x1a0/0x23c
[   43.595626]  driver_detach+0xcc/0x160
[   43.599249]  bus_remove_driver+0x68/0xe0
[   43.603130]  driver_unregister+0x3c/0x6c
[   43.607011]  platform_driver_unregister+0x20/0x2c
[   43.611678]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
[   43.618485]  __arm64_sys_delete_module+0x1bc/0x294

as the HDMI regulator is still enabled on release.

In order to address this, register a callback that will deal with
the disabling when the driver is unbound, solving the problem.

Fixes: 161a803fe32d ("drm/meson: dw_hdmi: Add support for an optional external 5V regulator")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-4-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_dw_hdmi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index 29a8ff41595d2..68826cf9993fc 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -941,6 +941,11 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
 
 }
 
+static void meson_disable_regulator(void *data)
+{
+	regulator_disable(data);
+}
+
 static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 				void *data)
 {
@@ -989,6 +994,10 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 		ret = regulator_enable(meson_dw_hdmi->hdmi_supply);
 		if (ret)
 			return ret;
+		ret = devm_add_action_or_reset(dev, meson_disable_regulator,
+					       meson_dw_hdmi->hdmi_supply);
+		if (ret)
+			return ret;
 	}
 
 	meson_dw_hdmi->hdmitx_apb = devm_reset_control_get_exclusive(dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 144/717] drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 143/717] drm/meson: dw-hdmi: Register a callback to disable the regulator Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 145/717] ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY Greg Kroah-Hartman
                   ` (574 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit b33340e33acdfe5ca6a5aa1244709575ae1e0432 ]

Removing the meson-dw-hdmi module and re-inserting it results in a hang
as the driver writes to HDMITX_TOP_SW_RESET. Similar effects can be seen
when booting with mainline u-boot and using the u-boot provided DT (which
is highly desirable).

The reason for the hang seem to be that the clocks are not always
enabled by the time we enter meson_dw_hdmi_init(). Moving this call
*after* dw_hdmi_probe() ensures that the clocks are enabled.

Fixes: 1374b8375c2e ("drm/meson: dw_hdmi: add resume/suspend hooks")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-5-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_dw_hdmi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index 68826cf9993fc..7f8eea4941472 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -1073,8 +1073,6 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 
 	DRM_DEBUG_DRIVER("encoder initialized\n");
 
-	meson_dw_hdmi_init(meson_dw_hdmi);
-
 	/* Bridge / Connector */
 
 	dw_plat_data->priv_data = meson_dw_hdmi;
@@ -1097,6 +1095,8 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 	if (IS_ERR(meson_dw_hdmi->hdmi))
 		return PTR_ERR(meson_dw_hdmi->hdmi);
 
+	meson_dw_hdmi_init(meson_dw_hdmi);
+
 	next_bridge = of_drm_find_bridge(pdev->dev.of_node);
 	if (next_bridge)
 		drm_bridge_attach(encoder, next_bridge,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 145/717] ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 144/717] drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 146/717] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM Greg Kroah-Hartman
                   ` (573 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Mark Brown, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 9a207228bdf0a4933b794c944d7111564353ea94 ]

The Intel Keem Bay audio module is only present on Intel Keem Bay SoCs.
Hence add a dependency on ARCH_KEEMBAY, to prevent asking the user about
this driver when configuring a kernel without Intel Keem Bay platform
support.

Fixes: c544912bcc2dc806 ("ASoC: Intel: Add makefiles and kconfig changes for KeemBay")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20201110145001.3280479-1-geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index a5b446d5af19f..c1bf69a0bcfe1 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -198,7 +198,7 @@ endif ## SND_SOC_INTEL_SST_TOPLEVEL || SND_SOC_SOF_INTEL_TOPLEVEL
 
 config SND_SOC_INTEL_KEEMBAY
 	tristate "Keembay Platforms"
-	depends on ARM64 || COMPILE_TEST
+	depends on ARCH_KEEMBAY || COMPILE_TEST
 	depends on COMMON_CLK
 	help
 	  If you have a Intel Keembay platform then enable this option
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 146/717] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 145/717] ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 147/717] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
                   ` (572 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Bulwahn, Lu Baolu, Will Deacon,
	Sasha Levin

From: Lukas Bulwahn <lukas.bulwahn@gmail.com>

[ Upstream commit 68dd9d89eaf56dfab8d46bf25610aa4650247617 ]

Commit 6ee1b77ba3ac ("iommu/vt-d: Add svm/sva invalidate function")
introduced intel_iommu_sva_invalidate() when CONFIG_INTEL_IOMMU_SVM.
This function uses the dedicated static variable inv_type_granu_table
and functions to_vtd_granularity() and to_vtd_size().

These parts are unused when !CONFIG_INTEL_IOMMU_SVM, and hence,
make CC=clang W=1 warns with an -Wunused-function warning.

Include these parts conditionally on CONFIG_INTEL_IOMMU_SVM.

Fixes: 6ee1b77ba3ac ("iommu/vt-d: Add svm/sva invalidate function")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20201115205951.20698-1-lukas.bulwahn@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index a49afa11673cc..c9da9e93f545c 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5387,6 +5387,7 @@ static void intel_iommu_aux_detach_device(struct iommu_domain *domain,
 	aux_domain_remove_dev(to_dmar_domain(domain), dev);
 }
 
+#ifdef CONFIG_INTEL_IOMMU_SVM
 /*
  * 2D array for converting and sanitizing IOMMU generic TLB granularity to
  * VT-d granularity. Invalidation is typically included in the unmap operation
@@ -5433,7 +5434,6 @@ static inline u64 to_vtd_size(u64 granu_size, u64 nr_granules)
 	return order_base_2(nr_pages);
 }
 
-#ifdef CONFIG_INTEL_IOMMU_SVM
 static int
 intel_iommu_sva_invalidate(struct iommu_domain *domain, struct device *dev,
 			   struct iommu_cache_invalidate_info *inv_info)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 147/717] Input: ads7846 - fix race that causes missing releases
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 146/717] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 148/717] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
                   ` (571 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: David Jander <david@protonic.nl>

[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]

If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.

Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 8fd7fc39c4fd7..69992d5e53118 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -199,6 +199,26 @@ struct ads7846 {
 #define	REF_ON	(READ_12BIT_DFR(x, 1, 1))
 #define	REF_OFF	(READ_12BIT_DFR(y, 0, 0))
 
+static int get_pendown_state(struct ads7846 *ts)
+{
+	if (ts->get_pendown_state)
+		return ts->get_pendown_state();
+
+	return !gpio_get_value(ts->gpio_pendown);
+}
+
+static void ads7846_report_pen_up(struct ads7846 *ts)
+{
+	struct input_dev *input = ts->input;
+
+	input_report_key(input, BTN_TOUCH, 0);
+	input_report_abs(input, ABS_PRESSURE, 0);
+	input_sync(input);
+
+	ts->pendown = false;
+	dev_vdbg(&ts->spi->dev, "UP\n");
+}
+
 /* Must be called with ts->lock held */
 static void ads7846_stop(struct ads7846 *ts)
 {
@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
 static void ads7846_restart(struct ads7846 *ts)
 {
 	if (!ts->disabled && !ts->suspended) {
+		/* Check if pen was released since last stop */
+		if (ts->pendown && !get_pendown_state(ts))
+			ads7846_report_pen_up(ts);
+
 		/* Tell IRQ thread that it may poll the device. */
 		ts->stopped = false;
 		mb();
@@ -606,14 +630,6 @@ static const struct attribute_group ads784x_attr_group = {
 
 /*--------------------------------------------------------------------------*/
 
-static int get_pendown_state(struct ads7846 *ts)
-{
-	if (ts->get_pendown_state)
-		return ts->get_pendown_state();
-
-	return !gpio_get_value(ts->gpio_pendown);
-}
-
 static void null_wait_for_sync(void)
 {
 }
@@ -868,16 +884,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
 				   msecs_to_jiffies(TS_POLL_PERIOD));
 	}
 
-	if (ts->pendown && !ts->stopped) {
-		struct input_dev *input = ts->input;
-
-		input_report_key(input, BTN_TOUCH, 0);
-		input_report_abs(input, ABS_PRESSURE, 0);
-		input_sync(input);
-
-		ts->pendown = false;
-		dev_vdbg(&ts->spi->dev, "UP\n");
-	}
+	if (ts->pendown && !ts->stopped)
+		ads7846_report_pen_up(ts);
 
 	return IRQ_HANDLED;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 148/717] Input: ads7846 - fix integer overflow on Rt calculation
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 147/717] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 149/717] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
                   ` (570 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 69992d5e53118..78ed285c27ae3 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -802,10 +802,11 @@ static void ads7846_report_state(struct ads7846 *ts)
 		/* compute touch pressure resistance using equation #2 */
 		Rt = z2;
 		Rt -= z1;
-		Rt *= x;
 		Rt *= ts->x_plate_ohms;
+		Rt = DIV_ROUND_CLOSEST(Rt, 16);
+		Rt *= x;
 		Rt /= z1;
-		Rt = (Rt + 2047) >> 12;
+		Rt = DIV_ROUND_CLOSEST(Rt, 256);
 	} else {
 		Rt = 0;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 149/717] Input: ads7846 - fix unaligned access on 7845
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 148/717] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 150/717] bus: mhi: core: Remove double locking from mhi_driver_remove() Greg Kroah-Hartman
                   ` (569 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Sasha Levin

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]

req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.

Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 78ed285c27ae3..ff97897feaf2a 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -33,6 +33,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/module.h>
 #include <asm/irq.h>
+#include <asm/unaligned.h>
 
 /*
  * This code has been heavily tested on a Nokia 770, and lightly
@@ -435,7 +436,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 
 	if (status == 0) {
 		/* BE12 value, then padding */
-		status = be16_to_cpu(*((u16 *)&req->sample[1]));
+		status = get_unaligned_be16(&req->sample[1]);
 		status = status >> 3;
 		status &= 0x0fff;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 150/717] bus: mhi: core: Remove double locking from mhi_driver_remove()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 149/717] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 151/717] bus: mhi: core: Fix null pointer access when parsing MHI configuration Greg Kroah-Hartman
                   ` (568 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuah Khan, Bhaumik Bhatt,
	Manivannan Sadhasivam, Sasha Levin

From: Bhaumik Bhatt <bbhatt@codeaurora.org>

[ Upstream commit 9b627c25e70816a5e1dca940444b5029065b4d60 ]

There is double acquisition of the pm_lock from mhi_driver_remove()
function. Remove the read_lock_bh/read_unlock_bh calls for pm_lock
taken during a call to mhi_device_put() as the lock is acquired
within the function already. This will help avoid a potential
kernel panic.

Fixes: 189ff97cca53 ("bus: mhi: core: Add support for data transfer")
Reported-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mhi/core/init.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
index 0ffdebde82657..0a09f8215057d 100644
--- a/drivers/bus/mhi/core/init.c
+++ b/drivers/bus/mhi/core/init.c
@@ -1276,10 +1276,8 @@ static int mhi_driver_remove(struct device *dev)
 		mutex_unlock(&mhi_chan->mutex);
 	}
 
-	read_lock_bh(&mhi_cntrl->pm_lock);
 	while (mhi_dev->dev_wake)
 		mhi_device_put(mhi_dev);
-	read_unlock_bh(&mhi_cntrl->pm_lock);
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 151/717] bus: mhi: core: Fix null pointer access when parsing MHI configuration
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 150/717] bus: mhi: core: Remove double locking from mhi_driver_remove() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 152/717] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
                   ` (567 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Carl Yin, Bhaumik Bhatt,
	Hemant Kumar, Manivannan Sadhasivam, Sasha Levin

From: Carl Yin <carl.yin@quectel.com>

[ Upstream commit f4d0b39c842585c74bce8f8a80553369181b72df ]

Functions parse_ev_cfg() and parse_ch_cfg() access mhi_cntrl->mhi_dev
before it is set in function mhi_register_controller(),
use cntrl_dev instead of mhi_dev.

Fixes: 0cbf260820fa ("bus: mhi: core: Add support for registering MHI controllers")
Signed-off-by: Carl Yin <carl.yin@quectel.com>
Reviewed-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mhi/core/init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
index 0a09f8215057d..8cefa359fccd8 100644
--- a/drivers/bus/mhi/core/init.c
+++ b/drivers/bus/mhi/core/init.c
@@ -610,7 +610,7 @@ static int parse_ev_cfg(struct mhi_controller *mhi_cntrl,
 {
 	struct mhi_event *mhi_event;
 	const struct mhi_event_config *event_cfg;
-	struct device *dev = &mhi_cntrl->mhi_dev->dev;
+	struct device *dev = mhi_cntrl->cntrl_dev;
 	int i, num;
 
 	num = config->num_events;
@@ -692,7 +692,7 @@ static int parse_ch_cfg(struct mhi_controller *mhi_cntrl,
 			const struct mhi_controller_config *config)
 {
 	const struct mhi_channel_config *ch_cfg;
-	struct device *dev = &mhi_cntrl->mhi_dev->dev;
+	struct device *dev = mhi_cntrl->cntrl_dev;
 	int i;
 	u32 chan;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 152/717] usb/max3421: fix return error code in max3421_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 151/717] bus: mhi: core: Fix null pointer access when parsing MHI configuration Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 153/717] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
                   ` (566 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ]

retval may be reassigned to 0 after max3421_of_vbus_en_pin(),
if allocate memory failed after this, max3421_probe() cann't
return ENOMEM, fix this by moving assign retval afther max3421_probe().

Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/max3421-hcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 0894f6caccb2c..ebb8180b52ab1 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1847,7 +1847,7 @@ max3421_probe(struct spi_device *spi)
 	struct max3421_hcd *max3421_hcd;
 	struct usb_hcd *hcd = NULL;
 	struct max3421_hcd_platform_data *pdata = NULL;
-	int retval = -ENOMEM;
+	int retval;
 
 	if (spi_setup(spi) < 0) {
 		dev_err(&spi->dev, "Unable to setup SPI bus");
@@ -1889,6 +1889,7 @@ max3421_probe(struct spi_device *spi)
 		goto error;
 	}
 
+	retval = -ENOMEM;
 	hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
 			     dev_name(&spi->dev));
 	if (!hcd) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 153/717] spi: mxs: fix reference leak in mxs_spi_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 152/717] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 154/717] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
                   ` (565 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in mxs_spi_probe, so we should fix it.

Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mxs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 918918a9e0491..435309b09227e 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -607,6 +607,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(ssp->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(ssp->dev);
 		dev_err(ssp->dev, "runtime_get_sync failed\n");
 		goto out_pm_runtime_disable;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 154/717] selftests/bpf: Fix broken riscv build
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 153/717] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 155/717] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
                   ` (564 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Andrii Nakryiko, Luke Nelson, Sasha Levin

From: Björn Töpel <bjorn.topel@gmail.com>

[ Upstream commit 6016df8fe874e1cf36f6357d71438b384198ce06 ]

The selftests/bpf Makefile includes system include directories from
the host, when building BPF programs. On RISC-V glibc requires that
__riscv_xlen is defined. This is not the case for "clang -target bpf",
which messes up __WORDSIZE (errno.h -> ... -> wordsize.h) and breaks
the build.

By explicitly defining __risc_xlen correctly for riscv, we can
workaround this.

Fixes: 167381f3eac0 ("selftests/bpf: Makefile fix "missing" headers on build with -idirafter")
Signed-off-by: Björn Töpel <bjorn.topel@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Luke Nelson <luke.r.nels@gmail.com>
Link: https://lore.kernel.org/bpf/20201118071640.83773-2-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 542768f5195b7..136df8c102812 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -220,7 +220,8 @@ $(RESOLVE_BTFIDS): $(BPFOBJ) | $(BUILD_DIR)/resolve_btfids	\
 # build would have failed anyways.
 define get_sys_includes
 $(shell $(1) -v -E - </dev/null 2>&1 \
-	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
+	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') \
+$(shell $(1) -dM -E - </dev/null | grep '#define __riscv_xlen ' | sed 's/#define /-D/' | sed 's/ /=/')
 endef
 
 # Determine target endianness.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 155/717] powerpc: Avoid broken GCC __attribute__((optimize))
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 154/717] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 156/717] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
                   ` (563 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Michael Ellerman,
	Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit a7223f5bfcaeade4a86d35263493bcda6c940891 ]

Commit 7053f80d9696 ("powerpc/64: Prevent stack protection in early
boot") introduced a couple of uses of __attribute__((optimize)) with
function scope, to disable the stack protector in some early boot
code.

Unfortunately, and this is documented in the GCC man pages [0],
overriding function attributes for optimization is broken, and is only
supported for debug scenarios, not for production: the problem appears
to be that setting GCC -f flags using this method will cause it to
forget about some or all other optimization settings that have been
applied.

So the only safe way to disable the stack protector is to disable it
for the entire source file.

[0] https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html

Fixes: 7053f80d9696 ("powerpc/64: Prevent stack protection in early boot")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
[mpe: Drop one remaining use of __nostackprotector, reported by snowpatch]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201028080433.26799-1-ardb@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/Makefile   | 3 +++
 arch/powerpc/kernel/paca.c     | 4 ++--
 arch/powerpc/kernel/setup.h    | 6 ------
 arch/powerpc/kernel/setup_64.c | 2 +-
 4 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index bf0bf1b900d21..fe2ef598e2ead 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -173,6 +173,9 @@ KCOV_INSTRUMENT_cputable.o := n
 KCOV_INSTRUMENT_setup_64.o := n
 KCOV_INSTRUMENT_paca.o := n
 
+CFLAGS_setup_64.o		+= -fno-stack-protector
+CFLAGS_paca.o			+= -fno-stack-protector
+
 extra-$(CONFIG_PPC_FPU)		+= fpu.o
 extra-$(CONFIG_ALTIVEC)		+= vector.o
 extra-$(CONFIG_PPC64)		+= entry_64.o
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index 0ad15768d762c..7f5aae3c387d2 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -208,7 +208,7 @@ static struct rtas_args * __init new_rtas_args(int cpu, unsigned long limit)
 struct paca_struct **paca_ptrs __read_mostly;
 EXPORT_SYMBOL(paca_ptrs);
 
-void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int cpu)
+void __init initialise_paca(struct paca_struct *new_paca, int cpu)
 {
 #ifdef CONFIG_PPC_PSERIES
 	new_paca->lppaca_ptr = NULL;
@@ -241,7 +241,7 @@ void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int
 }
 
 /* Put the paca pointer into r13 and SPRG_PACA */
-void __nostackprotector setup_paca(struct paca_struct *new_paca)
+void setup_paca(struct paca_struct *new_paca)
 {
 	/* Setup r13 */
 	local_paca = new_paca;
diff --git a/arch/powerpc/kernel/setup.h b/arch/powerpc/kernel/setup.h
index 2ec835574cc94..2dd0d9cb5a208 100644
--- a/arch/powerpc/kernel/setup.h
+++ b/arch/powerpc/kernel/setup.h
@@ -8,12 +8,6 @@
 #ifndef __ARCH_POWERPC_KERNEL_SETUP_H
 #define __ARCH_POWERPC_KERNEL_SETUP_H
 
-#ifdef CONFIG_CC_IS_CLANG
-#define __nostackprotector
-#else
-#define __nostackprotector __attribute__((__optimize__("no-stack-protector")))
-#endif
-
 void initialize_cache_info(void);
 void irqstack_early_init(void);
 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 74fd47f46fa58..c28e949cc2229 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -283,7 +283,7 @@ void __init record_spr_defaults(void)
  * device-tree is not accessible via normal means at this point.
  */
 
-void __init __nostackprotector early_setup(unsigned long dt_ptr)
+void __init early_setup(unsigned long dt_ptr)
 {
 	static __initdata struct paca_struct boot_paca;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 156/717] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 155/717] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 157/717] ARM: dts: tacoma: Fix node vs reg mismatch for flash memory Greg Kroah-Hartman
                   ` (562 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]

On 8xx, we get the following features:

[    0.000000] cpu_features      = 0x0000000000000100
[    0.000000]   possible        = 0x0000000000000120
[    0.000000]   always          = 0x0000000000000000

This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
other configurations, the three lines should be equal.

The problem is due to CPU_FTRS_GENERIC_32 which is taken when
CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
pointless because there is no generic configuration supporting
all 32 bits but book3s/32.

Remove this pointless generic features definition to unbreak the
calculation of 'possible' features and 'always' features.

Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/cputable.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 3d2f94afc13ae..5e31960a56a9d 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -409,7 +409,6 @@ static inline void cpu_feature_keys_init(void) { }
 	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
 	    CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
 	    CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
-#define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
 #define CPU_FTRS_PPC970	(CPU_FTR_LWSYNC | \
@@ -520,8 +519,6 @@ enum {
 	    CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
 	    CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
 	    CPU_FTRS_CLASSIC32 |
-#else
-	    CPU_FTRS_GENERIC_32 |
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX |
@@ -596,8 +593,6 @@ enum {
 	    CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
 	    CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
 	    CPU_FTRS_CLASSIC32 &
-#else
-	    CPU_FTRS_GENERIC_32 &
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX &
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 157/717] ARM: dts: tacoma: Fix node vs reg mismatch for flash memory
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 156/717] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 158/717] Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path" Greg Kroah-Hartman
                   ` (561 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Jeffery, Joel Stanley, Sasha Levin

From: Andrew Jeffery <andrew@aj.id.au>

[ Upstream commit cbee028da69d31cb927142e2828710de55a49f2a ]

The mismatch lead to a miscalculation of regions in another patch, and
shouldn't be mismatched anyway, so make them consistent.

Fixes: 575640201e66 ("ARM: dts: aspeed: tacoma: Use 64MB for firmware memory")
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201022014731.2035438-2-andrew@aj.id.au
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts b/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
index 4d070d6ba09f9..e86c22ce6d123 100644
--- a/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
@@ -26,7 +26,7 @@
 		#size-cells = <1>;
 		ranges;
 
-		flash_memory: region@ba000000 {
+		flash_memory: region@b8000000 {
 			no-map;
 			reg = <0xb8000000 0x4000000>; /* 64M */
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 158/717] Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 157/717] ARM: dts: tacoma: Fix node vs reg mismatch for flash memory Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 159/717] powerpc/powernv/sriov: fix unsigned int win compared to less than zero Greg Kroah-Hartman
                   ` (560 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Xiaoxu,
	Michael Ellerman, Sasha Levin

From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>

[ Upstream commit a40fdaf1420d6e6bda0dd2df1e6806013e58dbe1 ]

This reverts commit a0ff72f9f5a780341e7ff5e9ba50a0dad5fa1980.

Since the commit b015f6bc9547 ("powerpc/pseries: Add cpu DLPAR
support for drc-info property"), the 'cpu_drcs' wouldn't be double
freed when the 'cpus' node not found.

So we needn't apply this patch, otherwise, the memory will be leaked.

Fixes: a0ff72f9f5a7 ("powerpc/pseries/hotplug-cpu: Remove double free in error path")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
[mpe: Caused by me applying a patch to a function that had changed in the interim]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111020752.1686139-1-zhangxiaoxu5@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/hotplug-cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index a02012f1b04af..12cbffd3c2e32 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -746,6 +746,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
 	parent = of_find_node_by_path("/cpus");
 	if (!parent) {
 		pr_warn("Could not find CPU root node in device tree\n");
+		kfree(cpu_drcs);
 		return -1;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 159/717] powerpc/powernv/sriov: fix unsigned int win compared to less than zero
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 158/717] Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path" Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 160/717] mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c() Greg Kroah-Hartman
                   ` (559 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tosk Robot, Kaixu Xia,
	Andrew Donnellan, Michael Ellerman, Sasha Levin

From: Kaixu Xia <kaixuxia@tencent.com>

[ Upstream commit 027717a45ca251a7ba67a63db359994836962cd2 ]

Fix coccicheck warning:

  arch/powerpc/platforms/powernv/pci-sriov.c:443:7-10:
  WARNING: Unsigned expression compared with zero: win < 0

  arch/powerpc/platforms/powernv/pci-sriov.c:462:7-10:
  WARNING: Unsigned expression compared with zero: win < 0

Fixes: 39efc03e3ee8 ("powerpc/powernv/sriov: Move M64 BAR allocation into a helper")
Reported-by: Tosk Robot <tencent_os_robot@tencent.com>
Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1605007170-22171-1-git-send-email-kaixuxia@tencent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/powernv/pci-sriov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c
index c4434f20f42fa..28aac933a4391 100644
--- a/arch/powerpc/platforms/powernv/pci-sriov.c
+++ b/arch/powerpc/platforms/powernv/pci-sriov.c
@@ -422,7 +422,7 @@ static int pnv_pci_vf_assign_m64(struct pci_dev *pdev, u16 num_vfs)
 {
 	struct pnv_iov_data   *iov;
 	struct pnv_phb        *phb;
-	unsigned int           win;
+	int                    win;
 	struct resource       *res;
 	int                    i, j;
 	int64_t                rc;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 160/717] mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 159/717] powerpc/powernv/sriov: fix unsigned int win compared to less than zero Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 161/717] mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE Greg Kroah-Hartman
                   ` (558 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Lee Jones, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit 9a463284706c5217872c3cadaca863d47129bd95 ]

htcpld_register_chip_i2c() misses to call i2c_put_adapter() in an error
path. Add the missed function call to fix it.

Fixes: 6048a3dd2371 ("mfd: Add HTCPLD driver")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/htc-i2cpld.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/htc-i2cpld.c b/drivers/mfd/htc-i2cpld.c
index 247f9849e54ae..417b0355d904d 100644
--- a/drivers/mfd/htc-i2cpld.c
+++ b/drivers/mfd/htc-i2cpld.c
@@ -346,6 +346,7 @@ static int htcpld_register_chip_i2c(
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
 		dev_warn(dev, "i2c adapter %d non-functional\n",
 			 pdata->i2c_adapter_id);
+		i2c_put_adapter(adapter);
 		return -EINVAL;
 	}
 
@@ -360,6 +361,7 @@ static int htcpld_register_chip_i2c(
 		/* I2C device registration failed, contineu with the next */
 		dev_warn(dev, "Unable to add I2C device for 0x%x\n",
 			 plat_chip_data->addr);
+		i2c_put_adapter(adapter);
 		return PTR_ERR(client);
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 161/717] mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 160/717] mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 162/717] mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init() Greg Kroah-Hartman
                   ` (557 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Michael Walle,
	Lee Jones, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit de1292817cf736c04fab31903a6aa9d9ffe60b79 ]

Currently the Kontron sl28cpld Board Management Controller is found only
on Kontron boards equipped with a Freescale Layerscape SoC.  Hence add a
dependency on ARCH_LAYERSCAPE, to prevent asking the user about a driver
for this controller when configuring a kernel without Layerscape support.

Fixes: a538ad229bbee4f8 ("mfd: simple-mfd-i2c: Add sl28cpld support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Michael Walle <michael@walle.cc>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 8b99a13669bfc..4789507f325b8 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1189,6 +1189,7 @@ config MFD_SIMPLE_MFD_I2C
 config MFD_SL28CPLD
 	tristate "Kontron sl28cpld Board Management Controller"
 	depends on I2C
+	depends on ARCH_LAYERSCAPE || COMPILE_TEST
 	select MFD_SIMPLE_MFD_I2C
 	help
 	  Say yes here to enable support for the Kontron sl28cpld board
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 162/717] mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 161/717] mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 163/717] mfd: cpcap: Fix interrupt regression with regmap clear_ack Greg Kroah-Hartman
                   ` (556 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amelie Delaunay, Lee Jones, Sasha Levin

From: Amelie Delaunay <amelie.delaunay@st.com>

[ Upstream commit d75846ed08e6f4135ec73778575c34d9c0ace993 ]

'ret' may be 0 so, dev_err_probe() should be called only when 'ret' is
an error code.

Fixes: 41c9c06c491a ("mfd: stmfx: Simplify with dev_err_probe()")
Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/stmfx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index 5e680bfdf5c90..988e2ba6dd0f3 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -329,11 +329,11 @@ static int stmfx_chip_init(struct i2c_client *client)
 
 	stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
 	ret = PTR_ERR_OR_ZERO(stmfx->vdd);
-	if (ret == -ENODEV) {
-		stmfx->vdd = NULL;
-	} else {
-		return dev_err_probe(&client->dev, ret,
-				     "Failed to get VDD regulator\n");
+	if (ret) {
+		if (ret == -ENODEV)
+			stmfx->vdd = NULL;
+		else
+			return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
 	}
 
 	if (stmfx->vdd) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 163/717] mfd: cpcap: Fix interrupt regression with regmap clear_ack
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 162/717] mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init() Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 164/717] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
                   ` (555 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Carl Philipp Klemm, Laxminath Kasam,
	Merlijn Wajer, Mark Brown, Pavel Machek, Sebastian Reichel,
	Tim Harvey, Tony Lindgren, Lee Jones, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 14639a22de657eabbb776f503a816594393cc935 ]

With commit 3a6f0fb7b8eb ("regmap: irq: Add support to clear ack
registers"), the cpcap interrupts are no longer getting acked properly
leading to a very unresponsive device with CPUs fully loaded spinning
in the threaded IRQ handlers.

To me it looks like the clear_ack commit above actually fixed a long
standing bug in regmap_irq_thread() where we unconditionally acked the
interrupts earlier without considering ack_invert. And the issue with
cpcap started happening as we now also consider ack_invert.

Tim Harvey <tharvey@gateworks.com> tried to fix this issue earlier with
"[PATCH v2] regmap: irq: fix ack-invert", but the reading of the ack
register was considered unnecessary for just ack_invert, and we did not
have clear_ack available yet. As the cpcap irqs worked both with and
without ack_invert earlier because of the unconditional ack, the
problem remained hidden until now.

Also, looks like the earlier v3.0.8 based Motorola Android Linux kernel
does clear_ack style read-clear-write with "ireg_val & ~mreg_val" instead
of just ack_invert style write. So let's switch cpcap to use clear_ack
to fix the issue.

Fixes: 3a6f0fb7b8eb ("regmap: irq: Add support to clear ack registers")
Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Cc: Laxminath Kasam <lkasam@codeaurora.org>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Pavel Machek <pavel@ucw.cz>
Reviewed-By: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/motorola-cpcap.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c
index 2283d88adcc25..30d82bfe5b02f 100644
--- a/drivers/mfd/motorola-cpcap.c
+++ b/drivers/mfd/motorola-cpcap.c
@@ -97,7 +97,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
 		.ack_base = CPCAP_REG_MI1,
 		.mask_base = CPCAP_REG_MIM1,
 		.use_ack = true,
-		.ack_invert = true,
+		.clear_ack = true,
 	},
 	{
 		.name = "cpcap-m2",
@@ -106,7 +106,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
 		.ack_base = CPCAP_REG_MI2,
 		.mask_base = CPCAP_REG_MIM2,
 		.use_ack = true,
-		.ack_invert = true,
+		.clear_ack = true,
 	},
 	{
 		.name = "cpcap1-4",
@@ -115,7 +115,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
 		.ack_base = CPCAP_REG_INT1,
 		.mask_base = CPCAP_REG_INTM1,
 		.use_ack = true,
-		.ack_invert = true,
+		.clear_ack = true,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 164/717] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 163/717] mfd: cpcap: Fix interrupt regression with regmap clear_ack Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 165/717] scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF Greg Kroah-Hartman
                   ` (554 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yazen Ghannam, Borislav Petkov, Sasha Levin

From: Yazen Ghannam <yazen.ghannam@amd.com>

[ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ]

The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and
later systems. This function is used in amd64_edac_mod to do
system-specific decoding for DRAM ECC errors. The function takes a
"NodeId" as a parameter.

In AMD documentation, NodeId is used to identify a physical die in a
system. This can be used to identify a node in the AMD_NB code and also
it is used with umc_normaddr_to_sysaddr().

However, the input used for decode_dram_ecc() is currently the NUMA node
of a logical CPU. In the default configuration, the NUMA node and
physical die will be equivalent, so this doesn't have an impact.

But the NUMA node configuration can be adjusted with optional memory
interleaving modes. This will cause the NUMA node enumeration to not
match the physical die enumeration. The mismatch will cause the address
translation function to fail or report incorrect results.

Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the
physical ID is used.

Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID")
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/mce_amd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
index 7f28edb070bd0..6c474fbef32af 100644
--- a/drivers/edac/mce_amd.c
+++ b/drivers/edac/mce_amd.c
@@ -1003,7 +1003,7 @@ static void decode_smca_error(struct mce *m)
 		pr_cont(", %s.\n", smca_mce_descs[bank_type].descs[xec]);
 
 	if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc)
-		decode_dram_ecc(cpu_to_node(m->extcpu), m);
+		decode_dram_ecc(topology_die_id(m->extcpu), m);
 }
 
 static inline void amd_decode_err_code(u16 ec)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 165/717] scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 164/717] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 166/717] scsi: ufs: Fix clkgating on/off Greg Kroah-Hartman
                   ` (553 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Can Guo, Jaegeuk Kim,
	Martin K. Petersen, Sasha Levin

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit fd62de114f8c9df098dcd43b5d83c5714176dd12 ]

Once UFS is gated with CLKS_OFF, it should not call REQ_CLKS_OFF
again. This can lead to hibern8_enter failure.

Link: https://lore.kernel.org/r/20201117165839.1643377-2-jaegeuk@kernel.org
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 0c148fcd24deb..1ad7d6c130f5b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1752,7 +1752,8 @@ static void __ufshcd_release(struct ufs_hba *hba)
 	if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended ||
 	    hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL ||
 	    ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks ||
-	    hba->active_uic_cmd || hba->uic_async_done)
+	    hba->active_uic_cmd || hba->uic_async_done ||
+	    hba->clk_gating.state == CLKS_OFF)
 		return;
 
 	hba->clk_gating.state = REQ_CLKS_OFF;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 166/717] scsi: ufs: Fix clkgating on/off
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 165/717] scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 167/717] rcu: Allow rcu_irq_enter_check_tick() from NMI Greg Kroah-Hartman
                   ` (552 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Asutosh Das, Can Guo, Jaegeuk Kim,
	Martin K. Petersen, Sasha Levin

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit 8eb456be75af7e5a7ac0cd223eaa198cf7ee2ac1 ]

The following call stack prevents clk_gating at every I/O completion.  We
can remove the condition, ufshcd_any_tag_in_use(), since clkgating_work
will check it again.

ufshcd_complete_requests(struct ufs_hba *hba)
  ufshcd_transfer_req_compl()
    __ufshcd_transfer_req_compl()
      __ufshcd_release(hba)
        if (ufshcd_any_tag_in_use() == 1)
           return;
  ufshcd_tmc_handler(hba);
    blk_mq_tagset_busy_iter();

Note that this still requires work to deal with a potential race condition
when user sets clkgating.delay_ms to very small value. That can cause
preventing clkgating by the check of ufshcd_any_tag_in_use() in gate_work.

Link: https://lore.kernel.org/r/20201117165839.1643377-7-jaegeuk@kernel.org
Fixes: 7252a3603015 ("scsi: ufs: Avoid busy-waiting by eliminating tag conflicts")
Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 1ad7d6c130f5b..911aba3e7675c 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1751,7 +1751,7 @@ static void __ufshcd_release(struct ufs_hba *hba)
 
 	if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended ||
 	    hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL ||
-	    ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks ||
+	    hba->outstanding_tasks ||
 	    hba->active_uic_cmd || hba->uic_async_done ||
 	    hba->clk_gating.state == CLKS_OFF)
 		return;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 167/717] rcu: Allow rcu_irq_enter_check_tick() from NMI
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 166/717] scsi: ufs: Fix clkgating on/off Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 168/717] rcu,ftrace: Fix ftrace recursion Greg Kroah-Hartman
                   ` (551 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugenio Pérez,
	Peter Zijlstra (Intel),
	Andy Lutomirski, Paul E. McKenney, Sasha Levin

From: Peter Zijlstra <peterz@infradead.org>

[ Upstream commit 6dbce04d8417ae706596366e16841d77c454ba52 ]

Eugenio managed to tickle #PF from NMI context which resulted in
hitting a WARN in RCU through irqentry_enter() ->
__rcu_irq_enter_check_tick().

However, this situation is perfectly sane and does not warrant an
WARN. The #PF will (necessarily) be atomic and not require messing
with the tick state, so early return is correct.  This commit
therefore removes the WARN.

Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
Reported-by: "Eugenio Pérez" <eupm90@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index bd04b09b84b32..655ade095e043 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -928,8 +928,8 @@ void __rcu_irq_enter_check_tick(void)
 {
 	struct rcu_data *rdp = this_cpu_ptr(&rcu_data);
 
-	 // Enabling the tick is unsafe in NMI handlers.
-	if (WARN_ON_ONCE(in_nmi()))
+	// If we're here from NMI there's nothing to do.
+	if (in_nmi())
 		return;
 
 	RCU_LOCKDEP_WARN(rcu_dynticks_curr_cpu_in_eqs(),
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 168/717] rcu,ftrace: Fix ftrace recursion
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 167/717] rcu: Allow rcu_irq_enter_check_tick() from NMI Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 169/717] rcu/tree: Defer kvfree_rcu() allocation to a clean context Greg Kroah-Hartman
                   ` (550 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kim Phillips, Peter Zijlstra (Intel),
	Paul E. McKenney, Sasha Levin

From: Peter Zijlstra <peterz@infradead.org>

[ Upstream commit d2098b4440981705e844c50254540ba7b5f82795 ]

Kim reported that perf-ftrace made his box unhappy. It turns out that
commit:

  ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr")

removed one too many notrace qualifiers, probably due to there not being
a helpful comment.

This commit therefore reinstates the notrace and adds a comment to avoid
losing it again.

[ paulmck: Apply Steven Rostedt's feedback on the comment. ]
Fixes: ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr")
Reported-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 655ade095e043..585bf112ee08d 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -1093,8 +1093,11 @@ static void rcu_disable_urgency_upon_qs(struct rcu_data *rdp)
  * CPU can safely enter RCU read-side critical sections.  In other words,
  * if the current CPU is not in its idle loop or is in an interrupt or
  * NMI handler, return true.
+ *
+ * Make notrace because it can be called by the internal functions of
+ * ftrace, and making this notrace removes unnecessary recursion calls.
  */
-bool rcu_is_watching(void)
+notrace bool rcu_is_watching(void)
 {
 	bool ret;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 169/717] rcu/tree: Defer kvfree_rcu() allocation to a clean context
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 168/717] rcu,ftrace: Fix ftrace recursion Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 170/717] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
                   ` (549 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Uladzislau Rezki (Sony),
	Paul E. McKenney, Sasha Levin

From: Uladzislau Rezki (Sony) <urezki@gmail.com>

[ Upstream commit 56292e8609e39537297a7468dda4d87b9bd81d6a ]

The current memmory-allocation interface causes the following difficulties
for kvfree_rcu():

a) If built with CONFIG_PROVE_RAW_LOCK_NESTING, the lockdep will
   complain about violation of the nesting rules, as in "BUG: Invalid
   wait context".  This Kconfig option checks for proper raw_spinlock
   vs. spinlock nesting, in particular, it is not legal to acquire a
   spinlock_t while holding a raw_spinlock_t.

   This is a problem because kfree_rcu() uses raw_spinlock_t whereas the
   "page allocator" internally deals with spinlock_t to access to its
   zones. The code also can be broken from higher level of view:
   <snip>
       raw_spin_lock(&some_lock);
       kfree_rcu(some_pointer, some_field_offset);
   <snip>

b) If built with CONFIG_PREEMPT_RT, spinlock_t is converted into
   sleeplock.  This means that invoking the page allocator from atomic
   contexts results in "BUG: scheduling while atomic".

c) Please note that call_rcu() is already invoked from raw atomic context,
   so it is only reasonable to expaect that kfree_rcu() and kvfree_rcu()
   will also be called from atomic raw context.

This commit therefore defers page allocation to a clean context using the
combination of an hrtimer and a workqueue.  The hrtimer stage is required
in order to avoid deadlocks with the scheduler.  This deferred allocation
is required only when kvfree_rcu()'s per-CPU page cache is empty.

Link: https://lore.kernel.org/lkml/20200630164543.4mdcf6zb4zfclhln@linutronix.de/
Fixes: 3042f83f19be ("rcu: Support reclaim for head-less object")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree.c | 109 ++++++++++++++++++++++++++++------------------
 1 file changed, 66 insertions(+), 43 deletions(-)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 585bf112ee08d..593df7edfe97f 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -177,7 +177,7 @@ module_param(rcu_unlock_delay, int, 0444);
  * per-CPU. Object size is equal to one page. This value
  * can be changed at boot time.
  */
-static int rcu_min_cached_objs = 2;
+static int rcu_min_cached_objs = 5;
 module_param(rcu_min_cached_objs, int, 0444);
 
 /* Retrieve RCU kthreads priority for rcutorture */
@@ -3087,6 +3087,9 @@ struct kfree_rcu_cpu_work {
  *	In order to save some per-cpu space the list is singular.
  *	Even though it is lockless an access has to be protected by the
  *	per-cpu lock.
+ * @page_cache_work: A work to refill the cache when it is empty
+ * @work_in_progress: Indicates that page_cache_work is running
+ * @hrtimer: A hrtimer for scheduling a page_cache_work
  * @nr_bkv_objs: number of allocated objects at @bkvcache.
  *
  * This is a per-CPU structure.  The reason that it is not included in
@@ -3103,6 +3106,11 @@ struct kfree_rcu_cpu {
 	bool monitor_todo;
 	bool initialized;
 	int count;
+
+	struct work_struct page_cache_work;
+	atomic_t work_in_progress;
+	struct hrtimer hrtimer;
+
 	struct llist_head bkvcache;
 	int nr_bkv_objs;
 };
@@ -3220,10 +3228,10 @@ static void kfree_rcu_work(struct work_struct *work)
 			}
 			rcu_lock_release(&rcu_callback_map);
 
-			krcp = krc_this_cpu_lock(&flags);
+			raw_spin_lock_irqsave(&krcp->lock, flags);
 			if (put_cached_bnode(krcp, bkvhead[i]))
 				bkvhead[i] = NULL;
-			krc_this_cpu_unlock(krcp, flags);
+			raw_spin_unlock_irqrestore(&krcp->lock, flags);
 
 			if (bkvhead[i])
 				free_page((unsigned long) bkvhead[i]);
@@ -3350,6 +3358,57 @@ static void kfree_rcu_monitor(struct work_struct *work)
 		raw_spin_unlock_irqrestore(&krcp->lock, flags);
 }
 
+static enum hrtimer_restart
+schedule_page_work_fn(struct hrtimer *t)
+{
+	struct kfree_rcu_cpu *krcp =
+		container_of(t, struct kfree_rcu_cpu, hrtimer);
+
+	queue_work(system_highpri_wq, &krcp->page_cache_work);
+	return HRTIMER_NORESTART;
+}
+
+static void fill_page_cache_func(struct work_struct *work)
+{
+	struct kvfree_rcu_bulk_data *bnode;
+	struct kfree_rcu_cpu *krcp =
+		container_of(work, struct kfree_rcu_cpu,
+			page_cache_work);
+	unsigned long flags;
+	bool pushed;
+	int i;
+
+	for (i = 0; i < rcu_min_cached_objs; i++) {
+		bnode = (struct kvfree_rcu_bulk_data *)
+			__get_free_page(GFP_KERNEL | __GFP_NOWARN);
+
+		if (bnode) {
+			raw_spin_lock_irqsave(&krcp->lock, flags);
+			pushed = put_cached_bnode(krcp, bnode);
+			raw_spin_unlock_irqrestore(&krcp->lock, flags);
+
+			if (!pushed) {
+				free_page((unsigned long) bnode);
+				break;
+			}
+		}
+	}
+
+	atomic_set(&krcp->work_in_progress, 0);
+}
+
+static void
+run_page_cache_worker(struct kfree_rcu_cpu *krcp)
+{
+	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING &&
+			!atomic_xchg(&krcp->work_in_progress, 1)) {
+		hrtimer_init(&krcp->hrtimer, CLOCK_MONOTONIC,
+			HRTIMER_MODE_REL);
+		krcp->hrtimer.function = schedule_page_work_fn;
+		hrtimer_start(&krcp->hrtimer, 0, HRTIMER_MODE_REL);
+	}
+}
+
 static inline bool
 kvfree_call_rcu_add_ptr_to_bulk(struct kfree_rcu_cpu *krcp, void *ptr)
 {
@@ -3366,32 +3425,8 @@ kvfree_call_rcu_add_ptr_to_bulk(struct kfree_rcu_cpu *krcp, void *ptr)
 	if (!krcp->bkvhead[idx] ||
 			krcp->bkvhead[idx]->nr_records == KVFREE_BULK_MAX_ENTR) {
 		bnode = get_cached_bnode(krcp);
-		if (!bnode) {
-			/*
-			 * To keep this path working on raw non-preemptible
-			 * sections, prevent the optional entry into the
-			 * allocator as it uses sleeping locks. In fact, even
-			 * if the caller of kfree_rcu() is preemptible, this
-			 * path still is not, as krcp->lock is a raw spinlock.
-			 * With additional page pre-allocation in the works,
-			 * hitting this return is going to be much less likely.
-			 */
-			if (IS_ENABLED(CONFIG_PREEMPT_RT))
-				return false;
-
-			/*
-			 * NOTE: For one argument of kvfree_rcu() we can
-			 * drop the lock and get the page in sleepable
-			 * context. That would allow to maintain an array
-			 * for the CONFIG_PREEMPT_RT as well if no cached
-			 * pages are available.
-			 */
-			bnode = (struct kvfree_rcu_bulk_data *)
-				__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
-		}
-
 		/* Switch to emergency path. */
-		if (unlikely(!bnode))
+		if (!bnode)
 			return false;
 
 		/* Initialize the new block. */
@@ -3455,12 +3490,10 @@ void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
 		goto unlock_return;
 	}
 
-	/*
-	 * Under high memory pressure GFP_NOWAIT can fail,
-	 * in that case the emergency path is maintained.
-	 */
 	success = kvfree_call_rcu_add_ptr_to_bulk(krcp, ptr);
 	if (!success) {
+		run_page_cache_worker(krcp);
+
 		if (head == NULL)
 			// Inline if kvfree_rcu(one_arg) call.
 			goto unlock_return;
@@ -4452,24 +4485,14 @@ static void __init kfree_rcu_batch_init(void)
 
 	for_each_possible_cpu(cpu) {
 		struct kfree_rcu_cpu *krcp = per_cpu_ptr(&krc, cpu);
-		struct kvfree_rcu_bulk_data *bnode;
 
 		for (i = 0; i < KFREE_N_BATCHES; i++) {
 			INIT_RCU_WORK(&krcp->krw_arr[i].rcu_work, kfree_rcu_work);
 			krcp->krw_arr[i].krcp = krcp;
 		}
 
-		for (i = 0; i < rcu_min_cached_objs; i++) {
-			bnode = (struct kvfree_rcu_bulk_data *)
-				__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
-
-			if (bnode)
-				put_cached_bnode(krcp, bnode);
-			else
-				pr_err("Failed to preallocate for %d CPU!\n", cpu);
-		}
-
 		INIT_DELAYED_WORK(&krcp->monitor_work, kfree_rcu_monitor);
+		INIT_WORK(&krcp->page_cache_work, fill_page_cache_func);
 		krcp->initialized = true;
 	}
 	if (register_shrinker(&kfree_rcu_shrinker))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 170/717] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 169/717] rcu/tree: Defer kvfree_rcu() allocation to a clean context Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 171/717] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
                   ` (548 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor,
	Christian Lamparter, Herbert Xu, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ]

Clang warns:

drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has
lower precedence than '|'; '|' will be evaluated first
[-Wbitwise-conditional-parentheses]
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '|' expression to silence this warning
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                                                                        )
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '?:' expression to evaluate it first
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                 (
1 warning generated.

It looks like this should have been a logical OR so that
PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type
is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the
operator so that everything works properly.

Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load")
Link: https://github.com/ClangBuiltLinux/linux/issues/1198
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 981de43ea5e24..2e3690f65786d 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -917,7 +917,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
 	}
 
 	pd->pd_ctl.w = PD_CTL_HOST_READY |
-		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
+		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
 		 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
 			PD_CTL_HASH_FINAL : 0);
 	pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 171/717] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 170/717] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak Greg Kroah-Hartman
                   ` (547 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Herbert Xu, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]

The pm_runtime_enable will increase power disable depth.
Thus a pairing decrement is needed on the error handling
path to keep it balanced according to context.

Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-aes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index 4fd14d90cc409..1b1e0ab0a831a 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1137,7 +1137,7 @@ static int omap_aes_probe(struct platform_device *pdev)
 	if (err < 0) {
 		dev_err(dev, "%s: failed to get_sync(%d)\n",
 			__func__, err);
-		goto err_res;
+		goto err_pm_disable;
 	}
 
 	omap_aes_dma_stop(dd);
@@ -1246,6 +1246,7 @@ err_engine:
 	omap_aes_dma_cleanup(dd);
 err_irq:
 	tasklet_kill(&dd->done_task);
+err_pm_disable:
 	pm_runtime_disable(dev);
 err_res:
 	dd = NULL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 171/717] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 173/717] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
                   ` (546 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
	Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 732b764099f651a088fd931d7b8121b6aa84e62e ]

This patch fixes the following smatch warnings:
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c:412
sun8i_ce_hash_run() warn: possible memory leak of 'result'
Note: "buf" is leaked as well.

Furthermore, in case of ENOMEM, crypto_finalize_hash_request() was not
called which was an error.

Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
index a94bf28f858a7..4c5a2c11d7141 100644
--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
@@ -262,13 +262,13 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
 	u32 common;
 	u64 byte_count;
 	__le32 *bf;
-	void *buf;
+	void *buf = NULL;
 	int j, i, todo;
 	int nbw = 0;
 	u64 fill, min_fill;
 	__be64 *bebits;
 	__le64 *lebits;
-	void *result;
+	void *result = NULL;
 	u64 bs;
 	int digestsize;
 	dma_addr_t addr_res, addr_pad;
@@ -285,13 +285,17 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
 
 	/* the padding could be up to two block. */
 	buf = kzalloc(bs * 2, GFP_KERNEL | GFP_DMA);
-	if (!buf)
-		return -ENOMEM;
+	if (!buf) {
+		err = -ENOMEM;
+		goto theend;
+	}
 	bf = (__le32 *)buf;
 
 	result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
-	if (!result)
-		return -ENOMEM;
+	if (!result) {
+		err = -ENOMEM;
+		goto theend;
+	}
 
 	flow = rctx->flow;
 	chan = &ce->chanlist[flow];
@@ -403,11 +407,11 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
 	dma_unmap_sg(ce->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
 	dma_unmap_single(ce->dev, addr_res, digestsize, DMA_FROM_DEVICE);
 
-	kfree(buf);
 
 	memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
-	kfree(result);
 theend:
+	kfree(buf);
+	kfree(result);
 	crypto_finalize_hash_request(engine, breq, err);
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 173/717] spi: fix resource leak for drivers without .remove callback
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 174/717] drm/meson: dw-hdmi: Disable clocks on driver teardown Greg Kroah-Hartman
                   ` (545 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Mark Brown,
	Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]

Consider an spi driver with a .probe but without a .remove callback (e.g.
rtc-ds1347). The function spi_drv_probe() is called to bind a device and
so dev_pm_domain_attach() is called. As there is no remove callback
spi_drv_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.

To fix this always use both spi_drv_probe() and spi_drv_remove() and
make them handle the respective callback not being set. This has the
side effect that for a (hypothetical) driver that has neither .probe nor
remove the clk and pm domain setup is done.

Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index fc9a59788d2ea..2eaa7dbb70108 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -405,9 +405,11 @@ static int spi_drv_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = sdrv->probe(spi);
-	if (ret)
-		dev_pm_domain_detach(dev, true);
+	if (sdrv->probe) {
+		ret = sdrv->probe(spi);
+		if (ret)
+			dev_pm_domain_detach(dev, true);
+	}
 
 	return ret;
 }
@@ -415,9 +417,10 @@ static int spi_drv_probe(struct device *dev)
 static int spi_drv_remove(struct device *dev)
 {
 	const struct spi_driver		*sdrv = to_spi_driver(dev->driver);
-	int ret;
+	int ret = 0;
 
-	ret = sdrv->remove(to_spi_device(dev));
+	if (sdrv->remove)
+		ret = sdrv->remove(to_spi_device(dev));
 	dev_pm_domain_detach(dev, true);
 
 	return ret;
@@ -442,10 +445,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
 {
 	sdrv->driver.owner = owner;
 	sdrv->driver.bus = &spi_bus_type;
-	if (sdrv->probe)
-		sdrv->driver.probe = spi_drv_probe;
-	if (sdrv->remove)
-		sdrv->driver.remove = spi_drv_remove;
+	sdrv->driver.probe = spi_drv_probe;
+	sdrv->driver.remove = spi_drv_remove;
 	if (sdrv->shutdown)
 		sdrv->driver.shutdown = spi_drv_shutdown;
 	return driver_register(&sdrv->driver);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 174/717] drm/meson: dw-hdmi: Disable clocks on driver teardown
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 173/717] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 175/717] drm/meson: dw-hdmi: Enable the iahb clock early enough Greg Kroah-Hartman
                   ` (544 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 1dfeea904550c11eccf3fd5f6256e4b0f0208dfe ]

The HDMI driver request clocks early, but never disable them, leaving
the clocks on even when the driver is removed.

Fix it by slightly refactoring the clock code, and register a devm
action that will eventually disable/unprepare the enabled clocks.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201120094205.525228-2-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_dw_hdmi.c | 43 ++++++++++++++++++---------
 1 file changed, 29 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index 7f8eea4941472..29623b309cb11 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -145,8 +145,6 @@ struct meson_dw_hdmi {
 	struct reset_control *hdmitx_apb;
 	struct reset_control *hdmitx_ctrl;
 	struct reset_control *hdmitx_phy;
-	struct clk *hdmi_pclk;
-	struct clk *venci_clk;
 	struct regulator *hdmi_supply;
 	u32 irq_stat;
 	struct dw_hdmi *hdmi;
@@ -946,6 +944,29 @@ static void meson_disable_regulator(void *data)
 	regulator_disable(data);
 }
 
+static void meson_disable_clk(void *data)
+{
+	clk_disable_unprepare(data);
+}
+
+static int meson_enable_clk(struct device *dev, char *name)
+{
+	struct clk *clk;
+	int ret;
+
+	clk = devm_clk_get(dev, name);
+	if (IS_ERR(clk)) {
+		dev_err(dev, "Unable to get %s pclk\n", name);
+		return PTR_ERR(clk);
+	}
+
+	ret = clk_prepare_enable(clk);
+	if (!ret)
+		ret = devm_add_action_or_reset(dev, meson_disable_clk, clk);
+
+	return ret;
+}
+
 static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 				void *data)
 {
@@ -1026,19 +1047,13 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 	if (IS_ERR(meson_dw_hdmi->hdmitx))
 		return PTR_ERR(meson_dw_hdmi->hdmitx);
 
-	meson_dw_hdmi->hdmi_pclk = devm_clk_get(dev, "isfr");
-	if (IS_ERR(meson_dw_hdmi->hdmi_pclk)) {
-		dev_err(dev, "Unable to get HDMI pclk\n");
-		return PTR_ERR(meson_dw_hdmi->hdmi_pclk);
-	}
-	clk_prepare_enable(meson_dw_hdmi->hdmi_pclk);
+	ret = meson_enable_clk(dev, "isfr");
+	if (ret)
+		return ret;
 
-	meson_dw_hdmi->venci_clk = devm_clk_get(dev, "venci");
-	if (IS_ERR(meson_dw_hdmi->venci_clk)) {
-		dev_err(dev, "Unable to get venci clk\n");
-		return PTR_ERR(meson_dw_hdmi->venci_clk);
-	}
-	clk_prepare_enable(meson_dw_hdmi->venci_clk);
+	ret = meson_enable_clk(dev, "venci");
+	if (ret)
+		return ret;
 
 	dw_plat_data->regm = devm_regmap_init(dev, NULL, meson_dw_hdmi,
 					      &meson_dw_hdmi_regmap_config);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 175/717] drm/meson: dw-hdmi: Enable the iahb clock early enough
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 174/717] drm/meson: dw-hdmi: Disable clocks on driver teardown Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 176/717] PCI: Disable MSI for Pericom PCIe-USB adapter Greg Kroah-Hartman
                   ` (543 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernelci.org bot, Marc Zyngier,
	Guillaume Tucker, Neil Armstrong, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 2b6cb81b95d1e8abfb6d32cf194a5bd2992c315c ]

Instead of moving meson_dw_hdmi_init() around which breaks existing
platform, let's enable the clock meson_dw_hdmi_init() depends on.
This means we don't have to worry about this clock being enabled or
not, depending on the boot-loader features.

Fixes: b33340e33acd ("drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers")
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Guillaume Tucker <guillaume.tucker@collabora.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
[narmstrong: changed reported by to kernelci.org bot]
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201120094205.525228-3-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/meson/meson_dw_hdmi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index 29623b309cb11..aad75a22dc338 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -1051,6 +1051,10 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 	if (ret)
 		return ret;
 
+	ret = meson_enable_clk(dev, "iahb");
+	if (ret)
+		return ret;
+
 	ret = meson_enable_clk(dev, "venci");
 	if (ret)
 		return ret;
@@ -1086,6 +1090,8 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 
 	encoder->possible_crtcs = BIT(0);
 
+	meson_dw_hdmi_init(meson_dw_hdmi);
+
 	DRM_DEBUG_DRIVER("encoder initialized\n");
 
 	/* Bridge / Connector */
@@ -1110,8 +1116,6 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
 	if (IS_ERR(meson_dw_hdmi->hdmi))
 		return PTR_ERR(meson_dw_hdmi->hdmi);
 
-	meson_dw_hdmi_init(meson_dw_hdmi);
-
 	next_bridge = of_drm_find_bridge(pdev->dev.of_node);
 	if (next_bridge)
 		drm_bridge_attach(encoder, next_bridge,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 176/717] PCI: Disable MSI for Pericom PCIe-USB adapter
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 175/717] drm/meson: dw-hdmi: Enable the iahb clock early enough Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 177/717] PCI: brcmstb: Initialize "tmp" before use Greg Kroah-Hartman
                   ` (542 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, alberto.vignani, Andy Shevchenko,
	Bjorn Helgaas, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit f83c37941e881224885f2e694e0626bea358e96b ]

Pericom PCIe-USB adapter advertises MSI, but documentation says "The MSI
Function is not implemented on this device" in chapters 7.3.27,
7.3.29-7.3.31, and Alberto found that MSI in fact does not work.

Disable MSI for these devices.

Datasheet: https://www.diodes.com/assets/Datasheets/PI7C9X440SL.pdf
Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
Link: https://lore.kernel.org/linux-usb/20201030134826.GP4077@smile.fi.intel.com/
Link: https://lore.kernel.org/r/20201106100526.17726-1-andriy.shevchenko@linux.intel.com
Reported-by: alberto.vignani@fastwebnet.it
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f70692ac79c56..fb1dc11e7cc52 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5567,17 +5567,26 @@ static void pci_fixup_no_d0_pme(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x2142, pci_fixup_no_d0_pme);
 
 /*
- * Device [12d8:0x400e] and [12d8:0x400f]
+ * Device 12d8:0x400e [OHCI] and 12d8:0x400f [EHCI]
+ *
  * These devices advertise PME# support in all power states but don't
  * reliably assert it.
+ *
+ * These devices also advertise MSI, but documentation (PI7C9X440SL.pdf)
+ * says "The MSI Function is not implemented on this device" in chapters
+ * 7.3.27, 7.3.29-7.3.31.
  */
-static void pci_fixup_no_pme(struct pci_dev *dev)
+static void pci_fixup_no_msi_no_pme(struct pci_dev *dev)
 {
+#ifdef CONFIG_PCI_MSI
+	pci_info(dev, "MSI is not implemented on this device, disabling it\n");
+	dev->no_msi = 1;
+#endif
 	pci_info(dev, "PME# is unreliable, disabling it\n");
 	dev->pme_support = 0;
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_pme);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_pme);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_msi_no_pme);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_msi_no_pme);
 
 static void apex_pci_fixup_class(struct pci_dev *pdev)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 177/717] PCI: brcmstb: Initialize "tmp" before use
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 176/717] PCI: Disable MSI for Pericom PCIe-USB adapter Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 178/717] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
                   ` (541 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafał Miłecki, Jim Quinlan,
	Lorenzo Pieralisi, Nicolas Saenz Julienne, Florian Fainelli,
	Sasha Levin

From: Jim Quinlan <james.quinlan@broadcom.com>

[ Upstream commit ddaff0af653136ee1e0b49116ecf2988c2fc64ca ]

The variable 'tmp' is used multiple times in the brcm_pcie_setup()
function.  One such usage did not initialize 'tmp' to the current value
of the target register.  By luck the mistake does not currently affect
behavior;  regardless 'tmp' is now initialized properly.

Suggested-by: Rafał Miłecki <zajec5@gmail.com>
Link: https://lore.kernel.org/r/20201102205712.23332-1-james.quinlan@broadcom.com
Fixes: c0452137034b ("PCI: brcmstb: Add Broadcom STB PCIe host controller driver")
Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-brcmstb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index bea86899bd5df..9c3d2982248d3 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -893,6 +893,7 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 		burst = 0x2; /* 512 bytes */
 
 	/* Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN */
+	tmp = readl(base + PCIE_MISC_MISC_CTRL);
 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_SCB_ACCESS_EN_MASK);
 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_CFG_READ_UR_MODE_MASK);
 	u32p_replace_bits(&tmp, burst, PCIE_MISC_MISC_CTRL_MAX_BURST_SIZE_MASK);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 178/717] soc: ti: knav_qmss: fix reference leak in knav_queue_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 177/717] PCI: brcmstb: Initialize "tmp" before use Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 179/717] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
                   ` (540 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in knav_queue_probe, so we should fix it.

Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index a460f201bf8e7..54afa8f7f4087 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1784,6 +1784,7 @@ static int knav_queue_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	ret = pm_runtime_get_sync(&pdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(&pdev->dev);
 		dev_err(dev, "Failed to enable QMSS\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 179/717] soc: ti: Fix reference imbalance in knav_dma_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 178/717] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 180/717] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
                   ` (539 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]

The patch fix two reference leak.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to call put operation will result in
     reference leak.

  2) The pm_runtime_enable will increase power disable depth. Thus
     a pairing decrement is needed on the error handling path to
     keep it balanced.

We fix it by: 1) adding call pm_runtime_put_noidle or
pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
in error handling, to keep usage counter and disable depth balanced.

Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_dma.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 8c863ecb1c605..56597f6ea666a 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -749,8 +749,9 @@ static int knav_dma_probe(struct platform_device *pdev)
 	pm_runtime_enable(kdev->dev);
 	ret = pm_runtime_get_sync(kdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(kdev->dev);
 		dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* Initialise all packet dmas */
@@ -764,7 +765,8 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	if (list_empty(&kdev->list)) {
 		dev_err(dev, "no valid dma instance\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_put_sync;
 	}
 
 	debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
@@ -772,6 +774,13 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	device_ready = true;
 	return ret;
+
+err_put_sync:
+	pm_runtime_put_sync(kdev->dev);
+err_pm_disable:
+	pm_runtime_disable(kdev->dev);
+
+	return ret;
 }
 
 static int knav_dma_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 180/717] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 179/717] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:42 ` [PATCH 5.10 181/717] soc: qcom: initialize local variable Greg Kroah-Hartman
                   ` (538 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
	Santosh Shilimkar, Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]

Fix to return the error code from of_get_child_by_name() instaed of 0
in knav_queue_probe().

Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 54afa8f7f4087..53e36d4328d1e 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1852,9 +1852,10 @@ static int knav_queue_probe(struct platform_device *pdev)
 	if (ret)
 		goto err;
 
-	regions =  of_get_child_by_name(node, "descriptor-regions");
+	regions = of_get_child_by_name(node, "descriptor-regions");
 	if (!regions) {
 		dev_err(dev, "descriptor-regions not specified\n");
+		ret = -ENODEV;
 		goto err;
 	}
 	ret = knav_queue_setup_regions(kdev, regions);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 181/717] soc: qcom: initialize local variable
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 180/717] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:42 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 182/717] arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp Greg Kroah-Hartman
                   ` (537 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:42 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sibi Sankar, Tom Rix,
	Bjorn Andersson, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit a161ffe4b877721d8917e18e70461d255a090f19 ]

clang static analysis reports this problem

pdr_interface.c:596:6: warning: Branch condition evaluates
  to a garbage value
        if (!req.service_path[0])
            ^~~~~~~~~~~~~~~~~~~~

This check that req.service_path was set in an earlier loop.
However req is a stack variable and its initial value
is undefined.

So initialize req to 0.

Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers")
Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
Signed-off-by: Tom Rix <trix@redhat.com>
Link: https://lore.kernel.org/r/20200819184637.15648-1-trix@redhat.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/pdr_interface.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c
index 088dc99f77f3f..f63135c09667f 100644
--- a/drivers/soc/qcom/pdr_interface.c
+++ b/drivers/soc/qcom/pdr_interface.c
@@ -569,7 +569,7 @@ EXPORT_SYMBOL(pdr_add_lookup);
 int pdr_restart_pd(struct pdr_handle *pdr, struct pdr_service *pds)
 {
 	struct servreg_restart_pd_resp resp;
-	struct servreg_restart_pd_req req;
+	struct servreg_restart_pd_req req = { 0 };
 	struct sockaddr_qrtr addr;
 	struct pdr_service *tmp;
 	struct qmi_txn txn;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 182/717] arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-12-28 12:42 ` [PATCH 5.10 181/717] soc: qcom: initialize local variable Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 183/717] arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias Greg Kroah-Hartman
                   ` (536 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vinod Koul, Dmitry Baryshkov,
	Bjorn Andersson, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit d371a931540bc36fd1199de3ec365a1187b7b282 ]

Qualcomm boards should define two compatible strings: one for board,
anoter one for SoC family. sm8250-mtp.dts lists just the board
compatible, which makes it incompatible with qcom.yaml schema.

Reviewed-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
Link: https://lore.kernel.org/r/20200930112133.2091505-1-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8250-mtp.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
index fd194ed7fbc86..98675e1f8204f 100644
--- a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
@@ -14,7 +14,7 @@
 
 / {
 	model = "Qualcomm Technologies, Inc. SM8250 MTP";
-	compatible = "qcom,sm8250-mtp";
+	compatible = "qcom,sm8250-mtp", "qcom,sm8250";
 
 	aliases {
 		serial0 = &uart12;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 183/717] arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 182/717] arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 184/717] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
                   ` (535 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Nikita Travkin,
	Bjorn Andersson, Sasha Levin

From: Nikita Travkin <nikitos.tr@gmail.com>

[ Upstream commit 4e8692c2ee3d4ac6b669f7e306364d77a574c810 ]

Some versions of the firmware leave i2c gpios in a wrong state.
Add pinctrl that disables pin bias since external pull-up resistors
are present.

Reviewed-by: Stephan Gerhold <stephan@gerhold.net>
Fixes: 1329c1ab0730 ("arm64: dts: qcom: Add device tree for Samsung Galaxy A3U/A5U")
Signed-off-by: Nikita Travkin <nikitos.tr@gmail.com>
Link: https://lore.kernel.org/r/20201113175917.189123-6-nikitos.tr@gmail.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/qcom/msm8916-samsung-a2015-common.dtsi   | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
index b18d21e42f596..f7ac4c4033db6 100644
--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
@@ -78,6 +78,9 @@
 		sda-gpios = <&msmgpio 105 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
 		scl-gpios = <&msmgpio 106 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
 
+		pinctrl-names = "default";
+		pinctrl-0 = <&muic_i2c_default>;
+
 		#address-cells = <1>;
 		#size-cells = <0>;
 
@@ -314,6 +317,14 @@
 		};
 	};
 
+	muic_i2c_default: muic-i2c-default {
+		pins = "gpio105", "gpio106";
+		function = "gpio";
+
+		drive-strength = <2>;
+		bias-disable;
+	};
+
 	muic_int_default: muic-int-default {
 		pins = "gpio12";
 		function = "gpio";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 184/717] Input: omap4-keypad - fix runtime PM error handling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 183/717] arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 185/717] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
                   ` (534 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dmitry Torokhov, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]

In omap4_keypad_probe, the patch fix several bugs.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) In err_unmap, forget to disable runtime of device,
     pm_runtime_enable will increase power disable depth. Thus a
     pairing decrement is needed on the error handling path to keep
     it balanced.

  3) In err_pm_disable, it will call pm_runtime_put_sync twice not
     one time.

To fix this we factor out code reading revision and disabling touchpad, and
drop PM reference once we are done talking to the device.

Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
 1 file changed, 53 insertions(+), 36 deletions(-)

diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index d6c924032aaa8..dd16f7b3c7ef6 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -186,12 +186,8 @@ static int omap4_keypad_open(struct input_dev *input)
 	return 0;
 }
 
-static void omap4_keypad_close(struct input_dev *input)
+static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
 {
-	struct omap4_keypad *keypad_data = input_get_drvdata(input);
-
-	disable_irq(keypad_data->irq);
-
 	/* Disable interrupts and wake-up events */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
 			 OMAP4_VAL_IRQDISABLE);
@@ -200,7 +196,15 @@ static void omap4_keypad_close(struct input_dev *input)
 	/* clear pending interrupts */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
 			 kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+}
+
+static void omap4_keypad_close(struct input_dev *input)
+{
+	struct omap4_keypad *keypad_data;
 
+	keypad_data = input_get_drvdata(input);
+	disable_irq(keypad_data->irq);
+	omap4_keypad_stop(keypad_data);
 	enable_irq(keypad_data->irq);
 
 	pm_runtime_put_sync(input->dev.parent);
@@ -223,13 +227,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
 	return 0;
 }
 
+static int omap4_keypad_check_revision(struct device *dev,
+				       struct omap4_keypad *keypad_data)
+{
+	unsigned int rev;
+
+	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+	rev &= 0x03 << 30;
+	rev >>= 30;
+	switch (rev) {
+	case KBD_REVISION_OMAP4:
+		keypad_data->reg_offset = 0x00;
+		keypad_data->irqreg_offset = 0x00;
+		break;
+	case KBD_REVISION_OMAP5:
+		keypad_data->reg_offset = 0x10;
+		keypad_data->irqreg_offset = 0x0c;
+		break;
+	default:
+		dev_err(dev, "Keypad reports unsupported revision %d", rev);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int omap4_keypad_probe(struct platform_device *pdev)
 {
 	struct omap4_keypad *keypad_data;
 	struct input_dev *input_dev;
 	struct resource *res;
 	unsigned int max_keys;
-	int rev;
 	int irq;
 	int error;
 
@@ -269,41 +297,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_release_mem;
 	}
 
+	pm_runtime_enable(&pdev->dev);
 
 	/*
 	 * Enable clocks for the keypad module so that we can read
 	 * revision register.
 	 */
-	pm_runtime_enable(&pdev->dev);
 	error = pm_runtime_get_sync(&pdev->dev);
 	if (error) {
 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
-		goto err_unmap;
-	}
-	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
-	rev &= 0x03 << 30;
-	rev >>= 30;
-	switch (rev) {
-	case KBD_REVISION_OMAP4:
-		keypad_data->reg_offset = 0x00;
-		keypad_data->irqreg_offset = 0x00;
-		break;
-	case KBD_REVISION_OMAP5:
-		keypad_data->reg_offset = 0x10;
-		keypad_data->irqreg_offset = 0x0c;
-		break;
-	default:
-		dev_err(&pdev->dev,
-			"Keypad reports unsupported revision %d", rev);
-		error = -EINVAL;
-		goto err_pm_put_sync;
+		pm_runtime_put_noidle(&pdev->dev);
+	} else {
+		error = omap4_keypad_check_revision(&pdev->dev,
+						    keypad_data);
+		if (!error) {
+			/* Ensure device does not raise interrupts */
+			omap4_keypad_stop(keypad_data);
+		}
+		pm_runtime_put_sync(&pdev->dev);
 	}
+	if (error)
+		goto err_pm_disable;
 
 	/* input device allocation */
 	keypad_data->input = input_dev = input_allocate_device();
 	if (!input_dev) {
 		error = -ENOMEM;
-		goto err_pm_put_sync;
+		goto err_pm_disable;
 	}
 
 	input_dev->name = pdev->name;
@@ -349,28 +369,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_free_keymap;
 	}
 
-	device_init_wakeup(&pdev->dev, true);
-	pm_runtime_put_sync(&pdev->dev);
-
 	error = input_register_device(keypad_data->input);
 	if (error < 0) {
 		dev_err(&pdev->dev, "failed to register input device\n");
-		goto err_pm_disable;
+		goto err_free_irq;
 	}
 
+	device_init_wakeup(&pdev->dev, true);
 	platform_set_drvdata(pdev, keypad_data);
+
 	return 0;
 
-err_pm_disable:
-	pm_runtime_disable(&pdev->dev);
+err_free_irq:
 	free_irq(keypad_data->irq, keypad_data);
 err_free_keymap:
 	kfree(keypad_data->keymap);
 err_free_input:
 	input_free_device(input_dev);
-err_pm_put_sync:
-	pm_runtime_put_sync(&pdev->dev);
-err_unmap:
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 	iounmap(keypad_data->base);
 err_release_mem:
 	release_mem_region(res->start, resource_size(res));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 185/717] clk: meson: Kconfig: fix dependency for G12A
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 184/717] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 186/717] staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe() Greg Kroah-Hartman
                   ` (533 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Hilman, Jerome Brunet, Sasha Levin

From: Kevin Hilman <khilman@baylibre.com>

[ Upstream commit bae69bfa3a586493469078ec4ca35499b754ba5c ]

When building only G12A, ensure that VID_PLL_DIV clock driver is
selected, otherwise results in this build error:

ERROR: modpost: "meson_vid_pll_div_ro_ops" [drivers/clk/meson/g12a.ko] undefined!

Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller")
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201118190930.34352-1-khilman@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
index 034da203e8e0e..9a8a548d839d8 100644
--- a/drivers/clk/meson/Kconfig
+++ b/drivers/clk/meson/Kconfig
@@ -110,6 +110,7 @@ config COMMON_CLK_G12A
 	select COMMON_CLK_MESON_AO_CLKC
 	select COMMON_CLK_MESON_EE_CLKC
 	select COMMON_CLK_MESON_CPU_DYNDIV
+	select COMMON_CLK_MESON_VID_PLL_DIV
 	select MFD_SYSCON
 	help
 	  Support for the clock controller on Amlogic S905D2, S905X2 and S905Y2
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 186/717] staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 185/717] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 187/717] ath11k: Fix the rx_filter flag setting for peer rssi stats Greg Kroah-Hartman
                   ` (532 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit ba3e4a2a0b3c639d3835f2f1dce27d79576ae453 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 4524ac56cdca ("staging: mfd: add a PMIC driver for HiSilicon 6421 SPMI version")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201118103724.57451-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/hikey9xx/hi6421-spmi-pmic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/hikey9xx/hi6421-spmi-pmic.c b/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
index 64b30d263c8d0..4f34a52829700 100644
--- a/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
+++ b/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
@@ -262,8 +262,10 @@ static int hi6421_spmi_pmic_probe(struct spmi_device *pdev)
 	hi6421_spmi_pmic_irq_prc(pmic);
 
 	pmic->irqs = devm_kzalloc(dev, HISI_IRQ_NUM * sizeof(int), GFP_KERNEL);
-	if (!pmic->irqs)
+	if (!pmic->irqs) {
+		ret = -ENOMEM;
 		goto irq_malloc;
+	}
 
 	pmic->domain = irq_domain_add_simple(np, HISI_IRQ_NUM, 0,
 					     &hi6421_spmi_domain_ops, pmic);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 187/717] ath11k: Fix the rx_filter flag setting for peer rssi stats
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 186/717] staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 188/717] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
                   ` (531 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maharaja Kennadyrajan, Kalle Valo,
	Sasha Levin

From: Maharaja Kennadyrajan <mkenna@codeaurora.org>

[ Upstream commit 11af6de4799ee6eeae3730f18fd417414d212e2d ]

Set the rx_filter in ath11k_mac_config_mon_status_default(),
only when the rx_filter value exists in ath11k_debug_rx_filter().

Without this change, rx_filter gets set to 0 and peer rssi stats
aren't updating properly from firmware.

Tested-on: IPQ8074 WLAN.HK.2.1.0.1-01230-QCAHKSWPL_SILICONZ-4

Fixes: ec48d28ba291 ("ath11k: Fix rx_filter flags setting for per peer rx_stats")

Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605091117-11005-1-git-send-email-mkenna@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 7a2c9708693ec..f5e49e1c11ed7 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4094,7 +4094,8 @@ static int ath11k_mac_config_mon_status_default(struct ath11k *ar, bool enable)
 
 	if (enable) {
 		tlv_filter = ath11k_mac_mon_status_filter_default;
-		tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
+		if (ath11k_debugfs_rx_filter(ar))
+			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
 	}
 
 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 188/717] RDMA/cxgb4: Validate the number of CQEs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 187/717] ath11k: Fix the rx_filter flag setting for peer rssi stats Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 189/717] soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute Greg Kroah-Hartman
                   ` (530 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]

Before create CQ, make sure that the requested number of CQEs is in the
supported range.

Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 28349ed508854..d6cfefc269ee3 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1008,6 +1008,9 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	if (attr->flags)
 		return -EINVAL;
 
+	if (entries < 1 || entries > ibdev->attrs.max_cqe)
+		return -EINVAL;
+
 	if (vector >= rhp->rdev.lldi.nciq)
 		return -EINVAL;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 189/717] soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 188/717] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 190/717] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller Greg Kroah-Hartman
                   ` (529 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla,
	Pierre-Louis Bossart, Vinod Koul, Sasha Levin

From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>

[ Upstream commit e6db818a3f51781ba12ac4d52b8773f74d57b06b ]

running kernel with CONFIG_DEBUG_LOCKS_ALLOC enabled will below warning:

BUG: key ffff502e09807098 has not been registered!
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 5 PID: 129 at kernel/locking/lockdep.c:4623
	lockdep_init_map_waits+0xe8/0x250
Modules linked in:
CPU: 5 PID: 129 Comm: kworker/5:1 Tainted: G
       W         5.10.0-rc1-00277-ged49f224ca3f-dirty #1210
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80c00005 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
pc : lockdep_init_map_waits+0xe8/0x250
lr : lockdep_init_map_waits+0xe8/0x250
 [ Trimmed ]

Call trace:
 lockdep_init_map_waits+0xe8/0x250
 __kernfs_create_file+0x78/0x180
 sysfs_add_file_mode_ns+0x94/0x1c8
 internal_create_group+0x110/0x3e0
 sysfs_create_group+0x18/0x28
 devm_device_add_group+0x4c/0xb0
 add_all_attributes+0x438/0x490
 sdw_slave_sysfs_dpn_init+0x128/0x138
 sdw_slave_sysfs_init+0x80/0xa0
 sdw_drv_probe+0x94/0x170
 really_probe+0x118/0x3e0
 driver_probe_device+0x5c/0xc0

 [ Trimmed ]

CPU: 5 PID: 129 Comm: kworker/5:1 Tainted: G
     W         5.10.0-rc1-00277-ged49f224ca3f-dirty #1210
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Workqueue: events deferred_probe_work_func
Call trace:
 dump_backtrace+0x0/0x1c0
 show_stack+0x18/0x68
 dump_stack+0xd8/0x134
 __warn+0xa0/0x158
 report_bug+0xc8/0x178
 bug_handler+0x20/0x78
 brk_handler+0x70/0xc8

[ Trimmed ]

Fix this by initializing dynamically allocated sysfs attribute to keep lockdep happy!

Fixes: bcac59029955 ("soundwire: add Slave sysfs support")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20201104112941.1134-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/sysfs_slave_dpn.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soundwire/sysfs_slave_dpn.c b/drivers/soundwire/sysfs_slave_dpn.c
index 05a721ea9830a..c4b6543c09fd6 100644
--- a/drivers/soundwire/sysfs_slave_dpn.c
+++ b/drivers/soundwire/sysfs_slave_dpn.c
@@ -37,6 +37,7 @@ static int field##_attribute_alloc(struct device *dev,			\
 		return -ENOMEM;						\
 	dpn_attr->N = N;						\
 	dpn_attr->dir = dir;						\
+	sysfs_attr_init(&dpn_attr->dev_attr.attr);			\
 	dpn_attr->format_string = format_string;			\
 	dpn_attr->dev_attr.attr.name = __stringify(field);		\
 	dpn_attr->dev_attr.attr.mode = 0444;				\
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 190/717] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 189/717] soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
                   ` (528 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Linus Walleij, Sasha Levin

From: Yangtao Li <frank@allwinnertech.com>

[ Upstream commit 6de7ed693c631d4689acfe90c434147598d75543 ]

A100's pin starts with PB, so it should start with 1.

Fixes: 473436e7647d6 ("pinctrl: sunxi: add support for the Allwinner A100 pin controller")
Signed-off-by: Yangtao Li <frank@allwinnertech.com>
Link: https://lore.kernel.org/r/9db51667bf9065be55beafd56e5c319e3bbe8310.1604988979.git.frank@allwinnertech.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
index 19cfd1e76ee2c..e69f6da40dc0a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
@@ -677,7 +677,7 @@ static const struct sunxi_desc_pin a100_pins[] = {
 		  SUNXI_FUNCTION_IRQ_BANK(0x6, 6, 19)),
 };
 
-static const unsigned int a100_irq_bank_map[] = { 0, 1, 2, 3, 4, 5, 6};
+static const unsigned int a100_irq_bank_map[] = { 1, 2, 3, 4, 5, 6, 7};
 
 static const struct sunxi_pinctrl_desc a100_pinctrl_data = {
 	.pins = a100_pins,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 190/717] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-29 22:42   ` Pavel Machek
  2020-12-28 12:43 ` [PATCH 5.10 192/717] ARM: dts: at91: sam9x60: add pincontrol for USB Host Greg Kroah-Hartman
                   ` (527 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Ulf Hansson, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index ef03d6fafc5ce..12bc3f5a6cbbd 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
 			host->card = card;
 			if (device_register(&card->dev)) {
 				put_device(&card->dev);
-				kfree(host->card);
 				host->card = NULL;
 			}
 		} else
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 192/717] ARM: dts: at91: sam9x60: add pincontrol for USB Host
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 193/717] ARM: dts: at91: sama5d4_xplained: " Greg Kroah-Hartman
                   ` (526 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit 5ba6291086d2ae8006be9e0f19bf2001a85c9dc1 ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-2-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sam9x60ek.dts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
index eae28b82c7fd0..0e3b6147069f9 100644
--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
+++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
@@ -569,6 +569,13 @@
 			atmel,pins = <AT91_PIOB 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
 		};
 	};
+
+	usb1 {
+		pinctrl_usb_default: usb_default {
+			atmel,pins = <AT91_PIOD 15 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+				      AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+		};
+	};
 }; /* pinctrl */
 
 &pmc {
@@ -684,6 +691,8 @@
 	atmel,vbus-gpio = <0
 			   &pioD 15 GPIO_ACTIVE_HIGH
 			   &pioD 16 GPIO_ACTIVE_HIGH>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_usb_default>;
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 193/717] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 192/717] ARM: dts: at91: sam9x60: add pincontrol for USB Host Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 194/717] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
                   ` (525 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index e5974a17374cf..0b3ad1b580b83 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -134,6 +134,11 @@
 						atmel,pins =
 							<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 					pinctrl_key_gpio: key_gpio_0 {
 						atmel,pins =
 							<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -159,6 +164,8 @@
 					   &pioE 11 GPIO_ACTIVE_HIGH
 					   &pioE 14 GPIO_ACTIVE_HIGH
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 194/717] ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 193/717] ARM: dts: at91: sama5d4_xplained: " Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 195/717] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
                   ` (524 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index cf13632edd444..5179258f92470 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -242,6 +242,11 @@
 						atmel,pins =
 							<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PE9, conflicts with A9 */
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -259,6 +264,8 @@
 					   &pioE 3 GPIO_ACTIVE_LOW
 					   &pioE 4 GPIO_ACTIVE_LOW
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 195/717] mmc: pxamci: Fix error return code in pxamci_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 194/717] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 196/717] brcmfmac: fix error return code in brcmf_cfg80211_connect() Greg Kroah-Hartman
                   ` (523 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
	Ulf Hansson, Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit d7b819b5d33869d41bdaa427aeb98ae24c57a38b ]

Fix to return the error code from devm_gpiod_get_optional() instaed
of 0 in pxamci_probe().

Fixes: f54005b508b9a9d9c ("mmc: pxa: Use GPIO descriptor for power")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20201121021431.3168506-1-chengzhihao1@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/pxamci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 29f6180a00363..316393c694d7a 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -731,6 +731,7 @@ static int pxamci_probe(struct platform_device *pdev)
 
 		host->power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
 		if (IS_ERR(host->power)) {
+			ret = PTR_ERR(host->power);
 			dev_err(dev, "Failed requesting gpio_power\n");
 			goto out;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 196/717] brcmfmac: fix error return code in brcmf_cfg80211_connect()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 195/717] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 197/717] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
                   ` (522 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Chi-hsien Lin, Kalle Valo, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 37ff144d29acd7bca3d465ce2fc4cb5c7072a7e5 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 3b1e0a7bdfee ("brcmfmac: add support for SAE authentication offload")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Chi-hsien Lin <chi-hsien.lin@infineon.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605248896-16812-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index a2dbbb977d0cb..0ee421f30aa24 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -2137,7 +2137,8 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
 				    BRCMF_WSEC_MAX_PSK_LEN);
 	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
 		/* clean up user-space RSNE */
-		if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
+		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
+		if (err) {
 			bphy_err(drvr, "failed to clean up user-space RSNE\n");
 			goto done;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 197/717] orinoco: Move context allocation after processing the skb
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 196/717] brcmfmac: fix error return code in brcmf_cfg80211_connect() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 198/717] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
                   ` (521 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Kalle Valo, Sasha Levin

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]

ezusb_xmit() allocates a context which is leaked if
orinoco_process_xmit_skb() returns an error.

Move ezusb_alloc_ctx() after the invocation of
orinoco_process_xmit_skb() because the context is not needed so early.
ezusb_access_ltv() will cleanup the context in case of an error.

Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/intersil/orinoco/orinoco_usb.c    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
index b849d27bd741e..d1fc948364c79 100644
--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
@@ -1223,13 +1223,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (skb->len < ETH_HLEN)
 		goto drop;
 
-	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
-	if (!ctx)
-		goto busy;
-
-	memset(ctx->buf, 0, BULK_BUF_SIZE);
-	buf = ctx->buf->data;
-
 	tx_control = 0;
 
 	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1237,6 +1230,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (err)
 		goto drop;
 
+	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+	if (!ctx)
+		goto drop;
+
+	memset(ctx->buf, 0, BULK_BUF_SIZE);
+	buf = ctx->buf->data;
+
 	{
 		__le16 *tx_cntl = (__le16 *)buf;
 		*tx_cntl = cpu_to_le16(tx_control);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 198/717] qtnfmac: fix error return code in qtnf_pcie_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 197/717] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 199/717] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
                   ` (520 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Kalle Valo,
	Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit 31e07aa33fa7cdc93fa91c3f78f031e8d38862c2 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: b7da53cd6cd1 ("qtnfmac_pcie: use single PCIe driver for all platforms")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201114123347.29632-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
index 5337e67092ca6..0f328ce47fee3 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
@@ -299,19 +299,19 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	sysctl_bar = qtnf_map_bar(pdev, QTN_SYSCTL_BAR);
 	if (IS_ERR(sysctl_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_SYSCTL_BAR);
-		return ret;
+		return PTR_ERR(sysctl_bar);
 	}
 
 	dmareg_bar = qtnf_map_bar(pdev, QTN_DMA_BAR);
 	if (IS_ERR(dmareg_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_DMA_BAR);
-		return ret;
+		return PTR_ERR(dmareg_bar);
 	}
 
 	epmem_bar = qtnf_map_bar(pdev, QTN_SHMEM_BAR);
 	if (IS_ERR(epmem_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_SHMEM_BAR);
-		return ret;
+		return PTR_ERR(epmem_bar);
 	}
 
 	chipid = qtnf_chip_id_get(sysctl_bar);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 199/717] rsi: fix error return code in rsi_reset_card()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 198/717] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 200/717] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
                   ` (519 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Kalle Valo, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit fb21d14694bd46a538258d86498736490b3ba855 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 17ff2c794f39 ("rsi: reset device changes for 9116")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605582454-39649-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 30 +++++++++++++-------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index a62d41c0ccbc0..00b5589847985 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -741,24 +741,24 @@ static int rsi_reset_card(struct rsi_hw *adapter)
 		if (ret < 0)
 			goto fail;
 	} else {
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_INTERRUPT_TIMER,
-					      NWP_WWD_INT_TIMER_CLKS,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_INTERRUPT_TIMER,
+					       NWP_WWD_INT_TIMER_CLKS,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_SYSTEM_RESET_TIMER,
-					      NWP_WWD_SYS_RESET_TIMER_CLKS,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_SYSTEM_RESET_TIMER,
+					       NWP_WWD_SYS_RESET_TIMER_CLKS,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_MODE_AND_RSTART,
-					      NWP_WWD_TIMER_DISABLE,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_MODE_AND_RSTART,
+					       NWP_WWD_TIMER_DISABLE,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
 	}
 
 	rsi_dbg(INFO_ZONE, "Reset card done\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 200/717] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 199/717] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 201/717] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
                   ` (518 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Kalle Valo, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]

Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/st/cw1200/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
index f7fe56affbcd2..326b1cc1d2bcb 100644
--- a/drivers/net/wireless/st/cw1200/main.c
+++ b/drivers/net/wireless/st/cw1200/main.c
@@ -381,6 +381,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 				    CW1200_LINK_ID_MAX,
 				    cw1200_skb_dtor,
 				    priv)) {
+		destroy_workqueue(priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -392,6 +393,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 			for (; i > 0; i--)
 				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
 			cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+			destroy_workqueue(priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 201/717] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 200/717] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 202/717] arm64: dts: qcom: sdm845: Limit ipa iommu streams Greg Kroah-Hartman
                   ` (517 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng, Vinod Koul,
	Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]

Return the corresponding error code when first_msi_entry() returns
NULL in mv_xor_v2_probe().

Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor_v2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index 2753a6b916f60..9b0d463f89bbd 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -771,8 +771,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 		goto disable_clk;
 
 	msi_desc = first_msi_entry(&pdev->dev);
-	if (!msi_desc)
+	if (!msi_desc) {
+		ret = -ENODEV;
 		goto free_msi_irqs;
+	}
 	xor_dev->msi_desc = msi_desc;
 
 	ret = devm_request_irq(&pdev->dev, msi_desc->irq,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 202/717] arm64: dts: qcom: sdm845: Limit ipa iommu streams
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 201/717] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 203/717] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
                   ` (516 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Elder, Bjorn Andersson, Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 95e6f8467c83c4074a6f6b47bad00653549ff90a ]

The Android and Windows firmware does not accept the use of 3 as a mask
to cover the IPA streams. But with 0x721 being related to WiFi and 0x723
being unsed the mapping can be reduced to just cover 0x720 and 0x722,
which is accepted.

Acked-by: Alex Elder <elder@linaro.org>
Tested-by: Alex Elder <elder@linaro.org>
Fixes: e9e89c45bfeb ("arm64: dts: sdm845: add IPA iommus property")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20201123052305.157686-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm845.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 40e8c11f23ab0..f97f354af86f4 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -2141,7 +2141,8 @@
 		ipa: ipa@1e40000 {
 			compatible = "qcom,sdm845-ipa";
 
-			iommus = <&apps_smmu 0x720 0x3>;
+			iommus = <&apps_smmu 0x720 0x0>,
+				 <&apps_smmu 0x722 0x0>;
 			reg = <0 0x1e40000 0 0x7000>,
 			      <0 0x1e47000 0 0x2000>,
 			      <0 0x1e04000 0 0x2c000>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 203/717] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 202/717] arm64: dts: qcom: sdm845: Limit ipa iommu streams Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 204/717] leds: lp50xx: Fix an error handling path in lp50xx_probe_dt() Greg Kroah-Hartman
                   ` (515 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Pavel Machek, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 311066aa9ebcd6f1789c829da5039ca02f2dfe46 ]

if of_find_device_by_node() succeed, netxbig_leds_get_of_pdata() doesn't
have a corresponding put_device(). Thus add jump target to fix the
exception handling for this function implementation.

Fixes: 2976b1798909 ("leds: netxbig: add device tree binding")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-netxbig.c | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index e6fd47365b588..68fbf0b66fadd 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -448,31 +448,39 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	gpio_ext = devm_kzalloc(dev, sizeof(*gpio_ext), GFP_KERNEL);
 	if (!gpio_ext) {
 		of_node_put(gpio_ext_np);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto put_device;
 	}
 	ret = netxbig_gpio_ext_get(dev, gpio_ext_dev, gpio_ext);
 	of_node_put(gpio_ext_np);
 	if (ret)
-		return ret;
+		goto put_device;
 	pdata->gpio_ext = gpio_ext;
 
 	/* Timers (optional) */
 	ret = of_property_count_u32_elems(np, "timers");
 	if (ret > 0) {
-		if (ret % 3)
-			return -EINVAL;
+		if (ret % 3) {
+			ret = -EINVAL;
+			goto put_device;
+		}
+
 		num_timers = ret / 3;
 		timers = devm_kcalloc(dev, num_timers, sizeof(*timers),
 				      GFP_KERNEL);
-		if (!timers)
-			return -ENOMEM;
+		if (!timers) {
+			ret = -ENOMEM;
+			goto put_device;
+		}
 		for (i = 0; i < num_timers; i++) {
 			u32 tmp;
 
 			of_property_read_u32_index(np, "timers", 3 * i,
 						   &timers[i].mode);
-			if (timers[i].mode >= NETXBIG_LED_MODE_NUM)
-				return -EINVAL;
+			if (timers[i].mode >= NETXBIG_LED_MODE_NUM) {
+				ret = -EINVAL;
+				goto put_device;
+			}
 			of_property_read_u32_index(np, "timers",
 						   3 * i + 1, &tmp);
 			timers[i].delay_on = tmp;
@@ -488,12 +496,15 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	num_leds = of_get_available_child_count(np);
 	if (!num_leds) {
 		dev_err(dev, "No LED subnodes found in DT\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_device;
 	}
 
 	leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL);
-	if (!leds)
-		return -ENOMEM;
+	if (!leds) {
+		ret = -ENOMEM;
+		goto put_device;
+	}
 
 	led = leds;
 	for_each_available_child_of_node(np, child) {
@@ -574,6 +585,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 
 err_node_put:
 	of_node_put(child);
+put_device:
+	put_device(gpio_ext_dev);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 204/717] leds: lp50xx: Fix an error handling path in lp50xx_probe_dt()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 203/717] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 205/717] leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI Greg Kroah-Hartman
                   ` (514 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Dan Murphy,
	Pavel Machek, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6d8d014c7dcf85a79da71ef586d06d03d2cae558 ]

In case of memory allocation failure, we must release some resources as
done in all other error handling paths of the function.

'goto child_out' instead of a direct return so that 'fwnode_handle_put()'
is called when we break out of a 'device_for_each_child_node' loop.

Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-lp50xx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
index 5fb4f24aeb2e8..f13117eed976d 100644
--- a/drivers/leds/leds-lp50xx.c
+++ b/drivers/leds/leds-lp50xx.c
@@ -487,8 +487,10 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
 		 */
 		mc_led_info = devm_kcalloc(priv->dev, LP50XX_LEDS_PER_MODULE,
 					   sizeof(*mc_led_info), GFP_KERNEL);
-		if (!mc_led_info)
-			return -ENOMEM;
+		if (!mc_led_info) {
+			ret = -ENOMEM;
+			goto child_out;
+		}
 
 		fwnode_for_each_child_node(child, led_node) {
 			ret = fwnode_property_read_u32(led_node, "color",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 205/717] leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 204/717] leds: lp50xx: Fix an error handling path in lp50xx_probe_dt() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 206/717] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
                   ` (513 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Behún, Pavel Machek, Sasha Levin

From: Marek Behún <kabel@kernel.org>

[ Upstream commit 98650b0874171cc443251f7b369d3b1544db9d4e ]

LED core does not allow LED_COLOR_ID_MULTI for now and instead for RGB
LEDs prefers LED_COLOR_ID_RGB.

Signed-off-by: Marek Behún <kabel@kernel.org>
Fixes: 77dce3a22e89 ("leds: disallow /sys/class/leds/*:multi:* for now")
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-turris-omnia.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/leds-turris-omnia.c b/drivers/leds/leds-turris-omnia.c
index 8c5bdc3847ee7..880fc8def5309 100644
--- a/drivers/leds/leds-turris-omnia.c
+++ b/drivers/leds/leds-turris-omnia.c
@@ -98,9 +98,9 @@ static int omnia_led_register(struct i2c_client *client, struct omnia_led *led,
 	}
 
 	ret = of_property_read_u32(np, "color", &color);
-	if (ret || color != LED_COLOR_ID_MULTI) {
+	if (ret || color != LED_COLOR_ID_RGB) {
 		dev_warn(dev,
-			 "Node %pOF: must contain 'color' property with value LED_COLOR_ID_MULTI\n",
+			 "Node %pOF: must contain 'color' property with value LED_COLOR_ID_RGB\n",
 			 np);
 		return 0;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 206/717] arm64: tegra: Fix DT binding for IO High Voltage entry
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 205/717] leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 207/717] RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind Greg Kroah-Hartman
                   ` (512 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vidya Sagar, Thierry Reding, Sasha Levin

From: Vidya Sagar <vidyas@nvidia.com>

[ Upstream commit 6b26c1a034885923822f6c4d94f8644d32bc2481 ]

Fix the device-tree entry that represents I/O High Voltage property
by replacing 'nvidia,io-high-voltage' with 'nvidia,io-hv' as the former
entry is deprecated.

Fixes: dbb72e2c305b ("arm64: tegra: Add configuration for PCIe C5 sideband signals")
Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/nvidia/tegra194.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
index 93438d2b94696..6946fb210e484 100644
--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
@@ -378,7 +378,7 @@
 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
 					nvidia,enable-input = <TEGRA_PIN_DISABLE>;
-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
+					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
 				};
@@ -390,7 +390,7 @@
 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
 					nvidia,enable-input = <TEGRA_PIN_ENABLE>;
-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
+					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
 				};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 207/717] RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 206/717] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 208/717] soundwire: qcom: Fix build failure when slimbus is module Greg Kroah-Hartman
                   ` (511 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+1bc48bf7f78253f664a9,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit dd37d2f59eb839d51b988f6668ce5f0d533b23fd ]

rdma_detroy_id() cannot be called under &lock - we must instead keep the
error'd ID around until &lock can be released, then destroy it.

This is complicated by the usual way listen IDs are destroyed through
cma_process_remove() which can run at any time and will asynchronously
destroy the same ID.

Remove the ID from visiblity of cma_process_remove() before going down the
destroy path outside the locking.

Fixes: c80a0c52d85c ("RDMA/cma: Add missing error handling of listen_id")
Link: https://lore.kernel.org/r/20201118133756.GK244516@ziepe.ca
Reported-by: syzbot+1bc48bf7f78253f664a9@syzkaller.appspotmail.com
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 4585f654f8836..c06c87a4dc5e7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2496,7 +2496,8 @@ static int cma_listen_handler(struct rdma_cm_id *id,
 }
 
 static int cma_listen_on_dev(struct rdma_id_private *id_priv,
-			     struct cma_device *cma_dev)
+			     struct cma_device *cma_dev,
+			     struct rdma_id_private **to_destroy)
 {
 	struct rdma_id_private *dev_id_priv;
 	struct net *net = id_priv->id.route.addr.dev_addr.net;
@@ -2504,6 +2505,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
 
 	lockdep_assert_held(&lock);
 
+	*to_destroy = NULL;
 	if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1))
 		return 0;
 
@@ -2518,7 +2520,6 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
 	       rdma_addr_size(cma_src_addr(id_priv)));
 
 	_cma_attach_to_dev(dev_id_priv, cma_dev);
-	list_add_tail(&dev_id_priv->listen_list, &id_priv->listen_list);
 	cma_id_get(id_priv);
 	dev_id_priv->internal_id = 1;
 	dev_id_priv->afonly = id_priv->afonly;
@@ -2528,25 +2529,31 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
 	ret = rdma_listen(&dev_id_priv->id, id_priv->backlog);
 	if (ret)
 		goto err_listen;
+	list_add_tail(&dev_id_priv->listen_list, &id_priv->listen_list);
 	return 0;
 err_listen:
-	list_del(&id_priv->listen_list);
+	/* Caller must destroy this after releasing lock */
+	*to_destroy = dev_id_priv;
 	dev_warn(&cma_dev->device->dev, "RDMA CMA: %s, error %d\n", __func__, ret);
-	rdma_destroy_id(&dev_id_priv->id);
 	return ret;
 }
 
 static int cma_listen_on_all(struct rdma_id_private *id_priv)
 {
+	struct rdma_id_private *to_destroy;
 	struct cma_device *cma_dev;
 	int ret;
 
 	mutex_lock(&lock);
 	list_add_tail(&id_priv->list, &listen_any_list);
 	list_for_each_entry(cma_dev, &dev_list, list) {
-		ret = cma_listen_on_dev(id_priv, cma_dev);
-		if (ret)
+		ret = cma_listen_on_dev(id_priv, cma_dev, &to_destroy);
+		if (ret) {
+			/* Prevent racing with cma_process_remove() */
+			if (to_destroy)
+				list_del_init(&to_destroy->list);
 			goto err_listen;
+		}
 	}
 	mutex_unlock(&lock);
 	return 0;
@@ -2554,6 +2561,8 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)
 err_listen:
 	list_del(&id_priv->list);
 	mutex_unlock(&lock);
+	if (to_destroy)
+		rdma_destroy_id(&to_destroy->id);
 	return ret;
 }
 
@@ -4855,6 +4864,7 @@ static void cma_process_remove(struct cma_device *cma_dev)
 
 static int cma_add_one(struct ib_device *device)
 {
+	struct rdma_id_private *to_destroy;
 	struct cma_device *cma_dev;
 	struct rdma_id_private *id_priv;
 	unsigned int i;
@@ -4902,7 +4912,7 @@ static int cma_add_one(struct ib_device *device)
 	mutex_lock(&lock);
 	list_add_tail(&cma_dev->list, &dev_list);
 	list_for_each_entry(id_priv, &listen_any_list, list) {
-		ret = cma_listen_on_dev(id_priv, cma_dev);
+		ret = cma_listen_on_dev(id_priv, cma_dev, &to_destroy);
 		if (ret)
 			goto free_listen;
 	}
@@ -4915,6 +4925,7 @@ free_listen:
 	list_del(&cma_dev->list);
 	mutex_unlock(&lock);
 
+	/* cma_process_remove() will delete to_destroy */
 	cma_process_remove(cma_dev);
 	kfree(cma_dev->default_roce_tos);
 free_gid_type:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 208/717] soundwire: qcom: Fix build failure when slimbus is module
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 207/717] RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 209/717] drm/imx/dcss: fix rotations for Vivante tiled formats Greg Kroah-Hartman
                   ` (510 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot,
	Srinivas Kandagatla, Vinod Koul, Sasha Levin, Randy Dunlap

From: Vinod Koul <vkoul@kernel.org>

[ Upstream commit 47edc0104c61d609b0898a302267b7269d87a6af ]

Commit 5bd773242f75 ("soundwire: qcom: avoid dependency on
CONFIG_SLIMBUS") removed hard dependency on Slimbus for qcom driver but
it results in build failure when: CONFIG_SOUNDWIRE_QCOM=y
CONFIG_SLIMBUS=m

drivers/soundwire/qcom.o: In function `qcom_swrm_probe':
qcom.c:(.text+0xf44): undefined reference to `slimbus_bus'

Fix this by using IS_REACHABLE() in driver which is recommended to be
used with imply.

Fixes: 5bd773242f75 ("soundwire: qcom: avoid dependency on CONFIG_SLIMBUS")
Reported-by: kernel test robot <lkp@intel.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Link: https://lore.kernel.org/r/20201125055155.GD8403@vkoul-mobl
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/qcom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
index fbca4ebf63e92..6d22df01f3547 100644
--- a/drivers/soundwire/qcom.c
+++ b/drivers/soundwire/qcom.c
@@ -799,7 +799,7 @@ static int qcom_swrm_probe(struct platform_device *pdev)
 	data = of_device_get_match_data(dev);
 	ctrl->rows_index = sdw_find_row_index(data->default_rows);
 	ctrl->cols_index = sdw_find_col_index(data->default_cols);
-#if IS_ENABLED(CONFIG_SLIMBUS)
+#if IS_REACHABLE(CONFIG_SLIMBUS)
 	if (dev->parent->bus == &slimbus_bus) {
 #else
 	if (false) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 209/717] drm/imx/dcss: fix rotations for Vivante tiled formats
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 208/717] soundwire: qcom: Fix build failure when slimbus is module Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 210/717] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
                   ` (509 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurentiu Palcu, Lucas Stach, Sasha Levin

From: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>

[ Upstream commit 59cb403f38099506ddbe05fd09126f3f0890860b ]

DCSS supports 90/180/270 degree rotations for Vivante tiled and super-tiled
formats. Unfortunately, with the current code, they didn't work properly.

This simple patch makes the rotations work by fixing the way the scaler is set
up for 90/270 degree rotations. In this particular case, the source width and
height need to be swapped since DPR is sending the buffer to scaler already
rotated.

Also, make sure to allow full rotations for DRM_FORMAT_MOD_VIVANTE_SUPER_TILED.

Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ")
Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105140127.25249-2-laurentiu.palcu@oss.nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/imx/dcss/dcss-plane.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/imx/dcss/dcss-plane.c b/drivers/gpu/drm/imx/dcss/dcss-plane.c
index 961d671f171b4..f54087ac44d35 100644
--- a/drivers/gpu/drm/imx/dcss/dcss-plane.c
+++ b/drivers/gpu/drm/imx/dcss/dcss-plane.c
@@ -111,7 +111,8 @@ static bool dcss_plane_can_rotate(const struct drm_format_info *format,
 		supported_rotation = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_180 |
 				     DRM_MODE_REFLECT_MASK;
 	else if (!format->is_yuv &&
-		 modifier == DRM_FORMAT_MOD_VIVANTE_TILED)
+		 (modifier == DRM_FORMAT_MOD_VIVANTE_TILED ||
+		  modifier == DRM_FORMAT_MOD_VIVANTE_SUPER_TILED))
 		supported_rotation = DRM_MODE_ROTATE_MASK |
 				     DRM_MODE_REFLECT_MASK;
 	else if (format->is_yuv && linear_format &&
@@ -273,6 +274,7 @@ static void dcss_plane_atomic_update(struct drm_plane *plane,
 	u32 src_w, src_h, dst_w, dst_h;
 	struct drm_rect src, dst;
 	bool enable = true;
+	bool is_rotation_90_or_270;
 
 	if (!fb || !state->crtc || !state->visible)
 		return;
@@ -311,8 +313,13 @@ static void dcss_plane_atomic_update(struct drm_plane *plane,
 
 	dcss_plane_atomic_set_base(dcss_plane);
 
+	is_rotation_90_or_270 = state->rotation & (DRM_MODE_ROTATE_90 |
+						   DRM_MODE_ROTATE_270);
+
 	dcss_scaler_setup(dcss->scaler, dcss_plane->ch_num,
-			  state->fb->format, src_w, src_h,
+			  state->fb->format,
+			  is_rotation_90_or_270 ? src_h : src_w,
+			  is_rotation_90_or_270 ? src_w : src_h,
 			  dst_w, dst_h,
 			  drm_mode_vrefresh(&crtc_state->mode));
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 210/717] media: siano: fix memory leak of debugfs members in smsdvb_hotplug
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 209/717] drm/imx/dcss: fix rotations for Vivante tiled formats Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 211/717] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
                   ` (508 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Keita Suzuki, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>

[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]

When dvb_create_media_graph fails, the debugfs kept inside client should
be released. However, the current implementation does not release them.

Fix this by adding a new goto label to call smsdvb_debugfs_release.

Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/siano/smsdvb-main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index 88f90dfd368b1..ae17407e477a4 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1169,12 +1169,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	rc = dvb_create_media_graph(&client->adapter, true);
 	if (rc < 0) {
 		pr_err("dvb_create_media_graph failed %d\n", rc);
-		goto client_error;
+		goto media_graph_error;
 	}
 
 	pr_info("DVB interface registered.\n");
 	return 0;
 
+media_graph_error:
+	smsdvb_debugfs_release(client);
+
 client_error:
 	dvb_unregister_frontend(&client->frontend);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 211/717] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 210/717] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
                   ` (507 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100.
Till now all the systems from this class used few types of power units,
all equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 986ad3dda1c10..623e7f737d4ab 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -383,15 +383,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 211/717] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-29 19:01   ` Nathan Chancellor
  2020-12-28 12:43 ` [PATCH 5.10 213/717] arm64: dts: qcom: sc7180: limit IPA iommu streams Greg Kroah-Hartman
                   ` (506 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
all the systems from this class used few types of power units, all
equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 623e7f737d4ab..598f445587649 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -601,15 +601,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 213/717] arm64: dts: qcom: sc7180: limit IPA iommu streams
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 214/717] RDMA/hns: Only record vlan info for HIP08 Greg Kroah-Hartman
                   ` (505 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Alex Elder, Sasha Levin

From: Alex Elder <elder@linaro.org>

[ Upstream commit 8f34831d3659d38f480fddccb76d84c6c3e0ac0b ]

Recently we learned that Android and Windows firmware don't seem to
like using 3 as an iommu mask value for IPA.  A simple fix was to
specify exactly the streams needed explicitly, rather than implying
a range with the mask.  Make the same change for the SC7180 platform.

See also:
  https://lore.kernel.org/linux-arm-msm/20201123052305.157686-1-bjorn.andersson@linaro.org/

Fixes: d82fade846aa8 ("arm64: dts: qcom: sc7180: add IPA information")
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Alex Elder <elder@linaro.org>
Link: https://lore.kernel.org/r/20201126015457.6557-2-elder@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7180.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
index a02776ce77a10..c71f3afc1cc9f 100644
--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
@@ -1394,7 +1394,8 @@
 		ipa: ipa@1e40000 {
 			compatible = "qcom,sc7180-ipa";
 
-			iommus = <&apps_smmu 0x440 0x3>;
+			iommus = <&apps_smmu 0x440 0x0>,
+				 <&apps_smmu 0x442 0x0>;
 			reg = <0 0x1e40000 0 0x7000>,
 			      <0 0x1e47000 0 0x2000>,
 			      <0 0x1e04000 0 0x2c000>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 214/717] RDMA/hns: Only record vlan info for HIP08
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 213/717] arm64: dts: qcom: sc7180: limit IPA iommu streams Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 215/717] RDMA/hns: Fix missing fields in address vector Greg Kroah-Hartman
                   ` (504 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Weihang Li, Jason Gunthorpe, Sasha Levin

From: Weihang Li <liweihang@huawei.com>

[ Upstream commit 7406c0036f851ee1cd93cb08349f24b051b4cbf8 ]

Information about vlan is stored in GMV(GID/MAC/VLAN) table for HIP09, so
there is no need to copy it to address vector.

Link: https://lore.kernel.org/r/1605526408-6936-2-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_ah.c     | 51 ++++++++++-----------
 drivers/infiniband/hw/hns/hns_roce_device.h |  2 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 13 ++++--
 3 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index 75b06db60f7c2..3be80d42e03a9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -31,13 +31,13 @@
  */
 
 #include <linux/platform_device.h>
+#include <linux/pci.h>
 #include <rdma/ib_addr.h>
 #include <rdma/ib_cache.h>
 #include "hns_roce_device.h"
 
-#define HNS_ROCE_PORT_NUM_SHIFT		24
-#define HNS_ROCE_VLAN_SL_BIT_MASK	7
-#define HNS_ROCE_VLAN_SL_SHIFT		13
+#define VLAN_SL_MASK 7
+#define VLAN_SL_SHIFT 13
 
 static inline u16 get_ah_udp_sport(const struct rdma_ah_attr *ah_attr)
 {
@@ -58,37 +58,16 @@ static inline u16 get_ah_udp_sport(const struct rdma_ah_attr *ah_attr)
 int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
 		       struct ib_udata *udata)
 {
-	struct hns_roce_dev *hr_dev = to_hr_dev(ibah->device);
-	const struct ib_gid_attr *gid_attr;
-	struct device *dev = hr_dev->dev;
-	struct hns_roce_ah *ah = to_hr_ah(ibah);
 	struct rdma_ah_attr *ah_attr = init_attr->ah_attr;
 	const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr);
-	u16 vlan_id = 0xffff;
-	bool vlan_en = false;
-	int ret;
-
-	gid_attr = ah_attr->grh.sgid_attr;
-	ret = rdma_read_gid_l2_fields(gid_attr, &vlan_id, NULL);
-	if (ret)
-		return ret;
+	struct hns_roce_dev *hr_dev = to_hr_dev(ibah->device);
+	struct hns_roce_ah *ah = to_hr_ah(ibah);
+	int ret = 0;
 
-	/* Get mac address */
 	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
 
-	if (vlan_id < VLAN_N_VID) {
-		vlan_en = true;
-		vlan_id |= (rdma_ah_get_sl(ah_attr) &
-			     HNS_ROCE_VLAN_SL_BIT_MASK) <<
-			     HNS_ROCE_VLAN_SL_SHIFT;
-	}
-
 	ah->av.port = rdma_ah_get_port_num(ah_attr);
 	ah->av.gid_index = grh->sgid_index;
-	ah->av.vlan_id = vlan_id;
-	ah->av.vlan_en = vlan_en;
-	dev_dbg(dev, "gid_index = 0x%x,vlan_id = 0x%x\n", ah->av.gid_index,
-		ah->av.vlan_id);
 
 	if (rdma_ah_get_static_rate(ah_attr))
 		ah->av.stat_rate = IB_RATE_10_GBPS;
@@ -98,7 +77,23 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
 	ah->av.flowlabel = grh->flow_label;
 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
 
-	return 0;
+	/* HIP08 needs to record vlan info in Address Vector */
+	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
+		ah->av.vlan_en = 0;
+
+		ret = rdma_read_gid_l2_fields(ah_attr->grh.sgid_attr,
+					      &ah->av.vlan_id, NULL);
+		if (ret)
+			return ret;
+
+		if (ah->av.vlan_id < VLAN_N_VID) {
+			ah->av.vlan_en = 1;
+			ah->av.vlan_id |= (rdma_ah_get_sl(ah_attr) & VLAN_SL_MASK) <<
+					  VLAN_SL_SHIFT;
+		}
+	}
+
+	return ret;
 }
 
 int hns_roce_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)
diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
index 6d2acff69f982..b025841e08154 100644
--- a/drivers/infiniband/hw/hns/hns_roce_device.h
+++ b/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -547,7 +547,7 @@ struct hns_roce_av {
 	u8 dgid[HNS_ROCE_GID_SIZE];
 	u8 mac[ETH_ALEN];
 	u16 vlan_id;
-	bool vlan_en;
+	u8 vlan_en;
 };
 
 struct hns_roce_ah {
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 0468028ffe390..d127e0e4c3cda 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -495,8 +495,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
 	roce_set_field(ud_sq_wqe->byte_32, V2_UD_SEND_WQE_BYTE_32_DQPN_M,
 		       V2_UD_SEND_WQE_BYTE_32_DQPN_S, ud_wr(wr)->remote_qpn);
 
-	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_VLAN_M,
-		       V2_UD_SEND_WQE_BYTE_36_VLAN_S, ah->av.vlan_id);
 	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_M,
 		       V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_S, ah->av.hop_limit);
 	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_TCLASS_M,
@@ -508,11 +506,18 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
 	roce_set_field(ud_sq_wqe->byte_40, V2_UD_SEND_WQE_BYTE_40_PORTN_M,
 		       V2_UD_SEND_WQE_BYTE_40_PORTN_S, qp->port);
 
-	roce_set_bit(ud_sq_wqe->byte_40, V2_UD_SEND_WQE_BYTE_40_UD_VLAN_EN_S,
-		     ah->av.vlan_en ? 1 : 0);
 	roce_set_field(ud_sq_wqe->byte_48, V2_UD_SEND_WQE_BYTE_48_SGID_INDX_M,
 		       V2_UD_SEND_WQE_BYTE_48_SGID_INDX_S, ah->av.gid_index);
 
+	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
+		roce_set_bit(ud_sq_wqe->byte_40,
+			     V2_UD_SEND_WQE_BYTE_40_UD_VLAN_EN_S,
+			     ah->av.vlan_en);
+		roce_set_field(ud_sq_wqe->byte_36,
+			       V2_UD_SEND_WQE_BYTE_36_VLAN_M,
+			       V2_UD_SEND_WQE_BYTE_36_VLAN_S, ah->av.vlan_id);
+	}
+
 	memcpy(&ud_sq_wqe->dgid[0], &ah->av.dgid[0], GID_LEN_V2);
 
 	set_extend_sge(qp, wr, &curr_idx, valid_num_sge);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 215/717] RDMA/hns: Fix missing fields in address vector
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 214/717] RDMA/hns: Only record vlan info for HIP08 Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 216/717] RDMA/hns: Avoid setting loopback indicator when smac is same as dmac Greg Kroah-Hartman
                   ` (503 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Weihang Li, Jason Gunthorpe, Sasha Levin

From: Weihang Li <liweihang@huawei.com>

[ Upstream commit fba429fcf9a5e0c4ec2523ecf4cf18bc0507fcbc ]

Traffic class and hop limit in address vector is not assigned from GRH,
but it will be filled into UD SQ WQE. So the hardware will get a wrong
value.

Fixes: 82e620d9c3a0 ("RDMA/hns: Modify the data structure of hns_roce_av")
Link: https://lore.kernel.org/r/1605526408-6936-3-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_ah.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index 3be80d42e03a9..d65ff6aa322fa 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,18 +64,20 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
 	struct hns_roce_ah *ah = to_hr_ah(ibah);
 	int ret = 0;
 
-	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
-
 	ah->av.port = rdma_ah_get_port_num(ah_attr);
 	ah->av.gid_index = grh->sgid_index;
 
 	if (rdma_ah_get_static_rate(ah_attr))
 		ah->av.stat_rate = IB_RATE_10_GBPS;
 
-	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
-	ah->av.sl = rdma_ah_get_sl(ah_attr);
+	ah->av.hop_limit = grh->hop_limit;
 	ah->av.flowlabel = grh->flow_label;
 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
+	ah->av.sl = rdma_ah_get_sl(ah_attr);
+	ah->av.tclass = grh->traffic_class;
+
+	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
+	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
 
 	/* HIP08 needs to record vlan info in Address Vector */
 	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 216/717] RDMA/hns: Avoid setting loopback indicator when smac is same as dmac
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 215/717] RDMA/hns: Fix missing fields in address vector Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 217/717] serial: 8250-mtk: Fix reference leak in mtk8250_probe Greg Kroah-Hartman
                   ` (502 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Weihang Li, Jason Gunthorpe, Sasha Levin

From: Weihang Li <liweihang@huawei.com>

[ Upstream commit 3631dadfb118821236098a215e59fb5d3e1c30a8 ]

The loopback flag will be set to 1 by the hardware when the source mac
address is same as the destination mac address. So the driver don't need
to compare them.

Fixes: d6a3627e311c ("RDMA/hns: Optimize wqe buffer set flow for post send")
Link: https://lore.kernel.org/r/1605526408-6936-4-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index d127e0e4c3cda..4db7eea3dcec5 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -433,8 +433,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
 	unsigned int curr_idx = *sge_idx;
 	int valid_num_sge;
 	u32 msg_len = 0;
-	bool loopback;
-	u8 *smac;
 	int ret;
 
 	valid_num_sge = calc_wr_sge_num(wr, &msg_len);
@@ -457,13 +455,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
 	roce_set_field(ud_sq_wqe->byte_48, V2_UD_SEND_WQE_BYTE_48_DMAC_5_M,
 		       V2_UD_SEND_WQE_BYTE_48_DMAC_5_S, ah->av.mac[5]);
 
-	/* MAC loopback */
-	smac = (u8 *)hr_dev->dev_addr[qp->port];
-	loopback = ether_addr_equal_unaligned(ah->av.mac, smac) ? 1 : 0;
-
-	roce_set_bit(ud_sq_wqe->byte_40,
-		     V2_UD_SEND_WQE_BYTE_40_LBI_S, loopback);
-
 	ud_sq_wqe->msg_len = cpu_to_le32(msg_len);
 
 	/* Set sig attr */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 217/717] serial: 8250-mtk: Fix reference leak in mtk8250_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 216/717] RDMA/hns: Avoid setting loopback indicator when smac is same as dmac Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 218/717] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
                   ` (501 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 6e4e636e0e3e0b5deffc5e233adcb2cd4e68f2d0 ]

The pm_runtime_enable will increase power disable depth.
Thus a pairing decrement is needed on the error handling
path to keep it balanced according to context.

Fixes: e32a83c70cf98 ("serial: 8250-mtk: modify mtk uart power and clock management")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201119141126.168850-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_mtk.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index fa876e2c13e5d..f7d3023f860f0 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -572,15 +572,22 @@ static int mtk8250_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	err = mtk8250_runtime_resume(&pdev->dev);
 	if (err)
-		return err;
+		goto err_pm_disable;
 
 	data->line = serial8250_register_8250_port(&uart);
-	if (data->line < 0)
-		return data->line;
+	if (data->line < 0) {
+		err = data->line;
+		goto err_pm_disable;
+	}
 
 	data->rx_wakeup_irq = platform_get_irq_optional(pdev, 1);
 
 	return 0;
+
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
+
+	return err;
 }
 
 static int mtk8250_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 218/717] samples: bpf: Fix lwt_len_hist reusing previous BPF map
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 217/717] serial: 8250-mtk: Fix reference leak in mtk8250_probe Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 219/717] media: imx214: Fix stop streaming Greg Kroah-Hartman
                   ` (500 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel T. Lee, Andrii Nakryiko, Sasha Levin

From: Daniel T. Lee <danieltimlee@gmail.com>

[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]

Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
map isn't cleared on test end. This leds to reuse of that map for
each test, which prevents the results of the test from being accurate.

This commit fixes the problem by removing of pinned map from bpffs.
Also, this commit add the executable permission to shell script
files.

Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/lwt_len_hist.sh | 2 ++
 samples/bpf/test_lwt_bpf.sh | 0
 2 files changed, 2 insertions(+)
 mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
 mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh

diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
old mode 100644
new mode 100755
index 090b96eaf7f76..0eda9754f50b8
--- a/samples/bpf/lwt_len_hist.sh
+++ b/samples/bpf/lwt_len_hist.sh
@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
 TRACE_ROOT=/sys/kernel/debug/tracing
 
 function cleanup {
+	# To reset saved histogram, remove pinned map
+	rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
 	ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
 	ip link del $VETH0 2> /dev/null
 	ip link del $VETH1 2> /dev/null
diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
old mode 100644
new mode 100755
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 219/717] media: imx214: Fix stop streaming
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 218/717] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 220/717] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
                   ` (499 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Gomez, Ricardo Ribalda,
	Mauro Carvalho Chehab, Sasha Levin

From: Daniel Gomez <daniel@qtec.com>

[ Upstream commit eeb76afbe8d91e112396c6281cd020725160f006 ]

Stop video streaming when requested.

When s_stream is called to stop the video streaming, if/else condition calls
start_streaming function instead of the one for stopping it.

Fixes: 436190596241 ("media: imx214: Add imx214 camera sensor driver")
Signed-off-by: Daniel Gomez <daniel@qtec.com>
Signed-off-by: Ricardo Ribalda <ribalda@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/imx214.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/imx214.c b/drivers/media/i2c/imx214.c
index 1ef5af9a8c8bc..cee1a4817af99 100644
--- a/drivers/media/i2c/imx214.c
+++ b/drivers/media/i2c/imx214.c
@@ -786,7 +786,7 @@ static int imx214_s_stream(struct v4l2_subdev *subdev, int enable)
 		if (ret < 0)
 			goto err_rpm_put;
 	} else {
-		ret = imx214_start_streaming(imx214);
+		ret = imx214_stop_streaming(imx214);
 		if (ret < 0)
 			goto err_rpm_put;
 		pm_runtime_put(imx214->dev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 220/717] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 219/717] media: imx214: Fix stop streaming Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 221/717] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
                   ` (498 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Serge Semin, Thomas Bogendoerfer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]

kfree(dev) has been called inside put_device so anther
kfree would cause a use-after-free bug/

Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mips_cdmm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
index 9f7ed1fcd4285..626dedd110cbc 100644
--- a/drivers/bus/mips_cdmm.c
+++ b/drivers/bus/mips_cdmm.c
@@ -559,10 +559,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
 		dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
 		++id;
 		ret = device_register(&dev->dev);
-		if (ret) {
+		if (ret)
 			put_device(&dev->dev);
-			kfree(dev);
-		}
 	}
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 221/717] media: max2175: fix max2175_set_csm_mode() error code
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 220/717] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 222/717] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
                   ` (497 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mauro Carvalho Chehab,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]

This is supposed to return negative error codes but the type is bool so
it returns true instead.

Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/max2175.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
index 03b4ed3a61b83..661208c9bfc5d 100644
--- a/drivers/media/i2c/max2175.c
+++ b/drivers/media/i2c/max2175.c
@@ -503,7 +503,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
 	}
 }
 
-static bool max2175_set_csm_mode(struct max2175 *ctx,
+static int max2175_set_csm_mode(struct max2175 *ctx,
 			  enum max2175_csm_mode new_mode)
 {
 	int ret = max2175_poll_csm_ready(ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 222/717] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 221/717] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 223/717] RDMA/core: Track device memory MRs Greg Kroah-Hartman
                   ` (496 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Srinivas Kandagatla,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]

Attempting to send a power request during PM operations, when the QMI
handle isn't initialized results in a NULL pointer dereference. So check
if the QMI handle has been initialized before attempting to post the
power requests.

Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 218aefc3531cd..50cfd67c2871e 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1205,6 +1205,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
 		ret = qcom_slim_ngd_power_up(ctrl);
 	if (ret) {
@@ -1503,6 +1506,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	ret = qcom_slim_qmi_power_request(ctrl, false);
 	if (ret && ret != -EBUSY)
 		dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 223/717] RDMA/core: Track device memory MRs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 222/717] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 224/717] drm/mediatek: Use correct aliases name for ovl Greg Kroah-Hartman
                   ` (495 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe,
	Sasha Levin

From: Leon Romanovsky <leonro@mellanox.com>

[ Upstream commit b47a98efa97889c5b16d17e77eed3dc4500674eb ]

Device memory (DM) are registered as MR during initialization flow, these
MRs were not tracked by resource tracker and had res->valid set as a
false. Update the code to manage them too.

Before this change:
$ ibv_rc_pingpong -j &
$ rdma res show mr <-- shows nothing

After this change:
$ ibv_rc_pingpong -j &
$ rdma res show mr
dev ibp0s9 mrn 0 mrlen 4096 pdn 3 pid 734 comm ibv_rc_pingpong

Fixes: be934cca9e98 ("IB/uverbs: Add device memory registration ioctl support")
Link: https://lore.kernel.org/r/20201117070148.1974114-2-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/uverbs_std_types_mr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
index 9b22bb553e8b3..dc58564417292 100644
--- a/drivers/infiniband/core/uverbs_std_types_mr.c
+++ b/drivers/infiniband/core/uverbs_std_types_mr.c
@@ -33,6 +33,7 @@
 #include "rdma_core.h"
 #include "uverbs.h"
 #include <rdma/uverbs_std_types.h>
+#include "restrack.h"
 
 static int uverbs_free_mr(struct ib_uobject *uobject,
 			  enum rdma_remove_reason why,
@@ -134,6 +135,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DM_MR_REG)(
 	atomic_inc(&pd->usecnt);
 	atomic_inc(&dm->usecnt);
 
+	rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
+	rdma_restrack_set_name(&mr->res, NULL);
+	rdma_restrack_add(&mr->res);
 	uobj->object = mr;
 
 	uverbs_finalize_uobj_create(attrs, UVERBS_ATTR_REG_DM_MR_HANDLE);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 224/717] drm/mediatek: Use correct aliases name for ovl
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 223/717] RDMA/core: Track device memory MRs Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 225/717] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
                   ` (494 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Enric Balletbo i Serra,
	Chun-Kuang Hu, Sasha Levin

From: Enric Balletbo i Serra <enric.balletbo@collabora.com>

[ Upstream commit 414562b0ef36ce658f0ffec00e7039c7911e4cdc ]

Aliases property name must include only lowercase and '-', so fix this
in the driver, so we're not tempted to do "ovl_2l0 = &ovl_2l0" in the
device-tree instead of the right one which is "ovl-2l0 = &ovl_2l0".

Fixes: b17bdd0d7a73 ("drm/mediatek: add component OVL_2L0")
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
index 8eba44be3a8ae..3064eac1a7507 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
@@ -359,7 +359,7 @@ static const struct mtk_ddp_comp_funcs ddp_ufoe = {
 
 static const char * const mtk_ddp_comp_stem[MTK_DDP_COMP_TYPE_MAX] = {
 	[MTK_DISP_OVL] = "ovl",
-	[MTK_DISP_OVL_2L] = "ovl_2l",
+	[MTK_DISP_OVL_2L] = "ovl-2l",
 	[MTK_DISP_RDMA] = "rdma",
 	[MTK_DISP_WDMA] = "wdma",
 	[MTK_DISP_COLOR] = "color",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 225/717] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 224/717] drm/mediatek: Use correct aliases name for ovl Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 226/717] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
                   ` (493 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sebastian Reichel,
	Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]

In current code, it jumps to ida_simple_remove() when ida_simple_get()
failes to allocate an ID. Just return to fix it.

Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hsi/controllers/omap_ssi_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
index fa69b94debd9b..7596dc1646484 100644
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -355,7 +355,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
 
 	err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
 	if (err < 0)
-		goto out_err;
+		return err;
 	ssi->id = err;
 
 	ssi->owner = THIS_MODULE;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 226/717] ARM: dts: Remove non-existent i2c1 from 98dx3236
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 225/717] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 227/717] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
                   ` (492 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Packham, Andrew Lunn,
	Gregory CLEMENT, Sasha Levin

From: Chris Packham <chris.packham@alliedtelesis.co.nz>

[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]

The switches with integrated CPUs have only got a single i2c controller.
They incorrectly gained one when they were split from the Armada-XP.

Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
index 654648b05c7c2..aeccedd125740 100644
--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
@@ -266,11 +266,6 @@
 	reg = <0x11000 0x100>;
 };
 
-&i2c1 {
-	compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
-	reg = <0x11100 0x100>;
-};
-
 &mpic {
 	reg = <0x20a00 0x2d0>, <0x21070 0x58>;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 227/717] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 226/717] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 228/717] power: supply: bq25890: Use the correct range for IILIM register Greg Kroah-Hartman
                   ` (491 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Behún, Gregory CLEMENT,
	Andrew Lunn, Rob Herring, devicetree, Sasha Levin

From: Marek Behún <kabel@kernel.org>

[ Upstream commit 3aa669a994c9110a2dc7e08a5c0958a9ea5eb17c ]

Use property name `phy-handle` instead of the deprecated `phy` to
connect eth2 to the PHY.

Signed-off-by: Marek Behún <kabel@kernel.org>
Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: devicetree@vger.kernel.org
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index f3a678e0fd99b..bf76ebe463794 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -146,7 +146,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&rgmii_pins>;
 	phy-mode = "rgmii-id";
-	phy = <&phy1>;
+	phy-handle = <&phy1>;
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 228/717] power: supply: bq25890: Use the correct range for IILIM register
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 227/717] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 229/717] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
                   ` (490 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Krzyszkowiak,
	Michał Mirosław, Sebastian Reichel, Sasha Levin

From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>

[ Upstream commit d4e9e7b6f7ae37a99bc11ce9efe6e8bdc711362f ]

I've checked bq25890, bq25892, bq25895 and bq25896 datasheets and
they all define IILIM to be between 100mA-3.25A with 50mA steps.

Fixes: 478efc79ee32 ("power: bq25890: implement INPUT_CURRENT_LIMIT property")
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq25890_charger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c
index 34c21c51bac10..945c3257ca931 100644
--- a/drivers/power/supply/bq25890_charger.c
+++ b/drivers/power/supply/bq25890_charger.c
@@ -299,7 +299,7 @@ static const union {
 	/* TODO: BQ25896 has max ICHG 3008 mA */
 	[TBL_ICHG] =	{ .rt = {0,	  5056000, 64000} },	 /* uA */
 	[TBL_ITERM] =	{ .rt = {64000,   1024000, 64000} },	 /* uA */
-	[TBL_IILIM] =   { .rt = {50000,   3200000, 50000} },	 /* uA */
+	[TBL_IILIM] =   { .rt = {100000,  3250000, 50000} },	 /* uA */
 	[TBL_VREG] =	{ .rt = {3840000, 4608000, 16000} },	 /* uV */
 	[TBL_BOOSTV] =	{ .rt = {4550000, 5510000, 64000} },	 /* uV */
 	[TBL_SYSVMIN] = { .rt = {3000000, 3700000, 100000} },	 /* uV */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 229/717] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 228/717] power: supply: bq25890: Use the correct range for IILIM register Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 230/717] power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense Greg Kroah-Hartman
                   ` (489 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]

The board has a standard USB A female port connected to the USB OTG
controller's data pins. Set dr_mode in the OTG controller node to
indicate this usage, instead of having the implementation guess.

Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
index b70ffb1c6a630..b76282e704de1 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
@@ -334,6 +334,7 @@
 };
 
 &usb20_otg {
+	dr_mode = "host";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 230/717] power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 229/717] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 231/717] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
                   ` (488 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Timon Baetz, Sebastian Krzyszkowiak,
	Sebastian Reichel, Sasha Levin

From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>

[ Upstream commit 4b0a56e692503692da6555337a697c17feabbb3e ]

When current sense is disabled, max17042_no_current_sense_psy_desc gets
used which ignores two last properties from the list.

Fixes: 21b01cc879cc ("power: supply: max17042_battery: Add support for the TTE_NOW prop")
Reported-by: Timon Baetz <timon.baetz@protonmail.com>
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/max17042_battery.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index f284547913d6f..2e9672fe4df1f 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -85,9 +85,10 @@ static enum power_supply_property max17042_battery_props[] = {
 	POWER_SUPPLY_PROP_TEMP_MAX,
 	POWER_SUPPLY_PROP_HEALTH,
 	POWER_SUPPLY_PROP_SCOPE,
+	POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
+	// these two have to be at the end on the list
 	POWER_SUPPLY_PROP_CURRENT_NOW,
 	POWER_SUPPLY_PROP_CURRENT_AVG,
-	POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
 };
 
 static int max17042_get_temperature(struct max17042_chip *chip, int *temp)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 231/717] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 230/717] power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 232/717] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
                   ` (487 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sebastian Reichel,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]

Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling
for HP Pavilion x2 10") added special handling for HP Pavilion x2 10
models which use the weird combination of a Type-C connector and the
non Type-C aware AXP288 PMIC.

This special handling was activated by a DMI match a the product-name
of "HP Pavilion x2 Detachable". Recently I've learned that there are
also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC +
a micro-usb connector where we should not activate the special handling
for the Type-C connectors.

Extend the matching to also match on the DMI board-name and match on the
2 boards (one Bay Trail based one Cherry Trail based) of which we are
certain that they use the AXP288 + Type-C connector combination.

Note the DSDT code from these older (AXP288 + micro-USB) models contains
some AML code (which never runs under Linux) which reads the micro-USB
connector id-pin and if it is pulled to ground, which would normally mean
the port is in host mode!, then it sets the input-current-limit to 3A,
it seems HP is using the micro-USB port as a charging only connector
and identifies their own 3A capable charger though this hack which is a
major violation of the USB specs. Note HP also hardcodes a 2A limit
when the id-pin is not pulled to ground, which is also in violation
of the specs.

I've no intention to add support for HP's hack to support 3A charging
on these older models. By making the DMI matches for the Type-C equipped
models workaround more tighter, these older models will be treated just
like any other AXP288 + micro-USB equipped device and the input-current
limit will follow the BC 1.2 spec (using the defacto standard values
there where the BC 1.2 spec defines a range).

Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10")
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
index 9d981b76c1e72..a4df1ea923864 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -548,14 +548,15 @@ out:
 
 /*
  * The HP Pavilion x2 10 series comes in a number of variants:
- * Bay Trail SoC    + AXP288 PMIC, DMI_BOARD_NAME: "815D"
- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
- * Cherry Trail SoC + TI PMIC,     DMI_BOARD_NAME: "827C" or "82F4"
+ * Bay Trail SoC    + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
+ * Bay Trail SoC    + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "815D"
+ * Cherry Trail SoC + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "813E"
+ * Cherry Trail SoC + TI PMIC,     Type-C,    DMI_BOARD_NAME: "827C" or "82F4"
  *
- * The variants with the AXP288 PMIC are all kinds of special:
+ * The variants with the AXP288 + Type-C connector are all kinds of special:
  *
- * 1. All variants use a Type-C connector which the AXP288 does not support, so
- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * 1. They use a Type-C connector which the AXP288 does not support, so when
+ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
  * this model actually has mostly working ACPI AC / Battery code, the ACPI code
  * "solves" this by simply setting the input_current_limit to 3A.
  * There are still some issues with the ACPI code, so we use this native driver,
@@ -578,12 +579,17 @@ out:
  */
 static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
 	{
-		/*
-		 * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
-		 * Trail model has "HP", so we only match on product_name.
-		 */
 		.matches = {
-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
+		},
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
 		},
 	},
 	{} /* Terminating entry */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 232/717] power: supply: bq24190_charger: fix reference leak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 231/717] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 233/717] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
                   ` (486 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sebastian Reichel, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to call pm_runtime_put_noidle will result
in reference leak in callers(bq24190_sysfs_show,
bq24190_charger_get_property, bq24190_charger_set_property,
bq24190_battery_get_property, bq24190_battery_set_property),
so we should fix it.

Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
index d14186525e1e9..845af0f44c022 100644
--- a/drivers/power/supply/bq24190_charger.c
+++ b/drivers/power/supply/bq24190_charger.c
@@ -448,8 +448,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
 		return -EINVAL;
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
 	if (ret)
@@ -1077,8 +1079,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_CHARGE_TYPE:
@@ -1149,8 +1153,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
@@ -1410,8 +1416,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_STATUS:
@@ -1456,8 +1464,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 233/717] genirq/irqdomain: Dont try to free an interrupt that has no mapping
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 232/717] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 234/717] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
                   ` (485 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]

When an interrupt allocation fails for N interrupts, it is pretty
common for the error handling code to free the same number of interrupts,
no matter how many interrupts have actually been allocated.

This may result in the domain freeing code to be unexpectedly called
for interrupts that have no mapping in that domain. Things end pretty
badly.

Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
that thiss does not follow the hierarchy if no mapping exists for a given
interrupt.

Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e4ca69608f3b8..c6b419db68efc 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1373,8 +1373,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
 					   unsigned int irq_base,
 					   unsigned int nr_irqs)
 {
-	if (domain->ops->free)
-		domain->ops->free(domain, irq_base, nr_irqs);
+	unsigned int i;
+
+	if (!domain->ops->free)
+		return;
+
+	for (i = 0; i < nr_irqs; i++) {
+		if (irq_domain_get_irq_data(domain, irq_base + i))
+			domain->ops->free(domain, irq_base + i, 1);
+	}
 }
 
 int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 234/717] arm64: dts: ls1028a: fix ENETC PTP clock input
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 233/717] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 235/717] arm64: dts: ls1028a: fix FlexSPI " Greg Kroah-Hartman
                   ` (484 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Shawn Guo, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit d0570a575aa83116bd0f6a99c4de548af773d950 ]

On the LS1028A the ENETC reference clock is connected to 4th HWA output,
see Figure 7 "Clock subsystem block diagram".

The PHC may run with a wrong frequency. ptp_qoriq_auto_config() will read
the clock speed of the clock given in the device tree. It is likely that,
on the reference board this wasn't noticed because both clocks have the
same frequency. But this must not be always the case. Fix it.

Fixes: 49401003e260 ("arm64: dts: fsl: ls1028a: add ENETC 1588 timer node")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
index 7a6fb7e1fb82f..060b0d5c2669e 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
@@ -934,7 +934,7 @@
 			ethernet@0,4 {
 				compatible = "fsl,enetc-ptp";
 				reg = <0x000400 0 0 0 0>;
-				clocks = <&clockgen 4 0>;
+				clocks = <&clockgen 2 3>;
 				little-endian;
 				fsl,extts-fifo;
 			};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 235/717] arm64: dts: ls1028a: fix FlexSPI clock input
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 234/717] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 236/717] arm64: dts: freescale: sl28: combine SPI MTD partitions Greg Kroah-Hartman
                   ` (483 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Shawn Guo, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit 588b17eda1356e06efa4b888d0af02c80a2788f6 ]

On the LS1028A the FlexSPI clock is connected to the first HWA output,
see Figure 7 "Clock subsystem block diagram".

Fixes: c77fae5ba09a ("arm64: dts: ls1028a: Add FlexSPI support")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
index 060b0d5c2669e..33aa0efa2293a 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
@@ -309,7 +309,7 @@
 			      <0x0 0x20000000 0x0 0x10000000>;
 			reg-names = "fspi_base", "fspi_mmap";
 			interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+			clocks = <&clockgen 2 0>, <&clockgen 2 0>;
 			clock-names = "fspi_en", "fspi";
 			status = "disabled";
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 236/717] arm64: dts: freescale: sl28: combine SPI MTD partitions
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 235/717] arm64: dts: ls1028a: fix FlexSPI " Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 237/717] phy: tegra: xusb: Fix usb_phy device driver field Greg Kroah-Hartman
                   ` (482 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Shawn Guo, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit 91ab1c12285c9999afe56c09aa296d8b96862976 ]

The upstream port, doesn't really follow the vendor partitioning. The
bootloader partition has one U-Boot FIT image containing all needed
bits and pieces. Even today the bootloader is already larger than the
current "bootloader" partition. Thus, fold all the partitions into one
and keep the environment one. The latter is still valid.
We keep the failsafe partitions because the first half of the SPI flash
is preinstalled by the vendor and immutable.

Fixes: 815364d0424e ("arm64: dts: freescale: add Kontron sl28 support")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts  | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
index 8161dd2379712..b3fa4dbeebd52 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
@@ -155,20 +155,10 @@
 		};
 
 		partition@210000 {
-			reg = <0x210000 0x0f0000>;
+			reg = <0x210000 0x1d0000>;
 			label = "bootloader";
 		};
 
-		partition@300000 {
-			reg = <0x300000 0x040000>;
-			label = "DP firmware";
-		};
-
-		partition@340000 {
-			reg = <0x340000 0x0a0000>;
-			label = "trusted firmware";
-		};
-
 		partition@3e0000 {
 			reg = <0x3e0000 0x020000>;
 			label = "bootloader environment";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 237/717] phy: tegra: xusb: Fix usb_phy device driver field
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 236/717] arm64: dts: freescale: sl28: combine SPI MTD partitions Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 238/717] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
                   ` (481 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, JC Kuo, Thierry Reding, Vinod Koul,
	Sasha Levin

From: JC Kuo <jckuo@nvidia.com>

[ Upstream commit 4ea0bf2a52f1eea76578eac5a9148d95f5e181c0 ]

In commit "phy: tegra: xusb: Add usb-phy support", an OTG capable PHY
device, such as phy-usb2.0 device of Jetson-TX1 platform, will be
bound to the tegra-xusb-padctl driver by the following line in
tegra_xusb_setup_usb_role_switch().

	port->usb_phy.dev->driver = port->padctl->dev->driver;

With this, dev_pm_ops set of tegra-xusb-padctl driver will be invoked
for the OTG capable PHY incorrectly as below logs show.

This commit fixes the issue by assigning an empty driver to it.

[  153.451108] tegra-xusb-padctl phy-usb2.0: > tegra_xusb_padctl_suspend_noirq(dev=ffff000080917000)
[  153.460353] tegra-xusb-padctl phy-usb2.0:   driver: ffff8000114453e0 (tegra_xusb_padctl_driver)
[  153.469245] tegra-xusb-padctl phy-usb2.0:   padctl: ffff0000829f6480
[  153.475772] tegra-xusb-padctl phy-usb2.0:     soc: ef7bdd7fffffffff (0xef7bdd7fffffffff)
[  153.484061] Unable to handle kernel paging request at virtual address 007bdd800000004f
[  153.492132] Mem abort info:
[  153.495083]   ESR = 0x96000004
[  153.498308]   EC = 0x25: DABT (current EL), IL = 32 bits
[  153.503771]   SET = 0, FnV = 0
[  153.506979]   EA = 0, S1PTW = 0
[  153.510260] Data abort info:
[  153.513200]   ISV = 0, ISS = 0x00000004
[  153.517181]   CM = 0, WnR = 0
[  153.520302] [007bdd800000004f] address between user and kernel address ranges
[  153.527600] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[  153.533231] Modules linked in: nouveau panel_simple tegra_video(C) tegra_drm drm_ttm_helper videobuf2_dma_contig ttm videobuf2_memops cec videobuf2_v4l2 videobuf2_common drm_kms_helper v4l2_fwnode videodev drm mc snd_hda_codec_hdmi cdc_ether usbnet snd_hda_tegra r8152 crct10dif_ce snd_hda_codec snd_hda_core tegra_xudc host1x lp855x_bl at24 ip_tables x_tables ipv6
[  153.566417] CPU: 0 PID: 300 Comm: systemd-sleep Tainted: G         C        5.10.0-rc3-next-20201113-00019-g5c064d5372b0-dirty #624
[  153.578283] Hardware name: NVIDIA Jetson TX1 Developer Kit (DT)
[  153.584281] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[  153.590381] pc : tegra_xusb_padctl_suspend_noirq+0x88/0x100
[  153.596016] lr : tegra_xusb_padctl_suspend_noirq+0x80/0x100
[  153.601632] sp : ffff8000120dbb60
[  153.604999] x29: ffff8000120dbb60 x28: ffff000080a1df00
[  153.610430] x27: 0000000000000002 x26: ffff8000106f8540
[  153.615858] x25: ffff8000113ac4a4 x24: ffff80001148c198
[  153.621277] x23: ffff800010c4538c x22: 0000000000000002
[  153.626692] x21: ffff800010ccde80 x20: ffff0000829f6480
[  153.632107] x19: ffff000080917000 x18: 0000000000000030
[  153.637521] x17: 0000000000000000 x16: 0000000000000000
[  153.642933] x15: ffff000080a1e380 x14: 74636461702d6273
[  153.648346] x13: ffff8000113ad058 x12: 0000000000000f39
[  153.653759] x11: 0000000000000513 x10: ffff800011405058
[  153.659176] x9 : 00000000fffff000 x8 : ffff8000113ad058
[  153.664590] x7 : ffff800011405058 x6 : 0000000000000000
[  153.670002] x5 : 0000000000000000 x4 : ffff0000fe908bc0
[  153.675414] x3 : ffff0000fe910228 x2 : 162ef67e0581e700
[  153.680826] x1 : 162ef67e0581e700 x0 : ef7bdd7fffffffff
[  153.686241] Call trace:
[  153.688769]  tegra_xusb_padctl_suspend_noirq+0x88/0x100
[  153.694077]  __device_suspend_noirq+0x68/0x1cc
[  153.698594]  dpm_noirq_suspend_devices+0x10c/0x1d0
[  153.703456]  dpm_suspend_noirq+0x28/0xa0
[  153.707461]  suspend_devices_and_enter+0x234/0x4bc
[  153.712314]  pm_suspend+0x1e4/0x270
[  153.715868]  state_store+0x8c/0x110
[  153.719440]  kobj_attr_store+0x1c/0x30
[  153.723259]  sysfs_kf_write+0x4c/0x7c
[  153.726981]  kernfs_fop_write+0x124/0x240
[  153.731065]  vfs_write+0xe4/0x204
[  153.734449]  ksys_write+0x6c/0x100
[  153.737925]  __arm64_sys_write+0x20/0x30
[  153.741931]  el0_svc_common.constprop.0+0x78/0x1a0
[  153.746789]  do_el0_svc+0x24/0x90
[  153.750181]  el0_sync_handler+0x254/0x260
[  153.754251]  el0_sync+0x174/0x180
[  153.757663] Code: aa0303e2 94000f64 f9405680 b40000e0 (f9402803)
[  153.763826] ---[ end trace 81543a3394cb409d ]---

Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support")

Signed-off-by: JC Kuo <jckuo@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20201117083803.185209-1-jckuo@nvidia.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/tegra/xusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index ad88d74c18842..181a1be5f4917 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -688,7 +688,7 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
 	 * reference to retrieve usb-phy details.
 	 */
 	port->usb_phy.dev = &lane->pad->lanes[port->index]->dev;
-	port->usb_phy.dev->driver = port->padctl->dev->driver;
+	port->usb_phy.dev->driver = port->dev.driver;
 	port->usb_phy.otg->usb_phy = &port->usb_phy;
 	port->usb_phy.otg->set_peripheral = tegra_xusb_set_peripheral;
 	port->usb_phy.otg->set_host = tegra_xusb_set_host;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 238/717] arm64: dts: qcom: c630: Polish i2c-hid devices
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 237/717] phy: tegra: xusb: Fix usb_phy device driver field Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 239/717] arm64: dts: qcom: c630: Fix pinctrl pins properties Greg Kroah-Hartman
                   ` (480 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steev Klimaszewski, Bjorn Andersson,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 11d0e4f281565ef757479764ce7fd8d35eeb01b0 ]

The numbering of the i2c busses differs from ACPI and a number of typos
was made in the original patch. Further more the irq flags for the
various resources was not correct and i2c3 only has one of the two
client devices active in any one device.

Also label the various devices, for easier comparison with the ACPI
tables.

Tested-by: Steev Klimaszewski <steev@kali.org>
Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
Link: https://lore.kernel.org/r/20201130165924.319708-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
index d03ca31907466..60c6ab8162e21 100644
--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
@@ -264,23 +264,28 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@15 {
+	tsel: hid@15 {
 		compatible = "hid-over-i2c";
 		reg = <0x15>;
 		hid-descr-addr = <0x1>;
 
-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
+		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&i2c3_hid_active>;
 	};
 
-	hid@2c {
+	tsc2: hid@2c {
 		compatible = "hid-over-i2c";
 		reg = <0x2c>;
 		hid-descr-addr = <0x20>;
 
-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
+		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c2_hid_active>;
+		pinctrl-0 = <&i2c3_hid_active>;
+
+		status = "disabled";
 	};
 };
 
@@ -288,15 +293,15 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@10 {
+	tsc1: hid@10 {
 		compatible = "hid-over-i2c";
 		reg = <0x10>;
 		hid-descr-addr = <0x1>;
 
-		interrupts-extended = <&tlmm 125 IRQ_TYPE_EDGE_FALLING>;
+		interrupts-extended = <&tlmm 125 IRQ_TYPE_LEVEL_LOW>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c6_hid_active>;
+		pinctrl-0 = <&i2c5_hid_active>;
 	};
 };
 
@@ -304,7 +309,7 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@5c {
+	ecsh: hid@5c {
 		compatible = "hid-over-i2c";
 		reg = <0x5c>;
 		hid-descr-addr = <0x1>;
@@ -312,7 +317,7 @@
 		interrupts-extended = <&tlmm 92 IRQ_TYPE_LEVEL_LOW>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c12_hid_active>;
+		pinctrl-0 = <&i2c11_hid_active>;
 	};
 };
 
@@ -426,7 +431,7 @@
 &tlmm {
 	gpio-reserved-ranges = <0 4>, <81 4>;
 
-	i2c2_hid_active: i2c2-hid-active {
+	i2c3_hid_active: i2c2-hid-active {
 		pins = <37>;
 		function = "gpio";
 
@@ -435,7 +440,7 @@
 		drive-strength = <2>;
 	};
 
-	i2c6_hid_active: i2c6-hid-active {
+	i2c5_hid_active: i2c5-hid-active {
 		pins = <125>;
 		function = "gpio";
 
@@ -444,7 +449,7 @@
 		drive-strength = <2>;
 	};
 
-	i2c12_hid_active: i2c12-hid-active {
+	i2c11_hid_active: i2c11-hid-active {
 		pins = <92>;
 		function = "gpio";
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 239/717] arm64: dts: qcom: c630: Fix pinctrl pins properties
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 238/717] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 240/717] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
                   ` (479 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steev Klimaszewski, Bjorn Andersson,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit f55d373f7953909160cb4c1398f62123cdbe7650 ]

The "pins" property takes an array of pin _names_, not pin numbers. Fix
this.

Tested-by: Steev Klimaszewski <steev@kali.org>
Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
Link: https://lore.kernel.org/r/20201130170028.319798-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
index 60c6ab8162e21..76a8c996d497f 100644
--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
@@ -432,7 +432,7 @@
 	gpio-reserved-ranges = <0 4>, <81 4>;
 
 	i2c3_hid_active: i2c2-hid-active {
-		pins = <37>;
+		pins = "gpio37";
 		function = "gpio";
 
 		input-enable;
@@ -441,7 +441,7 @@
 	};
 
 	i2c5_hid_active: i2c5-hid-active {
-		pins = <125>;
+		pins = "gpio125";
 		function = "gpio";
 
 		input-enable;
@@ -450,7 +450,7 @@
 	};
 
 	i2c11_hid_active: i2c11-hid-active {
-		pins = <92>;
+		pins = "gpio92";
 		function = "gpio";
 
 		input-enable;
@@ -459,7 +459,7 @@
 	};
 
 	wcd_intr_default: wcd_intr_default {
-		pins = <54>;
+		pins = "gpio54";
 		function = "gpio";
 
 		input-enable;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 240/717] PCI: Bounds-check command-line resource alignment requests
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 239/717] arm64: dts: qcom: c630: Fix pinctrl pins properties Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.10 241/717] PCI: Fix overflow in " Greg Kroah-Hartman
                   ` (478 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Bjorn Helgaas, Sasha Levin

From: Bjorn Helgaas <bhelgaas@google.com>

[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]

32-bit BARs are limited to 2GB size (2^31).  By extension, I assume 64-bit
BARs are limited to 2^63 bytes.  Limit the alignment requested by the
"pci=resource_alignment=" command-line parameter to 2^63.

Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e578d34095e91..b7a860e790979 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6202,19 +6202,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 	while (*p) {
 		count = 0;
 		if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
-							p[count] == '@') {
+		    p[count] == '@') {
 			p += count + 1;
+			if (align_order > 63) {
+				pr_err("PCI: Invalid requested alignment (order %d)\n",
+				       align_order);
+				align_order = PAGE_SHIFT;
+			}
 		} else {
-			align_order = -1;
+			align_order = PAGE_SHIFT;
 		}
 
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			if (align_order == -1)
-				align = PAGE_SIZE;
-			else
-				align = 1 << align_order;
+			align = 1 << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 241/717] PCI: Fix overflow in command-line resource alignment requests
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 240/717] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 242/717] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
                   ` (477 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Bjorn Helgaas,
	Logan Gunthorpe, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]

The shift of 1 by align_order is evaluated using 32 bit arithmetic and the
result is assigned to a resource_size_t type variable that is a 64 bit
unsigned integer on 64 bit platforms. Fix an overflow before widening issue
by making the 1 a ULL.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b7a860e790979..6427cbd0a5be2 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6216,7 +6216,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			align = 1 << align_order;
+			align = 1ULL << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 242/717] PCI: iproc: Fix out-of-bound array accesses
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.10 241/717] PCI: Fix overflow in " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 243/717] PCI: iproc: Invalidate correct PAXB inbound windows Greg Kroah-Hartman
                   ` (476 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bharat Gooty, Lorenzo Pieralisi, Sasha Levin

From: Bharat Gooty <bharat.gooty@broadcom.com>

[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]

Declare the full size array for all revisions of PAX register sets
to avoid potentially out of bound access of the register array
when they are being initialized in iproc_pcie_rev_init().

Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index 905e938082432..d901b9d392b8c 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -307,7 +307,7 @@ enum iproc_pcie_reg {
 };
 
 /* iProc PCIe PAXB BCMA registers */
-static const u16 iproc_pcie_reg_paxb_bcma[] = {
+static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -318,7 +318,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
 };
 
 /* iProc PCIe PAXB registers */
-static const u16 iproc_pcie_reg_paxb[] = {
+static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -334,7 +334,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
 };
 
 /* iProc PCIe PAXB v2 registers */
-static const u16 iproc_pcie_reg_paxb_v2[] = {
+static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -363,7 +363,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
 };
 
 /* iProc PCIe PAXC v1 registers */
-static const u16 iproc_pcie_reg_paxc[] = {
+static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x1f0,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x1f4,
@@ -372,7 +372,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
 };
 
 /* iProc PCIe PAXC v2 registers */
-static const u16 iproc_pcie_reg_paxc_v2[] = {
+static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_MSI_GIC_MODE]	= 0x050,
 	[IPROC_PCIE_MSI_BASE_ADDR]	= 0x074,
 	[IPROC_PCIE_MSI_WINDOW_SIZE]	= 0x078,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 243/717] PCI: iproc: Invalidate correct PAXB inbound windows
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 242/717] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 244/717] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
                   ` (475 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roman Bacik, Srinath Mannam,
	Lorenzo Pieralisi, Sasha Levin

From: Roman Bacik <roman.bacik@broadcom.com>

[ Upstream commit 89bbcaac3dff21f3567956b3416f5ec8b45f5555 ]

Second stage bootloaders prior to Linux boot may use all inbound windows
including IARR1/IMAP1. We need to ensure that all previous configuration
of inbound windows are invalidated during the initialization stage of
the Linux iProc PCIe driver so let's add a fix to define and invalidate
IARR1/IMAP1 because it is currently missing, fixing the issue.

Link: https://lore.kernel.org/r/20201001060054.6616-3-srinath.mannam@broadcom.com
Fixes: 9415743e4c8a ("PCI: iproc: Invalidate PAXB address mapping")
Signed-off-by: Roman Bacik <roman.bacik@broadcom.com>
Signed-off-by: Srinath Mannam <srinath.mannam@broadcom.com>
[lorenzo.pieralisi@arm.com: commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index d901b9d392b8c..cc5b7823edeb7 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -192,8 +192,15 @@ static const struct iproc_pcie_ib_map paxb_v2_ib_map[] = {
 		.imap_window_offset = 0x4,
 	},
 	{
-		/* IARR1/IMAP1 (currently unused) */
-		.type = IPROC_PCIE_IB_MAP_INVALID,
+		/* IARR1/IMAP1 */
+		.type = IPROC_PCIE_IB_MAP_MEM,
+		.size_unit = SZ_1M,
+		.region_sizes = { 8 },
+		.nr_sizes = 1,
+		.nr_windows = 8,
+		.imap_addr_offset = 0x4,
+		.imap_window_offset = 0x8,
+
 	},
 	{
 		/* IARR2/IMAP2 */
@@ -351,6 +358,8 @@ static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_OMAP3]		= 0xdf8,
 	[IPROC_PCIE_IARR0]		= 0xd00,
 	[IPROC_PCIE_IMAP0]		= 0xc00,
+	[IPROC_PCIE_IARR1]		= 0xd08,
+	[IPROC_PCIE_IMAP1]		= 0xd70,
 	[IPROC_PCIE_IARR2]		= 0xd10,
 	[IPROC_PCIE_IMAP2]		= 0xcc0,
 	[IPROC_PCIE_IARR3]		= 0xe00,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 244/717] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 243/717] PCI: iproc: Invalidate correct PAXB inbound windows Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 245/717] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
                   ` (474 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem Lapkin, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Artem Lapkin <art@khadas.com>

[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]

The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc
chip should be 104Mhz not 30MHz.

Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
Signed-off-by: Artem Lapkin <art@khadas.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index bff8ec2c1c70c..e2bd9c7c817d7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -341,7 +341,7 @@
 		#size-cells = <1>;
 		compatible = "winbond,w25q16", "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <3000000>;
+		spi-max-frequency = <104000000>;
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 245/717] arm64: dts: meson-sm1: fix typo in opp table
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 244/717] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 246/717] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
                   ` (473 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongjin Kim, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Dongjin Kim <tobetter@gmail.com>

[ Upstream commit b6a1c8a1eaa73b1e2ae251399308e9445d74cef7 ]

The freqency 1512000000 should be 1500000000.

Signed-off-by: Dongjin Kim <tobetter@gmail.com>
Fixes: 3d9e76483049 ("arm64: dts: meson-sm1-sei610: enable DVFS")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201130060320.GA30098@anyang-linuxfactory-or-kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
index 71317f5aada1d..c309517abae32 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
@@ -130,7 +130,7 @@
 			opp-microvolt = <790000>;
 		};
 
-		opp-1512000000 {
+		opp-1500000000 {
 			opp-hz = /bits/ 64 <1500000000>;
 			opp-microvolt = <800000>;
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 246/717] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 245/717] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 247/717] scsi: hisi_sas: Fix up probe error handling for v3 hw Greg Kroah-Hartman
                   ` (472 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 28f851e6afa858f182802e23ac60c3ed7d1c04a1 ]

if of_find_device_by_node() succeed, meson_canvas_get() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: 382f8be04551 ("soc: amlogic: canvas: Fix meson_canvas_get when probe failed")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201117011322.522477-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/amlogic/meson-canvas.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c
index c655f5f92b124..d0329ad170d13 100644
--- a/drivers/soc/amlogic/meson-canvas.c
+++ b/drivers/soc/amlogic/meson-canvas.c
@@ -72,8 +72,10 @@ struct meson_canvas *meson_canvas_get(struct device *dev)
 	 * current state, this driver probe cannot return -EPROBE_DEFER
 	 */
 	canvas = dev_get_drvdata(&canvas_pdev->dev);
-	if (!canvas)
+	if (!canvas) {
+		put_device(&canvas_pdev->dev);
 		return ERR_PTR(-EINVAL);
+	}
 
 	return canvas;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 247/717] scsi: hisi_sas: Fix up probe error handling for v3 hw
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 246/717] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 248/717] scsi: pm80xx: Do not sleep in atomic context Greg Kroah-Hartman
                   ` (471 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiang Chen, John Garry,
	Martin K. Petersen, Sasha Levin

From: Xiang Chen <chenxiang66@hisilicon.com>

[ Upstream commit 2ebde94f2ea4cffd812ece2f318c2f4922239b1d ]

Fix some rollbacks in function hisi_sas_v3_probe() and
interrupt_init_v3_hw().

Link: https://lore.kernel.org/r/1606207594-196362-3-git-send-email-john.garry@huawei.com
Fixes: 8d98416a55eb ("scsi: hisi_sas: Switch v3 hw to MQ")
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 960de375ce699..2cbd8a524edab 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2409,8 +2409,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 			      DRV_NAME " phy", hisi_hba);
 	if (rc) {
 		dev_err(dev, "could not request phy interrupt, rc=%d\n", rc);
-		rc = -ENOENT;
-		goto free_irq_vectors;
+		return -ENOENT;
 	}
 
 	rc = devm_request_irq(dev, pci_irq_vector(pdev, 2),
@@ -2418,8 +2417,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 			      DRV_NAME " channel", hisi_hba);
 	if (rc) {
 		dev_err(dev, "could not request chnl interrupt, rc=%d\n", rc);
-		rc = -ENOENT;
-		goto free_irq_vectors;
+		return -ENOENT;
 	}
 
 	rc = devm_request_irq(dev, pci_irq_vector(pdev, 11),
@@ -2427,8 +2425,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 			      DRV_NAME " fatal", hisi_hba);
 	if (rc) {
 		dev_err(dev, "could not request fatal interrupt, rc=%d\n", rc);
-		rc = -ENOENT;
-		goto free_irq_vectors;
+		return -ENOENT;
 	}
 
 	if (hisi_sas_intr_conv)
@@ -2449,8 +2446,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 		if (rc) {
 			dev_err(dev, "could not request cq%d interrupt, rc=%d\n",
 				i, rc);
-			rc = -ENOENT;
-			goto free_irq_vectors;
+			return -ENOENT;
 		}
 		cq->irq_mask = pci_irq_get_affinity(pdev, i + BASE_VECTORS_V3_HW);
 		if (!cq->irq_mask) {
@@ -2460,10 +2456,6 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 	}
 
 	return 0;
-
-free_irq_vectors:
-	pci_free_irq_vectors(pdev);
-	return rc;
 }
 
 static int hisi_sas_v3_init(struct hisi_hba *hisi_hba)
@@ -3317,11 +3309,11 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	rc = interrupt_preinit_v3_hw(hisi_hba);
 	if (rc)
-		goto err_out_ha;
+		goto err_out_debugfs;
 	dev_err(dev, "%d hw queues\n", shost->nr_hw_queues);
 	rc = scsi_add_host(shost, dev);
 	if (rc)
-		goto err_out_ha;
+		goto err_out_free_irq_vectors;
 
 	rc = sas_register_ha(sha);
 	if (rc)
@@ -3348,8 +3340,12 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 err_out_register_ha:
 	scsi_remove_host(shost);
-err_out_ha:
+err_out_free_irq_vectors:
+	pci_free_irq_vectors(pdev);
+err_out_debugfs:
 	hisi_sas_debugfs_exit(hisi_hba);
+err_out_ha:
+	hisi_sas_free(hisi_hba);
 	scsi_host_put(shost);
 err_out_regions:
 	pci_release_regions(pdev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 248/717] scsi: pm80xx: Do not sleep in atomic context
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 247/717] scsi: hisi_sas: Fix up probe error handling for v3 hw Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 249/717] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR Greg Kroah-Hartman
                   ` (470 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vikram Auradkar, Jack Wang,
	Ahmed S. Darwish, Sebastian Andrzej Siewior, Martin K. Petersen,
	Sasha Levin

From: Ahmed S. Darwish <a.darwish@linutronix.de>

[ Upstream commit 4ba9e516573e60c471c01bb369144651f6f8d50b ]

hw_event_sas_phy_up() is used in hardirq/softirq context:

 pm8001_interrupt_handler_msix() || pm8001_interrupt_handler_intx() || pm8001_tasklet
   => PM8001_CHIP_DISP->isr() = pm80xx_chip_isr()
     => process_oq() [spin_lock_irqsave(&pm8001_ha->lock,)]
       => process_one_iomb()
         => mpi_hw_event()
           => hw_event_sas_phy_up()
             => msleep(200)

Revert the msleep() back to an mdelay() to avoid sleeping in atomic
context.

Link: https://lore.kernel.org/r/20201126132952.2287996-2-bigeasy@linutronix.de
Fixes: 4daf1ef3c681 ("scsi: pm80xx: Convert 'long' mdelay to msleep")
Cc: Vikram Auradkar <auradkar@google.com>
Cc: Jack Wang <jinpu.wang@cloud.ionos.com>
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 7593f248afb2c..155382ce84698 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -3363,7 +3363,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
 	pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
 	spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
 	if (pm8001_ha->flags == PM8001F_RUN_TIME)
-		msleep(200);/*delay a moment to wait disk to spinup*/
+		mdelay(200); /* delay a moment to wait for disk to spin up */
 	pm8001_bytes_dmaed(pm8001_ha, phy_id);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 249/717] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 248/717] scsi: pm80xx: Do not sleep in atomic context Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 250/717] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
                   ` (469 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Kochetkov, Mark Brown, Sasha Levin

From: Maxim Kochetkov <fido_max@inbox.ru>

[ Upstream commit 2c2b3ad2c4c801bab1eec7264ea6991b1e4e8f2c ]

If cs-gpios property is used in devicetree then ctlr->num_chipselect value
may be changed by spi_get_gpio_descs().
So use ctlr->max_native_cs instead of ctlr->num_chipselect to set SPI_MCR

Fixes: 4fcc7c2292de (spi: spi-fsl-dspi: Don't access reserved fields in SPI_MCR)
Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Link: https://lore.kernel.org/r/20201201085916.63543-1-fido_max@inbox.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-dspi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 1a08c1d584abe..0287366874882 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -1165,7 +1165,7 @@ static int dspi_init(struct fsl_dspi *dspi)
 	unsigned int mcr;
 
 	/* Set idle states for all chip select signals to high */
-	mcr = SPI_MCR_PCSIS(GENMASK(dspi->ctlr->num_chipselect - 1, 0));
+	mcr = SPI_MCR_PCSIS(GENMASK(dspi->ctlr->max_native_cs - 1, 0));
 
 	if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
 		mcr |= SPI_MCR_XSPI;
@@ -1250,7 +1250,7 @@ static int dspi_probe(struct platform_device *pdev)
 
 	pdata = dev_get_platdata(&pdev->dev);
 	if (pdata) {
-		ctlr->num_chipselect = pdata->cs_num;
+		ctlr->num_chipselect = ctlr->max_native_cs = pdata->cs_num;
 		ctlr->bus_num = pdata->bus_num;
 
 		/* Only Coldfire uses platform data */
@@ -1263,7 +1263,7 @@ static int dspi_probe(struct platform_device *pdev)
 			dev_err(&pdev->dev, "can't get spi-num-chipselects\n");
 			goto out_ctlr_put;
 		}
-		ctlr->num_chipselect = cs_num;
+		ctlr->num_chipselect = ctlr->max_native_cs = cs_num;
 
 		of_property_read_u32(np, "bus-num", &bus_num);
 		ctlr->bus_num = bus_num;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 250/717] ARM: dts: at91: at91sam9rl: fix ADC triggers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 249/717] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 251/717] RDMA/hns: Fix 0-length sge calculation error Greg Kroah-Hartman
                   ` (468 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]

The triggers for the ADC were taken from at91sam9260 dtsi but are not
correct.

Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index 5653e70c84b4b..36a42a9fe1957 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -282,23 +282,26 @@
 				atmel,adc-use-res = "highres";
 
 				trigger0 {
-					trigger-name = "timer-counter-0";
+					trigger-name = "external-rising";
 					trigger-value = <0x1>;
+					trigger-external;
 				};
+
 				trigger1 {
-					trigger-name = "timer-counter-1";
-					trigger-value = <0x3>;
+					trigger-name = "external-falling";
+					trigger-value = <0x2>;
+					trigger-external;
 				};
 
 				trigger2 {
-					trigger-name = "timer-counter-2";
-					trigger-value = <0x5>;
+					trigger-name = "external-any";
+					trigger-value = <0x3>;
+					trigger-external;
 				};
 
 				trigger3 {
-					trigger-name = "external";
-					trigger-value = <0x13>;
-					trigger-external;
+					trigger-name = "continuous";
+					trigger-value = <0x6>;
 				};
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 251/717] RDMA/hns: Fix 0-length sge calculation error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 250/717] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 252/717] RDMA/hns: Bugfix for calculation of extended sge Greg Kroah-Hartman
                   ` (467 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lang Cheng, Weihang Li,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Lang Cheng <chenglang@huawei.com>

[ Upstream commit 0fd0175e30e487f8d70ecb2cdd67fbb514fdf50f ]

One RC SQ WQE can store 2 sges but UD can't, so ignore 2 valid sges of
wr.sglist for RC which have been filled in WQE before setting extended
sge.  Either of RC and UD can not contain 0-length sges, so these 0-length
sges should be skipped.

Fixes: 54d6638765b0 ("RDMA/hns: Optimize WQE buffer size calculating process")
Link: https://lore.kernel.org/r/1606558959-48510-2-git-send-email-liweihang@huawei.com
Signed-off-by: Lang Cheng <chenglang@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 24 +++++++++-------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 4db7eea3dcec5..c287dbd2f384d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -214,25 +214,20 @@ static int fill_ext_sge_inl_data(struct hns_roce_qp *qp,
 	return 0;
 }
 
-static void set_extend_sge(struct hns_roce_qp *qp, const struct ib_send_wr *wr,
-			   unsigned int *sge_ind, unsigned int valid_num_sge)
+static void set_extend_sge(struct hns_roce_qp *qp, struct ib_sge *sge,
+			   unsigned int *sge_ind, unsigned int cnt)
 {
 	struct hns_roce_v2_wqe_data_seg *dseg;
-	unsigned int cnt = valid_num_sge;
-	struct ib_sge *sge = wr->sg_list;
 	unsigned int idx = *sge_ind;
 
-	if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC) {
-		cnt -= HNS_ROCE_SGE_IN_WQE;
-		sge += HNS_ROCE_SGE_IN_WQE;
-	}
-
 	while (cnt > 0) {
 		dseg = hns_roce_get_extend_sge(qp, idx & (qp->sge.sge_cnt - 1));
-		set_data_seg_v2(dseg, sge);
-		idx++;
+		if (likely(sge->length)) {
+			set_data_seg_v2(dseg, sge);
+			idx++;
+			cnt--;
+		}
 		sge++;
-		cnt--;
 	}
 
 	*sge_ind = idx;
@@ -340,7 +335,8 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr,
 			}
 		}
 
-		set_extend_sge(qp, wr, sge_ind, valid_num_sge);
+		set_extend_sge(qp, wr->sg_list + i, sge_ind,
+			       valid_num_sge - HNS_ROCE_SGE_IN_WQE);
 	}
 
 	roce_set_field(rc_sq_wqe->byte_16,
@@ -511,7 +507,7 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
 
 	memcpy(&ud_sq_wqe->dgid[0], &ah->av.dgid[0], GID_LEN_V2);
 
-	set_extend_sge(qp, wr, &curr_idx, valid_num_sge);
+	set_extend_sge(qp, wr->sg_list, &curr_idx, valid_num_sge);
 
 	*sge_idx = curr_idx;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 252/717] RDMA/hns: Bugfix for calculation of extended sge
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 251/717] RDMA/hns: Fix 0-length sge calculation error Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 253/717] mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree Greg Kroah-Hartman
                   ` (466 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangyang Li, Weihang Li,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Yangyang Li <liyangyang20@huawei.com>

[ Upstream commit d34895c319faa1e0fc1a48c3b06bba6a8a39ba44 ]

Page alignment is required when setting the number of extended sge
according to the hardware's achivement. If the space of needed extended
sge is greater than one page, the roundup_pow_of_two() can ensure
that. But if the needed extended sge isn't 0 and can not be filled in a
whole page, the driver should align it specifically.

Fixes: 54d6638765b0 ("RDMA/hns: Optimize WQE buffer size calculating process")
Link: https://lore.kernel.org/r/1606558959-48510-3-git-send-email-liweihang@huawei.com
Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_qp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 6c081dd985fc9..71ea8fd9041b9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -432,7 +432,12 @@ static int set_extend_sge_param(struct hns_roce_dev *hr_dev, u32 sq_wqe_cnt,
 	}
 
 	hr_qp->sge.sge_shift = HNS_ROCE_SGE_SHIFT;
-	hr_qp->sge.sge_cnt = cnt;
+
+	/* If the number of extended sge is not zero, they MUST use the
+	 * space of HNS_HW_PAGE_SIZE at least.
+	 */
+	hr_qp->sge.sge_cnt = cnt ?
+			max(cnt, (u32)HNS_HW_PAGE_SIZE / HNS_ROCE_SGE_SIZE) : 0;
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 253/717] mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 252/717] RDMA/hns: Bugfix for calculation of extended sge Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 254/717] soundwire: master: use pm_runtime_set_active() on add Greg Kroah-Hartman
                   ` (465 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Marussi, Sudeep Holla,
	Jassi Brar, Sasha Levin

From: Sudeep Holla <sudeep.holla@arm.com>

[ Upstream commit 9905f728b0bda737fe2c2afd7c24f3365a45cc7b ]

The mhu_db_channel info is allocated per channel using devm_kzalloc from
mhu_db_mbox_xlate which gets called from mbox_request_channel. However
we are releasing the allocated mhu_db_channel info using plain kfree from
mhu_db_shutdown which is called from mbox_free_channel.

This leads to random crashes when the channel is freed like below one:

  Unable to handle kernel paging request at virtual address 0080000400000008
  [0080000400000008] address between user and kernel address ranges
  Internal error: Oops: 96000044 [#1] PREEMPT SMP
  Modules linked in: scmi_module(-)
  CPU: 1 PID: 2212 Comm: rmmod Not tainted 5.10.0-rc5 #31
  Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno
  	Development Platform, BIOS EDK II Nov 19 2020
  pstate: 20000085 (nzCv daIf -PAN -UAO -TCO BTYPE=--)
  pc : release_nodes+0x74/0x230
  lr : devres_release_all+0x40/0x68
  Call trace:
   release_nodes+0x74/0x230
   devres_release_all+0x40/0x68
   device_release_driver_internal+0x12c/0x1f8
   driver_detach+0x58/0xe8
   bus_remove_driver+0x64/0xe0
   driver_unregister+0x38/0x68
   platform_driver_unregister+0x1c/0x28
   scmi_driver_exit+0x38/0x44 [scmi_module]
   __arm64_sys_delete_module+0x188/0x260
   el0_svc_common.constprop.0+0x80/0x1a8
   do_el0_svc+0x2c/0x98
   el0_sync_handler+0x160/0x168
   el0_sync+0x174/0x180
  Code: 1400000d eb07009f 54000460 f9400486 (f90004a6)
  ---[ end trace c55ffd306c140233 ]---

Fix it by replacing kfree with devm_kfree as required.

Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
Reported-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Tested-by: Cristian Marussi <cristian.marussi@arm.com>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/arm_mhu_db.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/arm_mhu_db.c b/drivers/mailbox/arm_mhu_db.c
index 275efe4cca0c2..8eb66c4ecf5bf 100644
--- a/drivers/mailbox/arm_mhu_db.c
+++ b/drivers/mailbox/arm_mhu_db.c
@@ -180,7 +180,7 @@ static void mhu_db_shutdown(struct mbox_chan *chan)
 
 	/* Reset channel */
 	mhu_db_mbox_clear_irq(chan);
-	kfree(chan->con_priv);
+	devm_kfree(mbox->dev, chan->con_priv);
 	chan->con_priv = NULL;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 254/717] soundwire: master: use pm_runtime_set_active() on add
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 253/717] mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 255/717] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
                   ` (464 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pierre-Louis Bossart, Rander Wang,
	Bard Liao, Vinod Koul, Sasha Levin

From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>

[ Upstream commit e04e60fce47e61743a8726d76b0149c1f4ad8957 ]

The 'master' device acts as a glue layer used during bus
initialization only, and it needs to be 'transparent' for pm_runtime
management. Its behavior should be that it becomes active when one of
its children becomes active, and suspends when all of its children are
suspended.

In our tests on Intel platforms, we routinely see these sort of
warnings on the initial boot:

[ 21.447345] rt715 sdw:3:25d:715:0: runtime PM trying to activate
child device sdw:3:25d:715:0 but parent (sdw-master-3) is not active

This is root-caused to a missing setup to make the device 'active' on
probe. Since we don't want the device to remain active forever after
the probe, the autosuspend configuration is also enabled at the end of
the probe - the device will actually autosuspend only in the case
where there are no devices physically attached. In practice, the
master device will suspend when all its children are no longer active.

Fixes: bd84256e86ecf ('soundwire: master: enable pm runtime')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20201124130742.10986-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/master.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/soundwire/master.c b/drivers/soundwire/master.c
index 3488bb824e845..9b05c9e25ebe4 100644
--- a/drivers/soundwire/master.c
+++ b/drivers/soundwire/master.c
@@ -8,6 +8,15 @@
 #include <linux/soundwire/sdw_type.h>
 #include "bus.h"
 
+/*
+ * The 3s value for autosuspend will only be used if there are no
+ * devices physically attached on a bus segment. In practice enabling
+ * the bus operation will result in children devices become active and
+ * the master device will only suspend when all its children are no
+ * longer active.
+ */
+#define SDW_MASTER_SUSPEND_DELAY_MS 3000
+
 /*
  * The sysfs for properties reflects the MIPI description as given
  * in the MIPI DisCo spec
@@ -154,7 +163,12 @@ int sdw_master_device_add(struct sdw_bus *bus, struct device *parent,
 	bus->dev = &md->dev;
 	bus->md = md;
 
+	pm_runtime_set_autosuspend_delay(&bus->md->dev, SDW_MASTER_SUSPEND_DELAY_MS);
+	pm_runtime_use_autosuspend(&bus->md->dev);
+	pm_runtime_mark_last_busy(&bus->md->dev);
+	pm_runtime_set_active(&bus->md->dev);
 	pm_runtime_enable(&bus->md->dev);
+	pm_runtime_idle(&bus->md->dev);
 device_register_err:
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 255/717] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 254/717] soundwire: master: use pm_runtime_set_active() on add Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 256/717] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width Greg Kroah-Hartman
                   ` (463 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mario Limonciello, Hans de Goede, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]

Fix to return the error code -ENODEV when fails to init wmi and
smm.

Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/dell-smbios-base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
index 2e2cd565926aa..3a1dbf1994413 100644
--- a/drivers/platform/x86/dell-smbios-base.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -594,6 +594,7 @@ static int __init dell_smbios_init(void)
 	if (wmi && smm) {
 		pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
 			wmi, smm);
+		ret = -ENODEV;
 		goto fail_create_group;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 256/717] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 255/717] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 257/717] media: max9271: Fix GPIO enable/disable Greg Kroah-Hartman
                   ` (462 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sathyanarayana Nujella,
	Pierre-Louis Bossart, Ranjani Sridharan, Mark Brown, Sasha Levin

From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>

[ Upstream commit 0d7f2459ae926a964ab211aac413d72074131727 ]

Speaker amp's SSP bclk configuration was changed in the topology file to be
based on 12.288MHz and dai_ops->hw_params is based on s32le format.
But, the TDM slot size remained set to 24 bits.
This inconsistency created audible noises and needs to be corrected.
This patch updates TDM slot width to 32.

Fixes: bc7477fc2ab4 ("ASoC: Intel: Boards: tgl_max98373: Update TDM configuration in hw_params")

Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201201211150.433472-1-ranjani.sridharan@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/sof_maxim_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/boards/sof_maxim_common.c b/sound/soc/intel/boards/sof_maxim_common.c
index b6e63ea13d64e..c2a9757181fe1 100644
--- a/sound/soc/intel/boards/sof_maxim_common.c
+++ b/sound/soc/intel/boards/sof_maxim_common.c
@@ -49,11 +49,11 @@ static int max98373_hw_params(struct snd_pcm_substream *substream,
 	for_each_rtd_codec_dais(rtd, j, codec_dai) {
 		if (!strcmp(codec_dai->component->name, MAX_98373_DEV0_NAME)) {
 			/* DEV0 tdm slot configuration */
-			snd_soc_dai_set_tdm_slot(codec_dai, 0x03, 3, 8, 24);
+			snd_soc_dai_set_tdm_slot(codec_dai, 0x03, 3, 8, 32);
 		}
 		if (!strcmp(codec_dai->component->name, MAX_98373_DEV1_NAME)) {
 			/* DEV1 tdm slot configuration */
-			snd_soc_dai_set_tdm_slot(codec_dai, 0x0C, 3, 8, 24);
+			snd_soc_dai_set_tdm_slot(codec_dai, 0x0C, 3, 8, 32);
 		}
 	}
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 257/717] media: max9271: Fix GPIO enable/disable
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 256/717] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 258/717] media: rdacm20: Enable GPIO1 explicitly Greg Kroah-Hartman
                   ` (461 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Geert Uytterhoeven,
	Kieran Bingham, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit 909a0a189c677307edd461e21fd962784370d27f ]

Fix GPIO enable/disable operations which wrongly read the 0x0f register
to obtain the current mask of the enabled lines instead of using
the correct 0x0e register.

Also fix access to bit 0 of the register which is marked as reserved.

Fixes: 34009bffc1c6 ("media: i2c: Add RDACM20 driver")
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/max9271.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/i2c/max9271.c b/drivers/media/i2c/max9271.c
index 0f6f7a092a463..c247db569bab0 100644
--- a/drivers/media/i2c/max9271.c
+++ b/drivers/media/i2c/max9271.c
@@ -223,12 +223,12 @@ int max9271_enable_gpios(struct max9271_device *dev, u8 gpio_mask)
 {
 	int ret;
 
-	ret = max9271_read(dev, 0x0f);
+	ret = max9271_read(dev, 0x0e);
 	if (ret < 0)
 		return 0;
 
 	/* BIT(0) reserved: GPO is always enabled. */
-	ret |= gpio_mask | BIT(0);
+	ret |= (gpio_mask & ~BIT(0));
 	ret = max9271_write(dev, 0x0e, ret);
 	if (ret < 0) {
 		dev_err(&dev->client->dev, "Failed to enable gpio (%d)\n", ret);
@@ -245,12 +245,12 @@ int max9271_disable_gpios(struct max9271_device *dev, u8 gpio_mask)
 {
 	int ret;
 
-	ret = max9271_read(dev, 0x0f);
+	ret = max9271_read(dev, 0x0e);
 	if (ret < 0)
 		return 0;
 
 	/* BIT(0) reserved: GPO cannot be disabled */
-	ret &= (~gpio_mask | BIT(0));
+	ret &= ~(gpio_mask | BIT(0));
 	ret = max9271_write(dev, 0x0e, ret);
 	if (ret < 0) {
 		dev_err(&dev->client->dev, "Failed to disable gpio (%d)\n", ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 258/717] media: rdacm20: Enable GPIO1 explicitly
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 257/717] media: max9271: Fix GPIO enable/disable Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 259/717] media: i2c: imx219: Selection compliance fixes Greg Kroah-Hartman
                   ` (460 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Kieran Bingham,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit 7fe1d4453fb6bf103d668a19d957a7b2fc21887c ]

The MAX9271 GPIO1 line that controls the sensor reset is by default
enabled after a serializer chip reset.

As rdacm20 does not go through an explicit serializer reset, make sure
GPIO1 is enabled to make the camera module driver more robust.

Fixes: 34009bffc1c6 ("media: i2c: Add RDACM20 driver")
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/rdacm20.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/media/i2c/rdacm20.c b/drivers/media/i2c/rdacm20.c
index 1ed928c4ca70f..16bcb764b0e0d 100644
--- a/drivers/media/i2c/rdacm20.c
+++ b/drivers/media/i2c/rdacm20.c
@@ -487,9 +487,18 @@ static int rdacm20_initialize(struct rdacm20_device *dev)
 	 * Reset the sensor by cycling the OV10635 reset signal connected to the
 	 * MAX9271 GPIO1 and verify communication with the OV10635.
 	 */
-	max9271_clear_gpios(dev->serializer, MAX9271_GPIO1OUT);
+	ret = max9271_enable_gpios(dev->serializer, MAX9271_GPIO1OUT);
+	if (ret)
+		return ret;
+
+	ret = max9271_clear_gpios(dev->serializer, MAX9271_GPIO1OUT);
+	if (ret)
+		return ret;
 	usleep_range(10000, 15000);
-	max9271_set_gpios(dev->serializer, MAX9271_GPIO1OUT);
+
+	ret = max9271_set_gpios(dev->serializer, MAX9271_GPIO1OUT);
+	if (ret)
+		return ret;
 	usleep_range(10000, 15000);
 
 again:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 259/717] media: i2c: imx219: Selection compliance fixes
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 258/717] media: rdacm20: Enable GPIO1 explicitly Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 260/717] ath11k: Dont cast ath11k_skb_cb to ieee80211_tx_info.control Greg Kroah-Hartman
                   ` (459 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Jacopo Mondi,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Hans Verkuil <hverkuil-cisco@xs4all.nl>

[ Upstream commit 1ed36ecd1459b653cced8929bfb37dba94b64c5d ]

To comply with the intended usage of the V4L2 selection target when
used to retrieve a sensor image properties, adjust the rectangles
returned by the imx219 driver.

The top/left crop coordinates of the TGT_CROP rectangle were set to
(0, 0) instead of (8, 8) which is the offset from the larger physical
pixel array rectangle. This was also a mismatch with the default values
crop rectangle value, so this is corrected. Found with v4l2-compliance.

While at it, add V4L2_SEL_TGT_CROP_BOUNDS support: CROP_DEFAULT and
CROP_BOUNDS have the same size as the non-active pixels are not readable
using the selection API. Found with v4l2-compliance.

[reword commit message, use macros for pixel offsets]

Fixes: e6d4ef7d58aa7 ("media: i2c: imx219: Implement get_selection")
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/imx219.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index 1cee45e353554..0ae66091a6962 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -473,8 +473,8 @@ static const struct imx219_mode supported_modes[] = {
 		.width = 3280,
 		.height = 2464,
 		.crop = {
-			.left = 0,
-			.top = 0,
+			.left = IMX219_PIXEL_ARRAY_LEFT,
+			.top = IMX219_PIXEL_ARRAY_TOP,
 			.width = 3280,
 			.height = 2464
 		},
@@ -489,8 +489,8 @@ static const struct imx219_mode supported_modes[] = {
 		.width = 1920,
 		.height = 1080,
 		.crop = {
-			.left = 680,
-			.top = 692,
+			.left = 688,
+			.top = 700,
 			.width = 1920,
 			.height = 1080
 		},
@@ -505,8 +505,8 @@ static const struct imx219_mode supported_modes[] = {
 		.width = 1640,
 		.height = 1232,
 		.crop = {
-			.left = 0,
-			.top = 0,
+			.left = IMX219_PIXEL_ARRAY_LEFT,
+			.top = IMX219_PIXEL_ARRAY_TOP,
 			.width = 3280,
 			.height = 2464
 		},
@@ -521,8 +521,8 @@ static const struct imx219_mode supported_modes[] = {
 		.width = 640,
 		.height = 480,
 		.crop = {
-			.left = 1000,
-			.top = 752,
+			.left = 1008,
+			.top = 760,
 			.width = 1280,
 			.height = 960
 		},
@@ -1008,6 +1008,7 @@ static int imx219_get_selection(struct v4l2_subdev *sd,
 		return 0;
 
 	case V4L2_SEL_TGT_CROP_DEFAULT:
+	case V4L2_SEL_TGT_CROP_BOUNDS:
 		sel->r.top = IMX219_PIXEL_ARRAY_TOP;
 		sel->r.left = IMX219_PIXEL_ARRAY_LEFT;
 		sel->r.width = IMX219_PIXEL_ARRAY_WIDTH;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 260/717] ath11k: Dont cast ath11k_skb_cb to ieee80211_tx_info.control
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 259/717] media: i2c: imx219: Selection compliance fixes Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 261/717] ath11k: Reset ath11k_skb_cb before setting new flags Greg Kroah-Hartman
                   ` (458 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit f4d291b43f809b74c66b21f5190cd578af43070b ]

The driver_data area of ieee80211_tx_info is used in ath11k for
ath11k_skb_cb. The first function in the TX patch which rewrites it to
ath11k_skb_cb is already ath11k_mac_op_tx. No one else in the code path
must use it for something else before it reinitializes it. Otherwise the
data has to be considered uninitialized or corrupt.

But the ieee80211_tx_info.control shares exactly the same area as
ieee80211_tx_info.driver_data and ath11k is still using it. This results in
best case in a

  ath11k c000000.wifi1: no vif found for mgmt frame, flags 0x0

or (slightly worse) in a kernel oops.

Instead, the interesting data must be moved first into the ath11k_skb_cb
and ieee80211_tx_info.control must then not be used anymore.

Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119154235.263250-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/core.h  |  2 ++
 drivers/net/wireless/ath/ath11k/dp_tx.c |  5 ++---
 drivers/net/wireless/ath/ath11k/mac.c   | 26 ++++++++++++++++---------
 3 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
index 18b97420f0d8a..5a7915f75e1e2 100644
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -75,12 +75,14 @@ static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
 
 enum ath11k_skb_flags {
 	ATH11K_SKB_HW_80211_ENCAP = BIT(0),
+	ATH11K_SKB_CIPHER_SET = BIT(1),
 };
 
 struct ath11k_skb_cb {
 	dma_addr_t paddr;
 	u8 eid;
 	u8 flags;
+	u32 cipher;
 	struct ath11k *ar;
 	struct ieee80211_vif *vif;
 } __packed;
diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
index 3d962eee4d61d..21dfd08d3debb 100644
--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
@@ -84,7 +84,6 @@ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
 	struct ath11k_dp *dp = &ab->dp;
 	struct hal_tx_info ti = {0};
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-	struct ieee80211_key_conf *key = info->control.hw_key;
 	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
 	struct hal_srng *tcl_ring;
 	struct ieee80211_hdr *hdr = (void *)skb->data;
@@ -149,9 +148,9 @@ tcl_ring_sel:
 	ti.meta_data_flags = arvif->tcl_metadata;
 
 	if (ti.encap_type == HAL_TCL_ENCAP_TYPE_RAW) {
-		if (key) {
+		if (skb_cb->flags & ATH11K_SKB_CIPHER_SET) {
 			ti.encrypt_type =
-				ath11k_dp_tx_get_encrypt_type(key->cipher);
+				ath11k_dp_tx_get_encrypt_type(skb_cb->cipher);
 
 			if (ieee80211_has_protected(hdr->frame_control))
 				skb_put(skb, IEEE80211_CCMP_MIC_LEN);
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index f5e49e1c11ed7..6b7f00e0086f5 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -3977,21 +3977,20 @@ static void ath11k_mgmt_over_wmi_tx_purge(struct ath11k *ar)
 static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work)
 {
 	struct ath11k *ar = container_of(work, struct ath11k, wmi_mgmt_tx_work);
-	struct ieee80211_tx_info *info;
+	struct ath11k_skb_cb *skb_cb;
 	struct ath11k_vif *arvif;
 	struct sk_buff *skb;
 	int ret;
 
 	while ((skb = skb_dequeue(&ar->wmi_mgmt_tx_queue)) != NULL) {
-		info = IEEE80211_SKB_CB(skb);
-		if (!info->control.vif) {
-			ath11k_warn(ar->ab, "no vif found for mgmt frame, flags 0x%x\n",
-				    info->control.flags);
+		skb_cb = ATH11K_SKB_CB(skb);
+		if (!skb_cb->vif) {
+			ath11k_warn(ar->ab, "no vif found for mgmt frame\n");
 			ieee80211_free_txskb(ar->hw, skb);
 			continue;
 		}
 
-		arvif = ath11k_vif_to_arvif(info->control.vif);
+		arvif = ath11k_vif_to_arvif(skb_cb->vif);
 		if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) &&
 		    arvif->is_started) {
 			ret = ath11k_mac_mgmt_tx_wmi(ar, arvif, skb);
@@ -4004,8 +4003,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work)
 			}
 		} else {
 			ath11k_warn(ar->ab,
-				    "dropping mgmt frame for vdev %d, flags 0x%x is_started %d\n",
-				    arvif->vdev_id, info->control.flags,
+				    "dropping mgmt frame for vdev %d, is_started %d\n",
+				    arvif->vdev_id,
 				    arvif->is_started);
 			ieee80211_free_txskb(ar->hw, skb);
 		}
@@ -4053,10 +4052,19 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
 	struct ieee80211_vif *vif = info->control.vif;
 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+	struct ieee80211_key_conf *key = info->control.hw_key;
+	u32 info_flags = info->flags;
 	bool is_prb_rsp;
 	int ret;
 
-	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+	skb_cb->vif = vif;
+
+	if (key) {
+		skb_cb->cipher = key->cipher;
+		skb_cb->flags |= ATH11K_SKB_CIPHER_SET;
+	}
+
+	if (info_flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
 		skb_cb->flags |= ATH11K_SKB_HW_80211_ENCAP;
 	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
 		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 261/717] ath11k: Reset ath11k_skb_cb before setting new flags
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 260/717] ath11k: Dont cast ath11k_skb_cb to ieee80211_tx_info.control Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 262/717] ath11k: Fix an error handling path Greg Kroah-Hartman
                   ` (457 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 5da7acfec5ec55aa0b69b8760f1d2116b4e2ad26 ]

It was observed that the codepath for the ATH11K_SKB_HW_80211_ENCAP was
used even when the IEEE80211_TX_CTRL_HW_80211_ENCAP was not enabled for a
an skbuff. This became even more prominent when the QCAs wlan-open patchset
for ath11k [1] was applied and a sane looking fix just caused crashes when
injecting frames via a monitor interface (for example with ratechecker):

  [   86.963152] Unable to handle kernel NULL pointer dereference at virtual address 00000338
  [   86.963192] pgd = ffffffc0008f0000
  [   86.971034] [00000338] *pgd=0000000051706003, *pud=0000000051706003, *pmd=0000000051707003, *pte=00e800000b000707
  [   86.984292] Internal error: Oops: 96000006 [#1] PREEMPT SMP
  [...]
  [   87.713339] [<ffffffbffc802480>] ieee80211_tx_status_8023+0xf8/0x220 [mac80211]
  [   87.715654] [<ffffffbffc98bad4>] ath11k_dp_tx_completion_handler+0x42c/0xa10 [ath11k]
  [   87.722924] [<ffffffbffc989190>] ath11k_dp_service_srng+0x70/0x3c8 [ath11k]
  [   87.730831] [<ffffffbffca03460>] 0xffffffbffca03460
  [   87.737599] [<ffffffc00046ef58>] net_rx_action+0xf8/0x288
  [   87.742462] [<ffffffc000097554>] __do_softirq+0xfc/0x220
  [   87.748014] [<ffffffc000097900>] irq_exit+0x98/0xe8
  [   87.753396] [<ffffffc0000cf188>] __handle_domain_irq+0x90/0xb8
  [   87.757999] [<ffffffc000081ca4>] gic_handle_irq+0x6c/0xc8
  [   87.763899] Exception stack(0xffffffc00081bdc0 to 0xffffffc00081bef0)

Problem is that the state of ath11k_skb_cb->flags must be considered
unknown and could contain anything when it is not manually initialized. So
it could also contain ATH11K_SKB_HW_80211_ENCAP. And this can result in the
code to assume that the ath11k_skb_cb->vif is set - even when this is not
always the case for non ATH11K_SKB_HW_80211_ENCAP transmissions.

Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2

[1] https://source.codeaurora.org/quic/qsdk/oss/system/feeds/wlan-open/tree/mac80211/patches?h=NHSS.QSDK.11.4.r3
    (162 patches at the moment which are often not upstreamed but essential
     to get ath11k working)

Fixes: e7f33e0c52c0 ("ath11k: add tx hw 802.11 encapsulation offloading support")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119154235.263250-2-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 6b7f00e0086f5..af427d9051a07 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -4057,6 +4057,7 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
 	bool is_prb_rsp;
 	int ret;
 
+	memset(skb_cb, 0, sizeof(*skb_cb));
 	skb_cb->vif = vif;
 
 	if (key) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 262/717] ath11k: Fix an error handling path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 261/717] ath11k: Reset ath11k_skb_cb before setting new flags Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 263/717] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
                   ` (456 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit e7bcc145bcd035e56da7b97b033c463b32a5ff80 ]

If 'kzalloc' fails, we must return an error code.

While at it, remove a useless initialization of 'err' which could hide the
issue.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122173943.1366167-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/qmi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
index c2b1651582259..99a88ca83deaa 100644
--- a/drivers/net/wireless/ath/ath11k/qmi.c
+++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -1585,15 +1585,17 @@ static int ath11k_qmi_fw_ind_register_send(struct ath11k_base *ab)
 	struct qmi_wlanfw_ind_register_resp_msg_v01 *resp;
 	struct qmi_handle *handle = &ab->qmi.handle;
 	struct qmi_txn txn;
-	int ret = 0;
+	int ret;
 
 	req = kzalloc(sizeof(*req), GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;
 
 	resp = kzalloc(sizeof(*resp), GFP_KERNEL);
-	if (!resp)
+	if (!resp) {
+		ret = -ENOMEM;
 		goto resp_out;
+	}
 
 	req->client_id_valid = 1;
 	req->client_id = QMI_WLANFW_CLIENT_ID;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 263/717] ath10k: Fix the parsing error in service available event
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 262/717] ath11k: Fix an error handling path Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 264/717] ath10k: Fix an error handling path Greg Kroah-Hartman
                   ` (455 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Douglas Anderson,
	Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]

The wmi service available event has been
extended to contain extra 128 bit for new services
to be indicated by firmware.

Currently the presence of any optional TLVs in
the wmi service available event leads to a parsing
error with the below error message:
ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71

The wmi service available event parsing should
not return error for the newly added optional TLV.
Fix this parsing for service available event message.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1

Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
 drivers/net/wireless/ath/ath10k/wmi.c     | 9 +++++++--
 drivers/net/wireless/ath/ath10k/wmi.h     | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 932266d1111bd..7b5834157fe51 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -1401,13 +1401,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
 
 	switch (tag) {
 	case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
+		arg->service_map_ext_valid = true;
 		arg->service_map_ext_len = *(__le32 *)ptr;
 		arg->service_map_ext = ptr + sizeof(__le32);
 		return 0;
 	default:
 		break;
 	}
-	return -EPROTO;
+
+	return 0;
 }
 
 static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 1fa7107a50515..37b53af760d76 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -5751,8 +5751,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
 			    ret);
 	}
 
-	ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
-			       __le32_to_cpu(arg.service_map_ext_len));
+	/*
+	 * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
+	 * for the below logic to work.
+	 */
+	if (arg.service_map_ext_valid)
+		ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+				       __le32_to_cpu(arg.service_map_ext_len));
 }
 
 static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 4898e19b0af65..66ecf09068c19 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6917,6 +6917,7 @@ struct wmi_svc_rdy_ev_arg {
 };
 
 struct wmi_svc_avail_ev_arg {
+	bool service_map_ext_valid;
 	__le32 service_map_ext_len;
 	const __le32 *service_map_ext;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 264/717] ath10k: Fix an error handling path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 263/717] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 265/717] ath10k: Release some resources in " Greg Kroah-Hartman
                   ` (454 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]

If 'ath10k_usb_create()' fails, we should release some resources and report
an error instead of silently continuing.

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 05a620ff6fe2c..0b47c3a09794c 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -997,6 +997,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	ar_usb = ath10k_usb_priv(ar);
 	ret = ath10k_usb_create(ar, interface);
+	if (ret)
+		goto err;
 	ar_usb->ar = ar;
 
 	ar->dev_id = product_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 265/717] ath10k: Release some resources in an error handling path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 264/717] ath10k: Fix an error handling path Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 266/717] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
                   ` (453 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]

Should an error occur after calling 'ath10k_usb_create()', it should be
undone by a corresponding 'ath10k_usb_destroy()' call

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 0b47c3a09794c..19b9c27e30e20 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1011,7 +1011,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 	ret = ath10k_core_register(ar, &bus_params);
 	if (ret) {
 		ath10k_warn(ar, "failed to register driver core: %d\n", ret);
-		goto err;
+		goto err_usb_destroy;
 	}
 
 	/* TODO: remove this once USB support is fully implemented */
@@ -1019,6 +1019,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	return 0;
 
+err_usb_destroy:
+	ath10k_usb_destroy(ar);
+
 err:
 	ath10k_core_destroy(ar);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 266/717] SUNRPC: rpc_wake_up() should wake up tasks in the correct order
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 265/717] ath10k: Release some resources in " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 267/717] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
                   ` (452 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit e4c72201b6ec3173dfe13fa2e2335a3ad78d4921 ]

Currently, we wake up the tasks by priority queue ordering, which means
that we ignore the batching that is supposed to help with QoS issues.

Fixes: c049f8ea9a0d ("SUNRPC: Remove the bh-safe lock requirement on the rpc_wait_queue->lock")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/sched.c | 65 +++++++++++++++++++++++++---------------------
 1 file changed, 35 insertions(+), 30 deletions(-)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index f06d7c315017c..cf702a5f7fe5d 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -675,6 +675,23 @@ struct rpc_task *rpc_wake_up_next(struct rpc_wait_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_next);
 
+/**
+ * rpc_wake_up_locked - wake up all rpc_tasks
+ * @queue: rpc_wait_queue on which the tasks are sleeping
+ *
+ */
+static void rpc_wake_up_locked(struct rpc_wait_queue *queue)
+{
+	struct rpc_task *task;
+
+	for (;;) {
+		task = __rpc_find_next_queued(queue);
+		if (task == NULL)
+			break;
+		rpc_wake_up_task_queue_locked(queue, task);
+	}
+}
+
 /**
  * rpc_wake_up - wake up all rpc_tasks
  * @queue: rpc_wait_queue on which the tasks are sleeping
@@ -683,25 +700,28 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-	struct list_head *head;
-
 	spin_lock(&queue->lock);
-	head = &queue->tasks[queue->maxpriority];
+	rpc_wake_up_locked(queue);
+	spin_unlock(&queue->lock);
+}
+EXPORT_SYMBOL_GPL(rpc_wake_up);
+
+/**
+ * rpc_wake_up_status_locked - wake up all rpc_tasks and set their status value.
+ * @queue: rpc_wait_queue on which the tasks are sleeping
+ * @status: status value to set
+ */
+static void rpc_wake_up_status_locked(struct rpc_wait_queue *queue, int status)
+{
+	struct rpc_task *task;
+
 	for (;;) {
-		while (!list_empty(head)) {
-			struct rpc_task *task;
-			task = list_first_entry(head,
-					struct rpc_task,
-					u.tk_wait.list);
-			rpc_wake_up_task_queue_locked(queue, task);
-		}
-		if (head == &queue->tasks[0])
+		task = __rpc_find_next_queued(queue);
+		if (task == NULL)
 			break;
-		head--;
+		rpc_wake_up_task_queue_set_status_locked(queue, task, status);
 	}
-	spin_unlock(&queue->lock);
 }
-EXPORT_SYMBOL_GPL(rpc_wake_up);
 
 /**
  * rpc_wake_up_status - wake up all rpc_tasks and set their status value.
@@ -712,23 +732,8 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
-	struct list_head *head;
-
 	spin_lock(&queue->lock);
-	head = &queue->tasks[queue->maxpriority];
-	for (;;) {
-		while (!list_empty(head)) {
-			struct rpc_task *task;
-			task = list_first_entry(head,
-					struct rpc_task,
-					u.tk_wait.list);
-			task->tk_status = status;
-			rpc_wake_up_task_queue_locked(queue, task);
-		}
-		if (head == &queue->tasks[0])
-			break;
-		head--;
-	}
+	rpc_wake_up_status_locked(queue, status);
 	spin_unlock(&queue->lock);
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_status);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 267/717] NFSv4.2: condition READDIRs mask for security label based on LSM state
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 266/717] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 268/717] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
                   ` (451 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Mosnacek, Scott Mayhew,
	Olga Kornievskaia, Trond Myklebust, Sasha Levin

From: Olga Kornievskaia <kolga@netapp.com>

[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]

Currently, the client will always ask for security_labels if the server
returns that it supports that feature regardless of any LSM modules
(such as Selinux) enforcing security policy. This adds performance
penalty to the READDIR operation.

Client adjusts superblock's support of the security_label based on
the server's support but also current client's configuration of the
LSM modules. Thus, prior to using the default bitmask in READDIR,
this patch checks the server's capabilities and then instructs
READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.

v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.

Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
Suggested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index e89468678ae16..6858b4bb556d5 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4961,12 +4961,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
 		u64 cookie, struct page **pages, unsigned int count, bool plus)
 {
 	struct inode		*dir = d_inode(dentry);
+	struct nfs_server	*server = NFS_SERVER(dir);
 	struct nfs4_readdir_arg args = {
 		.fh = NFS_FH(dir),
 		.pages = pages,
 		.pgbase = 0,
 		.count = count,
-		.bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
 		.plus = plus,
 	};
 	struct nfs4_readdir_res res;
@@ -4981,9 +4981,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
 	dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
 			dentry,
 			(unsigned long long)cookie);
+	if (!(server->caps & NFS_CAP_SECURITY_LABEL))
+		args.bitmask = server->attr_bitmask_nl;
+	else
+		args.bitmask = server->attr_bitmask;
+
 	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
 	res.pgbase = args.pgbase;
-	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
+			&res.seq_res, 0);
 	if (status >= 0) {
 		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
 		status += args.pgbase;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 268/717] SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 267/717] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 269/717] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
                   ` (450 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]

According to RFC5666, the correct netid for an IPv6 addressed RDMA
transport is "rdma6", which we've supported as a mount option since
Linux-4.7. The problem is when we try to load the module "xprtrdma6",
that will fail, since there is no modulealias of that name.

Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xprt.h     |  1 +
 net/sunrpc/xprt.c               | 65 +++++++++++++++++++++++++--------
 net/sunrpc/xprtrdma/module.c    |  1 +
 net/sunrpc/xprtrdma/transport.c |  1 +
 net/sunrpc/xprtsock.c           |  4 ++
 5 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index a603d48d2b2cd..3ac5037d1c3da 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -330,6 +330,7 @@ struct xprt_class {
 	struct rpc_xprt *	(*setup)(struct xprt_create *);
 	struct module		*owner;
 	char			name[32];
+	const char *		netid[];
 };
 
 /*
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index f6c17e75f20ed..57f09ea3ef2af 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -151,31 +151,64 @@ out:
 }
 EXPORT_SYMBOL_GPL(xprt_unregister_transport);
 
+static void
+xprt_class_release(const struct xprt_class *t)
+{
+	module_put(t->owner);
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid_locked(const char *netid)
+{
+	const struct xprt_class *t;
+	unsigned int i;
+
+	list_for_each_entry(t, &xprt_list, list) {
+		for (i = 0; t->netid[i][0] != '\0'; i++) {
+			if (strcmp(t->netid[i], netid) != 0)
+				continue;
+			if (!try_module_get(t->owner))
+				continue;
+			return t;
+		}
+	}
+	return NULL;
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid(const char *netid)
+{
+	const struct xprt_class *t;
+
+	spin_lock(&xprt_list_lock);
+	t = xprt_class_find_by_netid_locked(netid);
+	if (!t) {
+		spin_unlock(&xprt_list_lock);
+		request_module("rpc%s", netid);
+		spin_lock(&xprt_list_lock);
+		t = xprt_class_find_by_netid_locked(netid);
+	}
+	spin_unlock(&xprt_list_lock);
+	return t;
+}
+
 /**
  * xprt_load_transport - load a transport implementation
- * @transport_name: transport to load
+ * @netid: transport to load
  *
  * Returns:
  * 0:		transport successfully loaded
  * -ENOENT:	transport module not available
  */
-int xprt_load_transport(const char *transport_name)
+int xprt_load_transport(const char *netid)
 {
-	struct xprt_class *t;
-	int result;
+	const struct xprt_class *t;
 
-	result = 0;
-	spin_lock(&xprt_list_lock);
-	list_for_each_entry(t, &xprt_list, list) {
-		if (strcmp(t->name, transport_name) == 0) {
-			spin_unlock(&xprt_list_lock);
-			goto out;
-		}
-	}
-	spin_unlock(&xprt_list_lock);
-	result = request_module("xprt%s", transport_name);
-out:
-	return result;
+	t = xprt_class_find_by_netid(netid);
+	if (!t)
+		return -ENOENT;
+	xprt_class_release(t);
+	return 0;
 }
 EXPORT_SYMBOL_GPL(xprt_load_transport);
 
diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
index 620327c01302c..45c5b41ac8dc9 100644
--- a/net/sunrpc/xprtrdma/module.c
+++ b/net/sunrpc/xprtrdma/module.c
@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS("svcrdma");
 MODULE_ALIAS("xprtrdma");
+MODULE_ALIAS("rpcrdma6");
 
 static void __exit rpc_rdma_cleanup(void)
 {
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 8915e42240d38..035060c05fd5a 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -768,6 +768,7 @@ static struct xprt_class xprt_rdma = {
 	.owner			= THIS_MODULE,
 	.ident			= XPRT_TRANSPORT_RDMA,
 	.setup			= xprt_setup_rdma,
+	.netid			= { "rdma", "rdma6", "" },
 };
 
 void xprt_rdma_cleanup(void)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7090bbee0ec59..c93ff70da3f98 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3059,6 +3059,7 @@ static struct xprt_class	xs_local_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_LOCAL,
 	.setup		= xs_setup_local,
+	.netid		= { "" },
 };
 
 static struct xprt_class	xs_udp_transport = {
@@ -3067,6 +3068,7 @@ static struct xprt_class	xs_udp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_UDP,
 	.setup		= xs_setup_udp,
+	.netid		= { "udp", "udp6", "" },
 };
 
 static struct xprt_class	xs_tcp_transport = {
@@ -3075,6 +3077,7 @@ static struct xprt_class	xs_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_TCP,
 	.setup		= xs_setup_tcp,
+	.netid		= { "tcp", "tcp6", "" },
 };
 
 static struct xprt_class	xs_bc_tcp_transport = {
@@ -3083,6 +3086,7 @@ static struct xprt_class	xs_bc_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_BC_TCP,
 	.setup		= xs_setup_bc_tcp,
+	.netid		= { "" },
 };
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 269/717] NFSv4: Fix the alignment of page data in the getdeviceinfo reply
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 268/717] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 270/717] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
                   ` (449 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 046e5ccb4198b990190e11fb52fd9cfd264402eb ]

We can fit the device_addr4 opaque data padding in the pages.

Fixes: cf500bac8fd4 ("SUNRPC: Introduce rpc_prepare_reply_pages()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4xdr.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c6dbfcae75171..c16b93df1bc14 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3009,15 +3009,19 @@ static void nfs4_xdr_enc_getdeviceinfo(struct rpc_rqst *req,
 	struct compound_hdr hdr = {
 		.minorversion = nfs4_xdr_minorversion(&args->seq_args),
 	};
+	uint32_t replen;
 
 	encode_compound_hdr(xdr, req, &hdr);
 	encode_sequence(xdr, &args->seq_args, &hdr);
+
+	replen = hdr.replen + op_decode_hdr_maxsz;
+
 	encode_getdeviceinfo(xdr, args, &hdr);
 
-	/* set up reply kvec. Subtract notification bitmap max size (2)
-	 * so that notification bitmap is put in xdr_buf tail */
+	/* set up reply kvec. device_addr4 opaque data is read into the
+	 * pages */
 	rpc_prepare_reply_pages(req, args->pdev->pages, args->pdev->pgbase,
-				args->pdev->pglen, hdr.replen - 2);
+				args->pdev->pglen, replen + 2 + 1);
 	encode_nops(&hdr);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 270/717] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 269/717] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 271/717] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
                   ` (448 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fedor Tokarev, Trond Myklebust, Sasha Levin

From: Fedor Tokarev <ftokarev@gmail.com>

[ Upstream commit 35a6d396721e28ba161595b0fc9e8896c00399bb ]

'snprintf' returns the number of characters which would have been written
if enough space had been available, excluding the terminating null byte.
Thus, the return value of 'sizeof(buf)' means that the last character
has been dropped.

Signed-off-by: Fedor Tokarev <ftokarev@gmail.com>
Fixes: 2f34b8bfae19 ("SUNRPC: add links for all client xprts to debugfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
index fd9bca2427242..56029e3af6ff0 100644
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -128,13 +128,13 @@ static int do_xprt_debugfs(struct rpc_clnt *clnt, struct rpc_xprt *xprt, void *n
 		return 0;
 	len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
 		       xprt->debugfs->d_name.name);
-	if (len > sizeof(name))
+	if (len >= sizeof(name))
 		return -1;
 	if (*nump == 0)
 		strcpy(link, "xprt");
 	else {
 		len = snprintf(link, sizeof(link), "xprt%d", *nump);
-		if (len > sizeof(link))
+		if (len >= sizeof(link))
 			return -1;
 	}
 	debugfs_create_symlink(link, clnt->cl_debugfs, name);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 271/717] lockd: dont use interval-based rebinding over TCP
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 270/717] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 272/717] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
                   ` (447 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Calum Mackay, Trond Myklebust, Sasha Levin

From: Calum Mackay <calum.mackay@oracle.com>

[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]

NLM uses an interval-based rebinding, i.e. it clears the transport's
binding under certain conditions if more than 60 seconds have elapsed
since the connection was last bound.

This rebinding is not necessary for an autobind RPC client over a
connection-oriented protocol like TCP.

It can also cause problems: it is possible for nlm_bind_host() to clear
XPRT_BOUND whilst a connection worker is in the middle of trying to
reconnect, after it had already been checked in xprt_connect().

When the connection worker notices that XPRT_BOUND has been cleared
under it, in xs_tcp_finish_connecting(), that results in:

	xs_tcp_setup_socket: connect returned unhandled error -107

Worse, it's possible that the two can get into lockstep, resulting in
the same behaviour repeated indefinitely, with the above error every
300 seconds, without ever recovering, and the connection never being
established. This has been seen in practice, with a large number of NLM
client tasks, following a server restart.

The existing callers of nlm_bind_host & nlm_rebind_host should not need
to force the rebind, for TCP, so restrict the interval-based rebinding
to UDP only.

For TCP, we will still rebind when needed, e.g. on timeout, and connection
error (including closure), since connection-related errors on an existing
connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
already unconditionally clear XPRT_BOUND.

To avoid having to add the fix, and explanation, to both nlm_bind_host()
and nlm_rebind_host(), remove the duplicate code from the former, and
have it call the latter.

Drop the dprintk, which adds no value over a trace.

Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/host.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 0afb6d59bad03..771c289f6df7f 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -439,12 +439,7 @@ nlm_bind_host(struct nlm_host *host)
 	 * RPC rebind is required
 	 */
 	if ((clnt = host->h_rpcclnt) != NULL) {
-		if (time_after_eq(jiffies, host->h_nextrebind)) {
-			rpc_force_rebind(clnt);
-			host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-			dprintk("lockd: next rebind in %lu jiffies\n",
-					host->h_nextrebind - jiffies);
-		}
+		nlm_rebind_host(host);
 	} else {
 		unsigned long increment = nlmsvc_timeout;
 		struct rpc_timeout timeparms = {
@@ -494,13 +489,20 @@ nlm_bind_host(struct nlm_host *host)
 	return clnt;
 }
 
-/*
- * Force a portmap lookup of the remote lockd port
+/**
+ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
+ * @host: NLM host handle for peer
+ *
+ * This is not needed when using a connection-oriented protocol, such as TCP.
+ * The existing autobind mechanism is sufficient to force a rebind when
+ * required, e.g. on connection state transitions.
  */
 void
 nlm_rebind_host(struct nlm_host *host)
 {
-	dprintk("lockd: rebind host %s\n", host->h_name);
+	if (host->h_proto != IPPROTO_UDP)
+		return;
+
 	if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
 		rpc_force_rebind(host->h_rpcclnt);
 		host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 272/717] NFS: switch nfsiod to be an UNBOUND workqueue.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 271/717] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 273/717] selftests/seccomp: Update kernel config Greg Kroah-Hartman
                   ` (446 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, NeilBrown, Trond Myklebust, Sasha Levin

From: NeilBrown <neilb@suse.de>

[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]

nfsiod is currently a concurrency-managed workqueue (CMWQ).
This means that workitems scheduled to nfsiod on a given CPU are queued
behind all other work items queued on any CMWQ on the same CPU.  This
can introduce unexpected latency.

Occaionally nfsiod can even cause excessive latency.  If the work item
to complete a CLOSE request calls the final iput() on an inode, the
address_space of that inode will be dismantled.  This takes time
proportional to the number of in-memory pages, which on a large host
working on large files (e.g..  5TB), can be a large number of pages
resulting in a noticable number of seconds.

We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
This causes each concurrent work item to gets a dedicated thread which
can be scheduled to an idle CPU.

There is precedent for this as several other filesystems use WQ_UNBOUND
workqueue for handling various async events.

Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index aa6493905bbe8..43af053f467a7 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -2180,7 +2180,7 @@ static int nfsiod_start(void)
 {
 	struct workqueue_struct *wq;
 	dprintk("RPC:       creating workqueue nfsiod\n");
-	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
+	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
 	if (wq == NULL)
 		return -ENOMEM;
 	nfsiod_workqueue = wq;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 273/717] selftests/seccomp: Update kernel config
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 272/717] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 274/717] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
                   ` (445 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Shuah Khan,
	Mickaël Salaün, Tycho Andersen, Sasha Levin

From: Mickaël Salaün <mic@linux.microsoft.com>

[ Upstream commit 2c07343abd8932200a45ff7b10950e71081e9e77 ]

seccomp_bpf.c uses unshare(CLONE_NEWPID), which requires CONFIG_PID_NS
to be set.

Cc: Kees Cook <keescook@chromium.org>
Cc: Shuah Khan <shuah@kernel.org>
Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Acked-by: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201202162643.249276-1-mic@digikod.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/seccomp/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/seccomp/config b/tools/testing/selftests/seccomp/config
index 64c19d8eba795..ad431a5178fbe 100644
--- a/tools/testing/selftests/seccomp/config
+++ b/tools/testing/selftests/seccomp/config
@@ -1,3 +1,4 @@
+CONFIG_PID_NS=y
 CONFIG_SECCOMP=y
 CONFIG_SECCOMP_FILTER=y
 CONFIG_USER_NS=y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 274/717] vfio-pci: Use io_remap_pfn_range() for PCI IO memory
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 273/717] selftests/seccomp: Update kernel config Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 275/717] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
                   ` (444 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Peter Xu,
	Tom Lendacky, Alex Williamson, Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]

commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
BAR space into userspace to work correctly on AMD SME systems that default
to all memory encrypted.

Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
should be calling io_remap_pfn_range() otherwise it will not work on SME
systems.

Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index e6190173482c7..89e451615729a 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1635,8 +1635,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
 
 	mutex_unlock(&vdev->vma_lock);
 
-	if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-			    vma->vm_end - vma->vm_start, vma->vm_page_prot))
+	if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+			       vma->vm_end - vma->vm_start, vma->vm_page_prot))
 		ret = VM_FAULT_SIGBUS;
 
 up_out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 275/717] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 274/717] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 276/717] f2fs: fix double free of unicode map Greg Kroah-Hartman
                   ` (443 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Guenter Roeck, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit bce776f10069c806290eaac712ba73432ae8ecd7 ]

pm_runtime_get_sync will increment pm usage counter
even it failed. Forgetting to putting operation will
result in reference leak here. We fix it by replacing
it with pm_runtime_resume_and_get to keep usage counter
balanced. It depends on the mainline commit[PM: runtime:
Add pm_runtime_resume_and_get to deal with usagecounter].

Fixes: 323aeb0eb5d9a ("hwmon: (ina3221) Add PM runtime support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201202145320.1135614-1-zhangqilong3@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/ina3221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
index 41fb17e0d6416..ad11cbddc3a7b 100644
--- a/drivers/hwmon/ina3221.c
+++ b/drivers/hwmon/ina3221.c
@@ -489,7 +489,7 @@ static int ina3221_write_enable(struct device *dev, int channel, bool enable)
 
 	/* For enabling routine, increase refcount and resume() at first */
 	if (enable) {
-		ret = pm_runtime_get_sync(ina->pm_dev);
+		ret = pm_runtime_resume_and_get(ina->pm_dev);
 		if (ret < 0) {
 			dev_err(dev, "Failed to get PM runtime\n");
 			return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 276/717] f2fs: fix double free of unicode map
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 275/717] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 277/717] media: tvp5150: Fix wrong return value of tvp5150_parse_dt() Greg Kroah-Hartman
                   ` (442 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hyeongseok Kim, Chao Yu, Jaegeuk Kim,
	Sasha Levin

From: Hyeongseok Kim <hyeongseok@gmail.com>

[ Upstream commit 89ff6005039a878afac87889fee748fa3f957c3a ]

In case of retrying fill_super with skip_recovery,
s_encoding for casefold would not be loaded again even though it's
already been freed because it's not NULL.
Set NULL after free to prevent double freeing when unmount.

Fixes: eca4873ee1b6 ("f2fs: Use generic casefolding support")
Signed-off-by: Hyeongseok Kim <hyeongseok@gmail.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 00eff2f518079..fef22e476c526 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3918,6 +3918,7 @@ free_bio_info:
 
 #ifdef CONFIG_UNICODE
 	utf8_unload(sb->s_encoding);
+	sb->s_encoding = NULL;
 #endif
 free_options:
 #ifdef CONFIG_QUOTA
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 277/717] media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 276/717] f2fs: fix double free of unicode map Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 278/717] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
                   ` (441 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Xiaoxu,
	Marco Felsch, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>

[ Upstream commit eb08c48132a1f594478ab9fa2b6ee646c3513a49 ]

If of_graph_get_endpoint_by_regs() return NULL, it will return 0 rather
than an errno, because we doesn't initialize the return value.

Fixes: 0556f1d580d4 ("media: tvp5150: add input source selection of_graph support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tvp5150.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 7d9401219a3ac..3b3221fd3fe8f 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -2082,6 +2082,7 @@ static int tvp5150_parse_dt(struct tvp5150 *decoder, struct device_node *np)
 
 	ep_np = of_graph_get_endpoint_by_regs(np, TVP5150_PAD_VID_OUT, 0);
 	if (!ep_np) {
+		ret = -EINVAL;
 		dev_err(dev, "Error no output endpoint available\n");
 		goto err_free;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 278/717] media: saa7146: fix array overflow in vidioc_s_audio()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 277/717] media: tvp5150: Fix wrong return value of tvp5150_parse_dt() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 279/717] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
                   ` (440 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]

The "a->index" value comes from the user via the ioctl.  The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.

Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index 129a1f8ebe1ad..73fc901ecf3db 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -641,16 +641,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
 	struct mxb *mxb = (struct mxb *)dev->ext_priv;
 
 	DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
-	if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
-		if (mxb->cur_audinput != a->index) {
-			mxb->cur_audinput = a->index;
-			tea6420_route(mxb, a->index);
-			if (mxb->cur_audinput == 0)
-				mxb_update_audmode(mxb);
-		}
-		return 0;
+	if (a->index >= 32 ||
+	    !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+		return -EINVAL;
+
+	if (mxb->cur_audinput != a->index) {
+		mxb->cur_audinput = a->index;
+		tea6420_route(mxb, a->index);
+		if (mxb->cur_audinput == 0)
+			mxb_update_audmode(mxb);
 	}
-	return -EINVAL;
+	return 0;
 }
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 279/717] powerpc/perf: Fix crash with is_sier_available when pmu is not set
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 278/717] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 280/717] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
                   ` (439 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sachin Sant, Athira Rajeev,
	Michael Ellerman, Sasha Levin

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

[ Upstream commit f75e7d73bdf73f07b0701a6d21c111ef5d9021dd ]

On systems without any specific PMU driver support registered, running
'perf record' with —intr-regs  will crash ( perf record -I <workload> ).

The relevant portion from crash logs and Call Trace:

Unable to handle kernel paging request for data at address 0x00000068
Faulting instruction address: 0xc00000000013eb18
Oops: Kernel access of bad area, sig: 11 [#1]
CPU: 2 PID: 13435 Comm: kill Kdump: loaded Not tainted 4.18.0-193.el8.ppc64le #1
NIP:  c00000000013eb18 LR: c000000000139f2c CTR: c000000000393d80
REGS: c0000004a07ab4f0 TRAP: 0300   Not tainted  (4.18.0-193.el8.ppc64le)
NIP [c00000000013eb18] is_sier_available+0x18/0x30
LR [c000000000139f2c] perf_reg_value+0x6c/0xb0
Call Trace:
[c0000004a07ab770] [c0000004a07ab7c8] 0xc0000004a07ab7c8 (unreliable)
[c0000004a07ab7a0] [c0000000003aa77c] perf_output_sample+0x60c/0xac0
[c0000004a07ab840] [c0000000003ab3f0] perf_event_output_forward+0x70/0xb0
[c0000004a07ab8c0] [c00000000039e208] __perf_event_overflow+0x88/0x1a0
[c0000004a07ab910] [c00000000039e42c] perf_swevent_hrtimer+0x10c/0x1d0
[c0000004a07abc50] [c000000000228b9c] __hrtimer_run_queues+0x17c/0x480
[c0000004a07abcf0] [c00000000022aaf4] hrtimer_interrupt+0x144/0x520
[c0000004a07abdd0] [c00000000002a864] timer_interrupt+0x104/0x2f0
[c0000004a07abe30] [c0000000000091c4] decrementer_common+0x114/0x120

When perf record session is started with "-I" option, capturing registers
on each sample calls is_sier_available() to check for the
SIER (Sample Instruction Event Register) availability in the platform.
This function in core-book3s accesses 'ppmu->flags'. If a platform specific
PMU driver is not registered, ppmu is set to NULL and accessing its
members results in a crash. Fix the crash by returning false in
is_sier_available() if ppmu is not set.

Fixes: 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER")
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606185640-1720-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/core-book3s.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 08643cba14948..1de4770c2194b 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -137,6 +137,9 @@ static void pmao_restore_workaround(bool ebb) { }
 
 bool is_sier_available(void)
 {
+	if (!ppmu)
+		return false;
+
 	if (ppmu->flags & PPMU_HAS_SIER)
 		return true;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 280/717] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 279/717] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 281/717] powerpc/xmon: Fix build failure for 8xx Greg Kroah-Hartman
                   ` (438 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jordan Niethe, Michael Ellerman, Sasha Levin

From: Jordan Niethe <jniethe5@gmail.com>

[ Upstream commit fe18a35e685c9bdabc8b11b3e19deb85a068b75d ]

Commit 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard
trap") added an EMIT_BUG_ENTRY for the trap after the branch to
start_kernel(). The EMIT_BUG_ENTRY was for the address "0b", however the
trap was not labeled with "0". Hence the address used for bug is in
relative_toc() where the previous "0" label is. Label the trap as "0" so
the correct address is used.

Fixes: 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard trap")
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201130004404.30953-1-jniethe5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/head_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 7b7c8c5ee6602..2d6581db0c7b6 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -990,7 +990,7 @@ start_here_common:
 	bl	start_kernel
 
 	/* Not reached */
-	trap
+0:	trap
 	EMIT_BUG_ENTRY 0b, __FILE__, __LINE__, 0
 	.previous
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 281/717] powerpc/xmon: Fix build failure for 8xx
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 280/717] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 282/717] powerpc/perf: Fix to update radix_scope_qual in power10 Greg Kroah-Hartman
                   ` (437 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Ravi Bangoria,
	Michael Ellerman, Sasha Levin

From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

[ Upstream commit f3e90408019b353fd1fcd338091fb8d3c4a1c1a5 ]

With CONFIG_PPC_8xx and CONFIG_XMON set, kernel build fails with

  arch/powerpc/xmon/xmon.c:1379:12: error: 'find_free_data_bpt' defined
  but not used [-Werror=unused-function]

Fix it by enclosing find_free_data_bpt() inside #ifndef CONFIG_PPC_8xx.

Fixes: 30df74d67d48 ("powerpc/watchpoint/xmon: Support 2nd DAWR")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201130034406.288047-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/xmon/xmon.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 55c43a6c91112..5559edf36756c 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -1383,6 +1383,7 @@ static long check_bp_loc(unsigned long addr)
 	return 1;
 }
 
+#ifndef CONFIG_PPC_8xx
 static int find_free_data_bpt(void)
 {
 	int i;
@@ -1394,6 +1395,7 @@ static int find_free_data_bpt(void)
 	printf("Couldn't find free breakpoint register\n");
 	return -1;
 }
+#endif
 
 static void print_data_bpts(void)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 282/717] powerpc/perf: Fix to update radix_scope_qual in power10
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 281/717] powerpc/xmon: Fix build failure for 8xx Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 283/717] powerpc/perf: Update the PMU group constraints for l2l3 events " Greg Kroah-Hartman
                   ` (436 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman, Sasha Levin

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

[ Upstream commit d3afd28cd2f35b2a1046b76e0cf010b684da2e84 ]

power10 uses bit 9 of the raw event code as RADIX_SCOPE_QUAL.
This bit is used for enabling the radix process events.
Patch fixes the PMU counter support functions to program bit
18 of MMCR1 ( Monitor Mode Control Register1 ) with the
RADIX_SCOPE_QUAL bit value. Since this field is not per-pmc,
add this to PMU group constraints to make sure events in a
group will have same bit value for this field. Use bit 21 as
constraint bit field for radix_scope_qual. Patch also updates
the power10 raw event encoding layout information, format field
and constraints bit layout to include the radix_scope_qual bit.

Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606409684-1589-2-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/isa207-common.c | 12 ++++++++++++
 arch/powerpc/perf/isa207-common.h | 13 ++++++++++---
 arch/powerpc/perf/power10-pmu.c   | 11 +++++++----
 3 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index 2848904df6383..f57f54f92c10f 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -339,6 +339,11 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
 		value |= CNST_L1_QUAL_VAL(cache);
 	}
 
+	if (cpu_has_feature(CPU_FTR_ARCH_31)) {
+		mask |= CNST_RADIX_SCOPE_GROUP_MASK;
+		value |= CNST_RADIX_SCOPE_GROUP_VAL(event >> p10_EVENT_RADIX_SCOPE_QUAL_SHIFT);
+	}
+
 	if (is_event_marked(event)) {
 		mask  |= CNST_SAMPLE_MASK;
 		value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
@@ -456,6 +461,13 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
 			}
 		}
 
+		/* Set RADIX_SCOPE_QUAL bit */
+		if (cpu_has_feature(CPU_FTR_ARCH_31)) {
+			val = (event[i] >> p10_EVENT_RADIX_SCOPE_QUAL_SHIFT) &
+				p10_EVENT_RADIX_SCOPE_QUAL_MASK;
+			mmcr1 |= val << p10_MMCR1_RADIX_SCOPE_QUAL_SHIFT;
+		}
+
 		if (is_event_marked(event[i])) {
 			mmcra |= MMCRA_SAMPLE_ENABLE;
 
diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
index 7025de5e60e7d..dc9c3d22fb38d 100644
--- a/arch/powerpc/perf/isa207-common.h
+++ b/arch/powerpc/perf/isa207-common.h
@@ -101,6 +101,9 @@
 #define p10_EVENT_CACHE_SEL_MASK	0x3ull
 #define p10_EVENT_MMCR3_MASK		0x7fffull
 #define p10_EVENT_MMCR3_SHIFT		45
+#define p10_EVENT_RADIX_SCOPE_QUAL_SHIFT	9
+#define p10_EVENT_RADIX_SCOPE_QUAL_MASK	0x1
+#define p10_MMCR1_RADIX_SCOPE_QUAL_SHIFT	45
 
 #define p10_EVENT_VALID_MASK		\
 	((p10_SDAR_MODE_MASK   << p10_SDAR_MODE_SHIFT		|	\
@@ -112,6 +115,7 @@
 	(p9_EVENT_COMBINE_MASK << p9_EVENT_COMBINE_SHIFT)	|	\
 	(p10_EVENT_MMCR3_MASK  << p10_EVENT_MMCR3_SHIFT)	|	\
 	(EVENT_MARKED_MASK     << EVENT_MARKED_SHIFT)		|	\
+	(p10_EVENT_RADIX_SCOPE_QUAL_MASK << p10_EVENT_RADIX_SCOPE_QUAL_SHIFT)	|	\
 	 EVENT_LINUX_MASK					|	\
 	EVENT_PSEL_MASK))
 /*
@@ -125,9 +129,9 @@
  *
  *        28        24        20        16        12         8         4         0
  * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
- *               [ ] |   [ ]   [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
- *                |  |    |                     |
- *      BHRB IFM -*  |    |                     |      Count of events for each PMC.
+ *               [ ] |   [ ] |  [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
+ *                |  |    |  |                  |
+ *      BHRB IFM -*  |    |  |*radix_scope      |      Count of events for each PMC.
  *              EBB -*    |                     |        p1, p2, p3, p4, p5, p6.
  *      L1 I/D qualifier -*                     |
  *                     nc - number of counters -*
@@ -165,6 +169,9 @@
 #define CNST_L2L3_GROUP_VAL(v)	(((v) & 0x1full) << 55)
 #define CNST_L2L3_GROUP_MASK	CNST_L2L3_GROUP_VAL(0x1f)
 
+#define CNST_RADIX_SCOPE_GROUP_VAL(v)	(((v) & 0x1ull) << 21)
+#define CNST_RADIX_SCOPE_GROUP_MASK	CNST_RADIX_SCOPE_GROUP_VAL(1)
+
 /*
  * For NC we are counting up to 4 events. This requires three bits, and we need
  * the fifth event to overflow and set the 4th bit. To achieve that we bias the
diff --git a/arch/powerpc/perf/power10-pmu.c b/arch/powerpc/perf/power10-pmu.c
index 9dbe8f9b89b4f..cf44fb7446130 100644
--- a/arch/powerpc/perf/power10-pmu.c
+++ b/arch/powerpc/perf/power10-pmu.c
@@ -23,10 +23,10 @@
  *
  *        28        24        20        16        12         8         4         0
  * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
- *   [   ] [  sample ]   [ ] [ ]   [ pmc ]   [unit ]   [ ]   m   [    pmcxsel    ]
- *     |        |        |    |                        |     |
- *     |        |        |    |                        |     *- mark
- *     |        |        |    *- L1/L2/L3 cache_sel    |
+ *   [   ] [  sample ]   [ ] [ ]   [ pmc ]   [unit ]   [ ] |  m   [    pmcxsel    ]
+ *     |        |        |    |                        |   |  |
+ *     |        |        |    |                        |   |  *- mark
+ *     |        |        |    *- L1/L2/L3 cache_sel    |   |*-radix_scope_qual
  *     |        |        sdar_mode                     |
  *     |        *- sampling mode for marked events     *- combine
  *     |
@@ -59,6 +59,7 @@
  *
  * MMCR1[16] = cache_sel[0]
  * MMCR1[17] = cache_sel[1]
+ * MMCR1[18] = radix_scope_qual
  *
  * if mark:
  *	MMCRA[63]    = 1		(SAMPLE_ENABLE)
@@ -175,6 +176,7 @@ PMU_FORMAT_ATTR(src_sel,        "config:45-46");
 PMU_FORMAT_ATTR(invert_bit,     "config:47");
 PMU_FORMAT_ATTR(src_mask,       "config:48-53");
 PMU_FORMAT_ATTR(src_match,      "config:54-59");
+PMU_FORMAT_ATTR(radix_scope,	"config:9");
 
 static struct attribute *power10_pmu_format_attr[] = {
 	&format_attr_event.attr,
@@ -194,6 +196,7 @@ static struct attribute *power10_pmu_format_attr[] = {
 	&format_attr_invert_bit.attr,
 	&format_attr_src_mask.attr,
 	&format_attr_src_match.attr,
+	&format_attr_radix_scope.attr,
 	NULL,
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 283/717] powerpc/perf: Update the PMU group constraints for l2l3 events in power10
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 282/717] powerpc/perf: Fix to update radix_scope_qual in power10 Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 284/717] powerpc/perf: Fix the PMU group constraints for threshold " Greg Kroah-Hartman
                   ` (435 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman, Sasha Levin

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

[ Upstream commit e924be7b0b0d1f37d0509c854a92c7a71e3cdfe7 ]

In Power9, L2/L3 bus events are always available as a
"bank" of 4 events. To obtain the counts for any of the
l2/l3 bus events in a given bank, the user will have to
program PMC4 with corresponding l2/l3 bus event for that
bank.

Commit 59029136d750 ("powerpc/perf: Add constraints for power9 l2/l3 bus events")
enforced this rule in Power9. But this is not valid for
Power10, since in Power10 Monitor Mode Control Register2
(MMCR2) has bits to configure l2/l3 event bits. Hence remove
this PMC4 constraint check from power10.

Since the l2/l3 bits in MMCR2 are not per-pmc, patch handles
group constrints checks for l2/l3 bits in MMCR2.

Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606409684-1589-3-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/isa207-common.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index f57f54f92c10f..38ed450c78557 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -311,9 +311,11 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
 	}
 
 	if (unit >= 6 && unit <= 9) {
-		if (cpu_has_feature(CPU_FTR_ARCH_31) && (unit == 6)) {
-			mask |= CNST_L2L3_GROUP_MASK;
-			value |= CNST_L2L3_GROUP_VAL(event >> p10_L2L3_EVENT_SHIFT);
+		if (cpu_has_feature(CPU_FTR_ARCH_31)) {
+			if (unit == 6) {
+				mask |= CNST_L2L3_GROUP_MASK;
+				value |= CNST_L2L3_GROUP_VAL(event >> p10_L2L3_EVENT_SHIFT);
+			}
 		} else if (cpu_has_feature(CPU_FTR_ARCH_300)) {
 			mask  |= CNST_CACHE_GROUP_MASK;
 			value |= CNST_CACHE_GROUP_VAL(event & 0xff);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 284/717] powerpc/perf: Fix the PMU group constraints for threshold events in power10
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 283/717] powerpc/perf: Update the PMU group constraints for l2l3 events " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 285/717] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
                   ` (434 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman, Sasha Levin

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

[ Upstream commit 0263bbb377af0c2d38bc8b2ad2ff147e240094de ]

The PMU group constraints mask for threshold events covers
all thresholding bits which includes threshold control value
(start/stop), select value as well as thresh_cmp value (MMCRA[9:18].
In power9, thresh_cmp bits were part of the event code. But in case
of power10, thresh_cmp bits are not part of event code due to
inclusion of MMCR3 bits. Hence thresh_cmp is not valid for
group constraints for power10.

Fix the PMU group constraints checking for threshold events in
power10 by using constraint mask and value for only threshold control
and select bits.

Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606409684-1589-4-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/isa207-common.c | 7 ++++++-
 arch/powerpc/perf/isa207-common.h | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index 38ed450c78557..0f4983ef41036 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -351,7 +351,12 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
 		value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
 	}
 
-	if (cpu_has_feature(CPU_FTR_ARCH_300))  {
+	if (cpu_has_feature(CPU_FTR_ARCH_31)) {
+		if (event_is_threshold(event)) {
+			mask  |= CNST_THRESH_CTL_SEL_MASK;
+			value |= CNST_THRESH_CTL_SEL_VAL(event >> EVENT_THRESH_SHIFT);
+		}
+	} else if (cpu_has_feature(CPU_FTR_ARCH_300))  {
 		if (event_is_threshold(event) && is_thresh_cmp_valid(event)) {
 			mask  |= CNST_THRESH_MASK;
 			value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT);
diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
index dc9c3d22fb38d..42087643c3331 100644
--- a/arch/powerpc/perf/isa207-common.h
+++ b/arch/powerpc/perf/isa207-common.h
@@ -149,6 +149,9 @@
 #define CNST_THRESH_VAL(v)	(((v) & EVENT_THRESH_MASK) << 32)
 #define CNST_THRESH_MASK	CNST_THRESH_VAL(EVENT_THRESH_MASK)
 
+#define CNST_THRESH_CTL_SEL_VAL(v)	(((v) & 0x7ffull) << 32)
+#define CNST_THRESH_CTL_SEL_MASK	CNST_THRESH_CTL_SEL_VAL(0x7ff)
+
 #define CNST_EBB_VAL(v)		(((v) & EVENT_EBB_MASK) << 24)
 #define CNST_EBB_MASK		CNST_EBB_VAL(EVENT_EBB_MASK)
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 285/717] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 284/717] powerpc/perf: Fix the PMU group constraints for threshold " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 286/717] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
                   ` (433 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Daniel Lezcano, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit c1e6cad00aa2f17845e7270e38ff3cc82c7b022a ]

After calling clk_prepare_enable(), clk_disable_unprepare() need
be called on error path.

Fixes: fbe4b3566ddc ("clocksource/drivers/orion: Convert init function...")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201111064706.3397156-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-orion.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/clocksource/timer-orion.c b/drivers/clocksource/timer-orion.c
index d01ff41818676..5101e834d78ff 100644
--- a/drivers/clocksource/timer-orion.c
+++ b/drivers/clocksource/timer-orion.c
@@ -143,7 +143,8 @@ static int __init orion_timer_init(struct device_node *np)
 	irq = irq_of_parse_and_map(np, 1);
 	if (irq <= 0) {
 		pr_err("%pOFn: unable to parse timer1 irq\n", np);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unprep_clk;
 	}
 
 	rate = clk_get_rate(clk);
@@ -160,7 +161,7 @@ static int __init orion_timer_init(struct device_node *np)
 				    clocksource_mmio_readl_down);
 	if (ret) {
 		pr_err("Failed to initialize mmio timer\n");
-		return ret;
+		goto out_unprep_clk;
 	}
 
 	sched_clock_register(orion_read_sched_clock, 32, rate);
@@ -170,7 +171,7 @@ static int __init orion_timer_init(struct device_node *np)
 			  "orion_event", NULL);
 	if (ret) {
 		pr_err("%pOFn: unable to setup irq\n", np);
-		return ret;
+		goto out_unprep_clk;
 	}
 
 	ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ;
@@ -183,5 +184,9 @@ static int __init orion_timer_init(struct device_node *np)
 	orion_delay_timer_init(rate);
 
 	return 0;
+
+out_unprep_clk:
+	clk_disable_unprepare(clk);
+	return ret;
 }
 TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 286/717] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 285/717] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 287/717] clocksource/drivers/ingenic: Fix section mismatch Greg Kroah-Hartman
                   ` (432 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Daniel Lezcano,
	Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]

If clk_notifier_register() failed, ttc_setup_clockevent() will return
without freeing 'ttcce', which will leak memory.

Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-cadence-ttc.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
index 80e9606020307..4efd0cf3b602d 100644
--- a/drivers/clocksource/timer-cadence-ttc.c
+++ b/drivers/clocksource/timer-cadence-ttc.c
@@ -413,10 +413,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 	ttcce->ttc.clk = clk;
 
 	err = clk_prepare_enable(ttcce->ttc.clk);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	ttcce->ttc.clk_rate_change_nb.notifier_call =
 		ttc_rate_change_clockevent_cb;
@@ -426,7 +424,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 				    &ttcce->ttc.clk_rate_change_nb);
 	if (err) {
 		pr_warn("Unable to register clock notifier.\n");
-		return err;
+		goto out_kfree;
 	}
 
 	ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
@@ -455,15 +453,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 
 	err = request_irq(irq, ttc_clock_event_interrupt,
 			  IRQF_TIMER, ttcce->ce.name, ttcce);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	clockevents_config_and_register(&ttcce->ce,
 			ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
 
 	return 0;
+
+out_kfree:
+	kfree(ttcce);
+	return err;
 }
 
 static int __init ttc_timer_probe(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 287/717] clocksource/drivers/ingenic: Fix section mismatch
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 286/717] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 288/717] clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI Greg Kroah-Hartman
                   ` (431 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Daniel Lezcano,
	Paul Cercueil, 周琰杰  ,
	Sasha Levin

From: Daniel Lezcano <daniel.lezcano@linaro.org>

[ Upstream commit 5bd7cb29eceb52e4b108917786fdbf2a2c2048ef ]

The function ingenic_tcu_get_clock() is annotated for the __init
section but it is actually called from the online cpu callback.

That will lead to a crash if a CPU is hotplugged after boot time.

Remove the __init annotation for the ingenic_tcu_get_clock()
function.

Fixes: f19d838d08fc (clocksource/drivers/ingenic: Add high resolution timer support for SMP/SMT)
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Link: https://lore.kernel.org/r/20201125102346.1816310-1-daniel.lezcano@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/ingenic-timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clocksource/ingenic-timer.c b/drivers/clocksource/ingenic-timer.c
index 58fd9189fab7f..905fd6b163a81 100644
--- a/drivers/clocksource/ingenic-timer.c
+++ b/drivers/clocksource/ingenic-timer.c
@@ -127,7 +127,7 @@ static irqreturn_t ingenic_tcu_cevt_cb(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
-static struct clk * __init ingenic_tcu_get_clock(struct device_node *np, int id)
+static struct clk *ingenic_tcu_get_clock(struct device_node *np, int id)
 {
 	struct of_phandle_args args;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 288/717] clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 287/717] clocksource/drivers/ingenic: Fix section mismatch Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 289/717] arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE Greg Kroah-Hartman
                   ` (430 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kefeng Wang, Palmer Dabbelt,
	Daniel Lezcano, Sasha Levin

From: Kefeng Wang <wangkefeng.wang@huawei.com>

[ Upstream commit ab3105446f1ec4e98fadfc998ee24feec271c16c ]

The riscv timer is set via SBI timer call, let's make RISCV_TIMER
depends on RISCV_SBI, and it also fixes some build issue.

Fixes: d5be89a8d118 ("RISC-V: Resurrect the MMIO timer implementation for M-mode systems")
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
Acked-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201028131230.72907-1-wangkefeng.wang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 68b087bff59cc..2be849bb794ac 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -654,7 +654,7 @@ config ATCPIT100_TIMER
 
 config RISCV_TIMER
 	bool "Timer for the RISC-V platform" if COMPILE_TEST
-	depends on GENERIC_SCHED_CLOCK && RISCV
+	depends on GENERIC_SCHED_CLOCK && RISCV && RISCV_SBI
 	select TIMER_PROBE
 	select TIMER_OF
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 289/717] arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 288/717] clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 290/717] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
                   ` (429 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Collingbourne, Catalin Marinas,
	Will Deacon, Sasha Levin

From: Peter Collingbourne <pcc@google.com>

[ Upstream commit 929c1f3384d7e5cd319d03242cb925c3f91236f7 ]

Previously we were always returning a tag inclusion mask of zero via
PR_GET_TAGGED_ADDR_CTRL if TCF0 was set to NONE. Fix it by making
the code for the NONE case match the others.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Link: https://linux-review.googlesource.com/id/Iefbea66cf7d2b4c80b82f9639b9ea7f33f7fac53
Fixes: af5ce95282dc ("arm64: mte: Allow user control of the generated random tags via prctl()")
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20201203075110.2781021-1-pcc@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/mte.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
index 52a0638ed967b..ef15c8a2a49dc 100644
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -189,7 +189,8 @@ long get_mte_ctrl(struct task_struct *task)
 
 	switch (task->thread.sctlr_tcf0) {
 	case SCTLR_EL1_TCF0_NONE:
-		return PR_MTE_TCF_NONE;
+		ret |= PR_MTE_TCF_NONE;
+		break;
 	case SCTLR_EL1_TCF0_SYNC:
 		ret |= PR_MTE_TCF_SYNC;
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 290/717] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 289/717] arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 291/717] libbpf: Sanitise map names before pinning Greg Kroah-Hartman
                   ` (428 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Eggers, Lars-Peter Clausen,
	Sebastian Andrzej Siewior, Jonathan Cameron, Sasha Levin

From: Lars-Peter Clausen <lars@metafoo.de>

[ Upstream commit 0178297c1e6898e2197fe169ef3be723e019b971 ]

On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft
interrupt expiry mode by default.

The IIO hrtimer-trigger needs to run in hard interrupt context since it
will end up calling generic_handle_irq() which has the requirement to run
in hard interrupt context.

Explicitly specify that the timer needs to run in hard interrupt context by
using the HRTIMER_MODE_REL_HARD flag.

Fixes: f5c2f0215e36 ("hrtimer: Move unmarked hrtimers to soft interrupt expiry on RT")
Reported-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20201117103751.16131-1-lars@metafoo.de
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/trigger/iio-trig-hrtimer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/trigger/iio-trig-hrtimer.c b/drivers/iio/trigger/iio-trig-hrtimer.c
index f59bf8d585866..410de837d0417 100644
--- a/drivers/iio/trigger/iio-trig-hrtimer.c
+++ b/drivers/iio/trigger/iio-trig-hrtimer.c
@@ -102,7 +102,7 @@ static int iio_trig_hrtimer_set_state(struct iio_trigger *trig, bool state)
 
 	if (state)
 		hrtimer_start(&trig_info->timer, trig_info->period,
-			      HRTIMER_MODE_REL);
+			      HRTIMER_MODE_REL_HARD);
 	else
 		hrtimer_cancel(&trig_info->timer);
 
@@ -132,7 +132,7 @@ static struct iio_sw_trigger *iio_trig_hrtimer_probe(const char *name)
 	trig_info->swt.trigger->ops = &iio_hrtimer_trigger_ops;
 	trig_info->swt.trigger->dev.groups = iio_hrtimer_attr_groups;
 
-	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
 	trig_info->timer.function = iio_hrtimer_trig_handler;
 
 	trig_info->sampling_frequency = HRTIMER_DEFAULT_SAMPLING_FREQUENCY;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 291/717] libbpf: Sanitise map names before pinning
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 290/717] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 292/717] ARM: dts: at91: sam9x60ek: remove bypass property Greg Kroah-Hartman
                   ` (427 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Toke Høiland-Jørgensen,
	Andrii Nakryiko, Sasha Levin

From: Toke Høiland-Jørgensen <toke@redhat.com>

[ Upstream commit 9cf309c56f7910a81fbe053b6f11c3b1f0987b12 ]

When we added sanitising of map names before loading programs to libbpf, we
still allowed periods in the name. While the kernel will accept these for
the map names themselves, they are not allowed in file names when pinning
maps. This means that bpf_object__pin_maps() will fail if called on an
object that contains internal maps (such as sections .rodata).

Fix this by replacing periods with underscores when constructing map pin
paths. This only affects the paths generated by libbpf when
bpf_object__pin_maps() is called with a path argument. Any pin paths set
by bpf_map__set_pin_path() are unaffected, and it will still be up to the
caller to avoid invalid characters in those.

Fixes: 113e6b7e15e2 ("libbpf: Sanitise internal map names so they are not rejected by the kernel")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201203093306.107676-1-toke@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 28baee7ba1ca8..ad165e6e74bc0 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -7649,6 +7649,16 @@ bool bpf_map__is_pinned(const struct bpf_map *map)
 	return map->pinned;
 }
 
+static void sanitize_pin_path(char *s)
+{
+	/* bpffs disallows periods in path names */
+	while (*s) {
+		if (*s == '.')
+			*s = '_';
+		s++;
+	}
+}
+
 int bpf_object__pin_maps(struct bpf_object *obj, const char *path)
 {
 	struct bpf_map *map;
@@ -7678,6 +7688,7 @@ int bpf_object__pin_maps(struct bpf_object *obj, const char *path)
 				err = -ENAMETOOLONG;
 				goto err_unpin_maps;
 			}
+			sanitize_pin_path(buf);
 			pin_path = buf;
 		} else if (!map->pin_path) {
 			continue;
@@ -7722,6 +7733,7 @@ int bpf_object__unpin_maps(struct bpf_object *obj, const char *path)
 				return -EINVAL;
 			else if (len >= PATH_MAX)
 				return -ENAMETOOLONG;
+			sanitize_pin_path(buf);
 			pin_path = buf;
 		} else if (!map->pin_path) {
 			continue;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 292/717] ARM: dts: at91: sam9x60ek: remove bypass property
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 291/717] libbpf: Sanitise map names before pinning Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 293/717] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
                   ` (426 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Nicolas Ferre, Marco Cardellini, Sasha Levin

From: Claudiu Beznea <claudiu.beznea@microchip.com>

[ Upstream commit ab8a9bb41b2c330a0b280280bf37b6f3b1dd1e58 ]

atmel,osc-bypass property sets the bit 1 at main oscillator register.
On SAM9X60 this bit is not valid according to datasheet (chapter
28.16.9 PMC Clock Generator Main Oscillator Register).

Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Cc: Marco Cardellini <marco.cardellini@microchip.com>
Link: https://lore.kernel.org/r/1606903025-14197-2-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sam9x60ek.dts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
index 0e3b6147069f9..73b6b1f89de99 100644
--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
+++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
@@ -578,10 +578,6 @@
 	};
 }; /* pinctrl */
 
-&pmc {
-	atmel,osc-bypass;
-};
-
 &pwm0 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_pwm0_0 &pinctrl_pwm0_1 &pinctrl_pwm0_2 &pinctrl_pwm0_3>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 293/717] ARM: dts: at91: sama5d2: map securam as device
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 292/717] ARM: dts: at91: sam9x60ek: remove bypass property Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 294/717] scripts: kernel-doc: fix parsing function-like typedefs Greg Kroah-Hartman
                   ` (425 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Nicolas Ferre, Sasha Levin

From: Claudiu Beznea <claudiu.beznea@microchip.com>

[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]

Due to strobe signal not being propagated from CPU to securam
the securam needs to be mapped as device or strongly ordered memory
to work properly. Otherwise, updating to one offset may affect
the adjacent locations in securam.

Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sama5d2.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 2ddc85dff8ce9..6d399ac0385d4 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -656,6 +656,7 @@
 				clocks = <&pmc PMC_TYPE_PERIPHERAL 51>;
 				#address-cells = <1>;
 				#size-cells = <1>;
+				no-memory-wc;
 				ranges = <0 0xf8044000 0x1420>;
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 294/717] scripts: kernel-doc: fix parsing function-like typedefs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 293/717] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 295/717] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
                   ` (424 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab,
	Jonathan Corbet, Sasha Levin

From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

[ Upstream commit 7d2c6b1edf790d96e9017a0b27be2425e1af1532 ]

Changeset 6b80975c6308 ("scripts: kernel-doc: fix typedef parsing")
added support for things like:

	typedef unsigned long foo();

However, it caused a regression on this prototype:

	typedef bool v4l2_check_dv_timings_fnc(const struct v4l2_dv_timings *t, void *handle);

This is only noticed after adding a patch that checks if the
kernel-doc identifier matches the typedef:

	./scripts/kernel-doc -none $(git grep '^.. kernel-doc::' Documentation/ |cut -d ' ' -f 3|sort|uniq) 2>&1|grep expecting
	include/media/v4l2-dv-timings.h:38: warning: expecting prototype for typedef v4l2_check_dv_timings_fnc. Prototype was for typedef nc instead

The problem is that, with the new parsing logic, it is not
checking for complete words at the type part.

Fix it by adding a \b at the end of each type word at the
regex.

fixes: 6b80975c6308 ("scripts: kernel-doc: fix typedef parsing")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/218ff56dcb8e73755005d3fb64586eb1841a276b.1606896997.git.mchehab+huawei@kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kernel-doc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 9b6ddeb097e93..6325bec3f66f8 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1431,7 +1431,7 @@ sub dump_enum($$) {
     }
 }
 
-my $typedef_type = qr { ((?:\s+[\w\*]+){1,8})\s* }x;
+my $typedef_type = qr { ((?:\s+[\w\*]+\b){1,8})\s* }x;
 my $typedef_ident = qr { \*?\s*(\w\S+)\s* }x;
 my $typedef_args = qr { \s*\((.*)\); }x;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 295/717] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 294/717] scripts: kernel-doc: fix parsing function-like typedefs Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 296/717] selftests/bpf: Fix invalid use of strncat in test_sockmap Greg Kroah-Hartman
                   ` (423 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Martin KaFai Lau, Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit 12cc126df82c96c89706aa207ad27c56f219047c ]

__module_address() needs to be called with preemption disabled or with
module_mutex taken. preempt_disable() is enough for read-only uses, which is
what this fix does. Also, module_put() does internal check for NULL, so drop
it as well.

Fixes: a38d1107f937 ("bpf: support raw tracepoints in modules")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201203204634.1325171-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/bpf_trace.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index a125ea5e04cd7..0dde84b9d29fe 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2041,10 +2041,12 @@ struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name)
 
 void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp)
 {
-	struct module *mod = __module_address((unsigned long)btp);
+	struct module *mod;
 
-	if (mod)
-		module_put(mod);
+	preempt_disable();
+	mod = __module_address((unsigned long)btp);
+	module_put(mod);
+	preempt_enable();
 }
 
 static __always_inline
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 296/717] selftests/bpf: Fix invalid use of strncat in test_sockmap
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 295/717] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 297/717] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
                   ` (422 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit eceae70bdeaeb6b8ceb662983cf663ff352fbc96 ]

strncat()'s third argument is how many bytes will be added *in addition* to
already existing bytes in destination. Plus extra zero byte will be added
after that. So existing use in test_sockmap has many opportunities to overflow
the string and cause memory corruptions. And in this case, GCC complains for
a good reason.

Fixes: 16962b2404ac ("bpf: sockmap, add selftests")
Fixes: 73563aa3d977 ("selftests/bpf: test_sockmap, print additional test options")
Fixes: 1ade9abadfca ("bpf: test_sockmap, add options for msg_pop_data() helper")
Fixes: 463bac5f1ca7 ("bpf, selftests: Add test for ktls with skb bpf ingress policy")
Fixes: e9dd904708c4 ("bpf: add tls support for testing in test_sockmap")
Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201203235440.2302137-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_sockmap.c | 36 ++++++++++++++--------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 0fa1e421c3d7a..427ca00a32177 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -1273,6 +1273,16 @@ static char *test_to_str(int test)
 	return "unknown";
 }
 
+static void append_str(char *dst, const char *src, size_t dst_cap)
+{
+	size_t avail = dst_cap - strlen(dst);
+
+	if (avail <= 1) /* just zero byte could be written */
+		return;
+
+	strncat(dst, src, avail - 1); /* strncat() adds + 1 for zero byte */
+}
+
 #define OPTSTRING 60
 static void test_options(char *options)
 {
@@ -1281,42 +1291,42 @@ static void test_options(char *options)
 	memset(options, 0, OPTSTRING);
 
 	if (txmsg_pass)
-		strncat(options, "pass,", OPTSTRING);
+		append_str(options, "pass,", OPTSTRING);
 	if (txmsg_redir)
-		strncat(options, "redir,", OPTSTRING);
+		append_str(options, "redir,", OPTSTRING);
 	if (txmsg_drop)
-		strncat(options, "drop,", OPTSTRING);
+		append_str(options, "drop,", OPTSTRING);
 	if (txmsg_apply) {
 		snprintf(tstr, OPTSTRING, "apply %d,", txmsg_apply);
-		strncat(options, tstr, OPTSTRING);
+		append_str(options, tstr, OPTSTRING);
 	}
 	if (txmsg_cork) {
 		snprintf(tstr, OPTSTRING, "cork %d,", txmsg_cork);
-		strncat(options, tstr, OPTSTRING);
+		append_str(options, tstr, OPTSTRING);
 	}
 	if (txmsg_start) {
 		snprintf(tstr, OPTSTRING, "start %d,", txmsg_start);
-		strncat(options, tstr, OPTSTRING);
+		append_str(options, tstr, OPTSTRING);
 	}
 	if (txmsg_end) {
 		snprintf(tstr, OPTSTRING, "end %d,", txmsg_end);
-		strncat(options, tstr, OPTSTRING);
+		append_str(options, tstr, OPTSTRING);
 	}
 	if (txmsg_start_pop) {
 		snprintf(tstr, OPTSTRING, "pop (%d,%d),",
 			 txmsg_start_pop, txmsg_start_pop + txmsg_pop);
-		strncat(options, tstr, OPTSTRING);
+		append_str(options, tstr, OPTSTRING);
 	}
 	if (txmsg_ingress)
-		strncat(options, "ingress,", OPTSTRING);
+		append_str(options, "ingress,", OPTSTRING);
 	if (txmsg_redir_skb)
-		strncat(options, "redir_skb,", OPTSTRING);
+		append_str(options, "redir_skb,", OPTSTRING);
 	if (txmsg_ktls_skb)
-		strncat(options, "ktls_skb,", OPTSTRING);
+		append_str(options, "ktls_skb,", OPTSTRING);
 	if (ktls)
-		strncat(options, "ktls,", OPTSTRING);
+		append_str(options, "ktls,", OPTSTRING);
 	if (peek_flag)
-		strncat(options, "peek,", OPTSTRING);
+		append_str(options, "peek,", OPTSTRING);
 }
 
 static int __test_exec(int cgrp, int test, struct sockmap_options *opt)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 297/717] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 296/717] selftests/bpf: Fix invalid use of strncat in test_sockmap Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 298/717] soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe() Greg Kroah-Hartman
                   ` (421 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Linus Walleij, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]

if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
index 62c02b969327f..7521a924dffb0 100644
--- a/drivers/pinctrl/pinctrl-falcon.c
+++ b/drivers/pinctrl/pinctrl-falcon.c
@@ -431,24 +431,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
 
 	/* load and remap the pad resources of the different banks */
 	for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
-		struct platform_device *ppdev = of_find_device_by_node(np);
 		const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
 		struct resource res;
+		struct platform_device *ppdev;
 		u32 avail;
 		int pins;
 
 		if (!of_device_is_available(np))
 			continue;
 
-		if (!ppdev) {
-			dev_err(&pdev->dev, "failed to find pad pdev\n");
-			continue;
-		}
 		if (!bank || *bank >= PORTS)
 			continue;
 		if (of_address_to_resource(np, 0, &res))
 			continue;
+
+		ppdev = of_find_device_by_node(np);
+		if (!ppdev) {
+			dev_err(&pdev->dev, "failed to find pad pdev\n");
+			continue;
+		}
+
 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+		put_device(&ppdev->dev);
 		if (IS_ERR(falcon_info.clk[*bank])) {
 			dev_err(&ppdev->dev, "failed to get clock\n");
 			of_node_put(np);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 298/717] soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 297/717] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 299/717] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
                   ` (420 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Heiko Stuebner, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit c2867b2e710fc85bb39c6f6e5948450c48e8a33e ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: e943c43b32ce ("PM: AVS: rockchip-io: Move the driver to the rockchip specific drivers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607070805-33038-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/rockchip/io-domain.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/rockchip/io-domain.c b/drivers/soc/rockchip/io-domain.c
index eece97f97ef8f..b29e829e815e5 100644
--- a/drivers/soc/rockchip/io-domain.c
+++ b/drivers/soc/rockchip/io-domain.c
@@ -547,6 +547,7 @@ static int rockchip_iodomain_probe(struct platform_device *pdev)
 		if (uV < 0) {
 			dev_err(iod->dev, "Can't determine voltage: %s\n",
 				supply_name);
+			ret = uV;
 			goto unreg_notify;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 299/717] arm64: dts: rockchip: Fix UART pull-ups on rk3328
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 298/717] soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 300/717] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
                   ` (419 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]

For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
UARTs transmit active-low, so a disconnected RX pin should be pulled
high instead of left floating to prevent noise being interpreted as
transmissions.

This gets rid of bogus sysrq events when the UART console is not
connected.

Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index bbdb19a3e85d1..db0d5c8e5f96a 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1237,8 +1237,8 @@
 
 		uart0 {
 			uart0_xfer: uart0-xfer {
-				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
-						<1 RK_PB0 1 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
+						<1 RK_PB0 1 &pcfg_pull_up>;
 			};
 
 			uart0_cts: uart0-cts {
@@ -1256,8 +1256,8 @@
 
 		uart1 {
 			uart1_xfer: uart1-xfer {
-				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
-						<3 RK_PA6 4 &pcfg_pull_none>;
+				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
+						<3 RK_PA6 4 &pcfg_pull_up>;
 			};
 
 			uart1_cts: uart1-cts {
@@ -1275,15 +1275,15 @@
 
 		uart2-0 {
 			uart2m0_xfer: uart2m0-xfer {
-				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
-						<1 RK_PA1 2 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
+						<1 RK_PA1 2 &pcfg_pull_up>;
 			};
 		};
 
 		uart2-1 {
 			uart2m1_xfer: uart2m1-xfer {
-				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
-						<2 RK_PA1 1 &pcfg_pull_none>;
+				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
+						<2 RK_PA1 1 &pcfg_pull_up>;
 			};
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 300/717] memstick: r592: Fix error return in r592_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 299/717] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.10 301/717] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
                   ` (418 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Ulf Hansson, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/r592.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index dd3a1f3dcc191..d2ef46337191c 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -759,8 +759,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto error3;
 
 	dev->mmio = pci_ioremap_bar(pdev, 0);
-	if (!dev->mmio)
+	if (!dev->mmio) {
+		error = -ENOMEM;
 		goto error4;
+	}
 
 	dev->irq = pdev->irq;
 	spin_lock_init(&dev->irq_lock);
@@ -786,12 +788,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		&dev->dummy_dma_page_physical_address, GFP_KERNEL);
 	r592_stop_dma(dev , 0);
 
-	if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
-			  DRV_NAME, dev))
+	error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+			  DRV_NAME, dev);
+	if (error)
 		goto error6;
 
 	r592_update_card_detect(dev);
-	if (memstick_add_host(host))
+	error = memstick_add_host(host);
+	if (error)
 		goto error7;
 
 	message("driver successfully loaded");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 301/717] MIPS: Dont round up kernel sections size for memblock_add()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 300/717] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 302/717] mt76: mt7663s: fix a possible ple quota underflow Greg Kroah-Hartman
                   ` (417 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin,
	Thomas Bogendoerfer, Sasha Levin

From: Alexander Sverdlin <alexander.sverdlin@nokia.com>

[ Upstream commit d121f125af22a16f0f679293756d28a9691fa46d ]

Linux doesn't own the memory immediately after the kernel image. On Octeon
bootloader places a shared structure right close after the kernel _end,
refer to "struct cvmx_bootinfo *octeon_bootinfo" in cavium-octeon/setup.c.

If check_kernel_sections_mem() rounds the PFNs up, first memblock_alloc()
inside early_init_dt_alloc_memory_arch() <= device_tree_init() returns
memory block overlapping with the above octeon_bootinfo structure, which
is being overwritten afterwards.

Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kernel/setup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index ca579deef9391..9d11f68a9e8bb 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -498,8 +498,8 @@ static void __init request_crashkernel(struct resource *res)
 
 static void __init check_kernel_sections_mem(void)
 {
-	phys_addr_t start = PFN_PHYS(PFN_DOWN(__pa_symbol(&_text)));
-	phys_addr_t size = PFN_PHYS(PFN_UP(__pa_symbol(&_end))) - start;
+	phys_addr_t start = __pa_symbol(&_text);
+	phys_addr_t size = __pa_symbol(&_end) - start;
 
 	if (!memblock_is_region_memory(start, size)) {
 		pr_info("Kernel sections are not in the memory maps\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 302/717] mt76: mt7663s: fix a possible ple quota underflow
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.10 301/717] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 303/717] mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE Greg Kroah-Hartman
                   ` (416 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit 1c79a190e94325e01811f653f770a34e816fdd8f ]

Properly account current consumed ple quota in mt7663s_tx_pick_quota
routine and avoid possible underflow.

Fixes: 6ef2d665f64d ("mt76: mt7663s: split mt7663s_tx_update_sched in mt7663s_tx_{pick,update}_quota")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
index 2486cda3243bc..69e38f477b1e4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
@@ -150,7 +150,7 @@ static int mt7663s_tx_pick_quota(struct mt76_sdio *sdio, enum mt76_txq_id qid,
 			return -EBUSY;
 	} else {
 		if (sdio->sched.pse_data_quota < *pse_size + pse_sz ||
-		    sdio->sched.ple_data_quota < *ple_size)
+		    sdio->sched.ple_data_quota < *ple_size + 1)
 			return -EBUSY;
 
 		*ple_size = *ple_size + 1;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 303/717] mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 302/717] mt76: mt7663s: fix a possible ple quota underflow Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 304/717] mt76: set fops_tx_stats.owner " Greg Kroah-Hartman
                   ` (415 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Taehee Yoo, Felix Fietkau, Sasha Levin

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit 5efbe3b1b8992d5f837388091920945c23212159 ]

If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: ec9742a8f38e ("mt76: mt7915: add .sta_add_debugfs support")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
index 1049927faf246..d2ac7e5ee60a2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
@@ -460,6 +460,7 @@ static const struct file_operations fops_sta_stats = {
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
+	.owner = THIS_MODULE,
 };
 
 void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 304/717] mt76: set fops_tx_stats.owner to THIS_MODULE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 303/717] mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 305/717] mt76: dma: fix possible deadlock running mt76_dma_cleanup Greg Kroah-Hartman
                   ` (414 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Taehee Yoo, Felix Fietkau, Sasha Levin

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit f9df085ce1be5c599e4df590ff7ba853786c6d95 ]

If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
index d2ac7e5ee60a2..8f2ad32ade180 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
@@ -233,6 +233,7 @@ static const struct file_operations fops_tx_stats = {
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
+	.owner = THIS_MODULE,
 };
 
 static int mt7915_read_temperature(struct seq_file *s, void *data)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 305/717] mt76: dma: fix possible deadlock running mt76_dma_cleanup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 304/717] mt76: set fops_tx_stats.owner " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 306/717] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
                   ` (413 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit 5f0ce5848733b86deaba1c6d102e20479230b20a ]

Fix the following possible deadlock reported by lockdep disabling BH
running mt76_free_pending_txwi()

================================
WARNING: inconsistent lock state
5.9.0-rc6 #14 Not tainted
--------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
rmmod/1227 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff888156a83530 (&dev->lock#2){+.?.}-{2:2}, at: mt76_dma_cleanup+0x125/0x150 [mt76]
{IN-SOFTIRQ-W} state was registered at:
  __lock_acquire+0x20c/0x6b0
  lock_acquire+0x9d/0x220
  _raw_spin_lock+0x2c/0x70
  mt76_dma_tx_cleanup+0xc7/0x200 [mt76]
  mt76x02_poll_tx+0x31/0xb0 [mt76x02_lib]
  napi_poll+0x3a/0x100
  net_rx_action+0xa8/0x200
  __do_softirq+0xc4/0x430
  asm_call_on_stack+0xf/0x20
  do_softirq_own_stack+0x49/0x60
  irq_exit_rcu+0x9a/0xd0
  common_interrupt+0xa4/0x190
  asm_common_interrupt+0x1e/0x40
irq event stamp: 9915
hardirqs last  enabled at (9915): [<ffffffff8124e286>] __free_pages_ok+0x336/0x3b0
hardirqs last disabled at (9914): [<ffffffff8124e24e>] __free_pages_ok+0x2fe/0x3b0
softirqs last  enabled at (9912): [<ffffffffa03aa672>] mt76_dma_rx_cleanup+0xa2/0x120 [mt76]
softirqs last disabled at (9846): [<ffffffffa03aa5ea>] mt76_dma_rx_cleanup+0x1a/0x120 [mt76]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&dev->lock#2);
  <Interrupt>
    lock(&dev->lock#2);

 *** DEADLOCK ***

1 lock held by rmmod/1227:
 #0: ffff88815b5eb240 (&dev->mutex){....}-{3:3}, at: driver_detach+0xb5/0x110

stack backtrace:
CPU: 1 PID: 1227 Comm: rmmod Kdump: loaded Not tainted 5.9.0-rc6-wdn-src+ #14
Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
Call Trace:
 dump_stack+0x77/0xa0
 mark_lock_irq.cold+0x15/0x39
 mark_lock+0x1fc/0x500
 mark_usage+0xc7/0x140
 __lock_acquire+0x20c/0x6b0
 ? find_held_lock+0x2b/0x80
 ? sched_clock_cpu+0xc/0xb0
 lock_acquire+0x9d/0x220
 ? mt76_dma_cleanup+0x125/0x150 [mt76]
 _raw_spin_lock+0x2c/0x70
 ? mt76_dma_cleanup+0x125/0x150 [mt76]
 mt76_dma_cleanup+0x125/0x150 [mt76]
 mt76x2_cleanup+0x5a/0x70 [mt76x2e]
 mt76x2e_remove+0x18/0x30 [mt76x2e]
 pci_device_remove+0x36/0xa0
 __device_release_driver+0x16c/0x220
 driver_detach+0xcf/0x110
 bus_remove_driver+0x56/0xca
 pci_unregister_driver+0x36/0x80
 __do_sys_delete_module.constprop.0+0x127/0x200
 ? syscall_enter_from_user_mode+0x1d/0x50
 ? trace_hardirqs_on+0x1c/0xe0
 do_syscall_64+0x33/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff0da54e36b
Code: 73 01 c3 48 8b 0d 2d 0b 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 0c 00 f7 d8 64 89 01 48

Fixes: dd57a95cfddc ("mt76: move txwi handling code to dma.c, since it is mmio specific")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 214fc95b8a33f..145e839fea4e5 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -72,9 +72,11 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
 {
 	struct mt76_txwi_cache *t;
 
+	local_bh_disable();
 	while ((t = __mt76_get_txwi(dev)) != NULL)
 		dma_unmap_single(dev->dev, t->dma_addr, dev->drv->txwi_size,
 				 DMA_TO_DEVICE);
+	local_bh_enable();
 }
 
 static int
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 306/717] net/mlx5: Properly convey driver version to firmware
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 305/717] mt76: dma: fix possible deadlock running mt76_dma_cleanup Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 307/717] mt76: fix memory leak if device probing fails Greg Kroah-Hartman
                   ` (412 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]

mlx5 firmware expects driver version in specific format X.X.X, so
make it always correct and based on real kernel version aligned with
the driver.

Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 8ff207aa14792..e455a2f31f070 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -50,6 +50,7 @@
 #ifdef CONFIG_RFS_ACCEL
 #include <linux/cpu_rmap.h>
 #endif
+#include <linux/version.h>
 #include <net/devlink.h>
 #include "mlx5_core.h"
 #include "lib/eq.h"
@@ -233,7 +234,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
 	strncat(string, ",", remaining_size);
 
 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
-	strncat(string, DRIVER_VERSION, remaining_size);
+
+	snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
+		 (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
+		 (u16)(LINUX_VERSION_CODE & 0xffff));
 
 	/*Send the command*/
 	MLX5_SET(set_driver_version_in, in, opcode,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 307/717] mt76: fix memory leak if device probing fails
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 306/717] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 308/717] mt76: fix tkip configuration for mt7615/7663 devices Greg Kroah-Hartman
                   ` (411 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit bc348defcc6eceeb4f7784bf9a263ddb72fd3fb4 ]

Run mt76_free_device instead of ieee80211_free_hw if device probing
fails in order to remove the already allocated mt76 workqueue

Fixes: a86f1d01f5ce5 ("mt76: move mt76 workqueue in common code")
Fixes: f1d962369d568 ("mt76: mt7915: implement HE per-rate tx power support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7603/pci.c  | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7615/mmio.c | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt76x0/pci.c  | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt76x2/pci.c  | 3 ++-
 drivers/net/wireless/mediatek/mt76/mt7915/pci.c  | 5 +++--
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/pci.c b/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
index a5845da3547a9..06fa28f645f28 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
@@ -57,7 +57,8 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(&dev->mt76);
+
 	return ret;
 }
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
index 6de492a4cf025..9b191307e140e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
@@ -240,7 +240,8 @@ int mt7615_mmio_probe(struct device *pdev, void __iomem *mem_base,
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(&dev->mt76);
+
 	return ret;
 }
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
index dda11c704abaa..b87d8e136cb9a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
@@ -194,7 +194,8 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(&dev->mt76);
+
 	return ret;
 }
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
index 4d50dad29ddff..ecaf85b483ac3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
@@ -90,7 +90,8 @@ mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(&dev->mt76);
+
 	return ret;
 }
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
index fe62b4d853e48..3ac5bbb94d294 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
@@ -140,7 +140,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
 	dev = container_of(mdev, struct mt7915_dev, mt76);
 	ret = mt7915_alloc_device(pdev, dev);
 	if (ret)
-		return ret;
+		goto error;
 
 	mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
 	mdev->rev = (mt7915_l1_rr(dev, MT_HW_CHIPID) << 16) |
@@ -163,7 +163,8 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(&dev->mt76);
+
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 308/717] mt76: fix tkip configuration for mt7615/7663 devices
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 307/717] mt76: fix memory leak if device probing fails Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 309/717] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
                   ` (410 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YN Chen, Lorenzo Bianconi,
	Felix Fietkau, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit 930e0eaddf810cfa90e114a0df02f48539e1346f ]

Fix Tx-Rx MIC overwrite during TKIP hw key configuration

Fixes: 01cfc1b45421 ("mt76: mt7615: add BIP_CMAC_128 cipher support")
Tested-by: YN Chen <yn.chen@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index 8dc645e398fda..3d62fda067e44 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -1046,15 +1046,17 @@ int mt7615_mac_wtbl_update_key(struct mt7615_dev *dev,
 	if (cmd == SET_KEY) {
 		if (cipher == MT_CIPHER_TKIP) {
 			/* Rx/Tx MIC keys are swapped */
+			memcpy(data, key, 16);
 			memcpy(data + 16, key + 24, 8);
 			memcpy(data + 24, key + 16, 8);
+		} else {
+			if (cipher != MT_CIPHER_BIP_CMAC_128 && wcid->cipher)
+				memmove(data + 16, data, 16);
+			if (cipher != MT_CIPHER_BIP_CMAC_128 || !wcid->cipher)
+				memcpy(data, key, keylen);
+			else if (cipher == MT_CIPHER_BIP_CMAC_128)
+				memcpy(data + 16, key, 16);
 		}
-		if (cipher != MT_CIPHER_BIP_CMAC_128 && wcid->cipher)
-			memmove(data + 16, data, 16);
-		if (cipher != MT_CIPHER_BIP_CMAC_128 || !wcid->cipher)
-			memcpy(data, key, keylen);
-		else if (cipher == MT_CIPHER_BIP_CMAC_128)
-			memcpy(data + 16, key, 16);
 	} else {
 		if (wcid->cipher & ~BIT(cipher)) {
 			if (cipher != MT_CIPHER_BIP_CMAC_128)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 309/717] ASoC: jz4740-i2s: add missed checks for clk_get()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 308/717] mt76: fix tkip configuration for mt7615/7663 devices Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 310/717] ASoC: q6afe-clocks: Add missing parent clock rate Greg Kroah-Hartman
                   ` (409 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]

jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.

Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/jz4740/jz4740-i2s.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index c7bd20104b204..0793e284d0e78 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -312,10 +312,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
 	switch (clk_id) {
 	case JZ4740_I2S_CLKSRC_EXT:
 		parent = clk_get(NULL, "ext");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		break;
 	case JZ4740_I2S_CLKSRC_PLL:
 		parent = clk_get(NULL, "pll half");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		ret = clk_set_rate(i2s->clk_i2s, freq);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 310/717] ASoC: q6afe-clocks: Add missing parent clock rate
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 309/717] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 311/717] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
                   ` (408 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Kandagatla, Mark Brown, Sasha Levin

From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>

[ Upstream commit 7e20ae1208daaf6dad85c2dcb968fc590b6f3b99 ]

setting clock rate on child clocks without a parent clock rate will
result in zero clk rate for child. This also means that when audio
is started dsp will attempt to access registers without enabling
clock resulting in board boot up.

Fix this by adding the missing parent clock rate.

Fixes: 520a1c396d196 ("ASoC: q6afe-clocks: add q6afe clock controller")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20201204164228.1826-1-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/qdsp6/q6afe-clocks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/qcom/qdsp6/q6afe-clocks.c b/sound/soc/qcom/qdsp6/q6afe-clocks.c
index 2efc2eaa04243..acfc0c698f6a1 100644
--- a/sound/soc/qcom/qdsp6/q6afe-clocks.c
+++ b/sound/soc/qcom/qdsp6/q6afe-clocks.c
@@ -16,6 +16,7 @@
 		.afe_clk_id	= Q6AFE_##id,		\
 		.name = #id,				\
 		.attributes = LPASS_CLK_ATTRIBUTE_COUPLE_NO, \
+		.rate = 19200000,			\
 		.hw.init = &(struct clk_init_data) {	\
 			.ops = &clk_q6afe_ops,		\
 			.name = #id,			\
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 311/717] dm ioctl: fix error return code in target_message
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 310/717] ASoC: q6afe-clocks: Add missing parent clock rate Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 312/717] ASoC: cros_ec_codec: fix uninitialized memory read Greg Kroah-Hartman
                   ` (407 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mike Snitzer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index cd0478d44058b..5e306bba43751 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1600,6 +1600,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
 
 	if (!argc) {
 		DMWARN("Empty message received.");
+		r = -EINVAL;
 		goto out_argv;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 312/717] ASoC: cros_ec_codec: fix uninitialized memory read
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 311/717] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 313/717] ASoC: atmel: mchp-spdifrx needs COMMON_CLK Greg Kroah-Hartman
                   ` (406 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Tzung-Bi Shih,
	Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 7061b8a52296e044eed47b605d136a48da1a7761 ]

gcc points out a memory area that is copied to a device
but not initialized:

sound/soc/codecs/cros_ec_codec.c: In function 'i2s_rx_event':
arch/x86/include/asm/string_32.h:83:20: error: '*((void *)&p+4)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
   83 |   *((int *)to + 1) = *((int *)from + 1);

Initialize all the unused fields to zero.

Fixes: 727f1c71c780 ("ASoC: cros_ec_codec: refactor I2S RX")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Tzung-Bi Shih <tzungbi@google.com>
Link: https://lore.kernel.org/r/20201203225458.1477830-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cros_ec_codec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/cros_ec_codec.c b/sound/soc/codecs/cros_ec_codec.c
index 28f039adfa138..5c3b7e5e55d23 100644
--- a/sound/soc/codecs/cros_ec_codec.c
+++ b/sound/soc/codecs/cros_ec_codec.c
@@ -332,7 +332,7 @@ static int i2s_rx_event(struct snd_soc_dapm_widget *w,
 		snd_soc_dapm_to_component(w->dapm);
 	struct cros_ec_codec_priv *priv =
 		snd_soc_component_get_drvdata(component);
-	struct ec_param_ec_codec_i2s_rx p;
+	struct ec_param_ec_codec_i2s_rx p = {};
 
 	switch (event) {
 	case SND_SOC_DAPM_PRE_PMU:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 313/717] ASoC: atmel: mchp-spdifrx needs COMMON_CLK
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 312/717] ASoC: cros_ec_codec: fix uninitialized memory read Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 314/717] ASoC: qcom: fix QDSP6 dependencies, attempt #3 Greg Kroah-Hartman
                   ` (405 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Codrin Ciubotariu,
	Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 29275309b0e32bb838d67158c6b6e687275f43e9 ]

Compile-testing this driver on an older platform without CONFIG_COMMON_CLK fails with

ERROR: modpost: "clk_set_min_rate" [sound/soc/atmel/snd-soc-mchp-spdifrx.ko] undefined!

Make this is a strict dependency.

Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20201203223815.1353451-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/atmel/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
index bd8854bfd2ee4..142373ec411ad 100644
--- a/sound/soc/atmel/Kconfig
+++ b/sound/soc/atmel/Kconfig
@@ -148,6 +148,7 @@ config SND_MCHP_SOC_SPDIFTX
 config SND_MCHP_SOC_SPDIFRX
 	tristate "Microchip ASoC driver for boards using S/PDIF RX"
 	depends on OF && (ARCH_AT91 || COMPILE_TEST)
+	depends on COMMON_CLK
 	select SND_SOC_GENERIC_DMAENGINE_PCM
 	select REGMAP_MMIO
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 314/717] ASoC: qcom: fix QDSP6 dependencies, attempt #3
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 313/717] ASoC: atmel: mchp-spdifrx needs COMMON_CLK Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 315/717] phy: mediatek: allow compile-testing the hdmi phy Greg Kroah-Hartman
                   ` (404 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Srinivas Kandagatla,
	Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit b1b8eb1283c90a953089d988930d7b6156418958 ]

The previous fix left another warning in randconfig builds:

WARNING: unmet direct dependencies detected for SND_SOC_QDSP6
  Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && QCOM_APR [=y] && COMMON_CLK [=n]
  Selected by [y]:
  - SND_SOC_MSM8996 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && QCOM_APR [=y]

Add one more dependency for this one.

Fixes: 2bc8831b135c ("ASoC: qcom: fix SDM845 & QDSP6 dependencies more")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20201203231443.1483763-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
index 2696ffcba880f..a824f793811be 100644
--- a/sound/soc/qcom/Kconfig
+++ b/sound/soc/qcom/Kconfig
@@ -106,6 +106,7 @@ config SND_SOC_QDSP6
 config SND_SOC_MSM8996
 	tristate "SoC Machine driver for MSM8996 and APQ8096 boards"
 	depends on QCOM_APR
+	depends on COMMON_CLK
 	select SND_SOC_QDSP6
 	select SND_SOC_QCOM_COMMON
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 315/717] phy: mediatek: allow compile-testing the hdmi phy
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (313 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 314/717] ASoC: qcom: fix QDSP6 dependencies, attempt #3 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 316/717] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
                   ` (403 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Vinod Koul, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit f5f6e01f9164040ba120f30522efdb4deceb529a ]

Compile-testing the DRM_MEDIATEK_HDMI driver shows two missing
dependencies, one results in a link failure:

arm-linux-gnueabi-ld: drivers/phy/mediatek/phy-mtk-hdmi.o: in function `mtk_hdmi_phy_probe':
phy-mtk-hdmi.c:(.text+0xd8): undefined reference to `__clk_get_name'
arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x12c): undefined reference to `devm_clk_register'
arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x250): undefined reference to `of_clk_add_provider'
arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x298): undefined reference to `of_clk_src_simple_get'

The other one is a harmless warning:

WARNING: unmet direct dependencies detected for PHY_MTK_HDMI
  Depends on [n]: ARCH_MEDIATEK [=n] && OF [=y]
  Selected by [y]:
  - DRM_MEDIATEK_HDMI [=y] && HAS_IOMEM [=y] && DRM_MEDIATEK [=y]

Fix these by adding dependencies on CONFIG_OF and CONFIG_COMMON_CLK.
With that done, there is also no reason against adding
CONFIG_COMPILE_TEST.

Fixes: b28be59a2e26 ("phy: mediatek: Move mtk_hdmi_phy driver into drivers/phy/mediatek folder")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201204135650.2744481-1-arnd@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/mediatek/Kconfig | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/phy/mediatek/Kconfig b/drivers/phy/mediatek/Kconfig
index c8126bde9d7cc..43150608d8b62 100644
--- a/drivers/phy/mediatek/Kconfig
+++ b/drivers/phy/mediatek/Kconfig
@@ -38,7 +38,9 @@ config PHY_MTK_XSPHY
 
 config PHY_MTK_HDMI
 	tristate "MediaTek HDMI-PHY Driver"
-	depends on ARCH_MEDIATEK && OF
+	depends on ARCH_MEDIATEK || COMPILE_TEST
+	depends on COMMON_CLK
+	depends on OF
 	select GENERIC_PHY
 	help
 	  Support HDMI PHY for Mediatek SoCs.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 316/717] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (314 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 315/717] phy: mediatek: allow compile-testing the hdmi phy Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 317/717] memory: ti-emif-sram: only build for ARMv7 Greg Kroah-Hartman
                   ` (402 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Li, Vinod Koul, Sasha Levin

From: Wang Li <wangli74@huawei.com>

[ Upstream commit 51e339deab1e51443f6ac3b1bd5cd6cc8e8fe1d9 ]

pm_runtime_enable() will decrease power disable depth. Thus a pairing
increment is needed on the error handling path to keep it balanced.

Fixes: 5d8042e95fd4 ("phy: rcar-gen3-usb2: Add support for r8a77470")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Li <wangli74@huawei.com>
Link: https://lore.kernel.org/r/20201126024412.4046845-1-wangli74@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index e34e4475027ca..2cb949f931b69 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -656,8 +656,10 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
 	 */
 	pm_runtime_enable(dev);
 	phy_usb2_ops = of_device_get_match_data(dev);
-	if (!phy_usb2_ops)
-		return -EINVAL;
+	if (!phy_usb2_ops) {
+		ret = -EINVAL;
+		goto error;
+	}
 
 	mutex_init(&channel->lock);
 	for (i = 0; i < NUM_OF_PHYS; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 317/717] memory: ti-emif-sram: only build for ARMv7
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (315 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 316/717] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 318/717] memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe() Greg Kroah-Hartman
                   ` (401 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Krzysztof Kozlowski,
	Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d77d22d701b0471584abe1871570bb43deb6e3c4 ]

The driver can be compile-tested on all ARM machines, but
causes a failure when built for ARMv7-M:

arm-linux-gnueabi-ld: error: drivers/memory/ti-emif-sram-pm.o: conflicting architecture profiles A/M

Limit the target machines to configurations that have ARMv7 enabled.

Fixes: ea0c0ad6b6eb ("memory: Enable compile testing for most of the drivers")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201203230832.1481767-1-arnd@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/memory/Kconfig b/drivers/memory/Kconfig
index 00e013b14703e..cc2c83e1accfb 100644
--- a/drivers/memory/Kconfig
+++ b/drivers/memory/Kconfig
@@ -128,7 +128,7 @@ config OMAP_GPMC_DEBUG
 
 config TI_EMIF_SRAM
 	tristate "Texas Instruments EMIF SRAM driver"
-	depends on SOC_AM33XX || SOC_AM43XX || (ARM && COMPILE_TEST)
+	depends on SOC_AM33XX || SOC_AM43XX || (ARM && CPU_V7 && COMPILE_TEST)
 	depends on SRAM
 	help
 	  This driver is for the EMIF module available on Texas Instruments
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 318/717] memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (316 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 317/717] memory: ti-emif-sram: only build for ARMv7 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 319/717] drm/msm: a5xx: Make preemption reset case reentrant Greg Kroah-Hartman
                   ` (400 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Changzhong, Paul Cercueil,
	Krzysztof Kozlowski, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 4bfa07300b9334b487ed4f3d4901c35ebb31b7ca ]

platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.

This is detected by Coccinelle semantic patch.

Fixes: 911a88829725 ("memory: jz4780-nemc: driver for the NEMC on JZ4780 SoCs")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/1607070717-32880-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/jz4780-nemc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memory/jz4780-nemc.c b/drivers/memory/jz4780-nemc.c
index 3ec5cb0fce1ee..465ea92990d7e 100644
--- a/drivers/memory/jz4780-nemc.c
+++ b/drivers/memory/jz4780-nemc.c
@@ -291,6 +291,8 @@ static int jz4780_nemc_probe(struct platform_device *pdev)
 	nemc->dev = dev;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -EINVAL;
 
 	/*
 	 * The driver currently only uses the registers up to offset
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 319/717] drm/msm: a5xx: Make preemption reset case reentrant
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (317 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 318/717] memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 320/717] drm/msm: add IOMMU_SUPPORT dependency Greg Kroah-Hartman
                   ` (399 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marijn Suijten,
	AngeloGioacchino Del Regno, Jordan Crouse, Rob Clark,
	Sasha Levin

From: Marijn Suijten <marijn.suijten@somainline.org>

[ Upstream commit 7cc29fcdfcc8784e97c5151c848e193800ec79ac ]

nr_rings is reset to 1, but when this function is called for a second
(and third!) time nr_rings > 1 is false, thus the else case is entered
to set up a buffer for the RPTR shadow and consequently written to
RB_RPTR_ADDR, hanging platforms without WHERE_AM_I firmware support.

Restructure the condition in such a way that shadow buffer setup only
ever happens when has_whereami is true; otherwise preemption is only
finalized when the number of ring buffers has not been reset to 1 yet.

Fixes: 8907afb476ac ("drm/msm: Allow a5xx to mark the RPTR shadow as privileged")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 8aa08976aad17..69ed2c6094665 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -755,12 +755,8 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
 	gpu_write(gpu, REG_A5XX_CP_RB_CNTL,
 		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
 
-	/* Disable preemption if WHERE_AM_I isn't available */
-	if (!a5xx_gpu->has_whereami && gpu->nr_rings > 1) {
-		a5xx_preempt_fini(gpu);
-		gpu->nr_rings = 1;
-	} else {
-		/* Create a privileged buffer for the RPTR shadow */
+	/* Create a privileged buffer for the RPTR shadow */
+	if (a5xx_gpu->has_whereami) {
 		if (!a5xx_gpu->shadow_bo) {
 			a5xx_gpu->shadow = msm_gem_kernel_new(gpu->dev,
 				sizeof(u32) * gpu->nr_rings,
@@ -774,6 +770,10 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
 
 		gpu_write64(gpu, REG_A5XX_CP_RB_RPTR_ADDR,
 			REG_A5XX_CP_RB_RPTR_ADDR_HI, shadowptr(a5xx_gpu, gpu->rb[0]));
+	} else if (gpu->nr_rings > 1) {
+		/* Disable preemption if WHERE_AM_I isn't available */
+		a5xx_preempt_fini(gpu);
+		gpu->nr_rings = 1;
 	}
 
 	a5xx_preempt_hw_init(gpu);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 320/717] drm/msm: add IOMMU_SUPPORT dependency
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (318 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 319/717] drm/msm: a5xx: Make preemption reset case reentrant Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 321/717] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
                   ` (398 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Rob Clark, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit e319a1b956f785f618611857cd946dca2bb68542 ]

The iommu pgtable support is only available when IOMMU support
is built into the kernel:

WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE
  Depends on [n]: IOMMU_SUPPORT [=n]
  Selected by [y]:
  - DRM_MSM [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARCH_QCOM [=y] || SOC_IMX5 || ARM && COMPILE_TEST [=y]) && OF [=y] && COMMON_CLK [=y] && MMU [=y] && (QCOM_OCMEM [=y] || QCOM_OCMEM [=y]=n)

Fix the dependency accordingly. There is no need for depending on
CONFIG_MMU any more, as that is implied by the iommu support.

Fixes: b145c6e65eb0 ("drm/msm: Add support to create a local pagetable")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index e5816b4984942..dabb4a1ccdcf7 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -4,8 +4,8 @@ config DRM_MSM
 	tristate "MSM DRM"
 	depends on DRM
 	depends on ARCH_QCOM || SOC_IMX5 || (ARM && COMPILE_TEST)
+	depends on IOMMU_SUPPORT
 	depends on OF && COMMON_CLK
-	depends on MMU
 	depends on QCOM_OCMEM || QCOM_OCMEM=n
 	select IOMMU_IO_PGTABLE
 	select QCOM_MDT_LOADER if ARCH_QCOM
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 321/717] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (319 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 320/717] drm/msm: add IOMMU_SUPPORT dependency Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 322/717] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
                   ` (397 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
	Daniel Lezcano, Sasha Levin

From: Keqian Zhu <zhukeqian1@huawei.com>

[ Upstream commit d8cc3905b8073c7cfbff94af889fa8dc71f21dd5 ]

In commit 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter
to access stable counters"), we separate stable and normal count reader to omit
unnecessary overhead on systems that have no timer erratum.

However, in erratum_set_next_event_tval_generic(), count reader becomes normal
reader. This converts it to stable reader.

Fixes: 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter to access stable counters")
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-2-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 6c3e841801461..777d38cb39b09 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -396,10 +396,10 @@ static void erratum_set_next_event_tval_generic(const int access, unsigned long
 	ctrl &= ~ARCH_TIMER_CTRL_IT_MASK;
 
 	if (access == ARCH_TIMER_PHYS_ACCESS) {
-		cval = evt + arch_counter_get_cntpct();
+		cval = evt + arch_counter_get_cntpct_stable();
 		write_sysreg(cval, cntp_cval_el0);
 	} else {
-		cval = evt + arch_counter_get_cntvct();
+		cval = evt + arch_counter_get_cntvct_stable();
 		write_sysreg(cval, cntv_cval_el0);
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 322/717] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (320 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 321/717] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 323/717] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
                   ` (396 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
	Daniel Lezcano, Sasha Levin

From: Keqian Zhu <zhukeqian1@huawei.com>

[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]

ARM virtual counter supports event stream, it can only trigger an event
when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
when the trigger bit is 0, then virtual counter trigger an event for every
two cycles.

While we're at it, rework the way we compute the trigger bit position
by making it more obvious that when bits [n:n-1] are both set (with n
being the most significant bit), we pick bit (n + 1).

Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 777d38cb39b09..d0177824c518b 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -822,15 +822,24 @@ static void arch_timer_evtstrm_enable(int divider)
 
 static void arch_timer_configure_evtstream(void)
 {
-	int evt_stream_div, pos;
+	int evt_stream_div, lsb;
+
+	/*
+	 * As the event stream can at most be generated at half the frequency
+	 * of the counter, use half the frequency when computing the divider.
+	 */
+	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
+
+	/*
+	 * Find the closest power of two to the divisor. If the adjacent bit
+	 * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
+	 */
+	lsb = fls(evt_stream_div) - 1;
+	if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
+		lsb++;
 
-	/* Find the closest power of two to the divisor */
-	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
-	pos = fls(evt_stream_div);
-	if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
-		pos--;
 	/* enable event stream */
-	arch_timer_evtstrm_enable(min(pos, 15));
+	arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
 }
 
 static void arch_counter_set_user_access(void)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 323/717] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (321 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 322/717] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 324/717] cpufreq: highbank: " Greg Kroah-Hartman
                   ` (395 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 925a5bcefe105f2790ecbdc252eb2315573f309d ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: f525a670533d9 ("cpufreq: ap806: add cpufreq driver for Armada 8K")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/armada-8k-cpufreq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c
index 39e34f5066d3d..b0fc5e84f8570 100644
--- a/drivers/cpufreq/armada-8k-cpufreq.c
+++ b/drivers/cpufreq/armada-8k-cpufreq.c
@@ -204,6 +204,12 @@ static void __exit armada_8k_cpufreq_exit(void)
 }
 module_exit(armada_8k_cpufreq_exit);
 
+static const struct of_device_id __maybe_unused armada_8k_cpufreq_of_match[] = {
+	{ .compatible = "marvell,ap806-cpu-clock" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, armada_8k_cpufreq_of_match);
+
 MODULE_AUTHOR("Gregory Clement <gregory.clement@bootlin.com>");
 MODULE_DESCRIPTION("Armada 8K cpufreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 324/717] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (322 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 323/717] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 325/717] cpufreq: mediatek: " Greg Kroah-Hartman
                   ` (394 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 5a7f6dafcddb6..ac57cddc5f2fe 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -101,6 +101,13 @@ out_put_node:
 }
 module_init(hb_cpufreq_driver_init);
 
+static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
+	{ .compatible = "calxeda,highbank" },
+	{ .compatible = "calxeda,ecx-2000" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
+
 MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
 MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 325/717] cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (323 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 324/717] cpufreq: highbank: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 326/717] cpufreq: qcom: " Greg Kroah-Hartman
                   ` (393 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/mediatek-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index 7d1212c9b7c88..a310372dc53e9 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -540,6 +540,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
 
 	{ }
 };
+MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
 
 static int __init mtk_cpufreq_driver_init(void)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 326/717] cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (324 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 325/717] cpufreq: mediatek: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 327/717] cpufreq: st: " Greg Kroah-Hartman
                   ` (392 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit a5a6031663bc1dd0a10babd49d1bcb3153a8327f ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 46e2856b8e188 ("cpufreq: Add Kryo CPU scaling driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/qcom-cpufreq-nvmem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c
index d06b37822c3df..fba9937a406b3 100644
--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
+++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
@@ -464,6 +464,7 @@ static const struct of_device_id qcom_cpufreq_match_list[] __initconst = {
 	{ .compatible = "qcom,msm8960", .data = &match_data_krait },
 	{},
 };
+MODULE_DEVICE_TABLE(of, qcom_cpufreq_match_list);
 
 /*
  * Since the driver depends on smem and nvmem drivers, which may
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 327/717] cpufreq: st: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (325 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 326/717] cpufreq: qcom: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 328/717] cpufreq: sun50i: " Greg Kroah-Hartman
                   ` (391 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/sti-cpufreq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index 4ac6fb23792a0..c40d3d7d4ea43 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -292,6 +292,13 @@ register_cpufreq_dt:
 }
 module_init(sti_cpufreq_init);
 
+static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
+	{ .compatible = "st,stih407" },
+	{ .compatible = "st,stih410" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
+
 MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
 MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
 MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 328/717] cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (326 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 327/717] cpufreq: st: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 329/717] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
                   ` (390 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Yangtao Li,
	Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit af2096f285077e3339eb835ad06c50bdd59f01b5 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: f328584f7bff8 ("cpufreq: Add sun50i nvmem based CPU scaling driver")
Reviewed-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/sun50i-cpufreq-nvmem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
index 9907a165135b7..2deed8d8773fa 100644
--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
@@ -167,6 +167,7 @@ static const struct of_device_id sun50i_cpufreq_match_list[] = {
 	{ .compatible = "allwinner,sun50i-h6" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, sun50i_cpufreq_match_list);
 
 static const struct of_device_id *sun50i_cpufreq_match_node(void)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 329/717] cpufreq: loongson1: Add missing MODULE_ALIAS
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (327 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 328/717] cpufreq: sun50i: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 330/717] cpufreq: scpi: " Greg Kroah-Hartman
                   ` (389 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson1-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
index 0ea88778882ac..86f612593e497 100644
--- a/drivers/cpufreq/loongson1-cpufreq.c
+++ b/drivers/cpufreq/loongson1-cpufreq.c
@@ -216,6 +216,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
 
 module_platform_driver(ls1x_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:ls1x-cpufreq");
 MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
 MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 330/717] cpufreq: scpi: Add missing MODULE_ALIAS
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (328 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 329/717] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 331/717] cpufreq: vexpress-spc: " Greg Kroah-Hartman
                   ` (388 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/scpi-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 43db05b949d95..e5140ad63db83 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -233,6 +233,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
 };
 module_platform_driver(scpi_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:scpi-cpufreq");
 MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
 MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
 MODULE_LICENSE("GPL v2");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 331/717] cpufreq: vexpress-spc: Add missing MODULE_ALIAS
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (329 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 330/717] cpufreq: scpi: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 332/717] cpufreq: imx: fix NVMEM_IMX_OCOTP dependency Greg Kroah-Hartman
                   ` (387 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit d15183991c2d53d7cecf27a1555c91b702cef1ea ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 47ac9aa165540 ("cpufreq: arm_big_little: add vexpress SPC interface driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/vexpress-spc-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/vexpress-spc-cpufreq.c b/drivers/cpufreq/vexpress-spc-cpufreq.c
index e89b905754d21..f711d8eaea6a2 100644
--- a/drivers/cpufreq/vexpress-spc-cpufreq.c
+++ b/drivers/cpufreq/vexpress-spc-cpufreq.c
@@ -591,6 +591,7 @@ static struct platform_driver ve_spc_cpufreq_platdrv = {
 };
 module_platform_driver(ve_spc_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:vexpress-spc-cpufreq");
 MODULE_AUTHOR("Viresh Kumar <viresh.kumar@linaro.org>");
 MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
 MODULE_DESCRIPTION("Vexpress SPC ARM big LITTLE cpufreq driver");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 332/717] cpufreq: imx: fix NVMEM_IMX_OCOTP dependency
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (330 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 331/717] cpufreq: vexpress-spc: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 333/717] macintosh/adb-iop: Always wait for reply message from IOP Greg Kroah-Hartman
                   ` (386 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Viresh Kumar, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit fc928b901dc68481ba3e524860a641fe13e25dfe ]

A driver should not 'select' drivers from another subsystem.
If NVMEM is disabled, this one results in a warning:

WARNING: unmet direct dependencies detected for NVMEM_IMX_OCOTP
  Depends on [n]: NVMEM [=n] && (ARCH_MXC [=y] || COMPILE_TEST [=y]) && HAS_IOMEM [=y]
  Selected by [y]:
  - ARM_IMX6Q_CPUFREQ [=y] && CPU_FREQ [=y] && (ARM || ARM64 [=y]) && ARCH_MXC [=y] && REGULATOR_ANATOP [=y]

Change the 'select' to 'depends on' to prevent it from going wrong,
and allow compile-testing without that driver, since it is only
a runtime dependency.

Fixes: 2782ef34ed23 ("cpufreq: imx: Select NVMEM_IMX_OCOTP")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/Kconfig.arm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 015ec0c028358..1f73fa75b1a05 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -94,7 +94,7 @@ config ARM_IMX6Q_CPUFREQ
 	tristate "Freescale i.MX6 cpufreq support"
 	depends on ARCH_MXC
 	depends on REGULATOR_ANATOP
-	select NVMEM_IMX_OCOTP
+	depends on NVMEM_IMX_OCOTP || COMPILE_TEST
 	select PM_OPP
 	help
 	  This adds cpufreq driver support for Freescale i.MX6 series SoCs.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 333/717] macintosh/adb-iop: Always wait for reply message from IOP
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (331 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 332/717] cpufreq: imx: fix NVMEM_IMX_OCOTP dependency Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 334/717] macintosh/adb-iop: Send correct poll command Greg Kroah-Hartman
                   ` (385 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joshua Thompson, Stan Johnson,
	Finn Thain, Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 2c9cfbadfa234b03473f1ef54e6f4772cc07a371 ]

A recent patch incorrectly altered the adb-iop state machine behaviour
and introduced a regression that can appear intermittently as a
malfunctioning ADB input device. This seems to be caused when reply
packets from different ADB commands become mixed up, especially during
the adb bus scan. Fix this by unconditionally entering the awaiting_reply
state after sending an explicit command, even when the ADB command won't
generate a reply from the ADB device.

It turns out that the IOP always generates reply messages, even when the
ADB command does not produce a reply packet (e.g. ADB Listen command).
So it's not really the ADB reply packets that are being mixed up, it's the
IOP messages that enclose them. The bug goes like this:

  1. CPU sends a message to the IOP, expecting no response because this
     message contains an ADB Listen command. The ADB command is now
     considered complete.

  2. CPU sends a second message to the IOP, this time expecting a
     response because this message contains an ADB Talk command. This
     ADB command needs a reply before it can be completed.

  3. adb-iop driver receives an IOP message and assumes that it relates
     to the Talk command. It's actually an empty one (with flags ==
     ADB_IOP_EXPLICIT|ADB_IOP_TIMEOUT) for the previous command. The
     Talk command is now considered complete but it gets the wrong reply
     data.

  4. adb-iop driver gets another IOP response message, which contains
     the actual reply data for the Talk command, but this is dropped
     (the driver is no longer in awaiting_reply state).

Cc: Joshua Thompson <funaho@jurai.org>
Fixes: e2954e5f727f ("macintosh/adb-iop: Implement sending -> idle state transition")
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Link: https://lore.kernel.org/r/0f0a25855391e7eaa53a50f651aea0124e8525dd.1605847196.git.fthain@telegraphics.com.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/macintosh/adb-iop.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
index f3d1a460fbce1..422abd1d48e18 100644
--- a/drivers/macintosh/adb-iop.c
+++ b/drivers/macintosh/adb-iop.c
@@ -78,10 +78,7 @@ static void adb_iop_complete(struct iop_msg *msg)
 
 	local_irq_save(flags);
 
-	if (current_req->reply_expected)
-		adb_iop_state = awaiting_reply;
-	else
-		adb_iop_done();
+	adb_iop_state = awaiting_reply;
 
 	local_irq_restore(flags);
 }
@@ -89,8 +86,9 @@ static void adb_iop_complete(struct iop_msg *msg)
 /*
  * Listen for ADB messages from the IOP.
  *
- * This will be called when unsolicited messages (usually replies to TALK
- * commands or autopoll packets) are received.
+ * This will be called when unsolicited IOP messages are received.
+ * These IOP messages can carry ADB autopoll responses and also occur
+ * after explicit ADB commands.
  */
 
 static void adb_iop_listen(struct iop_msg *msg)
@@ -110,8 +108,10 @@ static void adb_iop_listen(struct iop_msg *msg)
 		if (adb_iop_state == awaiting_reply) {
 			struct adb_request *req = current_req;
 
-			req->reply_len = amsg->count + 1;
-			memcpy(req->reply, &amsg->cmd, req->reply_len);
+			if (req->reply_expected) {
+				req->reply_len = amsg->count + 1;
+				memcpy(req->reply, &amsg->cmd, req->reply_len);
+			}
 
 			req_done = true;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 334/717] macintosh/adb-iop: Send correct poll command
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (332 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 333/717] macintosh/adb-iop: Always wait for reply message from IOP Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 335/717] staging: bcm2835: fix vchiq_mmal dependencies Greg Kroah-Hartman
                   ` (384 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joshua Thompson, Stan Johnson,
	Finn Thain, Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 10199e90ee20e68859f8128331ec8d85b036d349 ]

The behaviour of the IOP firmware is not well documented but we do know
that IOP message reply data can be used to issue new ADB commands.
Use the message reply to better control autopoll behaviour by sending
a Talk Register 0 command after every ADB response, not unlike the
algorithm in the via-macii driver. This poll command is addressed to
that device which last received a Talk command (explicit or otherwise).

Cc: Joshua Thompson <funaho@jurai.org>
Fixes: 32226e817043 ("macintosh/adb-iop: Implement idle -> sending state transition")
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Link: https://lore.kernel.org/r/58bba4310da4c29b068345a4b36af8a531397ff7.1605847196.git.fthain@telegraphics.com.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/macintosh/adb-iop.c | 40 +++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
index 422abd1d48e18..0ee3272491501 100644
--- a/drivers/macintosh/adb-iop.c
+++ b/drivers/macintosh/adb-iop.c
@@ -25,6 +25,7 @@
 static struct adb_request *current_req;
 static struct adb_request *last_req;
 static unsigned int autopoll_devs;
+static u8 autopoll_addr;
 
 static enum adb_iop_state {
 	idle,
@@ -41,6 +42,11 @@ static int adb_iop_autopoll(int);
 static void adb_iop_poll(void);
 static int adb_iop_reset_bus(void);
 
+/* ADB command byte structure */
+#define ADDR_MASK       0xF0
+#define OP_MASK         0x0C
+#define TALK            0x0C
+
 struct adb_driver adb_iop_driver = {
 	.name         = "ISM IOP",
 	.probe        = adb_iop_probe,
@@ -94,17 +100,24 @@ static void adb_iop_complete(struct iop_msg *msg)
 static void adb_iop_listen(struct iop_msg *msg)
 {
 	struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
+	u8 addr = (amsg->cmd & ADDR_MASK) >> 4;
+	u8 op = amsg->cmd & OP_MASK;
 	unsigned long flags;
 	bool req_done = false;
 
 	local_irq_save(flags);
 
-	/* Handle a timeout. Timeout packets seem to occur even after
-	 * we've gotten a valid reply to a TALK, presumably because of
-	 * autopolling.
+	/* Responses to Talk commands may be unsolicited as they are
+	 * produced when the IOP polls devices. They are mostly timeouts.
 	 */
-
-	if (amsg->flags & ADB_IOP_EXPLICIT) {
+	if (op == TALK && ((1 << addr) & autopoll_devs))
+		autopoll_addr = addr;
+
+	switch (amsg->flags & (ADB_IOP_EXPLICIT |
+			       ADB_IOP_AUTOPOLL |
+			       ADB_IOP_TIMEOUT)) {
+	case ADB_IOP_EXPLICIT:
+	case ADB_IOP_EXPLICIT | ADB_IOP_TIMEOUT:
 		if (adb_iop_state == awaiting_reply) {
 			struct adb_request *req = current_req;
 
@@ -115,12 +128,16 @@ static void adb_iop_listen(struct iop_msg *msg)
 
 			req_done = true;
 		}
-	} else if (!(amsg->flags & ADB_IOP_TIMEOUT)) {
-		adb_input(&amsg->cmd, amsg->count + 1,
-			  amsg->flags & ADB_IOP_AUTOPOLL);
+		break;
+	case ADB_IOP_AUTOPOLL:
+		if (((1 << addr) & autopoll_devs) &&
+		    amsg->cmd == ADB_READREG(addr, 0))
+			adb_input(&amsg->cmd, amsg->count + 1, 1);
+		break;
 	}
-
-	msg->reply[0] = autopoll_devs ? ADB_IOP_AUTOPOLL : 0;
+	msg->reply[0] = autopoll_addr ? ADB_IOP_AUTOPOLL : 0;
+	msg->reply[1] = 0;
+	msg->reply[2] = autopoll_addr ? ADB_READREG(autopoll_addr, 0) : 0;
 	iop_complete_message(msg);
 
 	if (req_done)
@@ -233,6 +250,9 @@ static void adb_iop_set_ap_complete(struct iop_msg *msg)
 	struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
 
 	autopoll_devs = (amsg->data[1] << 8) | amsg->data[0];
+	if (autopoll_devs & (1 << autopoll_addr))
+		return;
+	autopoll_addr = autopoll_devs ? (ffs(autopoll_devs) - 1) : 0;
 }
 
 static int adb_iop_autopoll(int devs)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 335/717] staging: bcm2835: fix vchiq_mmal dependencies
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (333 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 334/717] macintosh/adb-iop: Send correct poll command Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 336/717] staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls Greg Kroah-Hartman
                   ` (383 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Arnd Bergmann, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 6c91799f59ed491a2b5bf5ef7c6d60306cda4e09 ]

When the MMAL code is built-in but the vchiq core config is
set to =m, the mmal code never gets built, which in turn can
lead to link errors:

ERROR: modpost: "vchiq_mmal_port_set_format" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_port_disable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_port_parameter_set" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_component_finalise" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_port_connect_tunnel" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_component_enable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_finalise" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_component_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_component_disable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "mmal_vchi_buffer_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_port_enable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_version" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_submit_buffer" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "mmal_vchi_buffer_cleanup" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
ERROR: modpost: "vchiq_mmal_port_parameter_get" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!

Change the Kconfig to depend on BCM2835_VCHIQ like the other drivers,
and remove the now redundant dependencies.

Fixes: b18ee53ad297 ("staging: bcm2835: Break MMAL support out from camera")
Acked-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201203223836.1362313-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/vc04_services/vchiq-mmal/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/Kconfig b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
index 500c0d12e4ff2..c99525a0bb452 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
@@ -1,6 +1,6 @@
 config BCM2835_VCHIQ_MMAL
 	tristate "BCM2835 MMAL VCHIQ service"
-	depends on (ARCH_BCM2835 || COMPILE_TEST)
+	depends on BCM2835_VCHIQ
 	help
 	  Enables the MMAL API over VCHIQ interface as used for the
 	  majority of the multimedia services on VideoCore.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 336/717] staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (334 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 335/717] staging: bcm2835: fix vchiq_mmal dependencies Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 337/717] spi: dw: Fix error return code in dw_spi_bt1_probe() Greg Kroah-Hartman
                   ` (382 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Vaibhav Agarwal,
	Wang Hai, Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit e77b259f67ab99f1e22ce895b9b1c637fd5f2d4c ]

In gbaudio_dapm_free_controls(), if one of the widgets is not found, an error
will be returned directly, which will cause the rest to be unable to be freed,
resulting in leak.

This patch fixes the bug. If if one of them is not found, just skip and free the others.

Fixes: 510e340efe0c ("staging: greybus: audio: Add helper APIs for dynamic audio module")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201205103827.31244-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/audio_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c
index 237531ba60f30..3011b8abce389 100644
--- a/drivers/staging/greybus/audio_helper.c
+++ b/drivers/staging/greybus/audio_helper.c
@@ -135,7 +135,8 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm,
 		if (!w) {
 			dev_err(dapm->dev, "%s: widget not found\n",
 				widget->name);
-			return -EINVAL;
+			widget++;
+			continue;
 		}
 		widget++;
 #ifdef CONFIG_DEBUG_FS
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 337/717] spi: dw: Fix error return code in dw_spi_bt1_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (335 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 336/717] staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 338/717] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
                   ` (381 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Serge Semin, Mark Brown, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit e748edd9841306908b4e02dddd0afd1aa1f8b973 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/1607071357-33378-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-dw-bt1.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-dw-bt1.c b/drivers/spi/spi-dw-bt1.c
index f382dfad78421..c279b7891e3ac 100644
--- a/drivers/spi/spi-dw-bt1.c
+++ b/drivers/spi/spi-dw-bt1.c
@@ -280,8 +280,10 @@ static int dw_spi_bt1_probe(struct platform_device *pdev)
 	dws->bus_num = pdev->id;
 	dws->reg_io_width = 4;
 	dws->max_freq = clk_get_rate(dwsbt1->clk);
-	if (!dws->max_freq)
+	if (!dws->max_freq) {
+		ret = -EINVAL;
 		goto err_disable_clk;
+	}
 
 	init_func = device_get_match_data(&pdev->dev);
 	ret = init_func(pdev, dwsbt1);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 338/717] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (336 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 337/717] spi: dw: Fix error return code in dw_spi_bt1_probe() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 339/717] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
                   ` (380 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Marcel Holtmann,
	Johan Hedberg, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit d1e9d232e1e60fa63df1b836ec3ecba5abd3fa9d ]

btusb_mtk_setup_firmware() misses to call release_firmware() in an error
path. Jump to err_release_fw to fix it.

Fixes: f645125711c8 ("Bluetooth: btusb: fix up firmware download sequence")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 1005b6e8ff743..a9981678199d7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3067,7 +3067,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
 	err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
 	if (err < 0) {
 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
-		return err;
+		goto err_release_fw;
 	}
 
 	fw_ptr = fw->data;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 339/717] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (337 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 338/717] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 340/717] Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option Greg Kroah-Hartman
                   ` (379 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Marcel Holtmann,
	Johan Hedberg, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit b73b5781a85c03113476f62346c390f0277baa4b ]

mtk_setup_firmware() misses to call release_firmware() in an error
path. Jump to free_fw to fix it.

Fixes: 737cd06072a7 ("Bluetooth: btmtksdio: fix up firmware download sequence")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btmtksdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index ba45c59bd9f36..5f9f027956317 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -704,7 +704,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
 	if (err < 0) {
 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
-		return err;
+		goto free_fw;
 	}
 
 	fw_ptr = fw->data;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 340/717] Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (338 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 339/717] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 341/717] block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name Greg Kroah-Hartman
                   ` (378 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
	Luiz Augusto Von Dentz, Marcel Holtmann, Johan Hedberg,
	Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit f6b8c6b5543983e9de29dc14716bfa4eb3f157c4 ]

This commit add the invalid check for connected socket, without it will
causes the following crash due to sco_pi(sk)->conn being NULL:

KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00
      00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
      c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c
RSP: 0018:ffff88801bb17d88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83a4ecdf
RDX: 000000000000000a RSI: ffffc90002fce000 RDI: 0000000000000050
RBP: 1ffff11003762fb4 R08: 0000000000000001 R09: ffff88810e1008c0
R10: ffffffffbd695dcf R11: fffffbfff7ad2bb9 R12: 0000000000000000
R13: ffff888018ff1000 R14: dffffc0000000000 R15: 000000000000000d
FS:  00007fb4f76c1700(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555e3b7a938 CR3: 00000001117be001 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 ? sco_skb_put_cmsg+0x80/0x80
 ? sco_skb_put_cmsg+0x80/0x80
 __sys_getsockopt+0x12a/0x220
 ? __ia32_sys_setsockopt+0x150/0x150
 ? syscall_enter_from_user_mode+0x18/0x50
 ? rcu_read_lock_bh_held+0xb0/0xb0
 __x64_sys_getsockopt+0xba/0x150
 ? syscall_enter_from_user_mode+0x1d/0x50
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 0fc1a726f897 ("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Luiz Augusto Von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 79ffcdef0b7ad..22a110f37abc6 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1003,6 +1003,11 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
 
 	case BT_SNDMTU:
 	case BT_RCVMTU:
+		if (sk->sk_state != BT_CONNECTED) {
+			err = -ENOTCONN;
+			break;
+		}
+
 		if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
 			err = -EFAULT;
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 341/717] block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (339 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 340/717] Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 342/717] block/rnbd: fix a null pointer dereference on dev->blk_symlink_name Greg Kroah-Hartman
                   ` (377 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Md Haris Iqbal, Jack Wang,
	Lutz Pogrell, Jens Axboe, Sasha Levin

From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>

[ Upstream commit 64e8a6ece1a5b1fa21316918053d068baeac84af ]

For every rnbd_clt_dev, we alloc the pathname and blk_symlink_name
statically to NAME_MAX which is 255 bytes. In most of the cases we only
need less than 10 bytes, so 500 bytes per block device are wasted.

This commit dynamically allocates memory buffer for pathname and
blk_symlink_name.

Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Reviewed-by: Lutz Pogrell <lutz.pogrell@cloud.ionos.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rnbd/rnbd-clt-sysfs.c | 12 ++++++++++--
 drivers/block/rnbd/rnbd-clt.c       | 14 +++++++++++---
 drivers/block/rnbd/rnbd-clt.h       |  4 ++--
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
index 4f4474eecadb7..b53df40c9a97f 100644
--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
+++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
@@ -435,6 +435,7 @@ void rnbd_clt_remove_dev_symlink(struct rnbd_clt_dev *dev)
 	 */
 	if (strlen(dev->blk_symlink_name) && try_module_get(THIS_MODULE)) {
 		sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name);
+		kfree(dev->blk_symlink_name);
 		module_put(THIS_MODULE);
 	}
 }
@@ -487,10 +488,17 @@ static int rnbd_clt_get_path_name(struct rnbd_clt_dev *dev, char *buf,
 static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
 {
 	struct kobject *gd_kobj = &disk_to_dev(dev->gd)->kobj;
-	int ret;
+	int ret, len;
+
+	len = strlen(dev->pathname) + strlen(dev->sess->sessname) + 2;
+	dev->blk_symlink_name = kzalloc(len, GFP_KERNEL);
+	if (!dev->blk_symlink_name) {
+		rnbd_clt_err(dev, "Failed to allocate memory for blk_symlink_name\n");
+		goto out_err;
+	}
 
 	ret = rnbd_clt_get_path_name(dev, dev->blk_symlink_name,
-				      sizeof(dev->blk_symlink_name));
+				      len);
 	if (ret) {
 		rnbd_clt_err(dev, "Failed to get /sys/block symlink path, err: %d\n",
 			      ret);
diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
index 8b2411ccbda97..f180ebf1e11c9 100644
--- a/drivers/block/rnbd/rnbd-clt.c
+++ b/drivers/block/rnbd/rnbd-clt.c
@@ -59,6 +59,7 @@ static void rnbd_clt_put_dev(struct rnbd_clt_dev *dev)
 	ida_simple_remove(&index_ida, dev->clt_device_id);
 	mutex_unlock(&ida_lock);
 	kfree(dev->hw_queues);
+	kfree(dev->pathname);
 	rnbd_clt_put_sess(dev->sess);
 	mutex_destroy(&dev->lock);
 	kfree(dev);
@@ -1381,10 +1382,17 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 		       pathname, sess->sessname, ret);
 		goto out_queues;
 	}
+
+	dev->pathname = kzalloc(strlen(pathname) + 1, GFP_KERNEL);
+	if (!dev->pathname) {
+		ret = -ENOMEM;
+		goto out_queues;
+	}
+	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
+
 	dev->clt_device_id	= ret;
 	dev->sess		= sess;
 	dev->access_mode	= access_mode;
-	strlcpy(dev->pathname, pathname, sizeof(dev->pathname));
 	mutex_init(&dev->lock);
 	refcount_set(&dev->refcount, 1);
 	dev->dev_state = DEV_STATE_INIT;
@@ -1413,8 +1421,8 @@ static bool __exists_dev(const char *pathname)
 	list_for_each_entry(sess, &sess_list, list) {
 		mutex_lock(&sess->lock);
 		list_for_each_entry(dev, &sess->devs_list, list) {
-			if (!strncmp(dev->pathname, pathname,
-				     sizeof(dev->pathname))) {
+			if (strlen(dev->pathname) == strlen(pathname) &&
+			    !strcmp(dev->pathname, pathname)) {
 				found = true;
 				break;
 			}
diff --git a/drivers/block/rnbd/rnbd-clt.h b/drivers/block/rnbd/rnbd-clt.h
index ed33654aa4868..b193d59040503 100644
--- a/drivers/block/rnbd/rnbd-clt.h
+++ b/drivers/block/rnbd/rnbd-clt.h
@@ -108,7 +108,7 @@ struct rnbd_clt_dev {
 	u32			clt_device_id;
 	struct mutex		lock;
 	enum rnbd_clt_dev_state	dev_state;
-	char			pathname[NAME_MAX];
+	char			*pathname;
 	enum rnbd_access_mode	access_mode;
 	bool			read_only;
 	bool			rotational;
@@ -126,7 +126,7 @@ struct rnbd_clt_dev {
 	struct list_head        list;
 	struct gendisk		*gd;
 	struct kobject		kobj;
-	char			blk_symlink_name[NAME_MAX];
+	char			*blk_symlink_name;
 	refcount_t		refcount;
 	struct work_struct	unmap_on_rmmod_work;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 342/717] block/rnbd: fix a null pointer dereference on dev->blk_symlink_name
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (340 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 341/717] block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 343/717] Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 Greg Kroah-Hartman
                   ` (376 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Jens Axboe, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 733c15bd3a944b8eeaacdddf061759b6a83dd3f4 ]

Currently in the case where dev->blk_symlink_name fails to be allocates
the error return path attempts to set an end-of-string character to
the unallocated dev->blk_symlink_name causing a null pointer dereference
error. Fix this by returning with an explicity ENOMEM error (which also
is missing in the original code as was not initialized).

Fixes: 1eb54f8f5dd8 ("block/rnbd: client: sysfs interface functions")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Dereference after null check")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rnbd/rnbd-clt-sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
index b53df40c9a97f..d854f057056bb 100644
--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
+++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
@@ -494,7 +494,7 @@ static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
 	dev->blk_symlink_name = kzalloc(len, GFP_KERNEL);
 	if (!dev->blk_symlink_name) {
 		rnbd_clt_err(dev, "Failed to allocate memory for blk_symlink_name\n");
-		goto out_err;
+		return -ENOMEM;
 	}
 
 	ret = rnbd_clt_get_path_name(dev, dev->blk_symlink_name,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 343/717] Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (341 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 342/717] block/rnbd: fix a null pointer dereference on dev->blk_symlink_name Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 344/717] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models Greg Kroah-Hartman
                   ` (375 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Marcel Holtmann,
	Johan Hedberg, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit d74e0ae7e03032b47b8631cc1e52a7ae1ce988c0 ]

Commit cde1a8a99287 ("Bluetooth: btusb: Fix and detect most of the
Chinese Bluetooth controllers") made the detection of fake controllers
more generic fixing it for much of the newer fakes / clones.

But this does not work for a fake CSR controller with a bcdDevice
value of 0x0134, which was correctly identified as fake before
this change.

Add an extra check for this special case, checking for a combination
of a bcdDevice value of 0x0134, together with a lmp_subver of 0x0c5c
and a hci_ver of BLUETOOTH_VER_2_0.

The chip inside this fake dongle is marked as with "clockwise cw6629d".

Fixes: cde1a8a99287 ("Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a9981678199d7..80468745d5c5e 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1763,6 +1763,8 @@ static int btusb_setup_bcm92035(struct hci_dev *hdev)
 
 static int btusb_setup_csr(struct hci_dev *hdev)
 {
+	struct btusb_data *data = hci_get_drvdata(hdev);
+	u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
 	struct hci_rp_read_local_version *rp;
 	struct sk_buff *skb;
 	bool is_fake = false;
@@ -1832,6 +1834,12 @@ static int btusb_setup_csr(struct hci_dev *hdev)
 		 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
 		is_fake = true;
 
+	/* Other clones which beat all the above checks */
+	else if (bcdDevice == 0x0134 &&
+		 le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
+		 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
+		is_fake = true;
+
 	if (is_fake) {
 		bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 344/717] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (342 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 343/717] Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 345/717] adm8211: fix error return code in adm8211_probe() Greg Kroah-Hartman
                   ` (374 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit a4327979a19e8734ddefbd8bcbb73bd9905b69cd ]

Some HP x360 models have an ACPI VGBS method which sets bit 4 instead of
bit 6 when NOT in tablet mode at boot. Inspecting all the DSDTs in my DSDT
collection shows only one other model, the Medion E1239T ever setting bit 4
and it always sets this together with bit 6.

So lets treat bit 4 as a second bit which when set indicates the device not
being in tablet-mode, as we already do for bit 6.

While at it also prefix all VGBS constant defines with "VGBS_".

Note this wrokaround was first added to the kernel as
commit d823346876a9 ("platform/x86: intel-vbtn: Fix SW_TABLET_MODE always
reporting 1 on the HP Pavilion 11 x360").
After commit 8169bd3e6e19 ("platform/x86: intel-vbtn: Switch to an
allow-list for SW_TABLET_MODE reporting") got added to the kernel this
was reverted, because with the new allow-list approach the workaround
was no longer necessary for the model on which the issue was first
reported.

But it turns out that the workaround is still necessary because some
affected models report a chassis-type of 31 which is on the allow-list.

BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1894017
Fixes: 21d64817c724 ("platform/x86: intel-vbtn: Revert "Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360"")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel-vbtn.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index 0419c8001fe33..123401f04b55a 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -15,9 +15,13 @@
 #include <linux/platform_device.h>
 #include <linux/suspend.h>
 
+/* Returned when NOT in tablet mode on some HP Stream x360 11 models */
+#define VGBS_TABLET_MODE_FLAG_ALT	0x10
 /* When NOT in tablet mode, VGBS returns with the flag 0x40 */
-#define TABLET_MODE_FLAG 0x40
-#define DOCK_MODE_FLAG   0x80
+#define VGBS_TABLET_MODE_FLAG		0x40
+#define VGBS_DOCK_MODE_FLAG		0x80
+
+#define VGBS_TABLET_MODE_FLAGS (VGBS_TABLET_MODE_FLAG | VGBS_TABLET_MODE_FLAG_ALT)
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("AceLan Kao");
@@ -72,9 +76,9 @@ static void detect_tablet_mode(struct platform_device *device)
 	if (ACPI_FAILURE(status))
 		return;
 
-	m = !(vgbs & TABLET_MODE_FLAG);
+	m = !(vgbs & VGBS_TABLET_MODE_FLAGS);
 	input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
-	m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;
+	m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;
 	input_report_switch(priv->input_dev, SW_DOCK, m);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 345/717] adm8211: fix error return code in adm8211_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (343 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 344/717] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 346/717] mtd: spi-nor: sst: fix BPn bits for the SST25VF064C Greg Kroah-Hartman
                   ` (373 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Kalle Valo, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 05c2a61d69ea306e891884a86486e1ef37c4b78d ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: cc0b88cf5ecf ("[PATCH] Add adm8211 802.11b wireless driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1607071638-33619-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/admtek/adm8211.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/admtek/adm8211.c b/drivers/net/wireless/admtek/adm8211.c
index 5cf2045fadeff..c41e72508d3db 100644
--- a/drivers/net/wireless/admtek/adm8211.c
+++ b/drivers/net/wireless/admtek/adm8211.c
@@ -1796,6 +1796,7 @@ static int adm8211_probe(struct pci_dev *pdev,
 	if (io_len < 256 || mem_len < 1024) {
 		printk(KERN_ERR "%s (adm8211): Too short PCI resources\n",
 		       pci_name(pdev));
+		err = -ENOMEM;
 		goto err_disable_pdev;
 	}
 
@@ -1805,6 +1806,7 @@ static int adm8211_probe(struct pci_dev *pdev,
 	if (reg != ADM8211_SIG1 && reg != ADM8211_SIG2) {
 		printk(KERN_ERR "%s (adm8211): Invalid signature (0x%x)\n",
 		       pci_name(pdev), reg);
+		err = -EINVAL;
 		goto err_disable_pdev;
 	}
 
@@ -1815,8 +1817,8 @@ static int adm8211_probe(struct pci_dev *pdev,
 		return err; /* someone else grabbed it? don't disable it */
 	}
 
-	if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)) ||
-	    dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32))) {
+	err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+	if (err) {
 		printk(KERN_ERR "%s (adm8211): No suitable DMA available\n",
 		       pci_name(pdev));
 		goto err_free_reg;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 346/717] mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (344 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 345/717] adm8211: fix error return code in adm8211_probe() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 347/717] mtd: spi-nor: ignore errors in spi_nor_unlock_all() Greg Kroah-Hartman
                   ` (372 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tudor Ambarus, Michael Walle,
	Vignesh Raghavendra, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit 989d4b72bae3b05c1564d38e71e18f65b12734fb ]

This flash part actually has 4 block protection bits.

Please note, that this patch is just based on information of the
datasheet of the datasheet and wasn't tested.

Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
Reported-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201203162959.29589-2-michael@walle.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/sst.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/spi-nor/sst.c b/drivers/mtd/spi-nor/sst.c
index e0af6d25d573b..0ab07624fb73f 100644
--- a/drivers/mtd/spi-nor/sst.c
+++ b/drivers/mtd/spi-nor/sst.c
@@ -18,7 +18,8 @@ static const struct flash_info sst_parts[] = {
 			      SECT_4K | SST_WRITE) },
 	{ "sst25vf032b", INFO(0xbf254a, 0, 64 * 1024, 64,
 			      SECT_4K | SST_WRITE) },
-	{ "sst25vf064c", INFO(0xbf254b, 0, 64 * 1024, 128, SECT_4K) },
+	{ "sst25vf064c", INFO(0xbf254b, 0, 64 * 1024, 128,
+			      SECT_4K | SPI_NOR_4BIT_BP) },
 	{ "sst25wf512",  INFO(0xbf2501, 0, 64 * 1024,  1,
 			      SECT_4K | SST_WRITE) },
 	{ "sst25wf010",  INFO(0xbf2502, 0, 64 * 1024,  2,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 347/717] mtd: spi-nor: ignore errors in spi_nor_unlock_all()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (345 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 346/717] mtd: spi-nor: sst: fix BPn bits for the SST25VF064C Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 348/717] mtd: spi-nor: atmel: remove global protection flag Greg Kroah-Hartman
                   ` (371 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Vignesh Raghavendra,
	Tudor Ambarus, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit bdb1a75e4b9df6861ec6a6e3e3997820d3cebabe ]

Just try to unlock the whole SPI-NOR flash array. Don't abort the
probing in case of an error. Justifications:
 (1) For some boards, this just works because
     spi_nor_write_16bit_sr_and_check() is broken and just checks the
     second half of the 16bit. Once that will be fixed, SPI probe will
     fail for boards which has hardware-write protected SPI-NOR flashes.
 (2) Until now, hardware write-protection was the only viable solution
     to use the block protection bits. This is because this very
     function spi_nor_unlock_all() will be called unconditionally on
     every linux boot. Therefore, this bits only makes sense in
     combination with the hardware write-protection. If we would fail
     the SPI probe on an error in spi_nor_unlock_all() we'd break
     virtually all users of the block protection bits.
 (3) We should try hard to keep the MTD working even if the flash might
     not be writable/erasable.

Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201203162959.29589-3-michael@walle.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/core.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index f0ae7a01703a1..61b00d4965475 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2915,20 +2915,27 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
 }
 
 /**
- * spi_nor_unlock_all() - Unlocks the entire flash memory array.
+ * spi_nor_try_unlock_all() - Tries to unlock the entire flash memory array.
  * @nor:	pointer to a 'struct spi_nor'.
  *
  * Some SPI NOR flashes are write protected by default after a power-on reset
  * cycle, in order to avoid inadvertent writes during power-up. Backward
  * compatibility imposes to unlock the entire flash memory array at power-up
  * by default.
+ *
+ * Unprotecting the entire flash array will fail for boards which are hardware
+ * write-protected. Thus any errors are ignored.
  */
-static int spi_nor_unlock_all(struct spi_nor *nor)
+static void spi_nor_try_unlock_all(struct spi_nor *nor)
 {
-	if (nor->flags & SNOR_F_HAS_LOCK)
-		return spi_nor_unlock(&nor->mtd, 0, nor->params->size);
+	int ret;
 
-	return 0;
+	if (!(nor->flags & SNOR_F_HAS_LOCK))
+		return;
+
+	ret = spi_nor_unlock(&nor->mtd, 0, nor->params->size);
+	if (ret)
+		dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
 }
 
 static int spi_nor_init(struct spi_nor *nor)
@@ -2941,11 +2948,7 @@ static int spi_nor_init(struct spi_nor *nor)
 		return err;
 	}
 
-	err = spi_nor_unlock_all(nor);
-	if (err) {
-		dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
-		return err;
-	}
+	spi_nor_try_unlock_all(nor);
 
 	if (nor->addr_width == 4 && !(nor->flags & SNOR_F_4B_OPCODES)) {
 		/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 348/717] mtd: spi-nor: atmel: remove global protection flag
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (346 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 347/717] mtd: spi-nor: ignore errors in spi_nor_unlock_all() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 349/717] mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040 Greg Kroah-Hartman
                   ` (370 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Vignesh Raghavendra,
	Tudor Ambarus, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit e6204d4620276398ed7317d64c369813a1f96615 ]

This is considered bad for the following reasons:
 (1) We only support the block protection with BPn bits for write
     protection. Not all Atmel parts support this.
 (2) Newly added flash chip will automatically inherit the "has
     locking" support and thus needs to explicitly tested. Better
     be opt-in instead of opt-out.
 (3) There are already supported flashes which doesn't support
     the locking scheme. So I assume this wasn't properly tested
     before adding that chip; which enforces my previous argument
     that locking support should be an opt-in.

Remove the global flag and add individual flags to all flashes which
supports BP locking. In particular the following flashes don't support
the BP scheme:
 - AT26F004
 - AT25SL321
 - AT45DB081D

Please note, that some flashes which are marked as SPI_NOR_HAS_LOCK just
support Global Protection, i.e. not our supported block protection
locking scheme. This is to keep backwards compatibility with the
current "unlock all at boot" mechanism. In particular the following
flashes doesn't have BP bits:
 - AT25DF041A
 - AT25DF321
 - AT25DF321A
 - AT25DF641
 - AT26DF081A
 - AT26DF161A
 - AT26DF321

Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201203162959.29589-4-michael@walle.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/atmel.c | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/drivers/mtd/spi-nor/atmel.c b/drivers/mtd/spi-nor/atmel.c
index 3f5f21a473a69..49d392c6c8bc5 100644
--- a/drivers/mtd/spi-nor/atmel.c
+++ b/drivers/mtd/spi-nor/atmel.c
@@ -10,37 +10,27 @@
 
 static const struct flash_info atmel_parts[] = {
 	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
-	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
-	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
+	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
 
-	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K) },
-	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K) },
-	{ "at25df321a", INFO(0x1f4701, 0, 64 * 1024,  64, SECT_4K) },
-	{ "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K) },
+	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at25df321a", INFO(0x1f4701, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K | SPI_NOR_HAS_LOCK) },
 
 	{ "at25sl321",	INFO(0x1f4216, 0, 64 * 1024, 64,
 			     SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
 
 	{ "at26f004",   INFO(0x1f0400, 0, 64 * 1024,  8, SECT_4K) },
-	{ "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K) },
-	{ "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K) },
-	{ "at26df321",  INFO(0x1f4700, 0, 64 * 1024, 64, SECT_4K) },
+	{ "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at26df321",  INFO(0x1f4700, 0, 64 * 1024, 64, SECT_4K | SPI_NOR_HAS_LOCK) },
 
 	{ "at45db081d", INFO(0x1f2500, 0, 64 * 1024, 16, SECT_4K) },
 };
 
-static void atmel_default_init(struct spi_nor *nor)
-{
-	nor->flags |= SNOR_F_HAS_LOCK;
-}
-
-static const struct spi_nor_fixups atmel_fixups = {
-	.default_init = atmel_default_init,
-};
-
 const struct spi_nor_manufacturer spi_nor_atmel = {
 	.name = "atmel",
 	.parts = atmel_parts,
 	.nparts = ARRAY_SIZE(atmel_parts),
-	.fixups = &atmel_fixups,
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 349/717] mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (347 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 348/717] mtd: spi-nor: atmel: remove global protection flag Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 350/717] arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements Greg Kroah-Hartman
                   ` (369 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Vignesh Raghavendra,
	Tudor Ambarus, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit 8c174d1511d235ed6c049dcb2b704777ad0df7a5 ]

These flashes have some weird BP bits mapping which aren't supported in
the current locking code. Just add a simple unlock op to unprotect the
entire flash array which is needed for legacy behavior.

Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201203162959.29589-7-michael@walle.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/atmel.c | 53 +++++++++++++++++++++++++++++++++++--
 drivers/mtd/spi-nor/core.c  |  2 +-
 drivers/mtd/spi-nor/core.h  |  1 +
 3 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/spi-nor/atmel.c b/drivers/mtd/spi-nor/atmel.c
index 49d392c6c8bc5..deacf87a68a06 100644
--- a/drivers/mtd/spi-nor/atmel.c
+++ b/drivers/mtd/spi-nor/atmel.c
@@ -8,10 +8,59 @@
 
 #include "core.h"
 
+/*
+ * The Atmel AT25FS010/AT25FS040 parts have some weird configuration for the
+ * block protection bits. We don't support them. But legacy behavior in linux
+ * is to unlock the whole flash array on startup. Therefore, we have to support
+ * exactly this operation.
+ */
+static int atmel_at25fs_lock(struct spi_nor *nor, loff_t ofs, uint64_t len)
+{
+	return -EOPNOTSUPP;
+}
+
+static int atmel_at25fs_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len)
+{
+	int ret;
+
+	/* We only support unlocking the whole flash array */
+	if (ofs || len != nor->params->size)
+		return -EINVAL;
+
+	/* Write 0x00 to the status register to disable write protection */
+	ret = spi_nor_write_sr_and_check(nor, 0);
+	if (ret)
+		dev_dbg(nor->dev, "unable to clear BP bits, WP# asserted?\n");
+
+	return ret;
+}
+
+static int atmel_at25fs_is_locked(struct spi_nor *nor, loff_t ofs, uint64_t len)
+{
+	return -EOPNOTSUPP;
+}
+
+static const struct spi_nor_locking_ops atmel_at25fs_locking_ops = {
+	.lock = atmel_at25fs_lock,
+	.unlock = atmel_at25fs_unlock,
+	.is_locked = atmel_at25fs_is_locked,
+};
+
+static void atmel_at25fs_default_init(struct spi_nor *nor)
+{
+	nor->params->locking_ops = &atmel_at25fs_locking_ops;
+}
+
+static const struct spi_nor_fixups atmel_at25fs_fixups = {
+	.default_init = atmel_at25fs_default_init,
+};
+
 static const struct flash_info atmel_parts[] = {
 	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
-	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK) },
-	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
+	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK)
+		.fixups = &atmel_at25fs_fixups },
+	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK)
+		.fixups = &atmel_at25fs_fixups },
 
 	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
 	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 61b00d4965475..ad6c79d9a7f86 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -906,7 +906,7 @@ static int spi_nor_write_16bit_cr_and_check(struct spi_nor *nor, u8 cr)
  *
  * Return: 0 on success, -errno otherwise.
  */
-static int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1)
+int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1)
 {
 	if (nor->flags & SNOR_F_HAS_16BIT_SR)
 		return spi_nor_write_16bit_sr_and_check(nor, sr1);
diff --git a/drivers/mtd/spi-nor/core.h b/drivers/mtd/spi-nor/core.h
index 6f2f6b27173fd..6f62ee861231a 100644
--- a/drivers/mtd/spi-nor/core.h
+++ b/drivers/mtd/spi-nor/core.h
@@ -409,6 +409,7 @@ void spi_nor_unlock_and_unprep(struct spi_nor *nor);
 int spi_nor_sr1_bit6_quad_enable(struct spi_nor *nor);
 int spi_nor_sr2_bit1_quad_enable(struct spi_nor *nor);
 int spi_nor_sr2_bit7_quad_enable(struct spi_nor *nor);
+int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1);
 
 int spi_nor_xread_sr(struct spi_nor *nor, u8 *sr);
 ssize_t spi_nor_read_data(struct spi_nor *nor, loff_t from, size_t len,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 350/717] arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (348 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 349/717] mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 351/717] arm64: dts: meson: " Greg Kroah-Hartman
                   ` (368 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 1c7412530d5d0e0a0b27f1642f5c13c8b9f36f05 ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. This fixes an issue where the Ethernet link doesn't come up
when using ip link set down/up:
  [   29.360965] meson8b-dwmac ff3f0000.ethernet eth0: Link is Down
  [   34.569012] meson8b-dwmac ff3f0000.ethernet eth0: PHY [0.0:00] driver [RTL8211F Gigabit Ethernet] (irq=31)
  [   34.676732] meson8b-dwmac ff3f0000.ethernet: Failed to reset the dma
  [   34.678874] meson8b-dwmac ff3f0000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed
  [   34.687850] meson8b-dwmac ff3f0000.ethernet eth0: stmmac_open: Hw setup failed

Fixes: 658e4129bb81 ("arm64: dts: meson: g12b: odroid-n2: add the Ethernet PHY reset line")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/df3f5c4fc6e43c55429fd3662a636036a21eed49.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
index 6982632ae6461..39a09661c5f62 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
@@ -413,7 +413,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
 
 		interrupt-parent = <&gpio_intc>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 351/717] arm64: dts: meson: fix PHY deassert timing requirements
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (349 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 350/717] arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 352/717] ARM: " Greg Kroah-Hartman
                   ` (367 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit c183c406c4321002fe85b345b51bc1a3a04b6d33 ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. This fixes an issue seen on ODROID-C2 where the Ethernet
link doesn't come up when using ip link set down/up:
  [ 6630.714855] meson8b-dwmac c9410000.ethernet eth0: Link is Down
  [ 6630.785775] meson8b-dwmac c9410000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=36)
  [ 6630.893071] meson8b-dwmac c9410000.ethernet: Failed to reset the dma
  [ 6630.893800] meson8b-dwmac c9410000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed
  [ 6630.902835] meson8b-dwmac c9410000.ethernet eth0: stmmac_open: Hw setup failed

Fixes: f29cabf240ed ("arm64: dts: meson: use the generic Ethernet PHY reset GPIO bindings")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/4a322c198b86e4c8b3dda015560a683babea4d63.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts   | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi     | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts   | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts        | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts    | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 7be3e354093bf..de27beafe9db9 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -165,7 +165,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 70fcfb7b0683d..50de1d01e5655 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -200,7 +200,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 222ee8069cfaa..9b0b81f191f1f 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -126,7 +126,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index ad812854a107f..a350fee1264d7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -147,7 +147,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
index b08c4537f260d..b2ab05c220903 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
@@ -82,7 +82,7 @@
 
 		/* External PHY reset is shared with internal PHY Led signal */
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index e2bd9c7c817d7..62d3e04299b67 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -194,7 +194,7 @@
 		reg = <0>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index 83eca3af44ce7..dfa7a37a1281f 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -112,7 +112,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 	};
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
index ea45ae0c71b7f..8edbfe040805c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
@@ -64,7 +64,7 @@
 
 		/* External PHY reset is shared with internal PHY Led signal */
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index c89c9f846fb10..dde7cfe12cffa 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -114,7 +114,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 	};
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 352/717] ARM: dts: meson: fix PHY deassert timing requirements
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (350 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 351/717] arm64: dts: meson: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 353/717] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
                   ` (366 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 656ab1bdcd2b755dc161a9774201100d5bf74b8d ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. On similar boards with the same PHY this fixes an issue where
Ethernet link would not come up when using ip link set down/up.

Fixes: a2c6e82e5341 ("ARM: dts: meson: switch to the generic Ethernet PHY reset bindings")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> # on Odroid-C1+
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/ff78772b306411e145769c46d4090554344db41e.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8b-odroidc1.dts    | 2 +-
 arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
index 0c26467de4d03..5963566dbcc9d 100644
--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
@@ -224,7 +224,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
index cc498191ddd1d..8f4eb1ed45816 100644
--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
@@ -81,7 +81,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
 		};
 	};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 353/717] arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (351 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 352/717] ARM: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 354/717] arm64: dts: meson: g12b: w400: " Greg Kroah-Hartman
                   ` (365 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 3d07c3b3a886fefd583c1b485b5e4e3c4e2da493 ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. On similar boards with the same PHY this fixes an issue where
Ethernet link would not come up when using ip link set down/up.

Fixes: ed5e8f689154 ("arm64: dts: meson: g12a: x96-max: fix the Ethernet PHY reset line")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/12506964ca5d5f936579a280ad0a7e7f9a0a2d4c.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
index 1b07c8c06eac5..463a72d6bb7c7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
@@ -340,7 +340,7 @@
 		eee-broken-1000t;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
 
 		interrupt-parent = <&gpio_intc>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 354/717] arm64: dts: meson: g12b: w400: fix PHY deassert timing requirements
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (352 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 353/717] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 355/717] clk: fsl-sai: fix memory leak Greg Kroah-Hartman
                   ` (364 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 9e454e37dc7c0ee9e108d70b983e7a71332aedff ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
egisters. On similar boards with the same PHY this fixes an issue where
Ethernet link would not come up when using ip link set down/up.

Fixes: 2cd2310fca4c ("arm64: dts: meson-g12b-ugoos-am6: add initial device-tree")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/46298e66572784c44f873f1b71cc4ab3d8fc5aa6.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
index 2802ddbb83ac7..feb0885047400 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
@@ -264,7 +264,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
 
 		interrupt-parent = <&gpio_intc>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 355/717] clk: fsl-sai: fix memory leak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (353 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 354/717] arm64: dts: meson: g12b: w400: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 356/717] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
                   ` (363 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Stephen Boyd, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit e81bed419f032824e7ddf8b5630153be6637e480 ]

If the device is removed we don't unregister the composite clock. Fix
that.

Fixes: 9cd10205227c ("clk: fsl-sai: new driver")
Signed-off-by: Michael Walle <michael@walle.cc>
Link: https://lore.kernel.org/r/20201105192746.19564-2-michael@walle.cc
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-fsl-sai.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/clk/clk-fsl-sai.c b/drivers/clk/clk-fsl-sai.c
index 0221180a4dd73..1e81c8d8a6fd3 100644
--- a/drivers/clk/clk-fsl-sai.c
+++ b/drivers/clk/clk-fsl-sai.c
@@ -68,9 +68,20 @@ static int fsl_sai_clk_probe(struct platform_device *pdev)
 	if (IS_ERR(hw))
 		return PTR_ERR(hw);
 
+	platform_set_drvdata(pdev, hw);
+
 	return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw);
 }
 
+static int fsl_sai_clk_remove(struct platform_device *pdev)
+{
+	struct clk_hw *hw = platform_get_drvdata(pdev);
+
+	clk_hw_unregister_composite(hw);
+
+	return 0;
+}
+
 static const struct of_device_id of_fsl_sai_clk_ids[] = {
 	{ .compatible = "fsl,vf610-sai-clock" },
 	{ }
@@ -79,6 +90,7 @@ MODULE_DEVICE_TABLE(of, of_fsl_sai_clk_ids);
 
 static struct platform_driver fsl_sai_clk_driver = {
 	.probe = fsl_sai_clk_probe,
+	.remove = fsl_sai_clk_remove,
 	.driver		= {
 		.name	= "fsl-sai-clk",
 		.of_match_table = of_fsl_sai_clk_ids,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 356/717] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (354 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 355/717] clk: fsl-sai: fix memory leak Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 357/717] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
                   ` (362 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Christie, Qinglang Miao,
	Martin K. Petersen, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]

Add the missing destroy_workqueue() before return from __qedi_probe in the
error handling case when fails to create workqueue qedi->offload_thread.

Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qedi/qedi_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 61fab01d2d527..f5fc7f518f8af 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2766,7 +2766,7 @@ retry_probe:
 			QEDI_ERR(&qedi->dbg_ctx,
 				 "Unable to start offload thread!\n");
 			rc = -ENODEV;
-			goto free_cid_que;
+			goto free_tmf_thread;
 		}
 
 		INIT_DELAYED_WORK(&qedi->recovery_work, qedi_recovery_handler);
@@ -2790,6 +2790,8 @@ retry_probe:
 
 	return 0;
 
+free_tmf_thread:
+	destroy_workqueue(qedi->tmf_thread);
 free_cid_que:
 	qedi_release_cid_que(qedi);
 free_uio:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 357/717] scsi: pm80xx: Fix error return in pm8001_pci_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (355 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 356/717] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 358/717] scsi: iscsi: Fix inappropriate use of put_device() Greg Kroah-Hartman
                   ` (361 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Wang, Zhang Qilong,
	Martin K. Petersen, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]

The driver did not return an error in the case where
pm8001_configure_phy_settings() failed.

Use rc to store the return value of pm8001_configure_phy_settings().

Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm8001_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 3cf3e58b69799..2025361b36e96 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -1131,7 +1131,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
 
 	pm8001_init_sas_add(pm8001_ha);
 	/* phy setting support for motherboard controller */
-	if (pm8001_configure_phy_settings(pm8001_ha))
+	rc = pm8001_configure_phy_settings(pm8001_ha);
+	if (rc)
 		goto err_out_shost;
 
 	pm8001_post_sas_ha_init(shost, chip);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 358/717] scsi: iscsi: Fix inappropriate use of put_device()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (356 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 357/717] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 359/717] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
                   ` (360 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Mike Christie,
	Qinglang Miao, Martin K. Petersen, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 6dc1c7ab6f047f45b62986ffebc5324e86ed5f5a ]

kfree(conn) is called inside put_device(&conn->dev) which could lead to
use-after-free. In addition, device_unregister() should be used here rather
than put_deviceO().

Link: https://lore.kernel.org/r/20201120074852.31658-1-miaoqinglang@huawei.com
Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport registration failure")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 2eb3e4f9375a5..2e68c0a876986 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
 	return conn;
 
 release_conn_ref:
-	put_device(&conn->dev);
+	device_unregister(&conn->dev);
+	put_device(&session->dev);
+	return NULL;
 release_parent_ref:
 	put_device(&session->dev);
 free_conn:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 359/717] seq_buf: Avoid type mismatch for seq_buf_init
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (357 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 358/717] scsi: iscsi: Fix inappropriate use of put_device() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 360/717] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
                   ` (359 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Arnd Bergmann,
	Steven Rostedt (VMware),
	Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]

Building with W=2 prints a number of warnings for one function that
has a pointer type mismatch:

linux/seq_buf.h: In function 'seq_buf_init':
linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]

Change the type in the function prototype according to the type in
the structure.

Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org

Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/seq_buf.h   | 2 +-
 include/linux/trace_seq.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
index fb0205d87d3c1..9d6c28cc4d8f2 100644
--- a/include/linux/seq_buf.h
+++ b/include/linux/seq_buf.h
@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
 }
 
 static inline void
-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
+seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
 {
 	s->buffer = buf;
 	s->size = size;
diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
index 6c30508fca198..5a2c650d9e1c1 100644
--- a/include/linux/trace_seq.h
+++ b/include/linux/trace_seq.h
@@ -12,7 +12,7 @@
  */
 
 struct trace_seq {
-	unsigned char		buffer[PAGE_SIZE];
+	char			buffer[PAGE_SIZE];
 	struct seq_buf		seq;
 	int			full;
 };
@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
  * that is about to be written to and then return the result
  * of that write.
  */
-static inline unsigned char *
+static inline char *
 trace_seq_buffer_ptr(struct trace_seq *s)
 {
 	return s->buffer + seq_buf_used(&s->seq);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 360/717] scsi: fnic: Fix error return code in fnic_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (358 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 359/717] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.10 361/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
                   ` (358 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Karan Tilak Kumar,
	Zhang Changzhong, Martin K. Petersen, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]

Return a negative error code from the error handling case instead of 0 as
done elsewhere in this function.

Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/fnic/fnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index 5f8a7ef8f6a8e..4f7befb43d604 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -740,6 +740,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	for (i = 0; i < FNIC_IO_LOCKS; i++)
 		spin_lock_init(&fnic->io_req_lock[i]);
 
+	err = -ENOMEM;
 	fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
 	if (!fnic->io_req_pool)
 		goto err_out_free_resources;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 361/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (359 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 360/717] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 362/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system Greg Kroah-Hartman
                   ` (357 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ]

Fix array names to match assignments for data items and data items
counter in 'mlxplat_mlxcpld_default_items' structure for:
	.data = mlxplat_mlxcpld_default_pwr_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
and
	.data = mlxplat_mlxcpld_default_fan_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),

Replace:
- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
   ARRAY_SIZE() calculation.
- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
   for ARRAY_SIZE() calculation.

Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201207174745.22889-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 598f445587649..902424e06180c 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -465,7 +465,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF,
 		.reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
 		.mask = MLXPLAT_CPLD_PWR_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
 		.inversed = 0,
 		.health = false,
 	},
@@ -474,7 +474,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF,
 		.reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
 		.mask = MLXPLAT_CPLD_FAN_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
 		.inversed = 1,
 		.health = false,
 	},
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 362/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (360 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.10 361/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 363/717] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode Greg Kroah-Hartman
                   ` (356 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit cf791774a16caf87b0e4c0c55b82979bad0b6c01 ]

Fix array names to match assignments for data items and data items
counter in 'mlxplat_mlxcpld_comex_items' structure for:
	.data = mlxplat_mlxcpld_default_pwr_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
and
	.data = mlxplat_mlxcpld_default_fan_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),

Replace:
- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
   ARRAY_SIZE() calculation.
- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
   for ARRAY_SIZE() calculation.

Fixes: bdd6e155e0d6 ("platform/x86: mlx-platform: Add support for new system type")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201207174745.22889-3-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 902424e06180c..be8cb880de596 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -504,7 +504,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_comex_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_MASK_CARRIER,
 		.reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
 		.mask = MLXPLAT_CPLD_PWR_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
 		.inversed = 0,
 		.health = false,
 	},
@@ -513,7 +513,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_comex_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_MASK_CARRIER,
 		.reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
 		.mask = MLXPLAT_CPLD_FAN_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
 		.inversed = 1,
 		.health = false,
 	},
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 363/717] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (361 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 362/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 364/717] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
                   ` (355 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Kees Cook,
	Ard Biesheuvel, Linus Walleij, Nick Desaulniers, Russell King,
	Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit f77ac2e378be9dd61eb88728f0840642f045d9d1 ]

There are a couple of problems with the exception entry code that deals
with FP exceptions (which are reported as UND exceptions) when building
the kernel in Thumb2 mode:
- the conditional branch to vfp_kmode_exception in vfp_support_entry()
  may be out of range for its target, depending on how the linker decides
  to arrange the sections;
- when the UND exception is taken in kernel mode, the emulation handling
  logic is entered via the 'call_fpe' label, which means we end up using
  the wrong value/mask pairs to match and detect the NEON opcodes.

Since UND exceptions in kernel mode are unlikely to occur on a hot path
(as opposed to the user mode version which is invoked for VFP support
code and lazy restore), we can use the existing undef hook machinery for
any kernel mode instruction emulation that is needed, including calling
the existing vfp_kmode_exception() routine for unexpected cases. So drop
the call to call_fpe, and instead, install an undef hook that will get
called for NEON and VFP instructions that trigger an UND exception in
kernel mode.

While at it, make sure that the PC correction is accurate for the
execution mode where the exception was taken, by checking the PSR
Thumb bit.

Cc: Dmitry Osipenko <digetx@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Fixes: eff8728fe698 ("vmlinux.lds.h: Add PGO and AutoFDO input sections")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/entry-armv.S | 25 ++----------------
 arch/arm/vfp/vfphw.S         |  5 ----
 arch/arm/vfp/vfpmodule.c     | 49 ++++++++++++++++++++++++++++++++++--
 3 files changed, 49 insertions(+), 30 deletions(-)

diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 55a47df047738..1c9e6d1452c5b 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -252,31 +252,10 @@ __und_svc:
 #else
 	svc_entry
 #endif
-	@
-	@ call emulation code, which returns using r9 if it has emulated
-	@ the instruction, or the more conventional lr if we are to treat
-	@ this as a real undefined instruction
-	@
-	@  r0 - instruction
-	@
-#ifndef CONFIG_THUMB2_KERNEL
-	ldr	r0, [r4, #-4]
-#else
-	mov	r1, #2
-	ldrh	r0, [r4, #-2]			@ Thumb instruction at LR - 2
-	cmp	r0, #0xe800			@ 32-bit instruction if xx >= 0
-	blo	__und_svc_fault
-	ldrh	r9, [r4]			@ bottom 16 bits
-	add	r4, r4, #2
-	str	r4, [sp, #S_PC]
-	orr	r0, r9, r0, lsl #16
-#endif
-	badr	r9, __und_svc_finish
-	mov	r2, r4
-	bl	call_fpe
 
 	mov	r1, #4				@ PC correction to apply
-__und_svc_fault:
+ THUMB(	tst	r5, #PSR_T_BIT		)	@ exception taken in Thumb mode?
+ THUMB(	movne	r1, #2			)	@ if so, fix up PC correction
 	mov	r0, sp				@ struct pt_regs *regs
 	bl	__und_fault
 
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index 4fcff9f59947d..d5837bf05a9a5 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -79,11 +79,6 @@ ENTRY(vfp_support_entry)
 	DBGSTR3	"instr %08x pc %08x state %p", r0, r2, r10
 
 	.fpu	vfpv2
-	ldr	r3, [sp, #S_PSR]	@ Neither lazy restore nor FP exceptions
-	and	r3, r3, #MODE_MASK	@ are supported in kernel mode
-	teq	r3, #USR_MODE
-	bne	vfp_kmode_exception	@ Returns through lr
-
 	VFPFMRX	r1, FPEXC		@ Is the VFP enabled?
 	DBGSTR1	"fpexc %08x", r1
 	tst	r1, #FPEXC_EN
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 8c9e7f9f0277d..c3b6451c18bda 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -23,6 +23,7 @@
 #include <asm/cputype.h>
 #include <asm/system_info.h>
 #include <asm/thread_notify.h>
+#include <asm/traps.h>
 #include <asm/vfp.h>
 
 #include "vfpinstr.h"
@@ -642,7 +643,9 @@ static int vfp_starting_cpu(unsigned int unused)
 	return 0;
 }
 
-void vfp_kmode_exception(void)
+#ifdef CONFIG_KERNEL_MODE_NEON
+
+static int vfp_kmode_exception(struct pt_regs *regs, unsigned int instr)
 {
 	/*
 	 * If we reach this point, a floating point exception has been raised
@@ -660,9 +663,51 @@ void vfp_kmode_exception(void)
 		pr_crit("BUG: unsupported FP instruction in kernel mode\n");
 	else
 		pr_crit("BUG: FP instruction issued in kernel mode with FP unit disabled\n");
+	pr_crit("FPEXC == 0x%08x\n", fmrx(FPEXC));
+	return 1;
 }
 
-#ifdef CONFIG_KERNEL_MODE_NEON
+static struct undef_hook vfp_kmode_exception_hook[] = {{
+	.instr_mask	= 0xfe000000,
+	.instr_val	= 0xf2000000,
+	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
+	.cpsr_val	= SVC_MODE,
+	.fn		= vfp_kmode_exception,
+}, {
+	.instr_mask	= 0xff100000,
+	.instr_val	= 0xf4000000,
+	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
+	.cpsr_val	= SVC_MODE,
+	.fn		= vfp_kmode_exception,
+}, {
+	.instr_mask	= 0xef000000,
+	.instr_val	= 0xef000000,
+	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
+	.cpsr_val	= SVC_MODE | PSR_T_BIT,
+	.fn		= vfp_kmode_exception,
+}, {
+	.instr_mask	= 0xff100000,
+	.instr_val	= 0xf9000000,
+	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
+	.cpsr_val	= SVC_MODE | PSR_T_BIT,
+	.fn		= vfp_kmode_exception,
+}, {
+	.instr_mask	= 0x0c000e00,
+	.instr_val	= 0x0c000a00,
+	.cpsr_mask	= MODE_MASK,
+	.cpsr_val	= SVC_MODE,
+	.fn		= vfp_kmode_exception,
+}};
+
+static int __init vfp_kmode_exception_hook_init(void)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(vfp_kmode_exception_hook); i++)
+		register_undef_hook(&vfp_kmode_exception_hook[i]);
+	return 0;
+}
+core_initcall(vfp_kmode_exception_hook_init);
 
 /*
  * Kernel-side NEON support functions
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 364/717] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (362 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 363/717] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 365/717] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
                   ` (354 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]

There are three ways pseries_suspend_begin() can be reached:

1. When "mem" is written to /sys/power/state:

kobj_attr_store()
-> state_store()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This never works because there is no way to supply a valid stream id
using this interface, and H_VASI_STATE is called with a stream id of
zero. So this call path is useless at best.

2. When a stream id is written to /sys/devices/system/power/hibernate.
pseries_suspend_begin() is polled directly from store_hibernate()
until the stream is in the "Suspending" state (i.e. the platform is
ready for the OS to suspend execution):

dev_attr_store()
-> store_hibernate()
  -> pseries_suspend_begin()

3. When a stream id is written to /sys/devices/system/power/hibernate
(continued). After #2, pseries_suspend_begin() is called once again
from the pm core:

dev_attr_store()
-> store_hibernate()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This is redundant because the VASI suspend state is already known to
be Suspending.

The begin() callback of platform_suspend_ops is optional, so we can
simply remove that assignment with no loss of function.

Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/suspend.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 81e0ac58d6204..3eaa9d59dc7ab 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -187,7 +187,6 @@ static struct bus_type suspend_subsys = {
 
 static const struct platform_suspend_ops pseries_suspend_ops = {
 	.valid		= suspend_valid_only_mem,
-	.begin		= pseries_suspend_begin,
 	.prepare_late	= pseries_prepare_late,
 	.enter		= pseries_suspend_enter,
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 365/717] powerpc/pseries/hibernation: remove redundant cacheinfo update
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (363 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 364/717] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 366/717] powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK Greg Kroah-Hartman
                   ` (353 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]

Partitions with cache nodes in the device tree can encounter the
following warning on resume:

CPU 0 already accounted in PowerPC,POWER9@0(Data)
WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820

These calls to cacheinfo_cpu_offline/online have been redundant since
commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo
hierarchy post-migration").

Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/suspend.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 3eaa9d59dc7ab..64b36a93c33a6 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -13,7 +13,6 @@
 #include <asm/mmu.h>
 #include <asm/rtas.h>
 #include <asm/topology.h>
-#include "../../kernel/cacheinfo.h"
 
 static u64 stream_id;
 static struct device suspend_dev;
@@ -78,9 +77,7 @@ static void pseries_suspend_enable_irqs(void)
 	 * Update configuration which can be modified based on device tree
 	 * changes during resume.
 	 */
-	cacheinfo_cpu_offline(smp_processor_id());
 	post_mobility_fixup();
-	cacheinfo_cpu_online(smp_processor_id());
 }
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 366/717] powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (364 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 365/717] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 367/717] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
                   ` (352 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Giuseppe Sacco, Christophe Leroy,
	Michael Ellerman, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit db972a3787d12b1ce9ba7a31ec376d8a79e04c47 ]

low_sleep_handler() can't restore the context from standard
stack because the stack can hardly be accessed with MMU OFF.

Store everything in a global storage area instead of storing
a pointer to the stack in that global storage area.

To avoid a complete churn of the function, still use r1 as
the pointer to the storage area during restore.

Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK")
Reported-by: Giuseppe Sacco <giuseppe@sguazz.it>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Tested-by: Giuseppe Sacco <giuseppe@sguazz.it>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/e3e0d8042a3ba75cb4a9546c19c408b5b5b28994.1607404931.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/Kconfig.cputype  |   2 +-
 arch/powerpc/platforms/powermac/sleep.S | 132 +++++++++++-------------
 2 files changed, 60 insertions(+), 74 deletions(-)

diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index c194c4ae8bc7d..32a9c4c09b989 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -36,7 +36,7 @@ config PPC_BOOK3S_6xx
 	select PPC_HAVE_PMU_SUPPORT
 	select PPC_HAVE_KUEP
 	select PPC_HAVE_KUAP
-	select HAVE_ARCH_VMAP_STACK if !ADB_PMU
+	select HAVE_ARCH_VMAP_STACK
 
 config PPC_85xx
 	bool "Freescale 85xx"
diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
index 7e0f8ba6e54a5..d497a60003d2d 100644
--- a/arch/powerpc/platforms/powermac/sleep.S
+++ b/arch/powerpc/platforms/powermac/sleep.S
@@ -44,7 +44,8 @@
 #define SL_TB		0xa0
 #define SL_R2		0xa8
 #define SL_CR		0xac
-#define SL_R12		0xb0	/* r12 to r31 */
+#define SL_LR		0xb0
+#define SL_R12		0xb4	/* r12 to r31 */
 #define SL_SIZE		(SL_R12 + 80)
 
 	.section .text
@@ -63,105 +64,107 @@ _GLOBAL(low_sleep_handler)
 	blr
 #else
 	mflr	r0
-	stw	r0,4(r1)
-	stwu	r1,-SL_SIZE(r1)
+	lis	r11,sleep_storage@ha
+	addi	r11,r11,sleep_storage@l
+	stw	r0,SL_LR(r11)
 	mfcr	r0
-	stw	r0,SL_CR(r1)
-	stw	r2,SL_R2(r1)
-	stmw	r12,SL_R12(r1)
+	stw	r0,SL_CR(r11)
+	stw	r1,SL_SP(r11)
+	stw	r2,SL_R2(r11)
+	stmw	r12,SL_R12(r11)
 
 	/* Save MSR & SDR1 */
 	mfmsr	r4
-	stw	r4,SL_MSR(r1)
+	stw	r4,SL_MSR(r11)
 	mfsdr1	r4
-	stw	r4,SL_SDR1(r1)
+	stw	r4,SL_SDR1(r11)
 
 	/* Get a stable timebase and save it */
 1:	mftbu	r4
-	stw	r4,SL_TB(r1)
+	stw	r4,SL_TB(r11)
 	mftb	r5
-	stw	r5,SL_TB+4(r1)
+	stw	r5,SL_TB+4(r11)
 	mftbu	r3
 	cmpw	r3,r4
 	bne	1b
 
 	/* Save SPRGs */
 	mfsprg	r4,0
-	stw	r4,SL_SPRG0(r1)
+	stw	r4,SL_SPRG0(r11)
 	mfsprg	r4,1
-	stw	r4,SL_SPRG0+4(r1)
+	stw	r4,SL_SPRG0+4(r11)
 	mfsprg	r4,2
-	stw	r4,SL_SPRG0+8(r1)
+	stw	r4,SL_SPRG0+8(r11)
 	mfsprg	r4,3
-	stw	r4,SL_SPRG0+12(r1)
+	stw	r4,SL_SPRG0+12(r11)
 
 	/* Save BATs */
 	mfdbatu	r4,0
-	stw	r4,SL_DBAT0(r1)
+	stw	r4,SL_DBAT0(r11)
 	mfdbatl	r4,0
-	stw	r4,SL_DBAT0+4(r1)
+	stw	r4,SL_DBAT0+4(r11)
 	mfdbatu	r4,1
-	stw	r4,SL_DBAT1(r1)
+	stw	r4,SL_DBAT1(r11)
 	mfdbatl	r4,1
-	stw	r4,SL_DBAT1+4(r1)
+	stw	r4,SL_DBAT1+4(r11)
 	mfdbatu	r4,2
-	stw	r4,SL_DBAT2(r1)
+	stw	r4,SL_DBAT2(r11)
 	mfdbatl	r4,2
-	stw	r4,SL_DBAT2+4(r1)
+	stw	r4,SL_DBAT2+4(r11)
 	mfdbatu	r4,3
-	stw	r4,SL_DBAT3(r1)
+	stw	r4,SL_DBAT3(r11)
 	mfdbatl	r4,3
-	stw	r4,SL_DBAT3+4(r1)
+	stw	r4,SL_DBAT3+4(r11)
 	mfibatu	r4,0
-	stw	r4,SL_IBAT0(r1)
+	stw	r4,SL_IBAT0(r11)
 	mfibatl	r4,0
-	stw	r4,SL_IBAT0+4(r1)
+	stw	r4,SL_IBAT0+4(r11)
 	mfibatu	r4,1
-	stw	r4,SL_IBAT1(r1)
+	stw	r4,SL_IBAT1(r11)
 	mfibatl	r4,1
-	stw	r4,SL_IBAT1+4(r1)
+	stw	r4,SL_IBAT1+4(r11)
 	mfibatu	r4,2
-	stw	r4,SL_IBAT2(r1)
+	stw	r4,SL_IBAT2(r11)
 	mfibatl	r4,2
-	stw	r4,SL_IBAT2+4(r1)
+	stw	r4,SL_IBAT2+4(r11)
 	mfibatu	r4,3
-	stw	r4,SL_IBAT3(r1)
+	stw	r4,SL_IBAT3(r11)
 	mfibatl	r4,3
-	stw	r4,SL_IBAT3+4(r1)
+	stw	r4,SL_IBAT3+4(r11)
 
 BEGIN_MMU_FTR_SECTION
 	mfspr	r4,SPRN_DBAT4U
-	stw	r4,SL_DBAT4(r1)
+	stw	r4,SL_DBAT4(r11)
 	mfspr	r4,SPRN_DBAT4L
-	stw	r4,SL_DBAT4+4(r1)
+	stw	r4,SL_DBAT4+4(r11)
 	mfspr	r4,SPRN_DBAT5U
-	stw	r4,SL_DBAT5(r1)
+	stw	r4,SL_DBAT5(r11)
 	mfspr	r4,SPRN_DBAT5L
-	stw	r4,SL_DBAT5+4(r1)
+	stw	r4,SL_DBAT5+4(r11)
 	mfspr	r4,SPRN_DBAT6U
-	stw	r4,SL_DBAT6(r1)
+	stw	r4,SL_DBAT6(r11)
 	mfspr	r4,SPRN_DBAT6L
-	stw	r4,SL_DBAT6+4(r1)
+	stw	r4,SL_DBAT6+4(r11)
 	mfspr	r4,SPRN_DBAT7U
-	stw	r4,SL_DBAT7(r1)
+	stw	r4,SL_DBAT7(r11)
 	mfspr	r4,SPRN_DBAT7L
-	stw	r4,SL_DBAT7+4(r1)
+	stw	r4,SL_DBAT7+4(r11)
 	mfspr	r4,SPRN_IBAT4U
-	stw	r4,SL_IBAT4(r1)
+	stw	r4,SL_IBAT4(r11)
 	mfspr	r4,SPRN_IBAT4L
-	stw	r4,SL_IBAT4+4(r1)
+	stw	r4,SL_IBAT4+4(r11)
 	mfspr	r4,SPRN_IBAT5U
-	stw	r4,SL_IBAT5(r1)
+	stw	r4,SL_IBAT5(r11)
 	mfspr	r4,SPRN_IBAT5L
-	stw	r4,SL_IBAT5+4(r1)
+	stw	r4,SL_IBAT5+4(r11)
 	mfspr	r4,SPRN_IBAT6U
-	stw	r4,SL_IBAT6(r1)
+	stw	r4,SL_IBAT6(r11)
 	mfspr	r4,SPRN_IBAT6L
-	stw	r4,SL_IBAT6+4(r1)
+	stw	r4,SL_IBAT6+4(r11)
 	mfspr	r4,SPRN_IBAT7U
-	stw	r4,SL_IBAT7(r1)
+	stw	r4,SL_IBAT7(r11)
 	mfspr	r4,SPRN_IBAT7L
-	stw	r4,SL_IBAT7+4(r1)
+	stw	r4,SL_IBAT7+4(r11)
 END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 
 	/* Backup various CPU config stuffs */
@@ -180,9 +183,9 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 	lis	r5,grackle_wake_up@ha
 	addi	r5,r5,grackle_wake_up@l
 	tophys(r5,r5)
-	stw	r5,SL_PC(r1)
+	stw	r5,SL_PC(r11)
 	lis	r4,KERNELBASE@h
-	tophys(r5,r1)
+	tophys(r5,r11)
 	addi	r5,r5,SL_PC
 	lis	r6,MAGIC@ha
 	addi	r6,r6,MAGIC@l
@@ -194,12 +197,6 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 	tophys(r3,r3)
 	stw	r3,0x80(r4)
 	stw	r5,0x84(r4)
-	/* Store a pointer to our backup storage into
-	 * a kernel global
-	 */
-	lis r3,sleep_storage@ha
-	addi r3,r3,sleep_storage@l
-	stw r5,0(r3)
 
 	.globl	low_cpu_offline_self
 low_cpu_offline_self:
@@ -279,7 +276,7 @@ _GLOBAL(core99_wake_up)
 	lis	r3,sleep_storage@ha
 	addi	r3,r3,sleep_storage@l
 	tophys(r3,r3)
-	lwz	r1,0(r3)
+	addi	r1,r3,SL_PC
 
 	/* Pass thru to older resume code ... */
 _ASM_NOKPROBE_SYMBOL(core99_wake_up)
@@ -399,13 +396,6 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 	blt	1b
 	sync
 
-	/* restore the MSR and turn on the MMU */
-	lwz	r3,SL_MSR(r1)
-	bl	turn_on_mmu
-
-	/* get back the stack pointer */
-	tovirt(r1,r1)
-
 	/* Restore TB */
 	li	r3,0
 	mttbl	r3
@@ -419,28 +409,24 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 	mtcr	r0
 	lwz	r2,SL_R2(r1)
 	lmw	r12,SL_R12(r1)
-	addi	r1,r1,SL_SIZE
-	lwz	r0,4(r1)
-	mtlr	r0
-	blr
-_ASM_NOKPROBE_SYMBOL(grackle_wake_up)
 
-turn_on_mmu:
-	mflr	r4
-	tovirt(r4,r4)
+	/* restore the MSR and SP and turn on the MMU and return */
+	lwz	r3,SL_MSR(r1)
+	lwz	r4,SL_LR(r1)
+	lwz	r1,SL_SP(r1)
 	mtsrr0	r4
 	mtsrr1	r3
 	sync
 	isync
 	rfi
-_ASM_NOKPROBE_SYMBOL(turn_on_mmu)
+_ASM_NOKPROBE_SYMBOL(grackle_wake_up)
 
 #endif /* defined(CONFIG_PM) || defined(CONFIG_CPU_FREQ) */
 
-	.section .data
+	.section .bss
 	.balign	L1_CACHE_BYTES
 sleep_storage:
-	.long 0
+	.space SL_SIZE
 	.balign	L1_CACHE_BYTES, 0
 
 #endif /* CONFIG_PPC_BOOK3S_32 */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 367/717] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (365 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 366/717] powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 368/717] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
                   ` (351 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Vinod Koul, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b097efba9580d1f7cbc80cda84e768983e3de541 ]

Currently there is a null pointer check for hdmi_phy that implies it
may be null, however a dev_err messages dereferences this potential null
pointer.  Avoid a null pointer dereference by only emitting the dev_err
message if hdmi_phy is non-null.  It is a moot point if the error message
needs to be printed at all, but since this is a relatively new piece of
code it may be useful to keep the message in for the moment in case there
are unforseen errors that need to be reported.

Fixes: be28b6507c46 ("drm/mediatek: separate hdmi phy to different file")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Dereference after null check")
Link: https://lore.kernel.org/r/20201207150937.170435-1-colin.king@canonical.com
[vkoul: fix indent of return call]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/mediatek/phy-mtk-hdmi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/phy/mediatek/phy-mtk-hdmi.c b/drivers/phy/mediatek/phy-mtk-hdmi.c
index 47c029d4b270b..206cc34687223 100644
--- a/drivers/phy/mediatek/phy-mtk-hdmi.c
+++ b/drivers/phy/mediatek/phy-mtk-hdmi.c
@@ -84,8 +84,9 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy)
 	    hdmi_phy->conf->hdmi_phy_disable_tmds)
 		return &mtk_hdmi_phy_dev_ops;
 
-	dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
-		return NULL;
+	if (hdmi_phy)
+		dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
+	return NULL;
 }
 
 static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 368/717] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (366 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 367/717] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 369/717] coresight: remove broken __exit annotations Greg Kroah-Hartman
                   ` (350 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 95d3befbc5e1ee39fc8a78713924cf7ed2b3cabe ]

cz_da7219_init() does not check the return values of clk_get(),
while da7219_clk_enable() calls clk_set_rate() to dereference
the pointers.
Add checks to fix the problems.
Also, change clk_get() to devm_clk_get() to avoid data leak after
failures.

Fixes: bb24a31ed584 ("ASoC: AMD: Configure wclk and bclk of master codec")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201204063610.513556-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/acp-da7219-max98357a.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
index a7702e64ec512..849288d01c6b4 100644
--- a/sound/soc/amd/acp-da7219-max98357a.c
+++ b/sound/soc/amd/acp-da7219-max98357a.c
@@ -73,8 +73,13 @@ static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd)
 		return ret;
 	}
 
-	da7219_dai_wclk = clk_get(component->dev, "da7219-dai-wclk");
-	da7219_dai_bclk = clk_get(component->dev, "da7219-dai-bclk");
+	da7219_dai_wclk = devm_clk_get(component->dev, "da7219-dai-wclk");
+	if (IS_ERR(da7219_dai_wclk))
+		return PTR_ERR(da7219_dai_wclk);
+
+	da7219_dai_bclk = devm_clk_get(component->dev, "da7219-dai-bclk");
+	if (IS_ERR(da7219_dai_bclk))
+		return PTR_ERR(da7219_dai_bclk);
 
 	ret = snd_soc_card_jack_new(card, "Headset Jack",
 				SND_JACK_HEADSET | SND_JACK_LINEOUT |
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 369/717] coresight: remove broken __exit annotations
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (367 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 368/717] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 370/717] ASoC: max98390: Fix error codes in max98390_dsm_init() Greg Kroah-Hartman
                   ` (349 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Arnd Bergmann,
	Mathieu Poirier, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 45fe7befe0db5e61cd3c846315f0ac48541e8445 ]

Functions that are annotated __exit are discarded for built-in drivers,
but the .remove callback in a device driver must still be kept around
to allow bind/unbind operations.

There is now a linker warning for the discarded symbol references:

`tmc_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-tmc-core.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-tmc-core.o
`tpiu_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-tpiu.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-tpiu.o
`etb_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-etb10.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-etb10.o
`static_funnel_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-funnel.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-funnel.o
`dynamic_funnel_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-funnel.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-funnel.o
`static_replicator_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-replicator.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-replicator.o
`dynamic_replicator_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-replicator.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-replicator.o
`catu_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-catu.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-catu.o

Remove all those annotations.

Fixes: 8b0cf82677d1 ("coresight: stm: Allow to build coresight-stm as a module")
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201208182651.1597945-3-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwtracing/coresight/coresight-catu.c       | 2 +-
 drivers/hwtracing/coresight/coresight-cti-core.c   | 2 +-
 drivers/hwtracing/coresight/coresight-etb10.c      | 2 +-
 drivers/hwtracing/coresight/coresight-etm3x-core.c | 4 ++--
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 ++--
 drivers/hwtracing/coresight/coresight-funnel.c     | 6 +++---
 drivers/hwtracing/coresight/coresight-replicator.c | 6 +++---
 drivers/hwtracing/coresight/coresight-stm.c        | 2 +-
 drivers/hwtracing/coresight/coresight-tmc-core.c   | 2 +-
 drivers/hwtracing/coresight/coresight-tpiu.c       | 2 +-
 10 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
index 99430f6cf5a5d..a61313f320bda 100644
--- a/drivers/hwtracing/coresight/coresight-catu.c
+++ b/drivers/hwtracing/coresight/coresight-catu.c
@@ -567,7 +567,7 @@ out:
 	return ret;
 }
 
-static int __exit catu_remove(struct amba_device *adev)
+static int catu_remove(struct amba_device *adev)
 {
 	struct catu_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
index d28eae93e55c8..61dbc1afd8da5 100644
--- a/drivers/hwtracing/coresight/coresight-cti-core.c
+++ b/drivers/hwtracing/coresight/coresight-cti-core.c
@@ -836,7 +836,7 @@ static void cti_device_release(struct device *dev)
 	if (drvdata->csdev_release)
 		drvdata->csdev_release(dev);
 }
-static int __exit cti_remove(struct amba_device *adev)
+static int cti_remove(struct amba_device *adev)
 {
 	struct cti_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 1b320ab581caf..0cf6f0b947b6f 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -803,7 +803,7 @@ err_misc_register:
 	return ret;
 }
 
-static int __exit etb_remove(struct amba_device *adev)
+static int etb_remove(struct amba_device *adev)
 {
 	struct etb_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
index 47f610b1c2b18..5bf5a5a4ce6d1 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -902,14 +902,14 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
 	return 0;
 }
 
-static void __exit clear_etmdrvdata(void *info)
+static void clear_etmdrvdata(void *info)
 {
 	int cpu = *(int *)info;
 
 	etmdrvdata[cpu] = NULL;
 }
 
-static int __exit etm_remove(struct amba_device *adev)
+static int etm_remove(struct amba_device *adev)
 {
 	struct etm_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index e516e5b879e3a..95b54b0a36252 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -1570,14 +1570,14 @@ static struct amba_cs_uci_id uci_id_etm4[] = {
 	}
 };
 
-static void __exit clear_etmdrvdata(void *info)
+static void clear_etmdrvdata(void *info)
 {
 	int cpu = *(int *)info;
 
 	etmdrvdata[cpu] = NULL;
 }
 
-static int __exit etm4_remove(struct amba_device *adev)
+static int etm4_remove(struct amba_device *adev)
 {
 	struct etmv4_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
index af40814ce5603..3fc6c678b51d8 100644
--- a/drivers/hwtracing/coresight/coresight-funnel.c
+++ b/drivers/hwtracing/coresight/coresight-funnel.c
@@ -274,7 +274,7 @@ out_disable_clk:
 	return ret;
 }
 
-static int __exit funnel_remove(struct device *dev)
+static int funnel_remove(struct device *dev)
 {
 	struct funnel_drvdata *drvdata = dev_get_drvdata(dev);
 
@@ -328,7 +328,7 @@ static int static_funnel_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int __exit static_funnel_remove(struct platform_device *pdev)
+static int static_funnel_remove(struct platform_device *pdev)
 {
 	funnel_remove(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
@@ -370,7 +370,7 @@ static int dynamic_funnel_probe(struct amba_device *adev,
 	return funnel_probe(&adev->dev, &adev->res);
 }
 
-static int __exit dynamic_funnel_remove(struct amba_device *adev)
+static int dynamic_funnel_remove(struct amba_device *adev)
 {
 	return funnel_remove(&adev->dev);
 }
diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index 62afdde0e5eab..38008aca2c0f4 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -291,7 +291,7 @@ out_disable_clk:
 	return ret;
 }
 
-static int __exit replicator_remove(struct device *dev)
+static int replicator_remove(struct device *dev)
 {
 	struct replicator_drvdata *drvdata = dev_get_drvdata(dev);
 
@@ -318,7 +318,7 @@ static int static_replicator_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int __exit static_replicator_remove(struct platform_device *pdev)
+static int static_replicator_remove(struct platform_device *pdev)
 {
 	replicator_remove(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
@@ -388,7 +388,7 @@ static int dynamic_replicator_probe(struct amba_device *adev,
 	return replicator_probe(&adev->dev, &adev->res);
 }
 
-static int __exit dynamic_replicator_remove(struct amba_device *adev)
+static int dynamic_replicator_remove(struct amba_device *adev)
 {
 	return replicator_remove(&adev->dev);
 }
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index b0ad912651a99..587c1d7f25208 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -951,7 +951,7 @@ stm_unregister:
 	return ret;
 }
 
-static int __exit stm_remove(struct amba_device *adev)
+static int stm_remove(struct amba_device *adev)
 {
 	struct stm_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
index 5653e0945c74b..8169dff5a9f6a 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
@@ -559,7 +559,7 @@ out:
 	spin_unlock_irqrestore(&drvdata->spinlock, flags);
 }
 
-static int __exit tmc_remove(struct amba_device *adev)
+static int tmc_remove(struct amba_device *adev)
 {
 	struct tmc_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index 566c57e035961..5b35029461a0c 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -173,7 +173,7 @@ static int tpiu_probe(struct amba_device *adev, const struct amba_id *id)
 	return PTR_ERR(drvdata->csdev);
 }
 
-static int __exit tpiu_remove(struct amba_device *adev)
+static int tpiu_remove(struct amba_device *adev)
 {
 	struct tpiu_drvdata *drvdata = dev_get_drvdata(&adev->dev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 370/717] ASoC: max98390: Fix error codes in max98390_dsm_init()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (368 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 369/717] coresight: remove broken __exit annotations Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 371/717] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
                   ` (348 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 3cea33b6f2d7782d1be17c71509986f33ee93541 ]

These error paths return success but they should return -EINVAL.

Fixes: 97ed3e509ee6 ("ASoC: max98390: Fix potential crash during param fw loading")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9B0uz4svyNTqeMb@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/max98390.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
index ff5cc9bbec291..bb736c44e68a3 100644
--- a/sound/soc/codecs/max98390.c
+++ b/sound/soc/codecs/max98390.c
@@ -784,6 +784,7 @@ static int max98390_dsm_init(struct snd_soc_component *component)
 	if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
 		dev_err(component->dev,
 			"param fw is invalid.\n");
+		ret = -EINVAL;
 		goto err_alloc;
 	}
 	dsm_param = (char *)fw->data;
@@ -794,6 +795,7 @@ static int max98390_dsm_init(struct snd_soc_component *component)
 		fw->size < param_size + MAX98390_DSM_PAYLOAD_OFFSET) {
 		dev_err(component->dev,
 			"param fw is invalid.\n");
+		ret = -EINVAL;
 		goto err_alloc;
 	}
 	regmap_write(max98390->regmap, MAX98390_R203A_AMP_EN, 0x80);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 371/717] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (369 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 370/717] ASoC: max98390: Fix error codes in max98390_dsm_init() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 372/717] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
                   ` (347 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Nicholas Piggin,
	Michael Ellerman, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 7ceb40027e19567a0a066e3b380cc034cdd9a124 ]

The verification and message introduced by commit 374f3f5979f9
("powerpc/mm/hash: Handle user access of kernel address gracefully")
applies to all platforms, it should not be limited to BOOK3S.

Make the BOOK3S version of sanity_check_fault() the one for all,
and bail out earlier if not BOOK3S.

Fixes: 374f3f5979f9 ("powerpc/mm/hash: Handle user access of kernel address gracefully")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/fe199d5af3578d3bf80035d203a94d742a7a28af.1607491748.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/fault.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 0add963a849b3..72e1b51beb10c 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -303,7 +303,6 @@ static inline void cmo_account_page_fault(void)
 static inline void cmo_account_page_fault(void) { }
 #endif /* CONFIG_PPC_SMLPAR */
 
-#ifdef CONFIG_PPC_BOOK3S
 static void sanity_check_fault(bool is_write, bool is_user,
 			       unsigned long error_code, unsigned long address)
 {
@@ -320,6 +319,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
 		return;
 	}
 
+	if (!IS_ENABLED(CONFIG_PPC_BOOK3S))
+		return;
+
 	/*
 	 * For hash translation mode, we should never get a
 	 * PROTFAULT. Any update to pte to reduce access will result in us
@@ -354,10 +356,6 @@ static void sanity_check_fault(bool is_write, bool is_user,
 
 	WARN_ON_ONCE(error_code & DSISR_PROTFAULT);
 }
-#else
-static void sanity_check_fault(bool is_write, bool is_user,
-			       unsigned long error_code, unsigned long address) { }
-#endif /* CONFIG_PPC_BOOK3S */
 
 /*
  * Define the correct "is_write" bit in error_code based
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 372/717] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (370 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 371/717] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 373/717] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Stern, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]

The pm_runtime_enable will decrement the power disable depth. Imbalance
depth will resulted in enabling runtime PM of device fails later.  Thus
a pairing decrement must be needed on the error handling path to keep it
balanced.

Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-omap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 8771a2ed69268..7f4a03e8647af 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -220,6 +220,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
 
 err_pm_runtime:
 	pm_runtime_put_sync(dev);
+	pm_runtime_disable(dev);
 
 err_phy:
 	for (i = 0; i < omap->nports; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 373/717] usb: oxu210hp-hcd: Fix memory leak in oxu_create
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (371 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 372/717] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 374/717] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]

usb_create_hcd will alloc memory for hcd, and we should
call usb_put_hcd to free it when adding fails to prevent
memory leak.

Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/oxu210hp-hcd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 27dbbe1b28b12..e832909a924fa 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -4151,8 +4151,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
 	oxu->is_otg = otg;
 
 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
-	if (ret < 0)
+	if (ret < 0) {
+		usb_put_hcd(hcd);
 		return ERR_PTR(ret);
+	}
 
 	device_wakeup_enable(hcd->self.controller);
 	return hcd;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 374/717] speakup: fix uninitialized flush_lock
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (372 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 373/717] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 375/717] nfsd: Fix message level for normal termination Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Samuel Thibault,
	Yang Yingliang, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]

The flush_lock is uninitialized, use DEFINE_SPINLOCK
to define and initialize flush_lock.

Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/accessibility/speakup/speakup_dectlk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accessibility/speakup/speakup_dectlk.c b/drivers/accessibility/speakup/speakup_dectlk.c
index 780214b5ca16e..ab6d61e80b1cb 100644
--- a/drivers/accessibility/speakup/speakup_dectlk.c
+++ b/drivers/accessibility/speakup/speakup_dectlk.c
@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);
 static int in_escape;
 static int is_flushing;
 
-static spinlock_t flush_lock;
+static DEFINE_SPINLOCK(flush_lock);
 static DECLARE_WAIT_QUEUE_HEAD(flush);
 
 static struct var_t vars[] = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 375/717] nfsd: Fix message level for normal termination
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (373 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 374/717] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 376/717] NFSD: Fix 5 seconds delay when doing inter server copy Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kazuo ito, Chuck Lever, Sasha Levin

From: kazuo ito <kzpn200@gmail.com>

[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]

The warning message from nfsd terminating normally
can confuse system adminstrators or monitoring software.

Though it's not exactly fair to pin-point a commit where it
originated, the current form in the current place started
to appear in:

Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP")
Signed-off-by: kazuo ito <kzpn200@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfssvc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 27b1ad1361508..9323e30a7eafe 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -527,8 +527,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 		return;
 
 	nfsd_shutdown_net(net);
-	printk(KERN_WARNING "nfsd: last server has exited, flushing export "
-			    "cache\n");
+	pr_info("nfsd: last server has exited, flushing export cache\n");
 	nfsd_export_flush(net);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 376/717] NFSD: Fix 5 seconds delay when doing inter server copy
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (374 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 375/717] nfsd: Fix message level for normal termination Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 377/717] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dai Ngo, Chuck Lever, Sasha Levin

From: Dai Ngo <dai.ngo@oracle.com>

[ Upstream commit ca9364dde50daba93eff711b4b945fd08beafcc2 ]

Since commit b4868b44c5628 ("NFSv4: Wait for stateid updates after
CLOSE/OPEN_DOWNGRADE"), every inter server copy operation suffers 5
seconds delay regardless of the size of the copy. The delay is from
nfs_set_open_stateid_locked when the check by nfs_stateid_is_sequential
fails because the seqid in both nfs4_state and nfs4_stateid are 0.

Fix by modifying nfs4_init_cp_state to return the stateid with seqid 1
instead of 0. This is also to conform with section 4.8 of RFC 7862.

Here is the relevant paragraph from section 4.8 of RFC 7862:

   A copy offload stateid's seqid MUST NOT be zero.  In the context of a
   copy offload operation, it is inappropriate to indicate "the most
   recent copy offload operation" using a stateid with a seqid of zero
   (see Section 8.2.2 of [RFC5661]).  It is inappropriate because the
   stateid refers to internal state in the server and there may be
   several asynchronous COPY operations being performed in parallel on
   the same file by the server.  Therefore, a copy offload stateid with
   a seqid of zero MUST be considered invalid.

Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4state.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index d7f27ed6b7941..47006eec724e6 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -769,6 +769,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
 	spin_lock(&nn->s2s_cp_lock);
 	new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
 	stid->stid.si_opaque.so_id = new_id;
+	stid->stid.si_generation = 1;
 	spin_unlock(&nn->s2s_cp_lock);
 	idr_preload_end();
 	if (new_id < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 377/717] nfs_common: need lock during iterate through the list
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (375 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 376/717] NFSD: Fix 5 seconds delay when doing inter server copy Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 378/717] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable,  Cheng Lin ,
	 Yi Wang ,
	Chuck Lever, Sasha Levin

From: Cheng Lin <cheng.lin130@zte.com.cn>

[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]

If the elem is deleted during be iterated on it, the iteration
process will fall into an endless loop.

kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]

PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd"
    [exception RIP: __state_in_grace+76]
    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246
    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50
    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580
    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40
    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40
    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000
    CS: 0010  SS: 0018
 #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
 #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
 #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
 #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
 #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
 #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
 #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
 #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
 #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
 #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607

The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
  list = {
    next = 0xffff881dc0c38298,
    prev = 0xffff881dc0c38298
  },
  block_opens = false
}

Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs_common/grace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
index b73d9dd37f73c..26f2a50eceac9 100644
--- a/fs/nfs_common/grace.c
+++ b/fs/nfs_common/grace.c
@@ -69,10 +69,14 @@ __state_in_grace(struct net *net, bool open)
 	if (!open)
 		return !list_empty(grace_list);
 
+	spin_lock(&grace_lock);
 	list_for_each_entry(lm, grace_list, list) {
-		if (lm->block_opens)
+		if (lm->block_opens) {
+			spin_unlock(&grace_lock);
 			return true;
+		}
 	}
+	spin_unlock(&grace_lock);
 	return false;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 378/717] x86/kprobes: Restore BTF if the single-stepping is cancelled
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (376 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 377/717] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 379/717] scsi: qla2xxx: Fix FW initialization error on big endian machines Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Masami Hiramatsu <mhiramat@kernel.org>

[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]

Fix to restore BTF if single-stepping causes a page fault and
it is cancelled.

Usually the BTF flag was restored when the single stepping is done
(in resume_execution()). However, if a page fault happens on the
single stepping instruction, the fault handler is invoked and
the single stepping is cancelled. Thus, the BTF flag is not
restored.

Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kprobes/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 547c7abb39f51..39f7d8c3c064b 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -937,6 +937,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
 		 * So clear it by resetting the current kprobe:
 		 */
 		regs->flags &= ~X86_EFLAGS_TF;
+		/*
+		 * Since the single step (trap) has been cancelled,
+		 * we need to restore BTF here.
+		 */
+		restore_btf();
 
 		/*
 		 * If the TF flag was set before the kprobe hit,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 379/717] scsi: qla2xxx: Fix FW initialization error on big endian machines
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (377 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 378/717] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 380/717] scsi: qla2xxx: Fix N2N and NVMe connect retry failure Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Arun Easi,
	Nilesh Javali, Martin K. Petersen, Sasha Levin

From: Arun Easi <aeasi@marvell.com>

[ Upstream commit 8a78dd6ed1af06bfa7b4ade81328ff7ea11b6947 ]

Some fields are not correctly byte swapped causing failure during
initialization. As probe() returns failure, HBAs will not be claimed when
this happens.

qla2xxx [0007:01:00.0]-ffff:3: Secure Flash Update in FW: Supported
qla2xxx [0007:01:00.0]-ffff:3: SCM in FW: Supported
qla2xxx [0007:01:00.0]-00d2:3: Init Firmware **** FAILED ****.
qla2xxx [0007:01:00.0]-00d6:3: Failed to initialize adapter - Adapter flags 2.
qla2xxx 0007:01:00.1: enabling device (0140 -> 0142)
qla2xxx [0007:01:00.1]-011c: : MSI-X vector count: 128.
qla2xxx [0007:01:00.1]-001d: : Found an ISP2289 irq 18 iobase 0xd000080080004000.
qla2xxx 0007:01:00.1: Using 64-bit direct DMA at offset 800000000000000
BUG: Bad page state in process insmod  pfn:67118 page:f00000000168bd40
count:-1 mapcount:0 mapping: (null) index:0x0
page flags: 0x3ffff800000000() page dumped because: nonzero _count
Modules linked in: qla2xxx(OE+) nvme_fc nvme_fabrics
	nvme_core scsi_transport_fc scsi_tgt nls_utf8 isofs ip6t_rpfilter
	ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set
	nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat
	nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle
	ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4
	nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle
	iptable_security iptable_raw ebtable_filter ebtables ip6table_filter
	ip6_tables iptable_filter nx_crypto ses enclosure scsi_transport_sas
	pseries_rng sg ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif
	crct10dif_generic crct10dif_common usb_storage ipr libata tg3 ptp
	pps_core dm_mirror dm_region_hash dm_log dm_mod
CPU: 32 PID: 8560 Comm: insmod Kdump: loaded Tainted: G
	OE  ------------   3.10.0-957.el7.ppc64 #1
Call Trace:
[c0000006dd7caa70] [c00000000001cca8] .show_stack+0x88/0x330 (unreliable)
[c0000006dd7cab30] [c000000000ac3d88] .dump_stack+0x28/0x3c
[c0000006dd7caba0] [c00000000029e48c] .bad_page+0x15c/0x1c0
[c0000006dd7cac40] [c00000000029f938] .get_page_from_freelist+0x11e8/0x1ea0
[c0000006dd7caf40] [c0000000002a1d30] .__alloc_pages_nodemask+0x1c0/0xc70
[c0000006dd7cb140] [c00000000002ba0c] .__dma_direct_alloc_coherent+0x8c/0x170
[c0000006dd7cb1e0] [d000000010a94688] .qla2x00_mem_alloc+0x10f8/0x1370 [qla2xxx]
[c0000006dd7cb2d0] [d000000010a9c790] .qla2x00_probe_one+0xb60/0x22e0 [qla2xxx]
[c0000006dd7cb540] [c0000000005de764] .pci_device_probe+0x204/0x300
[c0000006dd7cb600] [c0000000006ca61c] .driver_probe_device+0x2cc/0x6f0
[c0000006dd7cb6b0] [c0000000006cabec] .__driver_attach+0x10c/0x110
[c0000006dd7cb740] [c0000000006c5f04] .bus_for_each_dev+0x94/0x100
[c0000006dd7cb7e0] [c0000000006c94f4] .driver_attach+0x34/0x50
[c0000006dd7cb860] [c0000000006c8f58] .bus_add_driver+0x298/0x3b0
[c0000006dd7cb900] [c0000000006cb6e0] .driver_register+0xb0/0x1a0
[c0000006dd7cb980] [c0000000005dc474] .__pci_register_driver+0xc4/0xf0
[c0000006dd7cba10] [d000000010b94e20] .qla2x00_module_init+0x2a8/0x328 [qla2xxx]
[c0000006dd7cbaa0] [c00000000000c130] .do_one_initcall+0x130/0x2e0
[c0000006dd7cbb50] [c0000000001b2e8c] .load_module+0x1afc/0x2340
[c0000006dd7cbd40] [c0000000001b3920] .SyS_finit_module+0xd0/0x130
[c0000006dd7cbe30] [c00000000000a284] 	system_call+0x38/0xfc

Link: https://lore.kernel.org/r/20201202132312.19966-9-njavali@marvell.com
Fixes: 9f2475fe7406 ("scsi: qla2xxx: SAN congestion management implementation")
Fixes: cf3c54fb49a4 ("scsi: qla2xxx: Add SLER and PI control support”)
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_mbx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 07afd0d8a8f3e..bef871a890281 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -1129,7 +1129,7 @@ qla2x00_get_fw_version(scsi_qla_host_t *vha)
 		if (ha->flags.scm_supported_a &&
 		    (ha->fw_attributes_ext[0] & FW_ATTR_EXT0_SCM_SUPPORTED)) {
 			ha->flags.scm_supported_f = 1;
-			ha->sf_init_cb->flags |= BIT_13;
+			ha->sf_init_cb->flags |= cpu_to_le16(BIT_13);
 		}
 		ql_log(ql_log_info, vha, 0x11a3, "SCM in FW: %s\n",
 		       (ha->flags.scm_supported_f) ? "Supported" :
@@ -1137,9 +1137,9 @@ qla2x00_get_fw_version(scsi_qla_host_t *vha)
 
 		if (vha->flags.nvme2_enabled) {
 			/* set BIT_15 of special feature control block for SLER */
-			ha->sf_init_cb->flags |= BIT_15;
+			ha->sf_init_cb->flags |= cpu_to_le16(BIT_15);
 			/* set BIT_14 of special feature control block for PI CTRL*/
-			ha->sf_init_cb->flags |= BIT_14;
+			ha->sf_init_cb->flags |= cpu_to_le16(BIT_14);
 		}
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 380/717] scsi: qla2xxx: Fix N2N and NVMe connect retry failure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (378 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 379/717] scsi: qla2xxx: Fix FW initialization error on big endian machines Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 381/717] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quinn Tran, Nilesh Javali,
	Martin K. Petersen, Sasha Levin

From: Quinn Tran <qutran@marvell.com>

[ Upstream commit 07a5f69248e3486e387c40af64793466371c7d91 ]

FC-NVMe target discovery failed when initiator wwpn < target wwpn in an N2N
(Direct Attach) config, where the driver was stuck on FCP PRLI mode and
failed to retry with NVMe PRLI.

Link: https://lore.kernel.org/r/20201202132312.19966-10-njavali@marvell.com
Fixes: 84ed362ac40c ("scsi: qla2xxx: Dual FCP-NVMe target port support”)
Fixes: 983f127603fa ("scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure”)
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_init.c | 71 ++++++++++++++++++++++++---------
 drivers/scsi/qla2xxx/qla_mbx.c  |  3 --
 2 files changed, 52 insertions(+), 22 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 898c70b8ebbf6..52e8b555bd1dc 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1268,9 +1268,10 @@ qla24xx_async_prli(struct scsi_qla_host *vha, fc_port_t *fcport)
 		lio->u.logio.flags |= SRB_LOGIN_NVME_PRLI;
 
 	ql_dbg(ql_dbg_disc, vha, 0x211b,
-	    "Async-prli - %8phC hdl=%x, loopid=%x portid=%06x retries=%d %s.\n",
+	    "Async-prli - %8phC hdl=%x, loopid=%x portid=%06x retries=%d fc4type %x priority %x %s.\n",
 	    fcport->port_name, sp->handle, fcport->loop_id, fcport->d_id.b24,
-	    fcport->login_retry, NVME_TARGET(vha->hw, fcport) ? "nvme" : "fc");
+	    fcport->login_retry, fcport->fc4_type, vha->hw->fc4_type_priority,
+	    NVME_TARGET(vha->hw, fcport) ? "nvme" : "fcp");
 
 	rval = qla2x00_start_sp(sp);
 	if (rval != QLA_SUCCESS) {
@@ -1932,26 +1933,58 @@ qla24xx_handle_prli_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
 			break;
 		}
 
-		/*
-		 * Retry PRLI with other FC-4 type if failure occurred on dual
-		 * FCP/NVMe port
-		 */
-		if (NVME_FCP_TARGET(ea->fcport)) {
-			ql_dbg(ql_dbg_disc, vha, 0x2118,
-				"%s %d %8phC post %s prli\n",
-				__func__, __LINE__, ea->fcport->port_name,
-				(ea->fcport->fc4_type & FS_FC4TYPE_NVME) ?
-				"NVMe" : "FCP");
-			if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME)
+		ql_dbg(ql_dbg_disc, vha, 0x2118,
+		       "%s %d %8phC priority %s, fc4type %x\n",
+		       __func__, __LINE__, ea->fcport->port_name,
+		       vha->hw->fc4_type_priority == FC4_PRIORITY_FCP ?
+		       "FCP" : "NVMe", ea->fcport->fc4_type);
+
+		if (N2N_TOPO(vha->hw)) {
+			if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME) {
 				ea->fcport->fc4_type &= ~FS_FC4TYPE_NVME;
-			else
+				ea->fcport->fc4_type |= FS_FC4TYPE_FCP;
+			} else {
 				ea->fcport->fc4_type &= ~FS_FC4TYPE_FCP;
-		}
+				ea->fcport->fc4_type |= FS_FC4TYPE_NVME;
+			}
 
-		ea->fcport->flags &= ~FCF_ASYNC_SENT;
-		ea->fcport->keep_nport_handle = 0;
-		ea->fcport->logout_on_delete = 1;
-		qlt_schedule_sess_for_deletion(ea->fcport);
+			if (ea->fcport->n2n_link_reset_cnt < 3) {
+				ea->fcport->n2n_link_reset_cnt++;
+				vha->relogin_jif = jiffies + 2 * HZ;
+				/*
+				 * PRLI failed. Reset link to kick start
+				 * state machine
+				 */
+				set_bit(N2N_LINK_RESET, &vha->dpc_flags);
+			} else {
+				ql_log(ql_log_warn, vha, 0x2119,
+				       "%s %d %8phC Unable to reconnect\n",
+				       __func__, __LINE__,
+				       ea->fcport->port_name);
+			}
+		} else {
+			/*
+			 * switch connect. login failed. Take connection down
+			 * and allow relogin to retrigger
+			 */
+			if (NVME_FCP_TARGET(ea->fcport)) {
+				ql_dbg(ql_dbg_disc, vha, 0x2118,
+				       "%s %d %8phC post %s prli\n",
+				       __func__, __LINE__,
+				       ea->fcport->port_name,
+				       (ea->fcport->fc4_type & FS_FC4TYPE_NVME)
+				       ? "NVMe" : "FCP");
+				if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME)
+					ea->fcport->fc4_type &= ~FS_FC4TYPE_NVME;
+				else
+					ea->fcport->fc4_type &= ~FS_FC4TYPE_FCP;
+			}
+
+			ea->fcport->flags &= ~FCF_ASYNC_SENT;
+			ea->fcport->keep_nport_handle = 0;
+			ea->fcport->logout_on_delete = 1;
+			qlt_schedule_sess_for_deletion(ea->fcport);
+		}
 		break;
 	}
 }
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index bef871a890281..d6325fb2ef73b 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3998,9 +3998,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
 				fcport->scan_state = QLA_FCPORT_FOUND;
 				fcport->n2n_flag = 1;
 				fcport->keep_nport_handle = 1;
-				fcport->fc4_type = FS_FC4TYPE_FCP;
-				if (vha->flags.nvme_enabled)
-					fcport->fc4_type |= FS_FC4TYPE_NVME;
 
 				if (wwn_to_u64(vha->port_name) >
 				    wwn_to_u64(fcport->port_name)) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 381/717] platform/chrome: cros_ec_spi: Dont overwrite spi::mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (379 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 380/717] scsi: qla2xxx: Fix N2N and NVMe connect retry failure Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 382/717] misc: pci_endpoint_test: fix return value of error branch Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Glass, Gwendal Grignou,
	Douglas Anderson, Enric Balletbo i Serra, Alexandru M Stan,
	Stephen Boyd, Mark Brown, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 74639cbf51d7c0304342544a83dfda354a6bd208 ]

There isn't any need to overwrite the mode here in the driver with what
has been detected by the firmware, such as DT or ACPI. In fact, if we
use the SPI CS gpio descriptor feature we will overwrite the mode with
SPI_MODE_0 where it already contains SPI_MODE_0 and more importantly
SPI_CS_HIGH. Clearing the SPI_CS_HIGH bit causes the CS line to toggle
when the device is probed when it shouldn't change, confusing the driver
and making it fail to probe. Drop the assignment and let the spi core
take care of it.

Fixes: a17d94f0b6e1 ("mfd: Add ChromeOS EC SPI driver")
Cc: Simon Glass <sjg@chromium.org>
Cc: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: Alexandru M Stan <amstan@chromium.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Link: https://lore.kernel.org/r/20201204193540.3047030-2-swboyd@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/chrome/cros_ec_spi.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_spi.c b/drivers/platform/chrome/cros_ec_spi.c
index dfa1f816a45f4..f9df218fc2bbe 100644
--- a/drivers/platform/chrome/cros_ec_spi.c
+++ b/drivers/platform/chrome/cros_ec_spi.c
@@ -742,7 +742,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 	int err;
 
 	spi->bits_per_word = 8;
-	spi->mode = SPI_MODE_0;
 	spi->rt = true;
 	err = spi_setup(spi);
 	if (err < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 382/717] misc: pci_endpoint_test: fix return value of error branch
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (380 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 381/717] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 383/717] bus: fsl-mc: add back accidentally dropped error check Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Xiongfeng Wang, Sasha Levin

From: Xiongfeng Wang <wangxiongfeng2@huawei.com>

[ Upstream commit 1749c90489f2afa6b59dbf3ab59d58a9014c84a1 ]

We return 'err' in the error branch, but this variable may be set as
zero before. Fix it by setting 'err' as a negative value before we
goto the error label.

Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Link: https://lore.kernel.org/r/1605790158-6780-1-git-send-email-wangxiongfeng2@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/pci_endpoint_test.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 146ca6fb3260f..d3844730eacaf 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -811,8 +811,10 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
 
 	pci_set_master(pdev);
 
-	if (!pci_endpoint_test_alloc_irq_vectors(test, irq_type))
+	if (!pci_endpoint_test_alloc_irq_vectors(test, irq_type)) {
+		err = -EINVAL;
 		goto err_disable_irq;
+	}
 
 	for (bar = 0; bar < PCI_STD_NUM_BARS; bar++) {
 		if (pci_resource_flags(pdev, bar) & IORESOURCE_MEM) {
@@ -849,8 +851,10 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
 		goto err_ida_remove;
 	}
 
-	if (!pci_endpoint_test_request_irq(test))
+	if (!pci_endpoint_test_request_irq(test)) {
+		err = -EINVAL;
 		goto err_kfree_test_name;
+	}
 
 	misc_device = &test->miscdev;
 	misc_device->minor = MISC_DYNAMIC_MINOR;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 383/717] bus: fsl-mc: add back accidentally dropped error check
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (381 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 382/717] misc: pci_endpoint_test: fix return value of error branch Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 384/717] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Laurentiu Tudor, Sasha Levin

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

[ Upstream commit 61243c03dde238170001093a29716c2369e8358f ]

A previous patch accidentally dropped an error check, so add it back.

Fixes: aef85b56c3c1 ("bus: fsl-mc: MC control registers are not always available")
Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Link: https://lore.kernel.org/r/20201105153050.19662-1-laurentiu.tudor@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 76a6ee505d33d..806766b1b45f6 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -967,8 +967,11 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, mc);
 
 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-	if (plat_res)
+	if (plat_res) {
 		mc->fsl_mc_regs = devm_ioremap_resource(&pdev->dev, plat_res);
+		if (IS_ERR(mc->fsl_mc_regs))
+			return PTR_ERR(mc->fsl_mc_regs);
+	}
 
 	if (mc->fsl_mc_regs && IS_ENABLED(CONFIG_ACPI) &&
 	    !dev_of_node(&pdev->dev)) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 384/717] bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (382 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 383/717] bus: fsl-mc: add back accidentally dropped error check Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 385/717] fsi: Aspeed: Add mutex to protect HW access Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Laurentiu Tudor,
	Zhang Changzhong, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 197f4d6a4a00 ("staging: fsl-mc: fsl-mc object allocator driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Acked-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607068967-31991-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
index e71a6f52ea0cf..2d7c764bb7dcf 100644
--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
+++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev,
 		goto error;
 
 	mc_adev = resource->data;
-	if (!mc_adev)
+	if (!mc_adev) {
+		error = -EINVAL;
 		goto error;
+	}
 
 	mc_adev->consumer_link = device_link_add(&mc_dev->dev,
 						 &mc_adev->dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 385/717] fsi: Aspeed: Add mutex to protect HW access
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (383 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 384/717] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 386/717] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joel Stanley, Milton Miller,
	Eddie James, Sasha Levin

From: Eddie James <eajames@linux.ibm.com>

[ Upstream commit dfd7f2c1c532efaeff6084970bb60ec2f2e44191 ]

There is nothing to prevent multiple commands being executed
simultaneously. Add a mutex to prevent this.

Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Milton Miller <miltonm@us.ibm.com>
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201120004929.185239-1-joel@jms.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fsi/fsi-master-aspeed.c | 45 +++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 16 deletions(-)

diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index c006ec008a1aa..90dbe58ca1edc 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -8,6 +8,7 @@
 #include <linux/io.h>
 #include <linux/mfd/syscon.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
@@ -19,6 +20,7 @@
 
 struct fsi_master_aspeed {
 	struct fsi_master	master;
+	struct mutex		lock;	/* protect HW access */
 	struct device		*dev;
 	void __iomem		*base;
 	struct clk		*clk;
@@ -254,6 +256,8 @@ static int aspeed_master_read(struct fsi_master *master, int link,
 	addr |= id << 21;
 	addr += link * FSI_HUB_LINK_SIZE;
 
+	mutex_lock(&aspeed->lock);
+
 	switch (size) {
 	case 1:
 		ret = opb_readb(aspeed, fsi_base + addr, val);
@@ -265,14 +269,14 @@ static int aspeed_master_read(struct fsi_master *master, int link,
 		ret = opb_readl(aspeed, fsi_base + addr, val);
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto done;
 	}
 
 	ret = check_errors(aspeed, ret);
-	if (ret)
-		return ret;
-
-	return 0;
+done:
+	mutex_unlock(&aspeed->lock);
+	return ret;
 }
 
 static int aspeed_master_write(struct fsi_master *master, int link,
@@ -287,6 +291,8 @@ static int aspeed_master_write(struct fsi_master *master, int link,
 	addr |= id << 21;
 	addr += link * FSI_HUB_LINK_SIZE;
 
+	mutex_lock(&aspeed->lock);
+
 	switch (size) {
 	case 1:
 		ret = opb_writeb(aspeed, fsi_base + addr, *(u8 *)val);
@@ -298,14 +304,14 @@ static int aspeed_master_write(struct fsi_master *master, int link,
 		ret = opb_writel(aspeed, fsi_base + addr, *(__be32 *)val);
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto done;
 	}
 
 	ret = check_errors(aspeed, ret);
-	if (ret)
-		return ret;
-
-	return 0;
+done:
+	mutex_unlock(&aspeed->lock);
+	return ret;
 }
 
 static int aspeed_master_link_enable(struct fsi_master *master, int link,
@@ -320,17 +326,21 @@ static int aspeed_master_link_enable(struct fsi_master *master, int link,
 
 	reg = cpu_to_be32(0x80000000 >> bit);
 
-	if (!enable)
-		return opb_writel(aspeed, ctrl_base + FSI_MCENP0 + (4 * idx),
-				  reg);
+	mutex_lock(&aspeed->lock);
+
+	if (!enable) {
+		ret = opb_writel(aspeed, ctrl_base + FSI_MCENP0 + (4 * idx), reg);
+		goto done;
+	}
 
 	ret = opb_writel(aspeed, ctrl_base + FSI_MSENP0 + (4 * idx), reg);
 	if (ret)
-		return ret;
+		goto done;
 
 	mdelay(FSI_LINK_ENABLE_SETUP_TIME);
-
-	return 0;
+done:
+	mutex_unlock(&aspeed->lock);
+	return ret;
 }
 
 static int aspeed_master_term(struct fsi_master *master, int link, uint8_t id)
@@ -431,9 +441,11 @@ static ssize_t cfam_reset_store(struct device *dev, struct device_attribute *att
 {
 	struct fsi_master_aspeed *aspeed = dev_get_drvdata(dev);
 
+	mutex_lock(&aspeed->lock);
 	gpiod_set_value(aspeed->cfam_reset_gpio, 1);
 	usleep_range(900, 1000);
 	gpiod_set_value(aspeed->cfam_reset_gpio, 0);
+	mutex_unlock(&aspeed->lock);
 
 	return count;
 }
@@ -597,6 +609,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
 
 	dev_set_drvdata(&pdev->dev, aspeed);
 
+	mutex_init(&aspeed->lock);
 	aspeed_master_init(aspeed);
 
 	rc = fsi_master_register(&aspeed->master);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 386/717] s390/cio: fix use-after-free in ccw_device_destroy_console
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (384 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 385/717] fsi: Aspeed: Add mutex to protect HW access Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 387/717] iwlwifi: dbg-tlv: fix old length in is_trig_data_contained() Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Cornelia Huck,
	Qinglang Miao, Vineeth Vijayan, Heiko Carstens, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 14d4c4fa46eeaa3922e8e1c4aa727eb0a1412804 ]

Use of sch->dev reference after the put_device() call could trigger
the use-after-free bugs.

Fix this by simply adjusting the position of put_device.

Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Suggested-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
[vneethv@linux.ibm.com: Slight modification in the commit-message]
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/device.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index b29fe8d50baf2..33280ca181e95 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1664,10 +1664,10 @@ void __init ccw_device_destroy_console(struct ccw_device *cdev)
 	struct io_subchannel_private *io_priv = to_io_private(sch);
 
 	set_io_private(sch, NULL);
-	put_device(&sch->dev);
-	put_device(&cdev->dev);
 	dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
 			  io_priv->dma_area, io_priv->dma_area_dma);
+	put_device(&sch->dev);
+	put_device(&cdev->dev);
 	kfree(io_priv);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 387/717] iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (385 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 386/717] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 388/717] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Gabay, Johannes Berg,
	Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 58a1c9f9a9b6b9092ae10b84f6b571a06596e296 ]

There's a bug in the lengths - the 'old length' needs to be calculated
using the 'old' pointer, of course, likely a copy/paste mistake. Fix
this.

Reported-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.c0105ddffa74.I1ddb243053ff763c91b663748b6a593ecc3b5634@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 51ce93d21ffe5..8fa1c22fd96db 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -808,7 +808,7 @@ static bool is_trig_data_contained(struct iwl_ucode_tlv *new,
 	struct iwl_fw_ini_trigger_tlv *old_trig = (void *)old->data;
 	__le32 *new_data = new_trig->data, *old_data = old_trig->data;
 	u32 new_dwords_num = iwl_tlv_array_len(new, new_trig, data);
-	u32 old_dwords_num = iwl_tlv_array_len(new, new_trig, data);
+	u32 old_dwords_num = iwl_tlv_array_len(old, old_trig, data);
 	int i, j;
 
 	for (i = 0; i < new_dwords_num; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 388/717] iwlwifi: mvm: hook up missing RX handlers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (386 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 387/717] iwlwifi: dbg-tlv: fix old length in is_trig_data_contained() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 389/717] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 8a59d39033c35bb484f6bd91891db86ebe07fdc2 ]

The RX handlers for probe response data and channel switch weren't
hooked up properly, fix that.

Fixes: 86e177d80ff7 ("iwlwifi: mvm: add NOA and CSA to a probe response")
Fixes: d3a108a48dc6 ("iwlwifi: mvm: Support CSA countdown offloading")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.2d07dcee0d35.I07a61b5d734478db57d9434ff303e4c90bf6c32b@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index f1c5b3a9c26f7..0d1118f66f0d5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -315,6 +315,12 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
 		       iwl_mvm_mu_mimo_grp_notif, RX_HANDLER_SYNC),
 	RX_HANDLER_GRP(DATA_PATH_GROUP, STA_PM_NOTIF,
 		       iwl_mvm_sta_pm_notif, RX_HANDLER_SYNC),
+	RX_HANDLER_GRP(MAC_CONF_GROUP, PROBE_RESPONSE_DATA_NOTIF,
+		       iwl_mvm_probe_resp_data_notif,
+		       RX_HANDLER_ASYNC_LOCKED),
+	RX_HANDLER_GRP(MAC_CONF_GROUP, CHANNEL_SWITCH_NOA_NOTIF,
+		       iwl_mvm_channel_switch_noa_notif,
+		       RX_HANDLER_SYNC),
 };
 #undef RX_HANDLER
 #undef RX_HANDLER_GRP
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 389/717] erofs: avoid using generic_block_bmap
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (387 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 388/717] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 390/717] clk: renesas: r8a779a0: Fix R and OSC clocks Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Gao Xiang, Huang Jianan,
	Guo Weichao, Sasha Levin

From: Huang Jianan <huangjianan@oppo.com>

[ Upstream commit d8b3df8b1048405e73558b88cba2adf29490d468 ]

Surprisingly, `block' in sector_t indicates the number of
i_blkbits-sized blocks rather than sectors for bmap.

In addition, considering buffer_head limits mapped size to 32-bits,
should avoid using generic_block_bmap.

Link: https://lore.kernel.org/r/20201209115740.18802-1-huangjianan@oppo.com
Fixes: 9da681e017a3 ("staging: erofs: support bmap")
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Reviewed-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Huang Jianan <huangjianan@oppo.com>
Signed-off-by: Guo Weichao <guoweichao@oppo.com>
[ Gao Xiang: slightly update the commit message description. ]
Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/erofs/data.c | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 347be146884c3..ea4f693bee224 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -312,27 +312,12 @@ static void erofs_raw_access_readahead(struct readahead_control *rac)
 		submit_bio(bio);
 }
 
-static int erofs_get_block(struct inode *inode, sector_t iblock,
-			   struct buffer_head *bh, int create)
-{
-	struct erofs_map_blocks map = {
-		.m_la = iblock << 9,
-	};
-	int err;
-
-	err = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW);
-	if (err)
-		return err;
-
-	if (map.m_flags & EROFS_MAP_MAPPED)
-		bh->b_blocknr = erofs_blknr(map.m_pa);
-
-	return err;
-}
-
 static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
 {
 	struct inode *inode = mapping->host;
+	struct erofs_map_blocks map = {
+		.m_la = blknr_to_addr(block),
+	};
 
 	if (EROFS_I(inode)->datalayout == EROFS_INODE_FLAT_INLINE) {
 		erofs_blk_t blks = i_size_read(inode) >> LOG_BLOCK_SIZE;
@@ -341,7 +326,10 @@ static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
 			return 0;
 	}
 
-	return generic_block_bmap(mapping, block, erofs_get_block);
+	if (!erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW))
+		return erofs_blknr(map.m_pa);
+
+	return 0;
 }
 
 /* for uncompressed (aligned) files and raw access for other files */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 390/717] clk: renesas: r8a779a0: Fix R and OSC clocks
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (388 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 389/717] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 391/717] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
	Yoshihiro Shimoda, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 14653942de7f63e21ece32e3901f09a248598a43 ]

The R-Car V3U clock driver defines the R and OSC clocks using R-Car Gen3
clock types.  However, The R-Car V3U clock driver does not use the R-Car
Gen3 clock driver core, hence registering the R and OSC clocks fails:

    renesas-cpg-mssr e6150000.clock-controller: Failed to register core clock osc: -22
    renesas-cpg-mssr e6150000.clock-controller: Failed to register core clock r: -22

Fix this by introducing clock definition macros specific to R-Car V3U.
Note that rcar_r8a779a0_cpg_clk_register() already handled the related
clock types.  Drop the now unneeded include of rcar-gen3-cpg.h.

Fixes: 17bcc8035d2d19fc ("clk: renesas: cpg-mssr: Add support for R-Car V3U")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20201109152614.2465483-1-geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/renesas/r8a779a0-cpg-mssr.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/renesas/r8a779a0-cpg-mssr.c b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
index 17ebbac7ddfb4..046d79416b7d0 100644
--- a/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
@@ -26,7 +26,6 @@
 #include <dt-bindings/clock/r8a779a0-cpg-mssr.h>
 
 #include "renesas-cpg-mssr.h"
-#include "rcar-gen3-cpg.h"
 
 enum rcar_r8a779a0_clk_types {
 	CLK_TYPE_R8A779A0_MAIN = CLK_TYPE_CUSTOM,
@@ -84,6 +83,14 @@ enum clk_ids {
 	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_PLL2X_3X, CLK_MAIN, \
 		 .offset = _offset)
 
+#define DEF_MDSEL(_name, _id, _md, _parent0, _div0, _parent1, _div1) \
+	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_MDSEL,	\
+		 (_parent0) << 16 | (_parent1),		\
+		 .div = (_div0) << 16 | (_div1), .offset = _md)
+
+#define DEF_OSC(_name, _id, _parent, _div)		\
+	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_OSC, _parent, .div = _div)
+
 static const struct cpg_core_clk r8a779a0_core_clks[] __initconst = {
 	/* External Clock Inputs */
 	DEF_INPUT("extal",  CLK_EXTAL),
@@ -136,8 +143,8 @@ static const struct cpg_core_clk r8a779a0_core_clks[] __initconst = {
 	DEF_DIV6P1("canfd",	R8A779A0_CLK_CANFD,	CLK_PLL5_DIV4,	0x878),
 	DEF_DIV6P1("csi0",	R8A779A0_CLK_CSI0,	CLK_PLL5_DIV4,	0x880),
 
-	DEF_GEN3_OSC("osc",	R8A779A0_CLK_OSC,	CLK_EXTAL,	8),
-	DEF_GEN3_MDSEL("r",	R8A779A0_CLK_R, 29, CLK_EXTALR, 1, CLK_OCO, 1),
+	DEF_OSC("osc",		R8A779A0_CLK_OSC,	CLK_EXTAL,	8),
+	DEF_MDSEL("r",		R8A779A0_CLK_R, 29, CLK_EXTALR, 1, CLK_OCO, 1),
 };
 
 static const struct mssr_mod_clk r8a779a0_mod_clks[] __initconst = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 391/717] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (389 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 390/717] clk: renesas: r8a779a0: Fix R and OSC clocks Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 392/717] powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Nyekjaer, Sriram Dash,
	Dan Murphy, Marc Kleine-Budde, Sasha Levin

From: Sean Nyekjaer <sean@geanix.com>

[ Upstream commit c9f4cad6cdfe350ce2637e57f7f2aa7ff326bcc6 ]

The CSR bit is already cleared when arriving here so remove this section of
duplicate code.

The registers set in m_can_config_endisable() is set to same exact values as
before this patch.

Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Acked-by: Sriram Dash <sriram.dash@samsung.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Link: https://lore.kernel.org/r/20191211063227.84259-1-sean@geanix.com
Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 61a93b1920379..7fc4ac1582afc 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -380,10 +380,6 @@ void m_can_config_endisable(struct m_can_classdev *cdev, bool enable)
 		cccr &= ~CCCR_CSR;
 
 	if (enable) {
-		/* Clear the Clock stop request if it was set */
-		if (cccr & CCCR_CSR)
-			cccr &= ~CCCR_CSR;
-
 		/* enable m_can configuration */
 		m_can_write(cdev, M_CAN_CCCR, cccr | CCCR_INIT);
 		udelay(5);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 392/717] powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (390 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 391/717] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 393/717] powerpc/sstep: Cover new VSX instructions under CONFIG_VSX Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Balamuruhan S, Ravi Bangoria,
	Sandipan Das, Daniel Axtens, Michael Ellerman, Sasha Levin

From: Balamuruhan S <bala24@linux.ibm.com>

[ Upstream commit ef6879f8c8053cc3b493f400a06d452d7fb13650 ]

Unconditional emulation of prefixed instructions will allow
emulation of them on Power10 predecessors which might cause
issues. Restrict that.

Fixes: 3920742b92f5 ("powerpc sstep: Add support for prefixed fixed-point arithmetic")
Fixes: 50b80a12e4cc ("powerpc sstep: Add support for prefixed load/stores")
Signed-off-by: Balamuruhan S <bala24@linux.ibm.com>
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Reviewed-by: Sandipan Das <sandipan@linux.ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201011050908.72173-2-ravi.bangoria@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/lib/sstep.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 855457ed09b54..bf2cd3d42125d 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1346,6 +1346,9 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 	switch (opcode) {
 #ifdef __powerpc64__
 	case 1:
+		if (!cpu_has_feature(CPU_FTR_ARCH_31))
+			return -1;
+
 		prefix_r = GET_PREFIX_R(word);
 		ra = GET_PREFIX_RA(suffix);
 		rd = (suffix >> 21) & 0x1f;
@@ -2733,6 +2736,9 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 		}
 		break;
 	case 1: /* Prefixed instructions */
+		if (!cpu_has_feature(CPU_FTR_ARCH_31))
+			return -1;
+
 		prefix_r = GET_PREFIX_R(word);
 		ra = GET_PREFIX_RA(suffix);
 		op->update_reg = ra;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 393/717] powerpc/sstep: Cover new VSX instructions under CONFIG_VSX
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (391 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 392/717] powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 394/717] slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ravi Bangoria, Michael Ellerman, Sasha Levin

From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

[ Upstream commit 1817de2f141c718f1a0ae59927ec003e9b144349 ]

Recently added Power10 prefixed VSX instruction are included
unconditionally in the kernel. If they are executed on a
machine without VSX support, it might create issues. Fix that.
Also fix one mnemonics spelling mistake in comment.

Fixes: 50b80a12e4cc ("powerpc sstep: Add support for prefixed load/stores")
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201011050908.72173-3-ravi.bangoria@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/lib/sstep.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index bf2cd3d42125d..b18bce1a209fa 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -2757,6 +2757,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 			case 41:	/* plwa */
 				op->type = MKOP(LOAD, PREFIXED | SIGNEXT, 4);
 				break;
+#ifdef CONFIG_VSX
 			case 42:        /* plxsd */
 				op->reg = rd + 32;
 				op->type = MKOP(LOAD_VSX, PREFIXED, 8);
@@ -2797,13 +2798,14 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 				op->element_size = 16;
 				op->vsx_flags = VSX_CHECK_VEC;
 				break;
+#endif /* CONFIG_VSX */
 			case 56:        /* plq */
 				op->type = MKOP(LOAD, PREFIXED, 16);
 				break;
 			case 57:	/* pld */
 				op->type = MKOP(LOAD, PREFIXED, 8);
 				break;
-			case 60:        /* stq */
+			case 60:        /* pstq */
 				op->type = MKOP(STORE, PREFIXED, 16);
 				break;
 			case 61:	/* pstd */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 394/717] slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (392 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 393/717] powerpc/sstep: Cover new VSX instructions under CONFIG_VSX Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 395/717] ALSA: hda/hdmi: fix silent stream for first playback to DP Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Changzhong, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 428bb001143cf5bfb65aa4ae90d4ebc95f82d007 ]

platform_get_resource_byname() may fail and in this case a NULL
dereference will occur.

Fix it to use devm_platform_ioremap_resource_byname() instead of calling
platform_get_resource_byname() and devm_ioremap().

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t,
n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Fixes: ad7fcbc308b0 ("slimbus: qcom: Add Qualcomm Slimbus controller driver")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607392473-20610-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/slimbus/qcom-ctrl.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
index 4aad2566f52d2..f04b961b96cd4 100644
--- a/drivers/slimbus/qcom-ctrl.c
+++ b/drivers/slimbus/qcom-ctrl.c
@@ -472,15 +472,10 @@ static void qcom_slim_rxwq(struct work_struct *work)
 static void qcom_slim_prg_slew(struct platform_device *pdev,
 				struct qcom_slim_ctrl *ctrl)
 {
-	struct resource	*slew_mem;
-
 	if (!ctrl->slew_reg) {
 		/* SLEW RATE register for this SLIMbus */
-		slew_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM,
-				"slew");
-		ctrl->slew_reg = devm_ioremap(&pdev->dev, slew_mem->start,
-				resource_size(slew_mem));
-		if (!ctrl->slew_reg)
+		ctrl->slew_reg = devm_platform_ioremap_resource_byname(pdev, "slew");
+		if (IS_ERR(ctrl->slew_reg))
 			return;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 395/717] ALSA: hda/hdmi: fix silent stream for first playback to DP
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (393 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 394/717] slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 396/717] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai Vehmanen, Takashi Iwai, Sasha Levin

From: Kai Vehmanen <kai.vehmanen@linux.intel.com>

[ Upstream commit b1a5039759cb7bfcb2157f28604dbda0bca58598 ]

A problem exists in enabling silent stream when connection type is
DisplayPort. Silent stream programming is completed when a new DP
receiver is connected, but infoframe transmission does not actually
start until PCM is opened for the first time. This can result in audible
gap of multiple seconds. This only affects the first PCM open.

Fix the issue by properly assigning a converter to the silent stream,
and modifying the required stream ID programming sequence.

This change only affects Intel display audio codecs.

BugLink: https://github.com/thesofproject/linux/issues/2468
Fixes: 951894cf30f4 ("ALSA: hda/hdmi: Add Intel silent stream support")
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20201210174445.3134104-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/patch_hdmi.c | 98 +++++++++++++++++++++++++++++++++-----
 1 file changed, 86 insertions(+), 12 deletions(-)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b0068f8ca46dd..2ddc27db8c012 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -78,6 +78,7 @@ struct hdmi_spec_per_pin {
 	int pcm_idx; /* which pcm is attached. -1 means no pcm is attached */
 	int repoll_count;
 	bool setup; /* the stream has been set up by prepare callback */
+	bool silent_stream;
 	int channels; /* current number of channels */
 	bool non_pcm;
 	bool chmap_set;		/* channel-map override by ALSA API? */
@@ -979,6 +980,13 @@ static int hdmi_choose_cvt(struct hda_codec *codec,
 	else
 		per_pin = get_pin(spec, pin_idx);
 
+	if (per_pin && per_pin->silent_stream) {
+		cvt_idx = cvt_nid_to_cvt_index(codec, per_pin->cvt_nid);
+		if (cvt_id)
+			*cvt_id = cvt_idx;
+		return 0;
+	}
+
 	/* Dynamically assign converter to stream */
 	for (cvt_idx = 0; cvt_idx < spec->num_cvts; cvt_idx++) {
 		per_cvt = get_cvt(spec, cvt_idx);
@@ -1642,30 +1650,95 @@ static void hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
 	snd_hda_power_down_pm(codec);
 }
 
+#define I915_SILENT_RATE		48000
+#define I915_SILENT_CHANNELS		2
+#define I915_SILENT_FORMAT		SNDRV_PCM_FORMAT_S16_LE
+#define I915_SILENT_FORMAT_BITS	16
+#define I915_SILENT_FMT_MASK		0xf
+
 static void silent_stream_enable(struct hda_codec *codec,
-				struct hdmi_spec_per_pin *per_pin)
+				 struct hdmi_spec_per_pin *per_pin)
 {
-	unsigned int newval, oldval;
-
-	codec_dbg(codec, "hdmi: enabling silent stream for NID %d\n",
-			per_pin->pin_nid);
+	struct hdmi_spec *spec = codec->spec;
+	struct hdmi_spec_per_cvt *per_cvt;
+	int cvt_idx, pin_idx, err;
+	unsigned int format;
 
 	mutex_lock(&per_pin->lock);
 
-	if (!per_pin->channels)
-		per_pin->channels = 2;
+	if (per_pin->setup) {
+		codec_dbg(codec, "hdmi: PCM already open, no silent stream\n");
+		goto unlock_out;
+	}
 
-	oldval = snd_hda_codec_read(codec, per_pin->pin_nid, 0,
-			AC_VERB_GET_CONV, 0);
-	newval = (oldval & 0xF0) | 0xF;
-	snd_hda_codec_write(codec, per_pin->pin_nid, 0,
-			AC_VERB_SET_CHANNEL_STREAMID, newval);
+	pin_idx = pin_id_to_pin_index(codec, per_pin->pin_nid, per_pin->dev_id);
+	err = hdmi_choose_cvt(codec, pin_idx, &cvt_idx);
+	if (err) {
+		codec_err(codec, "hdmi: no free converter to enable silent mode\n");
+		goto unlock_out;
+	}
+
+	per_cvt = get_cvt(spec, cvt_idx);
+	per_cvt->assigned = 1;
+	per_pin->cvt_nid = per_cvt->cvt_nid;
+	per_pin->silent_stream = true;
 
+	codec_dbg(codec, "hdmi: enabling silent stream pin-NID=0x%x cvt-NID=0x%x\n",
+		  per_pin->pin_nid, per_cvt->cvt_nid);
+
+	snd_hda_set_dev_select(codec, per_pin->pin_nid, per_pin->dev_id);
+	snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
+				  AC_VERB_SET_CONNECT_SEL,
+				  per_pin->mux_idx);
+
+	/* configure unused pins to choose other converters */
+	pin_cvt_fixup(codec, per_pin, 0);
+
+	snd_hdac_sync_audio_rate(&codec->core, per_pin->pin_nid,
+				 per_pin->dev_id, I915_SILENT_RATE);
+
+	/* trigger silent stream generation in hw */
+	format = snd_hdac_calc_stream_format(I915_SILENT_RATE, I915_SILENT_CHANNELS,
+					     I915_SILENT_FORMAT, I915_SILENT_FORMAT_BITS, 0);
+	snd_hda_codec_setup_stream(codec, per_pin->cvt_nid,
+				   I915_SILENT_FMT_MASK, I915_SILENT_FMT_MASK, format);
+	usleep_range(100, 200);
+	snd_hda_codec_setup_stream(codec, per_pin->cvt_nid, I915_SILENT_FMT_MASK, 0, format);
+
+	per_pin->channels = I915_SILENT_CHANNELS;
 	hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
 
+ unlock_out:
 	mutex_unlock(&per_pin->lock);
 }
 
+static void silent_stream_disable(struct hda_codec *codec,
+				  struct hdmi_spec_per_pin *per_pin)
+{
+	struct hdmi_spec *spec = codec->spec;
+	struct hdmi_spec_per_cvt *per_cvt;
+	int cvt_idx;
+
+	mutex_lock(&per_pin->lock);
+	if (!per_pin->silent_stream)
+		goto unlock_out;
+
+	codec_dbg(codec, "HDMI: disable silent stream on pin-NID=0x%x cvt-NID=0x%x\n",
+		  per_pin->pin_nid, per_pin->cvt_nid);
+
+	cvt_idx = cvt_nid_to_cvt_index(codec, per_pin->cvt_nid);
+	if (cvt_idx >= 0 && cvt_idx < spec->num_cvts) {
+		per_cvt = get_cvt(spec, cvt_idx);
+		per_cvt->assigned = 0;
+	}
+
+	per_pin->cvt_nid = 0;
+	per_pin->silent_stream = false;
+
+ unlock_out:
+	mutex_unlock(&spec->pcm_lock);
+}
+
 /* update ELD and jack state via audio component */
 static void sync_eld_via_acomp(struct hda_codec *codec,
 			       struct hdmi_spec_per_pin *per_pin)
@@ -1701,6 +1774,7 @@ static void sync_eld_via_acomp(struct hda_codec *codec,
 				pm_ret);
 			silent_stream_enable(codec, per_pin);
 		} else if (monitor_prev && !monitor_next) {
+			silent_stream_disable(codec, per_pin);
 			pm_ret = snd_hda_power_down_pm(codec);
 			if (pm_ret < 0)
 				codec_err(codec,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 396/717] RDMA/core: Do not indicate device ready when device enablement fails
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (394 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 395/717] ALSA: hda/hdmi: fix silent stream for first playback to DP Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 397/717] RDMA/uverbs: Fix incorrect variable type Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jack Morgenstein,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 779e0bf47632c609c59f527f9711ecd3214dccb0 ]

In procedure ib_register_device, procedure kobject_uevent is called
(advertising that the device is ready for userspace usage) even when
device_enable_and_get() returned an error.

As a result, various RDMA modules attempted to register for the device
even while the device driver was preparing to unregister the device.

Fix this by advertising the device availability only after enabling the
device succeeds.

Fixes: e7a5b4aafd82 ("RDMA/device: Don't fire uevent before device is fully initialized")
Link: https://lore.kernel.org/r/20201208073545.9723-3-leon@kernel.org
Suggested-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a3b1fc84cdcab..4a041511b70ec 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1374,9 +1374,6 @@ int ib_register_device(struct ib_device *device, const char *name,
 	}
 
 	ret = enable_device_and_get(device);
-	dev_set_uevent_suppress(&device->dev, false);
-	/* Mark for userspace that device is ready */
-	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
 	if (ret) {
 		void (*dealloc_fn)(struct ib_device *);
 
@@ -1396,8 +1393,12 @@ int ib_register_device(struct ib_device *device, const char *name,
 		ib_device_put(device);
 		__ib_unregister_device(device);
 		device->ops.dealloc_driver = dealloc_fn;
+		dev_set_uevent_suppress(&device->dev, false);
 		return ret;
 	}
+	dev_set_uevent_suppress(&device->dev, false);
+	/* Mark for userspace that device is ready */
+	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
 	ib_device_put(device);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 397/717] RDMA/uverbs: Fix incorrect variable type
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (395 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 396/717] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 398/717] remoteproc/mediatek: change MT8192 CFG register base Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Avihai Horon,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Avihai Horon <avihaih@nvidia.com>

[ Upstream commit e0da68994d16b46384cce7b86eb645f1ef7c51ef ]

Fix incorrect type of max_entries in UVERBS_METHOD_QUERY_GID_TABLE -
max_entries is of type size_t although it can take negative values.

The following static check revealed it:

drivers/infiniband/core/uverbs_std_types_device.c:338 ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE() warn: 'max_entries' unsigned <= 0

Fixes: 9f85cbe50aa0 ("RDMA/uverbs: Expose the new GID query API to user space")
Link: https://lore.kernel.org/r/20201208073545.9723-4-leon@kernel.org
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/uverbs_std_types_device.c | 14 +++++---------
 include/rdma/uverbs_ioctl.h                       | 10 ++++++++++
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 302f898c5833f..9ec6971056fa8 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -317,8 +317,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)(
 	struct ib_device *ib_dev;
 	size_t user_entry_size;
 	ssize_t num_entries;
-	size_t max_entries;
-	size_t num_bytes;
+	int max_entries;
 	u32 flags;
 	int ret;
 
@@ -336,19 +335,16 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)(
 		attrs, UVERBS_ATTR_QUERY_GID_TABLE_RESP_ENTRIES,
 		user_entry_size);
 	if (max_entries <= 0)
-		return -EINVAL;
+		return max_entries ?: -EINVAL;
 
 	ucontext = ib_uverbs_get_ucontext(attrs);
 	if (IS_ERR(ucontext))
 		return PTR_ERR(ucontext);
 	ib_dev = ucontext->device;
 
-	if (check_mul_overflow(max_entries, sizeof(*entries), &num_bytes))
-		return -EINVAL;
-
-	entries = uverbs_zalloc(attrs, num_bytes);
-	if (!entries)
-		return -ENOMEM;
+	entries = uverbs_kcalloc(attrs, max_entries, sizeof(*entries));
+	if (IS_ERR(entries))
+		return PTR_ERR(entries);
 
 	num_entries = rdma_query_gid_table(ib_dev, entries, max_entries);
 	if (num_entries < 0)
diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
index b00270c72740f..94fac55772f57 100644
--- a/include/rdma/uverbs_ioctl.h
+++ b/include/rdma/uverbs_ioctl.h
@@ -862,6 +862,16 @@ static inline __malloc void *uverbs_zalloc(struct uverbs_attr_bundle *bundle,
 {
 	return _uverbs_alloc(bundle, size, GFP_KERNEL | __GFP_ZERO);
 }
+
+static inline __malloc void *uverbs_kcalloc(struct uverbs_attr_bundle *bundle,
+					    size_t n, size_t size)
+{
+	size_t bytes;
+
+	if (unlikely(check_mul_overflow(n, size, &bytes)))
+		return ERR_PTR(-EOVERFLOW);
+	return uverbs_zalloc(bundle, bytes);
+}
 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
 		      size_t idx, s64 lower_bound, u64 upper_bound,
 		      s64 *def_val);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 398/717] remoteproc/mediatek: change MT8192 CFG register base
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (396 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 397/717] RDMA/uverbs: Fix incorrect variable type Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 399/717] remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tzung-Bi Shih, Bjorn Andersson, Sasha Levin

From: Tzung-Bi Shih <tzungbi@google.com>

[ Upstream commit 0a441514bc2b8a48ebe23c2dcb9feee6351d45b6 ]

The correct MT8192 CFG register base is 0x20000 off.  Changes the
registers accordingly.

Fixes: fd0b6c1ff85a ("remoteproc/mediatek: Add support for mt8192 SCP")
Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
Link: https://lore.kernel.org/r/20201210054109.587795-1-tzungbi@google.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/mtk_common.h | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/remoteproc/mtk_common.h b/drivers/remoteproc/mtk_common.h
index 47b4561443a94..f2bcc9d9fda65 100644
--- a/drivers/remoteproc/mtk_common.h
+++ b/drivers/remoteproc/mtk_common.h
@@ -32,22 +32,22 @@
 #define MT8183_SCP_CACHESIZE_8KB	BIT(8)
 #define MT8183_SCP_CACHE_CON_WAYEN	BIT(10)
 
-#define MT8192_L2TCM_SRAM_PD_0		0x210C0
-#define MT8192_L2TCM_SRAM_PD_1		0x210C4
-#define MT8192_L2TCM_SRAM_PD_2		0x210C8
-#define MT8192_L1TCM_SRAM_PDN		0x2102C
-#define MT8192_CPU0_SRAM_PD		0x21080
-
-#define MT8192_SCP2APMCU_IPC_SET	0x24080
-#define MT8192_SCP2APMCU_IPC_CLR	0x24084
+#define MT8192_L2TCM_SRAM_PD_0		0x10C0
+#define MT8192_L2TCM_SRAM_PD_1		0x10C4
+#define MT8192_L2TCM_SRAM_PD_2		0x10C8
+#define MT8192_L1TCM_SRAM_PDN		0x102C
+#define MT8192_CPU0_SRAM_PD		0x1080
+
+#define MT8192_SCP2APMCU_IPC_SET	0x4080
+#define MT8192_SCP2APMCU_IPC_CLR	0x4084
 #define MT8192_SCP_IPC_INT_BIT		BIT(0)
-#define MT8192_SCP2SPM_IPC_CLR		0x24094
-#define MT8192_GIPC_IN_SET		0x24098
+#define MT8192_SCP2SPM_IPC_CLR		0x4094
+#define MT8192_GIPC_IN_SET		0x4098
 #define MT8192_HOST_IPC_INT_BIT		BIT(0)
 
-#define MT8192_CORE0_SW_RSTN_CLR	0x30000
-#define MT8192_CORE0_SW_RSTN_SET	0x30004
-#define MT8192_CORE0_WDT_CFG		0x30034
+#define MT8192_CORE0_SW_RSTN_CLR	0x10000
+#define MT8192_CORE0_SW_RSTN_SET	0x10004
+#define MT8192_CORE0_WDT_CFG		0x10034
 
 #define SCP_FW_VER_LEN			32
 #define SCP_SHARE_BUFFER_SIZE		288
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 399/717] remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (397 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 398/717] remoteproc/mediatek: change MT8192 CFG register base Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 400/717] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Alexandre Courbot,
	Bjorn Andersson, Sasha Levin

From: Alexandre Courbot <acourbot@chromium.org>

[ Upstream commit e59aef4edc45133ccb10b8e962cb74dcf1e3240b ]

Now that this driver can be compiled with COMPILE_TEST, we have no
guarantee that CONFIG_OF will also be defined. When that happens, a
warning about mtk_scp_of_match being defined but unused will be reported
so make sure this variable is only defined if of_match_ptr() actually
uses it.

Fixes: cbd2dca74926c0e4610c40923cc786b732c9e8ef remoteproc: scp: add COMPILE_TEST dependency
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Alexandre Courbot <acourbot@chromium.org>
Link: https://lore.kernel.org/r/20201102074007.299222-1-acourbot@chromium.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/mtk_scp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index 577cbd5d421ec..f74f22d4d1ffc 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -772,12 +772,14 @@ static const struct mtk_scp_of_data mt8192_of_data = {
 	.host_to_scp_int_bit = MT8192_HOST_IPC_INT_BIT,
 };
 
+#if defined(CONFIG_OF)
 static const struct of_device_id mtk_scp_of_match[] = {
 	{ .compatible = "mediatek,mt8183-scp", .data = &mt8183_of_data },
 	{ .compatible = "mediatek,mt8192-scp", .data = &mt8192_of_data },
 	{},
 };
 MODULE_DEVICE_TABLE(of, mtk_scp_of_match);
+#endif
 
 static struct platform_driver mtk_scp_driver = {
 	.probe = scp_probe,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 400/717] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (398 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 399/717] remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 401/717] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Bjorn Andersson, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a24723050037303e4008b37f1f8dcc99c58901aa ]

If the pm_runtime_get_sync failed in q6v5_pds_enable when
loop (i), The unroll_pd_votes will start from (i - 1), and
it will resulted in following problems:

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) Have not reset pds[i] performance state.

Then we fix it.

Fixes: 4760a896be88e ("remoteproc: q6v5-mss: Vote for rpmh power domains")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102143433.143996-1-zhangqilong3@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_mss.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index eb3457a6c3b73..ba6f7551242de 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -349,8 +349,11 @@ static int q6v5_pds_enable(struct q6v5 *qproc, struct device **pds,
 	for (i = 0; i < pd_count; i++) {
 		dev_pm_genpd_set_performance_state(pds[i], INT_MAX);
 		ret = pm_runtime_get_sync(pds[i]);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_noidle(pds[i]);
+			dev_pm_genpd_set_performance_state(pds[i], 0);
 			goto unroll_pd_votes;
+		}
 	}
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 401/717] remoteproc: qcom: fix reference leak in adsp_start
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (399 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 400/717] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 402/717] remoteproc: qcom: pas: fix error handling in adsp_pds_enable Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Bjorn Andersson, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit aa37448f597c09844942da87d042fc6793f989c2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in adsp_start, so we should fix it.

Fixes: dc160e4491222 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102143534.144484-1-zhangqilong3@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_adsp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
index efb2c1aa80a3c..f0b7363b5b268 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -193,8 +193,10 @@ static int adsp_start(struct rproc *rproc)
 
 	dev_pm_genpd_set_performance_state(adsp->dev, INT_MAX);
 	ret = pm_runtime_get_sync(adsp->dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(adsp->dev);
 		goto disable_xo_clk;
+	}
 
 	ret = clk_bulk_prepare_enable(adsp->num_clks, adsp->clks);
 	if (ret) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 402/717] remoteproc: qcom: pas: fix error handling in adsp_pds_enable
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (400 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 401/717] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 403/717] remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories() Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Bjorn Andersson, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit c0a6e5ee1ecfe4c3a5799cfd30820748eff5dfab ]

If the pm_runtime_get_sync failed in adsp_pds_enable when
loop (i), The unroll_pd_votes will start from (i - 1), and
it will resulted in following problems:

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) Have not reset pds[i] performance state.

Then we fix it.

Fixes: 17ee2fb4e8567 ("remoteproc: qcom: pas: Vote for active/proxy power domains")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102143554.144707-1-zhangqilong3@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_pas.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index 3837f23995e05..0678b417707ef 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -90,8 +90,11 @@ static int adsp_pds_enable(struct qcom_adsp *adsp, struct device **pds,
 	for (i = 0; i < pd_count; i++) {
 		dev_pm_genpd_set_performance_state(pds[i], INT_MAX);
 		ret = pm_runtime_get_sync(pds[i]);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_noidle(pds[i]);
+			dev_pm_genpd_set_performance_state(pds[i], 0);
 			goto unroll_pd_votes;
+		}
 	}
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 403/717] remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (401 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 402/717] remoteproc: qcom: pas: fix error handling in adsp_pds_enable Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 404/717] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Poirier, YueHaibing,
	Suman Anna, Bjorn Andersson, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 6dfdf6e4e7096fead7755d47d91d72e896bb4804 ]

In case of error, the function devm_ioremap_wc() returns NULL pointer
not ERR_PTR(). The IS_ERR() test in the return value check should be
replaced with NULL test.

Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 6edbe024ba17 ("remoteproc: k3-dsp: Add a remoteproc driver of K3 C66x DSPs")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Suman Anna <s-anna@ti.com>
Link: https://lore.kernel.org/r/20200905122503.17352-1-yuehaibing@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/ti_k3_dsp_remoteproc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/remoteproc/ti_k3_dsp_remoteproc.c b/drivers/remoteproc/ti_k3_dsp_remoteproc.c
index 9011e477290ce..863c0214e0a8e 100644
--- a/drivers/remoteproc/ti_k3_dsp_remoteproc.c
+++ b/drivers/remoteproc/ti_k3_dsp_remoteproc.c
@@ -445,10 +445,10 @@ static int k3_dsp_rproc_of_get_memories(struct platform_device *pdev,
 
 		kproc->mem[i].cpu_addr = devm_ioremap_wc(dev, res->start,
 							 resource_size(res));
-		if (IS_ERR(kproc->mem[i].cpu_addr)) {
+		if (!kproc->mem[i].cpu_addr) {
 			dev_err(dev, "failed to map %s memory\n",
 				data->mems[i].name);
-			return PTR_ERR(kproc->mem[i].cpu_addr);
+			return -ENOMEM;
 		}
 		kproc->mem[i].bus_addr = res->start;
 		kproc->mem[i].dev_addr = data->mems[i].dev_addr;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 404/717] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (402 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 403/717] remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 405/717] remoteproc/mediatek: unprepare clk if scp_before_load fails Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Changzhong, Bjorn Andersson,
	Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit c3d4e5b12672bbdf63f4cc933e3169bc6bbec8da ]

platform_get_resource() may fail and in this case a NULL dereference
will occur.

Fix it to use devm_platform_ioremap_resource() instead of calling
platform_get_resource() and devm_ioremap().

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t,
n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607392460-20516-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_adsp.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
index f0b7363b5b268..9eb599701f9b0 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -364,15 +364,12 @@ static int adsp_init_mmio(struct qcom_adsp *adsp,
 				struct platform_device *pdev)
 {
 	struct device_node *syscon;
-	struct resource *res;
 	int ret;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	adsp->qdsp6ss_base = devm_ioremap(&pdev->dev, res->start,
-			resource_size(res));
-	if (!adsp->qdsp6ss_base) {
+	adsp->qdsp6ss_base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(adsp->qdsp6ss_base)) {
 		dev_err(adsp->dev, "failed to map QDSP6SS registers\n");
-		return -ENOMEM;
+		return PTR_ERR(adsp->qdsp6ss_base);
 	}
 
 	syscon = of_parse_phandle(pdev->dev.of_node, "qcom,halt-regs", 0);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 405/717] remoteproc/mediatek: unprepare clk if scp_before_load fails
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (403 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 404/717] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 406/717] clk: qcom: gcc-sc7180: Use floor ops for sdcc clks Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Poirier, Tzung-Bi Shih,
	Bjorn Andersson, Sasha Levin

From: Tzung-Bi Shih <tzungbi@google.com>

[ Upstream commit 22c3df6f5574c8d401ea431c7ce24e7c5c5e7ef3 ]

Fixes the error handling to unprepare clk if scp_before_load fails.

Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: fd0b6c1ff85a ("remoteproc/mediatek: Add support for mt8192 SCP")
Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
Link: https://lore.kernel.org/r/20201203155914.3844426-1-tzungbi@google.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/mtk_scp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index f74f22d4d1ffc..52fa01d67c18e 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -350,9 +350,10 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
 
 	ret = scp->data->scp_before_load(scp);
 	if (ret < 0)
-		return ret;
+		goto leave;
 
 	ret = scp_elf_load_segments(rproc, fw);
+leave:
 	clk_disable_unprepare(scp->clk);
 
 	return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 406/717] clk: qcom: gcc-sc7180: Use floor ops for sdcc clks
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (404 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 405/717] remoteproc/mediatek: unprepare clk if scp_before_load fails Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 407/717] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 6d37a8d192830267e6b10a6d57ae28d2e89097e7 ]

I would repeat the same commit message that was in commit 5e4b7e82d497
("clk: qcom: gcc-sdm845: Use floor ops for sdcc clks") but it seems
silly to do so when you could just go read that commit.

NOTE: this is actually extra terrible because we're missing the 50 MHz
rate in the table (see the next patch AKA ("clk: qcom: gcc-sc7180: Add
50 MHz clock rate for SDC2")).  That means then when you run an older
SD card it'll try to clock it at 100 MHz when it's only specced to run
at 50 MHz max.  As you can probably guess that doesn't work super
well.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Fixes: 17269568f726 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180")
Link: https://lore.kernel.org/r/20201210102234.1.I096779f219625148900fc984dd0084ed1ba87c7f@changeid
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-sc7180.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
index 68d8f7aaf64e1..b080739ab0c33 100644
--- a/drivers/clk/qcom/gcc-sc7180.c
+++ b/drivers/clk/qcom/gcc-sc7180.c
@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
 		.name = "gcc_sdcc1_ice_core_clk_src",
 		.parent_data = gcc_parent_data_0,
 		.num_parents = 4,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_floor_ops,
 	},
 };
 
@@ -666,7 +666,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
 		.name = "gcc_sdcc2_apps_clk_src",
 		.parent_data = gcc_parent_data_5,
 		.num_parents = 5,
-		.ops = &clk_rcg2_ops,
+		.ops = &clk_rcg2_floor_ops,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 407/717] clk: tegra: Fix duplicated SE clock entry
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (405 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 406/717] clk: qcom: gcc-sc7180: Use floor ops for sdcc clks Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 408/717] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding,
	Stephen Boyd, Sasha Levin

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]

The periph_clks[] array contains duplicated entry for Security Engine
clock which was meant to be defined for T210, but it wasn't added
properly. This patch corrects the T210 SE entry and fixes the following
error message on T114/T124: "Tegra clk 127: register failed with -17".

Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210")
Tested-by Nicolas Chauvet <kwizart@gmail.com>
Reported-by Nicolas Chauvet <kwizart@gmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/tegra/clk-id.h           | 1 +
 drivers/clk/tegra/clk-tegra-periph.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index ff7da2d3e94d8..24413812ec5b6 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -227,6 +227,7 @@ enum clk_id {
 	tegra_clk_sdmmc4,
 	tegra_clk_sdmmc4_8,
 	tegra_clk_se,
+	tegra_clk_se_10,
 	tegra_clk_soc_therm,
 	tegra_clk_soc_therm_8,
 	tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 2b2a3b81c16ba..60cc34f90cb9b 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -630,7 +630,7 @@ static struct tegra_periph_init_data periph_clks[] = {
 	INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
 	INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
 	INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
-	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
 	INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
 	INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
 	INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 408/717] mtd: rawnand: gpmi: fix reference count leak in gpmi ops
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (406 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 407/717] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 409/717] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Han Xu, Miquel Raynal,
	Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 1b391c7f2e863985668d705f525af3ceb55bc800 ]

pm_runtime_get_sync() will increment pm usage at first and it
will resume the device later. If runtime of the device has
error or device is in inaccessible state(or other error state),
resume operation will fail. If we do not call put operation to
decrease the reference, it will result in reference leak in
the two functions(gpmi_init and gpmi_nfc_exec_op). Moreover,
this device cannot enter the idle state and always stay busy or
other non-idle state later. So we fixed it through adding
pm_runtime_put_noidle.

Fixes: 5bc6bb603b4d0 ("mtd: rawnand: gpmi: Fix suspend/resume problem")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201107110552.1568742-1-zhangqilong3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index dc8104e675062..b5f46f214a582 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -149,8 +149,10 @@ static int gpmi_init(struct gpmi_nand_data *this)
 	int ret;
 
 	ret = pm_runtime_get_sync(this->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(this->dev);
 		return ret;
+	}
 
 	ret = gpmi_reset_block(r->gpmi_regs, false);
 	if (ret)
@@ -2263,8 +2265,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		this->transfers[i].direction = DMA_NONE;
 
 	ret = pm_runtime_get_sync(this->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(this->dev);
 		return ret;
+	}
 
 	/*
 	 * This driver currently supports only one NAND chip. Plus, dies share
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 409/717] mtd: rawnand: meson: Fix a resource leak in init
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (407 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 408/717] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 410/717] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Miquel Raynal, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ad8566d3555c4731e6b48823b92d3929b0394c14 ]

Call clk_disable_unprepare(nfc->phase_rx) if the clk_set_rate() function
fails to avoid a resource leak.

Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/X8ikVCnUsfTpffFB@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/meson_nand.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
index 48e6dac96be6d..1fd7f7024c0b4 100644
--- a/drivers/mtd/nand/raw/meson_nand.c
+++ b/drivers/mtd/nand/raw/meson_nand.c
@@ -1044,9 +1044,12 @@ static int meson_nfc_clk_init(struct meson_nfc *nfc)
 
 	ret = clk_set_rate(nfc->device_clk, 24000000);
 	if (ret)
-		goto err_phase_rx;
+		goto err_disable_rx;
 
 	return 0;
+
+err_disable_rx:
+	clk_disable_unprepare(nfc->phase_rx);
 err_phase_rx:
 	clk_disable_unprepare(nfc->phase_tx);
 err_phase_tx:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 410/717] mtd: rawnand: gpmi: Fix the random DMA timeout issue
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (408 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 409/717] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 411/717] samples/bpf: Fix possible hang in xdpsock with multiple threads Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Han Xu, Sascha Hauer, Miquel Raynal,
	Sasha Levin

From: Han Xu <han.xu@nxp.com>

[ Upstream commit 7671edeb193910482a9b0c22cd32176e7de7b2ed ]

To get better performance, current gpmi driver collected and chained all
small DMA transfers in gpmi_nfc_exec_op, the whole chain triggered and
wait for complete at the end.

But some random DMA timeout found in this new driver, with the help of
ftrace, we found the root cause is as follows:

Take gpmi_ecc_read_page() as an example, gpmi_nfc_exec_op collected 6
DMA transfers and the DMA chain triggered at the end. It waits for bch
completion and check jiffies if it's timeout. The typical function graph
shown below,

   63.216351 |   1)               |  gpmi_ecc_read_page() {
   63.216352 |   1)   0.750 us    |    gpmi_bch_layout_std();
   63.216354 |   1)               |    gpmi_nfc_exec_op() {
   63.216355 |   1)               |      gpmi_chain_command() {
   63.216356 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216357 |   1)               |          /* mxs chan ccw idx: 0 */
   63.216358 |   1)   1.750 us    |        }
   63.216359 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216360 |   1)               |          /* mxs chan ccw idx: 1 */
   63.216361 |   1)   2.000 us    |        }
   63.216361 |   1)   6.500 us    |      }
   63.216362 |   1)               |      gpmi_chain_command() {
   63.216363 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216364 |   1)               |          /* mxs chan ccw idx: 2 */
   63.216365 |   1)   1.750 us    |        }
   63.216366 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216367 |   1)               |          /* mxs chan ccw idx: 3 */
   63.216367 |   1)   1.750 us    |        }
   63.216368 |   1)   5.875 us    |      }
   63.216369 |   1)               |      /* gpmi_chain_wait_ready */
   63.216370 |   1)               |      mxs_dma_prep_slave_sg() {
   63.216372 |   1)               |        /* mxs chan ccw idx: 4 */
   63.216373 |   1)   3.000 us    |      }
   63.216374 |   1)               |      /* gpmi_chain_data_read */
   63.216376 |   1)               |      mxs_dma_prep_slave_sg() {
   63.216377 |   1)               |        /* mxs chan ccw idx: 5 */
   63.216378 |   1)   2.000 us    |      }
   63.216379 |   1)   1.125 us    |      mxs_dma_tx_submit();
   63.216381 |   1)   1.000 us    |      mxs_dma_enable_chan();
   63.216712 |   0)   2.625 us    |  mxs_dma_int_handler();
   63.216717 |   0)   4.250 us    |  bch_irq();
   63.216723 |   0)   1.250 us    |  mxs_dma_tasklet();
   63.216723 |   1)               |      /* jiffies left 250 */
   63.216725 |   1) ! 372.000 us  |    }
   63.216726 |   1)   2.625 us    |    gpmi_count_bitflips();
   63.216730 |   1) ! 379.125 us  |  }

but it's not gurantee that bch irq handled always after dma irq handled,
sometimes bch_irq comes first and gpmi_nfc_exec_op won't wait anymore,
another gpmi_nfc_exec_op may get invoked before last DMA chain IRQ
handled, this messed up the next DMA chain and causes DMA timeout. Check
the trace log when issue happened.

   63.218923 |   1)               |  gpmi_ecc_read_page() {
   63.218924 |   1)   0.625 us    |    gpmi_bch_layout_std();
   63.218926 |   1)               |    gpmi_nfc_exec_op() {
   63.218927 |   1)               |      gpmi_chain_command() {
   63.218928 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218929 |   1)               |          /* mxs chan ccw idx: 0 */
   63.218929 |   1)   1.625 us    |        }
   63.218931 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218931 |   1)               |          /* mxs chan ccw idx: 1 */
   63.218932 |   1)   1.750 us    |        }
   63.218933 |   1)   5.875 us    |      }
   63.218934 |   1)               |      gpmi_chain_command() {
   63.218934 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218935 |   1)               |          /* mxs chan ccw idx: 2 */
   63.218936 |   1)   1.875 us    |        }
   63.218937 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218938 |   1)               |          /* mxs chan ccw idx: 3 */
   63.218939 |   1)   1.625 us    |        }
   63.218939 |   1)   5.875 us    |      }
   63.218940 |   1)               |      /* gpmi_chain_wait_ready */
   63.218941 |   1)               |      mxs_dma_prep_slave_sg() {
   63.218942 |   1)               |        /* mxs chan ccw idx: 4 */
   63.218942 |   1)   1.625 us    |      }
   63.218943 |   1)               |      /* gpmi_chain_data_read */
   63.218944 |   1)               |      mxs_dma_prep_slave_sg() {
   63.218945 |   1)               |        /* mxs chan ccw idx: 5 */
   63.218947 |   1)   2.375 us    |      }
   63.218948 |   1)   0.625 us    |      mxs_dma_tx_submit();
   63.218949 |   1)   1.000 us    |      mxs_dma_enable_chan();
   63.219276 |   0)   5.125 us    |  bch_irq();                  <----
   63.219283 |   1)               |      /* jiffies left 250 */
   63.219285 |   1) ! 358.625 us  |    }
   63.219286 |   1)   2.750 us    |    gpmi_count_bitflips();
   63.219289 |   1) ! 366.000 us  |  }
   63.219290 |   1)               |  gpmi_ecc_read_page() {
   63.219291 |   1)   0.750 us    |    gpmi_bch_layout_std();
   63.219293 |   1)               |    gpmi_nfc_exec_op() {
   63.219294 |   1)               |      gpmi_chain_command() {
   63.219295 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219295 |   0)   1.875 us    |  mxs_dma_int_handler();      <----
   63.219296 |   1)               |          /* mxs chan ccw idx: 6 */
   63.219297 |   1)   2.250 us    |        }
   63.219298 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219298 |   0)   1.000 us    |  mxs_dma_tasklet();
   63.219299 |   1)               |          /* mxs chan ccw idx: 0 */
   63.219300 |   1)   1.625 us    |        }
   63.219300 |   1)   6.375 us    |      }
   63.219301 |   1)               |      gpmi_chain_command() {
   63.219302 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219303 |   1)               |          /* mxs chan ccw idx: 1 */
   63.219304 |   1)   1.625 us    |        }
   63.219305 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219306 |   1)               |          /* mxs chan ccw idx: 2 */
   63.219306 |   1)   1.875 us    |        }
   63.219307 |   1)   6.000 us    |      }
   63.219308 |   1)               |      /* gpmi_chain_wait_ready */
   63.219308 |   1)               |      mxs_dma_prep_slave_sg() {
   63.219309 |   1)               |        /* mxs chan ccw idx: 3 */
   63.219310 |   1)   2.000 us    |      }
   63.219311 |   1)               |      /* gpmi_chain_data_read */
   63.219312 |   1)               |      mxs_dma_prep_slave_sg() {
   63.219313 |   1)               |        /* mxs chan ccw idx: 4 */
   63.219314 |   1)   1.750 us    |      }
   63.219315 |   1)   0.625 us    |      mxs_dma_tx_submit();
   63.219316 |   1)   0.875 us    |      mxs_dma_enable_chan();
   64.224227 |   1)               |      /* jiffies left 0 */

In the first gpmi_nfc_exec_op, bch_irq comes first and gpmi_nfc_exec_op
exits, but DMA IRQ still not happened yet until the middle of following
gpmi_nfc_exec_op, the first DMA transfer index get messed and DMA get
timeout.

To fix the issue, when there is bch ops in DMA chain, the
gpmi_nfc_exec_op should wait for both completions rather than bch
completion only.

Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201209035104.22679-3-han.xu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 30 +++++++++++++++-------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index b5f46f214a582..81028ba35f35d 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2254,7 +2254,7 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 	void *buf_read = NULL;
 	const void *buf_write = NULL;
 	bool direct = false;
-	struct completion *completion;
+	struct completion *dma_completion, *bch_completion;
 	unsigned long to;
 
 	if (check_only)
@@ -2351,22 +2351,24 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		       this->resources.bch_regs + HW_BCH_FLASH0LAYOUT1);
 	}
 
+	desc->callback = dma_irq_callback;
+	desc->callback_param = this;
+	dma_completion = &this->dma_done;
+	bch_completion = NULL;
+
+	init_completion(dma_completion);
+
 	if (this->bch && buf_read) {
 		writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
 		       this->resources.bch_regs + HW_BCH_CTRL_SET);
-		completion = &this->bch_done;
-	} else {
-		desc->callback = dma_irq_callback;
-		desc->callback_param = this;
-		completion = &this->dma_done;
+		bch_completion = &this->bch_done;
+		init_completion(bch_completion);
 	}
 
-	init_completion(completion);
-
 	dmaengine_submit(desc);
 	dma_async_issue_pending(get_dma_chan(this));
 
-	to = wait_for_completion_timeout(completion, msecs_to_jiffies(1000));
+	to = wait_for_completion_timeout(dma_completion, msecs_to_jiffies(1000));
 	if (!to) {
 		dev_err(this->dev, "DMA timeout, last DMA\n");
 		gpmi_dump_info(this);
@@ -2374,6 +2376,16 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		goto unmap;
 	}
 
+	if (this->bch && buf_read) {
+		to = wait_for_completion_timeout(bch_completion, msecs_to_jiffies(1000));
+		if (!to) {
+			dev_err(this->dev, "BCH timeout, last DMA\n");
+			gpmi_dump_info(this);
+			ret = -ETIMEDOUT;
+			goto unmap;
+		}
+	}
+
 	writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
 	       this->resources.bch_regs + HW_BCH_CTRL_CLR);
 	gpmi_clear_bch(this);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 411/717] samples/bpf: Fix possible hang in xdpsock with multiple threads
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (409 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 410/717] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 412/717] fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode() Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Magnus Karlsson, Daniel Borkmann,
	Sasha Levin

From: Magnus Karlsson <magnus.karlsson@intel.com>

[ Upstream commit 092fde0f863b72b67c4d6dc03844f5658fc00a35 ]

Fix a possible hang in xdpsock that can occur when using multiple
threads. In this case, one or more of the threads might get stuck in
the while-loop in tx_only after the user has signaled the main thread
to stop execution. In this case, no more Tx packets will be sent, so a
thread might get stuck in the aforementioned while-loop. Fix this by
introducing a test inside the while-loop to check if the benchmark has
been terminated. If so, return from the function.

Fixes: cd9e72b6f210 ("samples/bpf: xdpsock: Add option to specify batch size")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20201210163407.22066-1-magnus.karlsson@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/xdpsock_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
index 1149e94ca32fd..33c58de58626c 100644
--- a/samples/bpf/xdpsock_user.c
+++ b/samples/bpf/xdpsock_user.c
@@ -1250,6 +1250,8 @@ static void tx_only(struct xsk_socket_info *xsk, u32 *frame_nb, int batch_size)
 	while (xsk_ring_prod__reserve(&xsk->tx, batch_size, &idx) <
 				      batch_size) {
 		complete_tx_only(xsk, batch_size);
+		if (benchmark_done)
+			return;
 	}
 
 	for (i = 0; i < batch_size; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 412/717] fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (410 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 411/717] samples/bpf: Fix possible hang in xdpsock with multiple threads Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 413/717] extcon: max77693: Fix modalias string Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hao Li, Dave Chinner, Ira Weiny,
	Al Viro, Sasha Levin

From: Hao Li <lihao2018.fnst@cn.fujitsu.com>

[ Upstream commit 88149082bb8ef31b289673669e080ec6a00c2e59 ]

If generic_drop_inode() returns true, it means iput_final() can evict
this inode regardless of whether it is dirty or not. If we check
I_DONTCACHE in generic_drop_inode(), any inode with this bit set will be
evicted unconditionally. This is not the desired behavior because
I_DONTCACHE only means the inode shouldn't be cached on the LRU list.
As for whether we need to evict this inode, this is what
generic_drop_inode() should do. This patch corrects the usage of
I_DONTCACHE.

This patch was proposed in [1].

[1]: https://lore.kernel.org/linux-fsdevel/20200831003407.GE12096@dread.disaster.area/

Fixes: dae2f8ed7992 ("fs: Lift XFS_IDONTCACHE to the VFS layer")
Signed-off-by: Hao Li <lihao2018.fnst@cn.fujitsu.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/inode.c         | 4 +++-
 include/linux/fs.h | 3 +--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/inode.c b/fs/inode.c
index 9d78c37b00b81..5eea9912a0b9d 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1627,7 +1627,9 @@ static void iput_final(struct inode *inode)
 	else
 		drop = generic_drop_inode(inode);
 
-	if (!drop && (sb->s_flags & SB_ACTIVE)) {
+	if (!drop &&
+	    !(inode->i_state & I_DONTCACHE) &&
+	    (sb->s_flags & SB_ACTIVE)) {
 		inode_add_lru(inode);
 		spin_unlock(&inode->i_lock);
 		return;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8667d0cdc71e7..8bde32cf97115 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2878,8 +2878,7 @@ extern int inode_needs_sync(struct inode *inode);
 extern int generic_delete_inode(struct inode *inode);
 static inline int generic_drop_inode(struct inode *inode)
 {
-	return !inode->i_nlink || inode_unhashed(inode) ||
-		(inode->i_state & I_DONTCACHE);
+	return !inode->i_nlink || inode_unhashed(inode);
 }
 extern void d_mark_dontcache(struct inode *inode);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 413/717] extcon: max77693: Fix modalias string
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (411 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 412/717] fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 414/717] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Chanwoo Choi, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]

The platform device driver name is "max77693-muic", so advertise it
properly in the modalias string. This fixes automated module loading when
this driver is compiled as a module.

Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon-max77693.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 4a410fd2ea9ae..92af97e00828f 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1277,4 +1277,4 @@ module_platform_driver(max77693_muic_driver);
 MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
 MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:extcon-max77693");
+MODULE_ALIAS("platform:max77693-muic");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 414/717] crypto: atmel-i2c - select CONFIG_BITREVERSE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (412 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 413/717] extcon: max77693: Fix modalias string Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 415/717] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Herbert Xu, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d33a23b0532d5d1b5b700e8641661261e7dbef61 ]

The bitreverse helper is almost always built into the kernel,
but in a rare randconfig build it is possible to hit a case
in which it is a loadable module while the atmel-i2c driver
is built-in:

arm-linux-gnueabi-ld: drivers/crypto/atmel-i2c.o: in function `atmel_i2c_checksum':
atmel-i2c.c:(.text+0xa0): undefined reference to `byte_rev_table'

Add one more 'select' statement to prevent this.

Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 37da0c070a883..9d6645b1f0abe 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -548,6 +548,7 @@ config CRYPTO_DEV_ATMEL_SHA
 
 config CRYPTO_DEV_ATMEL_I2C
 	tristate
+	select BITREVERSE
 
 config CRYPTO_DEV_ATMEL_ECC
 	tristate "Support for Microchip / Atmel ECC hw accelerator"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 415/717] mac80211: dont set set TDLS STA bandwidth wider than possible
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (413 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 414/717] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 416/717] mac80211: fix a mistake check for rx_stats update Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ]

When we set up a TDLS station, we set sta->sta.bandwidth solely based
on the capabilities, because the "what's the current bandwidth" check
is bypassed and only applied for other types of stations.

This leads to the unfortunate scenario that the sta->sta.bandwidth is
160 MHz if both stations support it, but we never actually configure
this bandwidth unless the AP is already using 160 MHz; even for wider
bandwidth support we only go up to 80 MHz (at least right now.)

For iwlwifi, this can also lead to firmware asserts, telling us that
we've configured the TX rates for a higher bandwidth than is actually
available due to the PHY configuration.

For non-TDLS, we check against the interface's requested bandwidth,
but we explicitly skip this check for TDLS to cope with the wider BW
case. Change this to
 (a) still limit to the TDLS peer's own chandef, which gets factored
     into the overall PHY configuration we request from the driver,
     and
 (b) limit it to when the TDLS peer is authorized, because it's only
     factored into the channel context in this case.

Fixes: 504871e602d9 ("mac80211: fix bandwidth computation for TDLS peers")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.fcc7d29c4590.I11f77e9e25ddf871a3c8d5604650c763e2c5887a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/vht.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index fb0e3a657d2d3..c3ca973737742 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -465,12 +465,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
 	 * IEEE80211-2016 specification makes higher bandwidth operation
 	 * possible on the TDLS link if the peers have wider bandwidth
 	 * capability.
+	 *
+	 * However, in this case, and only if the TDLS peer is authorized,
+	 * limit to the tdls_chandef so that the configuration here isn't
+	 * wider than what's actually requested on the channel context.
 	 */
 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
-		return bw;
-
-	bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) &&
+	    test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
+	    sta->tdls_chandef.chan)
+		bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width));
+	else
+		bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
 
 	return bw;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 416/717] mac80211: fix a mistake check for rx_stats update
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (414 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 415/717] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 417/717] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wen Gong, Johannes Berg, Sasha Levin

From: Wen Gong <wgong@codeaurora.org>

[ Upstream commit f879ac8ed6c83ce05fcb53815a8ea83c5b6099a1 ]

It should be !is_multicast_ether_addr() in ieee80211_rx_h_sta_process()
for the rx_stats update, below commit remove the !, this patch is to
change it back.

It lead the rx rate "iw wlan0 station dump" become invalid for some
scenario when IEEE80211_HW_USES_RSS is set.

Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons")
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Link: https://lore.kernel.org/r/1607483189-3891-1-git-send-email-wgong@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1e2e5a406d587..2a5a11f92b03e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1758,7 +1758,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
 		sta->rx_stats.last_rx = jiffies;
 	} else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
-		   is_multicast_ether_addr(hdr->addr1)) {
+		   !is_multicast_ether_addr(hdr->addr1)) {
 		/*
 		 * Mesh beacons will update last_rx when if they are found to
 		 * match the current local configuration when processed.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 417/717] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (415 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 416/717] mac80211: fix a mistake check for rx_stats update Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 418/717] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Charles Keepax,
	Mark Brown, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]

The error handling frees "ctl" but it's still on the "dsp->ctl_list"
list so that could result in a use after free.  Remove it from the list
before returning.

Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm_adsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index e61d00486c653..dec8716aa8ef5 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1519,7 +1519,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 	ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
 	if (!ctl_work) {
 		ret = -ENOMEM;
-		goto err_ctl_cache;
+		goto err_list_del;
 	}
 
 	ctl_work->dsp = dsp;
@@ -1529,7 +1529,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 
 	return 0;
 
-err_ctl_cache:
+err_list_del:
+	list_del(&ctl->list);
 	kfree(ctl->cache);
 err_ctl_subname:
 	kfree(ctl->subname);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 418/717] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (416 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 417/717] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 419/717] irqchip/ti-sci-inta: Fix printing of inta id on probe success Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Antoine Tenart,
	Tsahee Zidenberg, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]

The alpine-msi driver has an interesting allocation error handling,
where it frees the same interrupts repeatedly. Hilarity follows.

This code is probably never executed, but let's fix it nonetheless.

Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Cc: Tsahee Zidenberg <tsahee@annapurnalabs.com>
Cc: Antoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-alpine-msi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 23a3b877f7f1d..ede02dc2bcd0b 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
 	return 0;
 
 err_sgi:
-	while (--i >= 0)
-		irq_domain_free_irqs_parent(domain, virq, i);
+	irq_domain_free_irqs_parent(domain, virq, i - 1);
 	alpine_msix_free_sgi(priv, sgi, nr_irqs);
 	return err;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 419/717] irqchip/ti-sci-inta: Fix printing of inta id on probe success
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (417 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 418/717] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 420/717] irqchip/ti-sci-intr: Fix freeing of irqs Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lokesh Vutla, Marc Zyngier, Sasha Levin

From: Lokesh Vutla <lokeshvutla@ti.com>

[ Upstream commit b10d5fd489b0c67f59cbdd28d95f4bd9f76a62f2 ]

On a successful probe, the driver tries to print a success message with
INTA device id. It uses pdev->id for printing the id but id is stored in
inta->ti_sci_id. Fix it by correcting the dev_info parameter.

Fixes: 5c4b585d2910 ("irqchip/ti-sci-inta: Add support for INTA directly connecting to GIC")
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201102120614.11109-1-lokeshvutla@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-ti-sci-inta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c
index b2ab8db439d92..532d0ae172d9f 100644
--- a/drivers/irqchip/irq-ti-sci-inta.c
+++ b/drivers/irqchip/irq-ti-sci-inta.c
@@ -726,7 +726,7 @@ static int ti_sci_inta_irq_domain_probe(struct platform_device *pdev)
 	INIT_LIST_HEAD(&inta->vint_list);
 	mutex_init(&inta->vint_mutex);
 
-	dev_info(dev, "Interrupt Aggregator domain %d created\n", pdev->id);
+	dev_info(dev, "Interrupt Aggregator domain %d created\n", inta->ti_sci_id);
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 420/717] irqchip/ti-sci-intr: Fix freeing of irqs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (418 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 419/717] irqchip/ti-sci-inta: Fix printing of inta id on probe success Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.10 421/717] dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0 Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lokesh Vutla, Marc Zyngier, Sasha Levin

From: Lokesh Vutla <lokeshvutla@ti.com>

[ Upstream commit fc6c7cd3878641fd43189f15697e7ad0871f5c1a ]

ti_sci_intr_irq_domain_free() assumes that out_irq of intr is stored in
data->chip_data and uses it for calling ti_sci irq_free() and then
mark the out_irq as available resource. But ti_sci_intr_irq_domain_alloc()
is storing p_hwirq(parent's hardware irq) which is translated from out_irq.
This is causing resource leakage and eventually out_irq resources might
be exhausted. Fix ti_sci_intr_irq_domain_alloc() by storing the out_irq
in data->chip_data.

Fixes: a5b659bd4bc7 ("irqchip/ti-sci-intr: Add support for INTR being a parent to INTR")
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201102120631.11165-1-lokeshvutla@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-ti-sci-intr.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c
index ac9d6d658e65c..fe8fad22bcf96 100644
--- a/drivers/irqchip/irq-ti-sci-intr.c
+++ b/drivers/irqchip/irq-ti-sci-intr.c
@@ -129,7 +129,7 @@ static void ti_sci_intr_irq_domain_free(struct irq_domain *domain,
  * @virq:	Corresponding Linux virtual IRQ number
  * @hwirq:	Corresponding hwirq for the IRQ within this IRQ domain
  *
- * Returns parent irq if all went well else appropriate error pointer.
+ * Returns intr output irq if all went well else appropriate error pointer.
  */
 static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
 					unsigned int virq, u32 hwirq)
@@ -173,7 +173,7 @@ static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
 	if (err)
 		goto err_msg;
 
-	return p_hwirq;
+	return out_irq;
 
 err_msg:
 	irq_domain_free_irqs_parent(domain, virq, 1);
@@ -198,19 +198,19 @@ static int ti_sci_intr_irq_domain_alloc(struct irq_domain *domain,
 	struct irq_fwspec *fwspec = data;
 	unsigned long hwirq;
 	unsigned int flags;
-	int err, p_hwirq;
+	int err, out_irq;
 
 	err = ti_sci_intr_irq_domain_translate(domain, fwspec, &hwirq, &flags);
 	if (err)
 		return err;
 
-	p_hwirq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
-	if (p_hwirq < 0)
-		return p_hwirq;
+	out_irq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
+	if (out_irq < 0)
+		return out_irq;
 
 	irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
 				      &ti_sci_intr_irq_chip,
-				      (void *)(uintptr_t)p_hwirq);
+				      (void *)(uintptr_t)out_irq);
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 421/717] dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (419 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 420/717] irqchip/ti-sci-intr: Fix freeing of irqs Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 422/717] RDMA/hns: Limit the length of data copied between kernel and userspace Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Vinod Koul, Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

[ Upstream commit e2de925bbfe321ba0588c99f577c59386ab1f428 ]

According to different sections of the TRM, the hchan_cnt of CAP3 includes
the number of uchan in UDMA, thus the start offset of the normal channels
are hchan_cnt.

Fixes: daf4ad0499aa4 ("dmaengine: ti: k3-udma: Query throughput level information from hardware")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20201208090440.31792-2-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ti/k3-udma.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 82cf6c77f5c93..d3902784cae24 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -3201,8 +3201,7 @@ static int udma_setup_resources(struct udma_dev *ud)
 	} else if (UDMA_CAP3_UCHAN_CNT(cap3)) {
 		ud->tpl_levels = 3;
 		ud->tpl_start_idx[1] = UDMA_CAP3_UCHAN_CNT(cap3);
-		ud->tpl_start_idx[0] = ud->tpl_start_idx[1] +
-				       UDMA_CAP3_HCHAN_CNT(cap3);
+		ud->tpl_start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
 	} else if (UDMA_CAP3_HCHAN_CNT(cap3)) {
 		ud->tpl_levels = 2;
 		ud->tpl_start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 422/717] RDMA/hns: Limit the length of data copied between kernel and userspace
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (420 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.10 421/717] dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 423/717] RDMA/hns: Normalization the judgment of some features Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenpeng Liang, Weihang Li,
	Jason Gunthorpe, Sasha Levin

From: Wenpeng Liang <liangwenpeng@huawei.com>

[ Upstream commit 1c0ca9cd1741687f529498ddb899805fc2c51caa ]

For ib_copy_from_user(), the length of udata may not be the same as that
of cmd. For ib_copy_to_user(), the length of udata may not be the same as
that of resp. So limit the length to prevent out-of-bounds read and write
operations from ib_copy_from_user() and ib_copy_to_user().

Fixes: de77503a5940 ("RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db")
Fixes: 633fb4d9fdaa ("RDMA/hns: Use structs to describe the uABI instead of opencoding")
Fixes: ae85bf92effc ("RDMA/hns: Optimize qp param setup flow")
Fixes: 6fd610c5733d ("RDMA/hns: Support 0 hop addressing for SRQ buffer")
Fixes: 9d9d4ff78884 ("RDMA/hns: Update the kernel header file of hns")
Link: https://lore.kernel.org/r/1607650657-35992-2-git-send-email-liweihang@huawei.com
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_cq.c   |  5 +++--
 drivers/infiniband/hw/hns/hns_roce_main.c |  3 ++-
 drivers/infiniband/hw/hns/hns_roce_pd.c   | 11 ++++++-----
 drivers/infiniband/hw/hns/hns_roce_qp.c   |  9 ++++++---
 drivers/infiniband/hw/hns/hns_roce_srq.c  | 10 +++++-----
 5 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index 809b22aa5056c..da346129f6e9e 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -274,7 +274,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 
 	if (udata) {
 		ret = ib_copy_from_udata(&ucmd, udata,
-					 min(sizeof(ucmd), udata->inlen));
+					 min(udata->inlen, sizeof(ucmd)));
 		if (ret) {
 			ibdev_err(ibdev, "Failed to copy CQ udata, err %d\n",
 				  ret);
@@ -313,7 +313,8 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 
 	if (udata) {
 		resp.cqn = hr_cq->cqn;
-		ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
+		ret = ib_copy_to_udata(udata, &resp,
+				       min(udata->outlen, sizeof(resp)));
 		if (ret)
 			goto err_cqc;
 	}
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index afeffafc59f90..a6277d1c36ba9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -325,7 +325,8 @@ static int hns_roce_alloc_ucontext(struct ib_ucontext *uctx,
 
 	resp.cqe_size = hr_dev->caps.cqe_sz;
 
-	ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
+	ret = ib_copy_to_udata(udata, &resp,
+			       min(udata->outlen, sizeof(resp)));
 	if (ret)
 		goto error_fail_copy_to_udata;
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
index 98f69496adb49..f78fa1d3d8075 100644
--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
+++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
@@ -70,16 +70,17 @@ int hns_roce_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 	}
 
 	if (udata) {
-		struct hns_roce_ib_alloc_pd_resp uresp = {.pdn = pd->pdn};
+		struct hns_roce_ib_alloc_pd_resp resp = {.pdn = pd->pdn};
 
-		if (ib_copy_to_udata(udata, &uresp, sizeof(uresp))) {
+		ret = ib_copy_to_udata(udata, &resp,
+				       min(udata->outlen, sizeof(resp)));
+		if (ret) {
 			hns_roce_pd_free(to_hr_dev(ib_dev), pd->pdn);
-			ibdev_err(ib_dev, "failed to copy to udata\n");
-			return -EFAULT;
+			ibdev_err(ib_dev, "failed to copy to udata, ret = %d\n", ret);
 		}
 	}
 
-	return 0;
+	return ret;
 }
 
 int hns_roce_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata)
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 71ea8fd9041b9..800141ab643a3 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -865,9 +865,12 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 	}
 
 	if (udata) {
-		if (ib_copy_from_udata(ucmd, udata, sizeof(*ucmd))) {
-			ibdev_err(ibdev, "Failed to copy QP ucmd\n");
-			return -EFAULT;
+		ret = ib_copy_from_udata(ucmd, udata,
+					 min(udata->inlen, sizeof(*ucmd)));
+		if (ret) {
+			ibdev_err(ibdev,
+				  "failed to copy QP ucmd, ret = %d\n", ret);
+			return ret;
 		}
 
 		ret = set_user_sq_size(hr_dev, &init_attr->cap, hr_qp, ucmd);
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 8caf74e44efd9..75d74f4bb52c9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -300,7 +300,8 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
 	srq->max_gs = init_attr->attr.max_sge;
 
 	if (udata) {
-		ret = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd));
+		ret = ib_copy_from_udata(&ucmd, udata,
+					 min(udata->inlen, sizeof(ucmd)));
 		if (ret) {
 			ibdev_err(ibdev, "Failed to copy SRQ udata, err %d\n",
 				  ret);
@@ -343,11 +344,10 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
 	resp.srqn = srq->srqn;
 
 	if (udata) {
-		if (ib_copy_to_udata(udata, &resp,
-				     min(udata->outlen, sizeof(resp)))) {
-			ret = -EFAULT;
+		ret = ib_copy_to_udata(udata, &resp,
+				       min(udata->outlen, sizeof(resp)));
+		if (ret)
 			goto err_srqc_alloc;
-		}
 	}
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 423/717] RDMA/hns: Normalization the judgment of some features
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (421 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 422/717] RDMA/hns: Limit the length of data copied between kernel and userspace Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 424/717] RDMA/hns: Do shift on traffic class when using RoCEv2 Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wenpeng Liang, Weihang Li,
	Jason Gunthorpe, Sasha Levin

From: Wenpeng Liang <liangwenpeng@huawei.com>

[ Upstream commit 4ddeacf68a3dd05f346b63f4507e1032a15cc3cc ]

Whether to enable the these features should better depend on the enable
flags, not the value of related fields.

Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08")
Fixes: 3cb2c996c9dc ("RDMA/hns: Add support for SCCC in size of 64 Bytes")
Link: https://lore.kernel.org/r/1607650657-35992-3-git-send-email-liweihang@huawei.com
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hem.c  | 4 ++--
 drivers/infiniband/hw/hns/hns_roce_main.c | 8 ++++----
 drivers/infiniband/hw/hns/hns_roce_qp.c   | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 7487cf3d2c37a..66f9f036ef946 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -1017,7 +1017,7 @@ void hns_roce_cleanup_hem_table(struct hns_roce_dev *hr_dev,
 
 void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
 {
-	if (hr_dev->caps.srqc_entry_sz)
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
 		hns_roce_cleanup_hem_table(hr_dev,
 					   &hr_dev->srq_table.table);
 	hns_roce_cleanup_hem_table(hr_dev, &hr_dev->cq_table.table);
@@ -1027,7 +1027,7 @@ void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
 	if (hr_dev->caps.cqc_timer_entry_sz)
 		hns_roce_cleanup_hem_table(hr_dev,
 					   &hr_dev->cqc_timer_table);
-	if (hr_dev->caps.sccc_sz)
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)
 		hns_roce_cleanup_hem_table(hr_dev,
 					   &hr_dev->qp_table.sccc_table);
 	if (hr_dev->caps.trrl_entry_sz)
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index a6277d1c36ba9..ae721fa61e0e4 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -632,7 +632,7 @@ static int hns_roce_init_hem(struct hns_roce_dev *hr_dev)
 		goto err_unmap_trrl;
 	}
 
-	if (hr_dev->caps.srqc_entry_sz) {
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) {
 		ret = hns_roce_init_hem_table(hr_dev, &hr_dev->srq_table.table,
 					      HEM_TYPE_SRQC,
 					      hr_dev->caps.srqc_entry_sz,
@@ -644,7 +644,7 @@ static int hns_roce_init_hem(struct hns_roce_dev *hr_dev)
 		}
 	}
 
-	if (hr_dev->caps.sccc_sz) {
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) {
 		ret = hns_roce_init_hem_table(hr_dev,
 					      &hr_dev->qp_table.sccc_table,
 					      HEM_TYPE_SCCC,
@@ -688,11 +688,11 @@ err_unmap_qpc_timer:
 		hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qpc_timer_table);
 
 err_unmap_ctx:
-	if (hr_dev->caps.sccc_sz)
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)
 		hns_roce_cleanup_hem_table(hr_dev,
 					   &hr_dev->qp_table.sccc_table);
 err_unmap_srq:
-	if (hr_dev->caps.srqc_entry_sz)
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
 		hns_roce_cleanup_hem_table(hr_dev, &hr_dev->srq_table.table);
 
 err_unmap_cq:
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 800141ab643a3..ef1452215b17d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -286,7 +286,7 @@ static int alloc_qpc(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
 		}
 	}
 
-	if (hr_dev->caps.sccc_sz) {
+	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) {
 		/* Alloc memory for SCC CTX */
 		ret = hns_roce_table_get(hr_dev, &qp_table->sccc_table,
 					 hr_qp->qpn);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 424/717] RDMA/hns: Do shift on traffic class when using RoCEv2
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (422 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 423/717] RDMA/hns: Normalization the judgment of some features Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 425/717] gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Weihang Li, Jason Gunthorpe, Sasha Levin

From: Weihang Li <liweihang@huawei.com>

[ Upstream commit 603bee935f38080a3674c763c50787751e387779 ]

The high 6 bits of traffic class in GRH is DSCP (Differentiated Services
Codepoint), the driver should shift it before the hardware gets it when
using RoCEv2.

Fixes: 606bf89e98ef ("RDMA/hns: Refactor for hns_roce_v2_modify_qp function")
Fixes: fba429fcf9a5 ("RDMA/hns: Fix missing fields in address vector")
Link: https://lore.kernel.org/r/1607650657-35992-4-git-send-email-liweihang@huawei.com
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_ah.c     |  2 +-
 drivers/infiniband/hw/hns/hns_roce_device.h |  8 ++++++++
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 10 +++-------
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index d65ff6aa322fa..7dd3b6097226f 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -74,7 +74,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
 	ah->av.flowlabel = grh->flow_label;
 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
 	ah->av.sl = rdma_ah_get_sl(ah_attr);
-	ah->av.tclass = grh->traffic_class;
+	ah->av.tclass = get_tclass(grh);
 
 	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
 	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
index b025841e08154..1ea87f92aabbe 100644
--- a/drivers/infiniband/hw/hns/hns_roce_device.h
+++ b/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -1132,6 +1132,14 @@ static inline u32 to_hr_hem_entries_shift(u32 count, u32 buf_shift)
 	return ilog2(to_hr_hem_entries_count(count, buf_shift));
 }
 
+#define DSCP_SHIFT 2
+
+static inline u8 get_tclass(const struct ib_global_route *grh)
+{
+	return grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP ?
+	       grh->traffic_class >> DSCP_SHIFT : grh->traffic_class;
+}
+
 int hns_roce_init_uar_table(struct hns_roce_dev *dev);
 int hns_roce_uar_alloc(struct hns_roce_dev *dev, struct hns_roce_uar *uar);
 void hns_roce_uar_free(struct hns_roce_dev *dev, struct hns_roce_uar *uar);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index c287dbd2f384d..5c29c7d8c50e6 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4460,15 +4460,11 @@ static int hns_roce_v2_set_path(struct ib_qp *ibqp,
 	roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_HOP_LIMIT_M,
 		       V2_QPC_BYTE_24_HOP_LIMIT_S, 0);
 
-	if (is_udp)
-		roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
-			       V2_QPC_BYTE_24_TC_S, grh->traffic_class >> 2);
-	else
-		roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
-			       V2_QPC_BYTE_24_TC_S, grh->traffic_class);
-
+	roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
+		       V2_QPC_BYTE_24_TC_S, get_tclass(&attr->ah_attr.grh));
 	roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
 		       V2_QPC_BYTE_24_TC_S, 0);
+
 	roce_set_field(context->byte_28_at_fl, V2_QPC_BYTE_28_FL_M,
 		       V2_QPC_BYTE_28_FL_S, grh->flow_label);
 	roce_set_field(qpc_mask->byte_28_at_fl, V2_QPC_BYTE_28_FL_M,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 425/717] gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (423 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 424/717] RDMA/hns: Do shift on traffic class when using RoCEv2 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 426/717] ath11k: Fix incorrect tlvs in scan start command Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikita Shubin, Linus Walleij, Sasha Levin

From: Nikita Shubin <nikita.shubin@maquefel.me>

[ Upstream commit 9d5522199505c761575c8ea31dcfd9a2a8d73614 ]

irqchip shared with multiple gpiochips, leads to recursive call of
gpiochip_irq_mask/gpiochip_irq_unmask which was assigned to
rqchip->irq_mask/irqchip->irq_unmask, these happens becouse of
only irqchip->irq_enable == gpiochip_irq_enable is checked.

Let's add an additional check to make sure shared irqchip is detected
even if irqchip->irq_enable wasn't defined.

Fixes: a8173820f441 ("gpio: gpiolib: Allow GPIO IRQs to lazy disable")
Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
Link: https://lore.kernel.org/r/20201210070514.13238-1-nikita.shubin@maquefel.me
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 6e3c4d7a7d146..4ad3c4b276dcf 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1477,7 +1477,8 @@ static void gpiochip_set_irq_hooks(struct gpio_chip *gc)
 	if (WARN_ON(gc->irq.irq_enable))
 		return;
 	/* Check if the irqchip already has this hook... */
-	if (irqchip->irq_enable == gpiochip_irq_enable) {
+	if (irqchip->irq_enable == gpiochip_irq_enable ||
+		irqchip->irq_mask == gpiochip_irq_mask) {
 		/*
 		 * ...and if so, give a gentle warning that this is bad
 		 * practice.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 426/717] ath11k: Fix incorrect tlvs in scan start command
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (424 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 425/717] gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 427/717] irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Carl Huang, Pradeep Kumar Chitrapu,
	Kalle Valo, Sasha Levin

From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>

[ Upstream commit f57ad6a9885e8399897daee3249cabccf9c972f8 ]

Currently 6G specific tlvs have duplicate entries which is causing
scan failures. Fix this by removing the duplicate entries of the same
tlv. This also fixes out-of-bound memory writes caused due to
adding tlvs when num_hint_bssid and num_hint_s_ssid are ZEROs.

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1

Fixes: 74601ecfef6e ("ath11k: Add support for 6g scan hint")
Reported-by: Carl Huang <cjhuang@codeaurora.org>
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1607609124-17250-7-git-send-email-kvalo@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 31 ---------------------------
 1 file changed, 31 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 8eca92520837e..04b8b002edfe0 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2198,37 +2198,6 @@ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
 		}
 	}
 
-	len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
-	tlv = ptr;
-	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
-		      FIELD_PREP(WMI_TLV_LEN, len);
-	ptr += TLV_HDR_SIZE;
-	if (params->num_hint_s_ssid) {
-		s_ssid = ptr;
-		for (i = 0; i < params->num_hint_s_ssid; ++i) {
-			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
-			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
-			s_ssid++;
-		}
-	}
-	ptr += len;
-
-	len = params->num_hint_bssid * sizeof(struct hint_bssid);
-	tlv = ptr;
-	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
-		      FIELD_PREP(WMI_TLV_LEN, len);
-	ptr += TLV_HDR_SIZE;
-	if (params->num_hint_bssid) {
-		hint_bssid = ptr;
-		for (i = 0; i < params->num_hint_bssid; ++i) {
-			hint_bssid->freq_flags =
-				params->hint_bssid[i].freq_flags;
-			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
-					&hint_bssid->bssid.addr[0]);
-			hint_bssid++;
-		}
-	}
-
 	ret = ath11k_wmi_cmd_send(wmi, skb,
 				  WMI_START_SCAN_CMDID);
 	if (ret) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 427/717] irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (425 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 426/717] ath11k: Fix incorrect tlvs in scan start command Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 428/717] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Marc Zyngier,
	Maulik Shah, Stephen Boyd, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 2f5fbc4305d07725bfebaedb09e57271315691ef ]

We have a problem if we use gpio-keys and configure wakeups such that
we only want one edge to wake us up.  AKA:
  wakeup-event-action = <EV_ACT_DEASSERTED>;
  wakeup-source;

Specifically we end up with a phantom interrupt that blocks suspend if
the line was already high and we want wakeups on rising edges (AKA we
want the GPIO to go low and then high again before we wake up).  The
opposite is also problematic.

Specifically, here's what's happening today:
1. Normally, gpio-keys configures to look for both edges.  Due to the
   current workaround introduced in commit c3c0c2e18d94 ("pinctrl:
   qcom: Handle broken/missing PDC dual edge IRQs on sc7180"), if the
   line was high we'd configure for falling edges.
2. At suspend time, we change to look for rising edges.
3. After qcom_pdc_gic_set_type() runs, we get a phantom interrupt.

We can solve this by just clearing the phantom interrupt.

NOTE: it is possible that this could cause problems for a client with
very specific needs, but there's not much we can do with this
hardware.  As an example, let's say the interrupt signal is currently
high and the client is looking for falling edges.  The client now
changes to look for rising edges.  The client could possibly expect
that if the line has a short pulse low (and back high) that it would
always be detected.  Specifically no matter when the pulse happened,
it should either have tripped the (old) falling edge trigger or the
(new) rising edge trigger.  We will simply not trip it.  We could
narrow down the race a bit by polling our parent before changing
types, but no matter what we do there will still be a period of time
where we can't tell the difference between a real transition (or more
than one transition) and the phantom.

Fixes: f55c73aef890 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Maulik Shah <mkshah@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20201211141514.v4.1.I2702919afc253e2a451bebc3b701b462b2d22344@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/qcom-pdc.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
index bd39e9de6ecf7..5dc63c20b67ea 100644
--- a/drivers/irqchip/qcom-pdc.c
+++ b/drivers/irqchip/qcom-pdc.c
@@ -159,6 +159,8 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
 {
 	int pin_out = d->hwirq;
 	enum pdc_irq_config_bits pdc_type;
+	enum pdc_irq_config_bits old_pdc_type;
+	int ret;
 
 	if (pin_out == GPIO_NO_WAKE_IRQ)
 		return 0;
@@ -187,9 +189,26 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
 		return -EINVAL;
 	}
 
+	old_pdc_type = pdc_reg_read(IRQ_i_CFG, pin_out);
 	pdc_reg_write(IRQ_i_CFG, pin_out, pdc_type);
 
-	return irq_chip_set_type_parent(d, type);
+	ret = irq_chip_set_type_parent(d, type);
+	if (ret)
+		return ret;
+
+	/*
+	 * When we change types the PDC can give a phantom interrupt.
+	 * Clear it.  Specifically the phantom shows up when reconfiguring
+	 * polarity of interrupt without changing the state of the signal
+	 * but let's be consistent and clear it always.
+	 *
+	 * Doing this works because we have IRQCHIP_SET_TYPE_MASKED so the
+	 * interrupt will be cleared before the rest of the system sees it.
+	 */
+	if (old_pdc_type != pdc_type)
+		irq_chip_set_parent_state(d, IRQCHIP_STATE_PENDING, false);
+
+	return 0;
 }
 
 static struct irq_chip qcom_pdc_gic_chip = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 428/717] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (426 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 427/717] irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 429/717] watchdog: sirfsoc: " Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 7f6f1dfb2dcbe5d2bfa213f2df5d74c147cd5954 ]

The following kbuild warning is seen on a system without HAS_IOMEM.

WARNING: unmet direct dependencies detected for MFD_SYSCON
  Depends on [n]: HAS_IOMEM [=n]
  Selected by [y]:
  - ARMADA_37XX_WATCHDOG [=y] && WATCHDOG [=y] && (ARCH_MVEBU || COMPILE_TEST

This results in a subsequent compile error.

drivers/watchdog/armada_37xx_wdt.o: in function `armada_37xx_wdt_probe':
armada_37xx_wdt.c:(.text+0xdc): undefined reference to `devm_ioremap'

Add the missing dependency.

Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Fixes: 54e3d9b518c8 ("watchdog: Add support for Armada 37xx CPU watchdog")
Link: https://lore.kernel.org/r/20201108162550.27660-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fd7968635e6df..b3e8bdaa2a112 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -386,6 +386,7 @@ config ARM_SBSA_WATCHDOG
 config ARMADA_37XX_WATCHDOG
 	tristate "Armada 37xx watchdog"
 	depends on ARCH_MVEBU || COMPILE_TEST
+	depends on HAS_IOMEM
 	select MFD_SYSCON
 	select WATCHDOG_CORE
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 429/717] watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (427 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 428/717] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 430/717] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]

If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled,
the build fails with the following error.

drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
sirfsoc_wdt.c:(.text+0x112):
	undefined reference to `devm_platform_ioremap_resource'

Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index b3e8bdaa2a112..f8e9be65036ae 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -790,6 +790,7 @@ config MOXART_WDT
 
 config SIRFSOC_WATCHDOG
 	tristate "SiRFSOC watchdog"
+	depends on HAS_IOMEM
 	depends on ARCH_SIRF || COMPILE_TEST
 	select WATCHDOG_CORE
 	default y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 430/717] watchdog: sprd: remove watchdog disable from resume fail path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (428 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 429/717] watchdog: sirfsoc: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 431/717] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lingling Xu, Chunyan Zhang,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Lingling Xu <ling_ling.xu@unisoc.com>

[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ]

sprd_wdt_start() would return fail if the loading operation is not completed
in a certain time, disabling watchdog for that case would probably cause
the kernel crash when kick watchdog later, that's too bad, so remove the
watchdog disable operation for the fail case to make sure other parts in
the kernel can run normally.

[ chunyan: Massaged changelog ]

Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201029023933.24548-2-zhang.lyra@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sprd_wdt.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index 65cb55f3916fc..f3c90b4afead1 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -345,15 +345,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
 	if (ret)
 		return ret;
 
-	if (watchdog_active(&wdt->wdd)) {
+	if (watchdog_active(&wdt->wdd))
 		ret = sprd_wdt_start(&wdt->wdd);
-		if (ret) {
-			sprd_wdt_disable(wdt);
-			return ret;
-		}
-	}
 
-	return 0;
+	return ret;
 }
 
 static const struct dev_pm_ops sprd_wdt_pm_ops = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 431/717] watchdog: sprd: check busy bit before new loading rather than after that
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (429 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 430/717] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 432/717] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lingling Xu, Chunyan Zhang,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Lingling Xu <ling_ling.xu@unisoc.com>

[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ]

As the specification described, users must check busy bit before start
a new loading operation to make sure that the previous loading is done
and the device is ready to accept a new one.

[ chunyan: Massaged changelog ]

Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201029023933.24548-3-zhang.lyra@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index f3c90b4afead1..b9b1daa9e2a4c 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -108,18 +108,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
 	u32 tmr_step = timeout * SPRD_WDT_CNT_STEP;
 	u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP;
 
-	sprd_wdt_unlock(wdt->base);
-	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
-		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
-	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
-		       wdt->base + SPRD_WDT_LOAD_LOW);
-	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
-			SPRD_WDT_LOW_VALUE_MASK,
-		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
-	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
-		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
-	sprd_wdt_lock(wdt->base);
-
 	/*
 	 * Waiting the load value operation done,
 	 * it needs two or three RTC clock cycles.
@@ -134,6 +122,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
 
 	if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT)
 		return -EBUSY;
+
+	sprd_wdt_unlock(wdt->base);
+	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
+	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
+		       wdt->base + SPRD_WDT_LOAD_LOW);
+	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+			SPRD_WDT_LOW_VALUE_MASK,
+		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
+	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
+		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
+	sprd_wdt_lock(wdt->base);
+
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 432/717] watchdog: Fix potential dereferencing of null pointer
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (430 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 431/717] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 433/717] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang Wensheng, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Wang Wensheng <wangwensheng4@huawei.com>

[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ]

A reboot notifier, which stops the WDT by calling the stop hook without
any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.

Howerer we allow the WDT driver to omit the stop hook since commit
"d0684c8a93549" ("watchdog: Make stop function optional") and provide
a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
control reboot policy"). Together that commits make user potential to
insert a watchdog driver that don't provide a stop hook but with the
stop_on_reboot parameter set, then dereferencing of null pointer occurs
on system reboot.

Check the stop hook before registering the reboot notifier to fix the
issue.

Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 4238447578128..0e9a99559609c 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
 	}
 
 	if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
-		wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
-
-		ret = register_reboot_notifier(&wdd->reboot_nb);
-		if (ret) {
-			pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
-			       wdd->id, ret);
-			watchdog_dev_unregister(wdd);
-			ida_simple_remove(&watchdog_ida, id);
-			return ret;
+		if (!wdd->ops->stop)
+			pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
+		else {
+			wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+
+			ret = register_reboot_notifier(&wdd->reboot_nb);
+			if (ret) {
+				pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+					wdd->id, ret);
+				watchdog_dev_unregister(wdd);
+				ida_simple_remove(&watchdog_ida, id);
+				return ret;
+			}
 		}
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 433/717] ubifs: Fix error return code in ubifs_init_authentication()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (431 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 432/717] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 434/717] um: Monitor error events in IRQ controller Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang ShaoBo, Sascha Hauer,
	Richard Weinberger, Sasha Levin

From: Wang ShaoBo <bobo.shaobowang@huawei.com>

[ Upstream commit 3cded66330591cfd2554a3fd5edca8859ea365a2 ]

Fix to return PTR_ERR() error code from the error handling case where
ubifs_hash_get_desc() failed instead of 0 in ubifs_init_authentication(),
as done elsewhere in this function.

Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support")
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ubifs/auth.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
index b93b3cd10bfd3..8c50de693e1d4 100644
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -338,8 +338,10 @@ int ubifs_init_authentication(struct ubifs_info *c)
 	c->authenticated = true;
 
 	c->log_hash = ubifs_hash_get_desc(c);
-	if (IS_ERR(c->log_hash))
+	if (IS_ERR(c->log_hash)) {
+		err = PTR_ERR(c->log_hash);
 		goto out_free_hmac;
+	}
 
 	err = 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 434/717] um: Monitor error events in IRQ controller
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (432 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 433/717] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 435/717] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ]

Ensure that file closes, connection closes, etc are propagated
as interrupts in the interrupt controller.

Fixes: ff6a17989c08 ("Epoll based IRQ controller")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/os-Linux/irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
index d508310ee5e1e..f1732c308c615 100644
--- a/arch/um/os-Linux/irq.c
+++ b/arch/um/os-Linux/irq.c
@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)
 int os_event_mask(int irq_type)
 {
 	if (irq_type == IRQ_READ)
-		return EPOLLIN | EPOLLPRI;
+		return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP;
 	if (irq_type == IRQ_WRITE)
 		return EPOLLOUT;
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 435/717] um: tty: Fix handling of close in tty lines
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (433 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 434/717] um: Monitor error events in IRQ controller Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 436/717] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ]

Fix a logical error in tty reading. We get 0 and errno == EAGAIN
on the first attempt to read from a closed file descriptor.

Compared to that a true EAGAIN is EAGAIN and -1.

If we check errno for EAGAIN first, before checking the return
value we miss the fact that the descriptor is closed.

This bug is as old as the driver. It was not showing up with
the original POLL based IRQ controller, because it was
producing multiple events. Switching to EPOLL unmasked it.

Fixes: ff6a17989c08 ("Epoll based IRQ controller")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/chan_user.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 4d80526a4236e..d8845d4aac6a7 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused)
 	n = read(fd, c_out, sizeof(*c_out));
 	if (n > 0)
 		return n;
-	else if (errno == EAGAIN)
-		return 0;
 	else if (n == 0)
 		return -EIO;
+	else if (errno == EAGAIN)
+		return 0;
 	return -errno;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 436/717] um: chan_xterm: Fix fd leak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (434 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 435/717] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 437/717] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]

xterm serial channel was leaking a fd used in setting up the
port helper

This bug is prehistoric - it predates switching to git. The "fixes"
header here is really just to mark all the versions we would like this to
apply to which is "Anything from the Cretaceous period onwards".

No dinosaurs were harmed in fixing this bug.

Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/xterm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index fc7f1e7467032..87ca4a47cd66e 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -18,6 +18,7 @@
 struct xterm_chan {
 	int pid;
 	int helper_pid;
+	int chan_fd;
 	char *title;
 	int device;
 	int raw;
@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
 		return NULL;
 	*data = ((struct xterm_chan) { .pid 		= -1,
 				       .helper_pid 	= -1,
+				       .chan_fd		= -1,
 				       .device 		= device,
 				       .title 		= opts->xterm_title,
 				       .raw  		= opts->raw } );
@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
 		goto out_kill;
 	}
 
+	data->chan_fd = fd;
 	new = xterm_fd(fd, &data->helper_pid);
 	if (new < 0) {
 		err = new;
@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
 		os_kill_process(data->helper_pid, 0);
 	data->helper_pid = -1;
 
+	if (data->chan_fd != -1)
+		os_close_file(data->chan_fd);
 	os_close_file(fd);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 437/717] sunrpc: fix xs_read_xdr_buf for partial pages receive
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (435 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 436/717] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 438/717] RDMA/mlx5: Fix MR cache memory leak Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Aloni, Trond Myklebust, Sasha Levin

From: Dan Aloni <dan@kernelim.com>

[ Upstream commit ac9645c87380e39a8fa87a1b51721efcdea89dbf ]

When receiving pages data, return value 'ret' when positive includes
`buf->page_base`, so we should subtract that before it is used for
changing `offset` and comparing against `want`.

This was discovered on the very rare cases where the server returned a
chunk of bytes that when added to the already received amount of bytes
for the pages happened to match the current `recv.len`, for example
on this case:

     buf->page_base : 258356
     actually received from socket: 1740
     ret : 260096
     want : 260096

In this case neither of the two 'if ... goto out' trigger, and we
continue to tail parsing.

Worth to mention that the ensuing EMSGSIZE from the continued execution of
`xs_read_xdr_buf` may be observed by an application due to 4 superfluous
bytes being added to the pages data.

Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching to using iterators")
Signed-off-by: Dan Aloni <dan@kernelim.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtsock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index c93ff70da3f98..c56a66cdf4ac8 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -433,7 +433,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
 		if (ret <= 0)
 			goto sock_err;
 		xs_flush_bvec(buf->bvec, ret, seek + buf->page_base);
-		offset += ret - buf->page_base;
+		ret -= buf->page_base;
+		offset += ret;
 		if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
 			goto out;
 		if (ret != want)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 438/717] RDMA/mlx5: Fix MR cache memory leak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (436 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 437/717] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 439/717] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maor Gottlieb, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Maor Gottlieb <maorg@nvidia.com>

[ Upstream commit e89938902927a54abebccc9537991aca5237dfaf ]

If the MR cache entry invalidation failed, then we detach this entry from
the cache, therefore we must to free the memory as well.

Allcation backtrace for the leaker:

    [<00000000d8e423b0>] alloc_cache_mr+0x23/0xc0 [mlx5_ib]
    [<000000001f21304c>] create_cache_mr+0x3f/0xf0 [mlx5_ib]
    [<000000009d6b45dc>] mlx5_ib_alloc_implicit_mr+0x41/0×210 [mlx5_ib]
    [<00000000879d0d68>] mlx5_ib_reg_user_mr+0x9e/0×6e0 [mlx5_ib]
    [<00000000be74bf89>] create_qp+0x2fc/0xf00 [ib_uverbs]
    [<000000001a532d22>] ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ+0x1d9/0×230 [ib_uverbs]
    [<0000000070f46001>] rdma_alloc_commit_uobject+0xb5/0×120 [ib_uverbs]
    [<000000006d8a0b38>] uverbs_alloc+0x2b/0xf0 [ib_uverbs]
    [<00000000075217c9>] ksysioctl+0x234/0×7d0
    [<00000000eb5c120b>] __x64_sys_ioctl+0x16/0×20
    [<00000000db135b48>] do_syscall_64+0x59/0×2e0

Fixes: 1769c4c57548 ("RDMA/mlx5: Always remove MRs from the cache before destroying them")
Link: https://lore.kernel.org/r/20201213132940.345554-2-leon@kernel.org
Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 3468ae804eaee..971694e781b65 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -642,6 +642,7 @@ void mlx5_mr_cache_free(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 	if (mlx5_mr_cache_invalidate(mr)) {
 		detach_mr_from_cache(mr);
 		destroy_mkey(dev, mr);
+		kfree(mr);
 		return;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 439/717] RDMA/cma: Dont overwrite sgid_attr after device is released
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (437 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 438/717] RDMA/mlx5: Fix MR cache memory leak Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 440/717] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe,
	Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit e246b7c035d74abfb3507fa10082d0c42cc016c3 ]

As part of the cma_dev release, that pointer will be set to NULL.  In case
it happens in rdma_bind_addr() (part of an error flow), the next call to
addr_handler() will have a call to cma_acquire_dev_by_src_ip() which will
overwrite sgid_attr without releasing it.

  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
  CPU: 2 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  Workqueue: ib_addr process_one_req
  RIP: 0010:cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
  RIP: 0010:cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
  Code: 66 d9 4a ff 4d 8b 6e 10 49 8d bd 1c 08 00 00 e8 b6 d6 4a ff 45 0f b6 bd 1c 08 00 00 41 83 e7 01 e9 49 fd ff ff e8 90 c5 29 ff <0f> 0b e9 80 fe ff ff e8 84 c5 29 ff 4c 89 f7 e8 2c d9 4a ff 4d 8b
  RSP: 0018:ffff8881047c7b40 EFLAGS: 00010293
  RAX: ffff888104789c80 RBX: 0000000000000001 RCX: ffffffff820b8ef8
  RDX: 0000000000000000 RSI: ffffffff820b9080 RDI: ffff88810cd4c998
  RBP: ffff8881047c7c08 R08: ffff888104789c80 R09: ffffed10209f4036
  R10: ffff888104fa01ab R11: ffffed10209f4035 R12: ffff88810cd4c800
  R13: ffff888105750e28 R14: ffff888108f0a100 R15: ffff88810cd4c998
  FS:  0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 0000000104e60005 CR4: 0000000000370ea0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   addr_handler+0x266/0x350 drivers/infiniband/core/cma.c:3190
   process_one_req+0xa3/0x300 drivers/infiniband/core/addr.c:645
   process_one_work+0x54c/0x930 kernel/workqueue.c:2272
   worker_thread+0x82/0x830 kernel/workqueue.c:2418
   kthread+0x1ca/0x220 kernel/kthread.c:292
   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Fixes: ff11c6cd521f ("RDMA/cma: Introduce and use cma_acquire_dev_by_src_ip()")
Link: https://lore.kernel.org/r/20201213132940.345554-5-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index c06c87a4dc5e7..c51b84b2d2f37 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -477,6 +477,10 @@ static void cma_release_dev(struct rdma_id_private *id_priv)
 	list_del(&id_priv->list);
 	cma_dev_put(id_priv->cma_dev);
 	id_priv->cma_dev = NULL;
+	if (id_priv->id.route.addr.dev_addr.sgid_attr) {
+		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
+		id_priv->id.route.addr.dev_addr.sgid_attr = NULL;
+	}
 	mutex_unlock(&lock);
 }
 
@@ -1861,9 +1865,6 @@ static void _destroy_id(struct rdma_id_private *id_priv,
 
 	kfree(id_priv->id.route.path_rec);
 
-	if (id_priv->id.route.addr.dev_addr.sgid_attr)
-		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
-
 	put_net(id_priv->id.route.addr.dev_addr.net);
 	rdma_restrack_del(&id_priv->res);
 	kfree(id_priv);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 440/717] nfc: s3fwrn5: Release the nfc firmware
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (438 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 439/717] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 441/717] drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bongsu Jeon, Krzysztof Kozlowski,
	Jakub Kicinski, Sasha Levin

From: Bongsu Jeon <bongsu.jeon@samsung.com>

[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]

add the code to release the nfc firmware when the firmware image size is
wrong.

Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/s3fwrn5/firmware.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
index ec930ee2c847e..64df50827642b 100644
--- a/drivers/nfc/s3fwrn5/firmware.c
+++ b/drivers/nfc/s3fwrn5/firmware.c
@@ -293,8 +293,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
 	if (ret < 0)
 		return ret;
 
-	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
+	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
+		release_firmware(fw->fw);
 		return -EINVAL;
+	}
 
 	memcpy(fw->date, fw->fw->data + 0x00, 12);
 	fw->date[12] = '\0';
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 441/717] drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (439 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 440/717] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 442/717] powerpc/perf: Fix Threshold Event Counter Multiplier width for P10 Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guido Günther, Daniel Vetter,
	Sasha Levin

From: Guido Günther <agx@sigxcpu.org>

[ Upstream commit ee46d16d2e40bebc2aa790fd7b6a056466ff895c ]

It can take multiple iterations until all components for an attached DSI
bridge are up leading to several:

[    3.796425] mxsfb 30320000.lcd-controller: Cannot connect bridge: -517
[    3.816952] mxsfb 30320000.lcd-controller: [drm:mxsfb_probe [mxsfb]] *ERROR* failed to attach bridge: -517

Silence this by checking for -EPROBE_DEFER and using dev_err_probe() so
we set a deferred reason in case a dependency fails to probe (which
quickly happens on small config/DT changes due to the rather long probe
chain which can include bridges, phys, panels, backights, leds, etc.).

This also removes the only DRM_DEV_ERROR() usage, the rest of the driver
uses dev_err().

Signed-off-by: Guido Günther <agx@sigxcpu.org>
Fixes: c42001e357f7 ("drm: mxsfb: Use drm_panel_bridge")
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/d5761eb871adde5464ba112b89d966568bc2ff6c.1608020391.git.agx@sigxcpu.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mxsfb/mxsfb_drv.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index 35122aef037b4..17f26052e8450 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -134,11 +134,8 @@ static int mxsfb_attach_bridge(struct mxsfb_drm_private *mxsfb)
 		return -ENODEV;
 
 	ret = drm_bridge_attach(&mxsfb->encoder, bridge, NULL, 0);
-	if (ret) {
-		DRM_DEV_ERROR(drm->dev,
-			      "failed to attach bridge: %d\n", ret);
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(drm->dev, ret, "Failed to attach bridge\n");
 
 	mxsfb->bridge = bridge;
 
@@ -212,7 +209,8 @@ static int mxsfb_load(struct drm_device *drm,
 
 	ret = mxsfb_attach_bridge(mxsfb);
 	if (ret) {
-		dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
+		if (ret != -EPROBE_DEFER)
+			dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
 		goto err_vblank;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 442/717] powerpc/perf: Fix Threshold Event Counter Multiplier width for P10
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (440 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 441/717] drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 443/717] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Madhavan Srinivasan, Athira Rajeev,
	Michael Ellerman, Sasha Levin

From: Madhavan Srinivasan <maddy@linux.ibm.com>

[ Upstream commit ef0e3b650f8ddc54bb70868852f50642ee3ae765 ]

Threshold Event Counter Multiplier (TECM) is part of Monitor Mode
Control Register A (MMCRA). This field along with Threshold Event
Counter Exponent (TECE) is used to get threshould counter value.
In Power10, this is a 8bit field, so patch fixes the
current code to modify the MMCRA[TECM] extraction macro to
handle this change. ISA v3.1 says this is a 7 bit field but
POWER10 it's actually 8 bits which will hopefully be fixed
in ISA v3.1 update.

Fixes: 170a315f41c6 ("powerpc/perf: Support to export MMCRA[TEC*] field to userspace")
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1608022578-1532-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/isa207-common.c | 3 +++
 arch/powerpc/perf/isa207-common.h | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index 0f4983ef41036..e1a21d34c6e49 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -247,6 +247,9 @@ void isa207_get_mem_weight(u64 *weight)
 	u64 sier = mfspr(SPRN_SIER);
 	u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
 
+	if (cpu_has_feature(CPU_FTR_ARCH_31))
+		mantissa = P10_MMCRA_THR_CTR_MANT(mmcra);
+
 	if (val == 0 || val == 7)
 		*weight = 0;
 	else
diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
index 42087643c3331..454b32c314406 100644
--- a/arch/powerpc/perf/isa207-common.h
+++ b/arch/powerpc/perf/isa207-common.h
@@ -231,6 +231,10 @@
 #define MMCRA_THR_CTR_EXP(v)		(((v) >> MMCRA_THR_CTR_EXP_SHIFT) &\
 						MMCRA_THR_CTR_EXP_MASK)
 
+#define P10_MMCRA_THR_CTR_MANT_MASK	0xFFul
+#define P10_MMCRA_THR_CTR_MANT(v)	(((v) >> MMCRA_THR_CTR_MANT_SHIFT) &\
+						P10_MMCRA_THR_CTR_MANT_MASK)
+
 /* MMCRA Threshold Compare bit constant for power9 */
 #define p9_MMCRA_THR_CMP_SHIFT	45
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 443/717] powerpc/ps3: use dma_mapping_error()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (441 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 442/717] powerpc/perf: Fix Threshold Event Counter Multiplier width for P10 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 444/717] perf test: Fix metric parsing test Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Stehlé,
	Geert Uytterhoeven, Michael Ellerman, Sasha Levin

From: Vincent Stehlé <vincent.stehle@laposte.net>

[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]

The DMA address returned by dma_map_single() should be checked with
dma_mapping_error(). Fix the ps3stor_setup() function accordingly.

Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ps3/ps3stor_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
index 333ba83006e48..a12a1ad9b5fe3 100644
--- a/drivers/ps3/ps3stor_lib.c
+++ b/drivers/ps3/ps3stor_lib.c
@@ -189,7 +189,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
 	dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
 	dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
 					 dev->bounce_size, DMA_BIDIRECTIONAL);
-	if (!dev->bounce_dma) {
+	if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
 		dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
 			__func__, __LINE__);
 		error = -ENODEV;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 444/717] perf test: Fix metric parsing test
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (442 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 443/717] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 445/717] drm/amdgpu: fix regression in vbios reservation handling on headless Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kajol Jain, Ian Rogers, Jiri Olsa,
	Madhavan Srinivasan, Ravi Bangoria, Arnaldo Carvalho de Melo,
	Sasha Levin

From: Kajol Jain <kjain@linux.ibm.com>

[ Upstream commit b2ce5dbc15819ea4bef47dbd368239cb1e965158 ]

Commit e1c92a7fbbc5 ("perf tests: Add another metric parsing test") add
another test for metric parsing. The test goes through all metrics
compiled for arch within pmu events and try to parse them.

Right now this test is failing in powerpc machine.

Result in power9 platform:

  [command]# ./perf test 10
  10: PMU events                                                      :
  10.1: PMU event table sanity                                        : Ok
  10.2: PMU event map aliases                                         : Ok
  10.3: Parsing of PMU event table metrics                            : Skip (some metrics failed)
  10.4: Parsing of PMU event table metrics with fake PMUs             : FAILED!

Issue is we are passing different runtime parameter value in
"expr__find_other" and "expr__parse" function which is called from
function `metric_parse_fake`.  And because of this parsing of hv-24x7
metrics is failing.

  [command]# ./perf test 10 -vv
  .....
  hv_24x7/pm_mcs01_128b_rd_disp_port01,chip=1/ not found
  expr__parse failed
  test child finished with -1
  ---- end ----
  PMU events subtest 4: FAILED!

This patch fix this issue and change runtime parameter value to '0' in
expr__parse function.

Result in power9 platform after this patch:

  [command]# ./perf test 10
  10: PMU events                                                      :
  10.1: PMU event table sanity                                        : Ok
  10.2: PMU event map aliases                                         : Ok
  10.3: Parsing of PMU event table metrics                            : Skip (some metrics failed)
  10.4: Parsing of PMU event table metrics with fake PMUs             : Ok

Fixes: e1c92a7fbbc5 ("perf tests: Add another metric parsing test")
Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
Acked-by: Ian Rogers <irogers@google.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Link: http://lore.kernel.org/lkml/20201119152411.46041-1-kjain@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/pmu-events.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/pmu-events.c b/tools/perf/tests/pmu-events.c
index d3517a74d95e3..31f987bb7ebba 100644
--- a/tools/perf/tests/pmu-events.c
+++ b/tools/perf/tests/pmu-events.c
@@ -561,7 +561,7 @@ static int metric_parse_fake(const char *str)
 		}
 	}
 
-	if (expr__parse(&result, &ctx, str, 1))
+	if (expr__parse(&result, &ctx, str, 0))
 		pr_err("expr__parse failed\n");
 	else
 		ret = 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 445/717] drm/amdgpu: fix regression in vbios reservation handling on headless
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (443 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 444/717] perf test: Fix metric parsing test Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 446/717] mm/gup: reorganize internal_get_user_pages_fast() Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guchun Chen, Alex Deucher, Sasha Levin

From: Alex Deucher <alexander.deucher@amd.com>

[ Upstream commit 7eded018bfeccb365963bb51be731a9f99aeea59 ]

We need to move the check under the non-headless case, otherwise
we always reserve the VGA save size.

Fixes: 157fe68d74c2ad ("drm/amdgpu: fix size calculation with stolen vga memory")
Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
index 3e4892b7b7d3c..ff4e226739308 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -494,13 +494,14 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)
 		break;
 	}
 
-	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE))
+	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE)) {
 		size = 0;
-	else
+	} else {
 		size = amdgpu_gmc_get_vbios_fb_size(adev);
 
-	if (adev->mman.keep_stolen_vga_memory)
-		size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
+		if (adev->mman.keep_stolen_vga_memory)
+			size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
+	}
 
 	/* set to 0 if the pre-OS buffer uses up most of vram */
 	if ((adev->gmc.real_vram_size - size) < (8 * 1024 * 1024))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 446/717] mm/gup: reorganize internal_get_user_pages_fast()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (444 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 445/717] drm/amdgpu: fix regression in vbios reservation handling on headless Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 447/717] mm/gup: prevent gup_fast from racing with COW during fork Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Jan Kara,
	John Hubbard, Peter Xu, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit c28b1fc70390df32e29991eedd52bd86e7aba080 ]

Patch series "Add a seqcount between gup_fast and copy_page_range()", v4.

As discussed and suggested by Linus use a seqcount to close the small race
between gup_fast and copy_page_range().

Ahmed confirms that raw_write_seqcount_begin() is the correct API to use
in this case and it doesn't trigger any lockdeps.

I was able to test it using two threads, one forking and the other using
ibv_reg_mr() to trigger GUP fast.  Modifying copy_page_range() to sleep
made the window large enough to reliably hit to test the logic.

This patch (of 2):

The next patch in this series makes the lockless flow a little more
complex, so move the entire block into a new function and remove a level
of indention.  Tidy a bit of cruft:

 - addr is always the same as start, so use start

 - Use the modern check_add_overflow() for computing end = start + len

 - nr_pinned/pages << PAGE_SHIFT needs the LHS to be unsigned long to
   avoid shift overflow, make the variables unsigned long to avoid coding
   casts in both places. nr_pinned was missing its cast

 - The handling of ret and nr_pinned can be streamlined a bit

No functional change.

Link: https://lkml.kernel.org/r/0-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
Link: https://lkml.kernel.org/r/1-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/gup.c | 99 ++++++++++++++++++++++++++++++--------------------------
 1 file changed, 54 insertions(+), 45 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index 98eb8e6d2609c..c7e24301860ab 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2677,13 +2677,43 @@ static int __gup_longterm_unlocked(unsigned long start, int nr_pages,
 	return ret;
 }
 
-static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
+static unsigned long lockless_pages_from_mm(unsigned long start,
+					    unsigned long end,
+					    unsigned int gup_flags,
+					    struct page **pages)
+{
+	unsigned long flags;
+	int nr_pinned = 0;
+
+	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
+	    !gup_fast_permitted(start, end))
+		return 0;
+
+	/*
+	 * Disable interrupts. The nested form is used, in order to allow full,
+	 * general purpose use of this routine.
+	 *
+	 * With interrupts disabled, we block page table pages from being freed
+	 * from under us. See struct mmu_table_batch comments in
+	 * include/asm-generic/tlb.h for more details.
+	 *
+	 * We do not adopt an rcu_read_lock() here as we also want to block IPIs
+	 * that come from THPs splitting.
+	 */
+	local_irq_save(flags);
+	gup_pgd_range(start, end, gup_flags, pages, &nr_pinned);
+	local_irq_restore(flags);
+	return nr_pinned;
+}
+
+static int internal_get_user_pages_fast(unsigned long start,
+					unsigned long nr_pages,
 					unsigned int gup_flags,
 					struct page **pages)
 {
-	unsigned long addr, len, end;
-	unsigned long flags;
-	int nr_pinned = 0, ret = 0;
+	unsigned long len, end;
+	unsigned long nr_pinned;
+	int ret;
 
 	if (WARN_ON_ONCE(gup_flags & ~(FOLL_WRITE | FOLL_LONGTERM |
 				       FOLL_FORCE | FOLL_PIN | FOLL_GET |
@@ -2697,54 +2727,33 @@ static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
 		might_lock_read(&current->mm->mmap_lock);
 
 	start = untagged_addr(start) & PAGE_MASK;
-	addr = start;
-	len = (unsigned long) nr_pages << PAGE_SHIFT;
-	end = start + len;
-
-	if (end <= start)
+	len = nr_pages << PAGE_SHIFT;
+	if (check_add_overflow(start, len, &end))
 		return 0;
 	if (unlikely(!access_ok((void __user *)start, len)))
 		return -EFAULT;
 
-	/*
-	 * Disable interrupts. The nested form is used, in order to allow
-	 * full, general purpose use of this routine.
-	 *
-	 * With interrupts disabled, we block page table pages from being
-	 * freed from under us. See struct mmu_table_batch comments in
-	 * include/asm-generic/tlb.h for more details.
-	 *
-	 * We do not adopt an rcu_read_lock(.) here as we also want to
-	 * block IPIs that come from THPs splitting.
-	 */
-	if (IS_ENABLED(CONFIG_HAVE_FAST_GUP) && gup_fast_permitted(start, end)) {
-		unsigned long fast_flags = gup_flags;
-
-		local_irq_save(flags);
-		gup_pgd_range(addr, end, fast_flags, pages, &nr_pinned);
-		local_irq_restore(flags);
-		ret = nr_pinned;
-	}
-
-	if (nr_pinned < nr_pages && !(gup_flags & FOLL_FAST_ONLY)) {
-		/* Try to get the remaining pages with get_user_pages */
-		start += nr_pinned << PAGE_SHIFT;
-		pages += nr_pinned;
+	nr_pinned = lockless_pages_from_mm(start, end, gup_flags, pages);
+	if (nr_pinned == nr_pages || gup_flags & FOLL_FAST_ONLY)
+		return nr_pinned;
 
-		ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned,
-					      gup_flags, pages);
-
-		/* Have to be a bit careful with return values */
-		if (nr_pinned > 0) {
-			if (ret < 0)
-				ret = nr_pinned;
-			else
-				ret += nr_pinned;
-		}
+	/* Slow path: try to get the remaining pages with get_user_pages */
+	start += nr_pinned << PAGE_SHIFT;
+	pages += nr_pinned;
+	ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned, gup_flags,
+				      pages);
+	if (ret < 0) {
+		/*
+		 * The caller has to unpin the pages we already pinned so
+		 * returning -errno is not an option
+		 */
+		if (nr_pinned)
+			return nr_pinned;
+		return ret;
 	}
-
-	return ret;
+	return ret + nr_pinned;
 }
+
 /**
  * get_user_pages_fast_only() - pin user pages in memory
  * @start:      starting user address
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 447/717] mm/gup: prevent gup_fast from racing with COW during fork
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (445 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 446/717] mm/gup: reorganize internal_get_user_pages_fast() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 448/717] mm/gup: combine put_compound_head() and unpin_user_page() Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Linus Torvalds,
	John Hubbard, Jan Kara, Peter Xu, Andrea Arcangeli,
	Aneesh Kumar K.V, Christoph Hellwig, Hugh Dickins, Jann Horn,
	Kirill Shutemov, Kirill Tkhai, Leon Romanovsky, Michal Hocko,
	Oleg Nesterov, Andrew Morton, Sasha Levin, Ahmed S. Darwish

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 57efa1fe5957694fa541c9062de0a127f0b9acb0 ]

Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during
fork() for ptes") pages under a FOLL_PIN will not be write protected
during COW for fork.  This means that pages returned from
pin_user_pages(FOLL_WRITE) should not become write protected while the pin
is active.

However, there is a small race where get_user_pages_fast(FOLL_PIN) can
establish a FOLL_PIN at the same time copy_present_page() is write
protecting it:

        CPU 0                             CPU 1
   get_user_pages_fast()
    internal_get_user_pages_fast()
                                       copy_page_range()
                                         pte_alloc_map_lock()
                                           copy_present_page()
                                             atomic_read(has_pinned) == 0
					     page_maybe_dma_pinned() == false
     atomic_set(has_pinned, 1);
     gup_pgd_range()
      gup_pte_range()
       pte_t pte = gup_get_pte(ptep)
       pte_access_permitted(pte)
       try_grab_compound_head()
                                             pte = pte_wrprotect(pte)
	                                     set_pte_at();
                                         pte_unmap_unlock()
      // GUP now returns with a write protected page

The first attempt to resolve this by using the write protect caused
problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid
early COW write protect games during fork()")

Instead wrap copy_p4d_range() with the write side of a seqcount and check
the read side around gup_pgd_range().  If there is a collision then
get_user_pages_fast() fails and falls back to slow GUP.

Slow GUP is safe against this race because copy_page_range() is only
called while holding the exclusive side of the mmap_lock on the src
mm_struct.

[akpm@linux-foundation.org: coding style fixes]
  Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com

Link: https://lkml.kernel.org/r/2-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: "Ahmed S. Darwish" <a.darwish@linutronix.de>	[seqcount_t parts]
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kirill Shutemov <kirill@shutemov.name>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Leon Romanovsky <leonro@nvidia.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/tboot.c    |  1 +
 drivers/firmware/efi/efi.c |  1 +
 include/linux/mm_types.h   |  8 ++++++++
 kernel/fork.c              |  1 +
 mm/gup.c                   | 18 ++++++++++++++++++
 mm/init-mm.c               |  1 +
 mm/memory.c                | 13 ++++++++++++-
 7 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index ae64f98ec2ab6..4c09ba1102047 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -93,6 +93,7 @@ static struct mm_struct tboot_mm = {
 	.pgd            = swapper_pg_dir,
 	.mm_users       = ATOMIC_INIT(2),
 	.mm_count       = ATOMIC_INIT(1),
+	.write_protect_seq = SEQCNT_ZERO(tboot_mm.write_protect_seq),
 	MMAP_LOCK_INITIALIZER(init_mm)
 	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
 	.mmlist         = LIST_HEAD_INIT(init_mm.mmlist),
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 6c6eec044a978..df3f9bcab581c 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -57,6 +57,7 @@ struct mm_struct efi_mm = {
 	.mm_rb			= RB_ROOT,
 	.mm_users		= ATOMIC_INIT(2),
 	.mm_count		= ATOMIC_INIT(1),
+	.write_protect_seq      = SEQCNT_ZERO(efi_mm.write_protect_seq),
 	MMAP_LOCK_INITIALIZER(efi_mm)
 	.page_table_lock	= __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
 	.mmlist			= LIST_HEAD_INIT(efi_mm.mmlist),
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 5a9238f6caad9..915f4f100383b 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -14,6 +14,7 @@
 #include <linux/uprobes.h>
 #include <linux/page-flags-layout.h>
 #include <linux/workqueue.h>
+#include <linux/seqlock.h>
 
 #include <asm/mmu.h>
 
@@ -446,6 +447,13 @@ struct mm_struct {
 		 */
 		atomic_t has_pinned;
 
+		/**
+		 * @write_protect_seq: Locked when any thread is write
+		 * protecting pages mapped by this mm to enforce a later COW,
+		 * for instance during page table copying for fork().
+		 */
+		seqcount_t write_protect_seq;
+
 #ifdef CONFIG_MMU
 		atomic_long_t pgtables_bytes;	/* PTE page table pages */
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index 6d266388d3804..dc55f68a6ee36 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
 	mm->vmacache_seqnum = 0;
 	atomic_set(&mm->mm_users, 1);
 	atomic_set(&mm->mm_count, 1);
+	seqcount_init(&mm->write_protect_seq);
 	mmap_init_lock(mm);
 	INIT_LIST_HEAD(&mm->mmlist);
 	mm->core_state = NULL;
diff --git a/mm/gup.c b/mm/gup.c
index c7e24301860ab..9c6a2f5001c5c 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2684,11 +2684,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
 {
 	unsigned long flags;
 	int nr_pinned = 0;
+	unsigned seq;
 
 	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
 	    !gup_fast_permitted(start, end))
 		return 0;
 
+	if (gup_flags & FOLL_PIN) {
+		seq = raw_read_seqcount(&current->mm->write_protect_seq);
+		if (seq & 1)
+			return 0;
+	}
+
 	/*
 	 * Disable interrupts. The nested form is used, in order to allow full,
 	 * general purpose use of this routine.
@@ -2703,6 +2710,17 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
 	local_irq_save(flags);
 	gup_pgd_range(start, end, gup_flags, pages, &nr_pinned);
 	local_irq_restore(flags);
+
+	/*
+	 * When pinning pages for DMA there could be a concurrent write protect
+	 * from fork() via copy_page_range(), in this case always fail fast GUP.
+	 */
+	if (gup_flags & FOLL_PIN) {
+		if (read_seqcount_retry(&current->mm->write_protect_seq, seq)) {
+			unpin_user_pages(pages, nr_pinned);
+			return 0;
+		}
+	}
 	return nr_pinned;
 }
 
diff --git a/mm/init-mm.c b/mm/init-mm.c
index 3a613c85f9ede..153162669f806 100644
--- a/mm/init-mm.c
+++ b/mm/init-mm.c
@@ -31,6 +31,7 @@ struct mm_struct init_mm = {
 	.pgd		= swapper_pg_dir,
 	.mm_users	= ATOMIC_INIT(2),
 	.mm_count	= ATOMIC_INIT(1),
+	.write_protect_seq = SEQCNT_ZERO(init_mm.write_protect_seq),
 	MMAP_LOCK_INITIALIZER(init_mm)
 	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
 	.arg_lock	=  __SPIN_LOCK_UNLOCKED(init_mm.arg_lock),
diff --git a/mm/memory.c b/mm/memory.c
index c48f8df6e5026..50632c4366b8a 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1171,6 +1171,15 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
 		mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE,
 					0, src_vma, src_mm, addr, end);
 		mmu_notifier_invalidate_range_start(&range);
+		/*
+		 * Disabling preemption is not needed for the write side, as
+		 * the read side doesn't spin, but goes to the mmap_lock.
+		 *
+		 * Use the raw variant of the seqcount_t write API to avoid
+		 * lockdep complaining about preemptibility.
+		 */
+		mmap_assert_write_locked(src_mm);
+		raw_write_seqcount_begin(&src_mm->write_protect_seq);
 	}
 
 	ret = 0;
@@ -1187,8 +1196,10 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
 		}
 	} while (dst_pgd++, src_pgd++, addr = next, addr != end);
 
-	if (is_cow)
+	if (is_cow) {
+		raw_write_seqcount_end(&src_mm->write_protect_seq);
 		mmu_notifier_invalidate_range_end(&range);
+	}
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 448/717] mm/gup: combine put_compound_head() and unpin_user_page()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (446 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 447/717] mm/gup: prevent gup_fast from racing with COW during fork Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 449/717] mm: memcg/slab: fix return of child memcg objcg for root memcg Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, John Hubbard,
	Ira Weiny, Jan Kara, Joao Martins, Jonathan Corbet, Dan Williams,
	Dave Chinner, Christoph Hellwig, Jane Chu, Kirill A. Shutemov,
	Michal Hocko, Mike Kravetz, Shuah Khan, Muchun Song,
	Vlastimil Babka, Matthew Wilcox, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 4509b42c38963f495b49aa50209c34337286ecbe ]

These functions accomplish the same thing but have different
implementations.

unpin_user_page() has a bug where it calls mod_node_page_state() after
calling put_page() which creates a risk that the page could have been
hot-uplugged from the system.

Fix this by using put_compound_head() as the only implementation.

__unpin_devmap_managed_user_page() and related can be deleted as well in
favour of the simpler, but slower, version in put_compound_head() that has
an extra atomic page_ref_sub, but always calls put_page() which internally
contains the special devmap code.

Move put_compound_head() to be directly after try_grab_compound_head() so
people can find it in future.

Link: https://lkml.kernel.org/r/0-v1-6730d4ee0d32+40e6-gup_combine_put_jgg@nvidia.com
Fixes: 1970dc6f5226 ("mm/gup: /proc/vmstat: pin_user_pages (FOLL_PIN) reporting")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
CC: Joao Martins <joao.m.martins@oracle.com>
CC: Jonathan Corbet <corbet@lwn.net>
CC: Dan Williams <dan.j.williams@intel.com>
CC: Dave Chinner <david@fromorbit.com>
CC: Christoph Hellwig <hch@infradead.org>
CC: Jane Chu <jane.chu@oracle.com>
CC: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
CC: Michal Hocko <mhocko@suse.com>
CC: Mike Kravetz <mike.kravetz@oracle.com>
CC: Shuah Khan <shuah@kernel.org>
CC: Muchun Song <songmuchun@bytedance.com>
CC: Vlastimil Babka <vbabka@suse.cz>
CC: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/gup.c | 103 +++++++++++++------------------------------------------
 1 file changed, 23 insertions(+), 80 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index 9c6a2f5001c5c..054ff923d3d92 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -123,6 +123,28 @@ static __maybe_unused struct page *try_grab_compound_head(struct page *page,
 	return NULL;
 }
 
+static void put_compound_head(struct page *page, int refs, unsigned int flags)
+{
+	if (flags & FOLL_PIN) {
+		mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED,
+				    refs);
+
+		if (hpage_pincount_available(page))
+			hpage_pincount_sub(page, refs);
+		else
+			refs *= GUP_PIN_COUNTING_BIAS;
+	}
+
+	VM_BUG_ON_PAGE(page_ref_count(page) < refs, page);
+	/*
+	 * Calling put_page() for each ref is unnecessarily slow. Only the last
+	 * ref needs a put_page().
+	 */
+	if (refs > 1)
+		page_ref_sub(page, refs - 1);
+	put_page(page);
+}
+
 /**
  * try_grab_page() - elevate a page's refcount by a flag-dependent amount
  *
@@ -177,41 +199,6 @@ bool __must_check try_grab_page(struct page *page, unsigned int flags)
 	return true;
 }
 
-#ifdef CONFIG_DEV_PAGEMAP_OPS
-static bool __unpin_devmap_managed_user_page(struct page *page)
-{
-	int count, refs = 1;
-
-	if (!page_is_devmap_managed(page))
-		return false;
-
-	if (hpage_pincount_available(page))
-		hpage_pincount_sub(page, 1);
-	else
-		refs = GUP_PIN_COUNTING_BIAS;
-
-	count = page_ref_sub_return(page, refs);
-
-	mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED, 1);
-	/*
-	 * devmap page refcounts are 1-based, rather than 0-based: if
-	 * refcount is 1, then the page is free and the refcount is
-	 * stable because nobody holds a reference on the page.
-	 */
-	if (count == 1)
-		free_devmap_managed_page(page);
-	else if (!count)
-		__put_page(page);
-
-	return true;
-}
-#else
-static bool __unpin_devmap_managed_user_page(struct page *page)
-{
-	return false;
-}
-#endif /* CONFIG_DEV_PAGEMAP_OPS */
-
 /**
  * unpin_user_page() - release a dma-pinned page
  * @page:            pointer to page to be released
@@ -223,28 +210,7 @@ static bool __unpin_devmap_managed_user_page(struct page *page)
  */
 void unpin_user_page(struct page *page)
 {
-	int refs = 1;
-
-	page = compound_head(page);
-
-	/*
-	 * For devmap managed pages we need to catch refcount transition from
-	 * GUP_PIN_COUNTING_BIAS to 1, when refcount reach one it means the
-	 * page is free and we need to inform the device driver through
-	 * callback. See include/linux/memremap.h and HMM for details.
-	 */
-	if (__unpin_devmap_managed_user_page(page))
-		return;
-
-	if (hpage_pincount_available(page))
-		hpage_pincount_sub(page, 1);
-	else
-		refs = GUP_PIN_COUNTING_BIAS;
-
-	if (page_ref_sub_and_test(page, refs))
-		__put_page(page);
-
-	mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED, 1);
+	put_compound_head(compound_head(page), 1, FOLL_PIN);
 }
 EXPORT_SYMBOL(unpin_user_page);
 
@@ -2062,29 +2028,6 @@ EXPORT_SYMBOL(get_user_pages_unlocked);
  * This code is based heavily on the PowerPC implementation by Nick Piggin.
  */
 #ifdef CONFIG_HAVE_FAST_GUP
-
-static void put_compound_head(struct page *page, int refs, unsigned int flags)
-{
-	if (flags & FOLL_PIN) {
-		mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED,
-				    refs);
-
-		if (hpage_pincount_available(page))
-			hpage_pincount_sub(page, refs);
-		else
-			refs *= GUP_PIN_COUNTING_BIAS;
-	}
-
-	VM_BUG_ON_PAGE(page_ref_count(page) < refs, page);
-	/*
-	 * Calling put_page() for each ref is unnecessarily slow. Only the last
-	 * ref needs a put_page().
-	 */
-	if (refs > 1)
-		page_ref_sub(page, refs - 1);
-	put_page(page);
-}
-
 #ifdef CONFIG_GUP_GET_PTE_LOW_HIGH
 
 /*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 449/717] mm: memcg/slab: fix return of child memcg objcg for root memcg
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (447 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 448/717] mm/gup: combine put_compound_head() and unpin_user_page() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 450/717] mm: memcg/slab: fix use after free in obj_cgroup_charge Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Muchun Song, Roman Gushchin,
	Johannes Weiner, Michal Hocko, Vladimir Davydov, Shakeel Butt,
	Joonsoo Kim, Yafang Shao, Chris Down, Christian Brauner,
	Peter Zijlstra, Ingo Molnar, Kees Cook, Thomas Gleixner,
	Eugene Syromiatnikov, Suren Baghdasaryan, Adrian Reber,
	Marco Elver, Andrew Morton, Linus Torvalds, Sasha Levin

From: Muchun Song <songmuchun@bytedance.com>

[ Upstream commit 2f7659a314736b32b66273dbf91c19874a052fde ]

Consider the following memcg hierarchy.

                    root
                   /    \
                  A      B

If we failed to get the reference on objcg of memcg A, the
get_obj_cgroup_from_current can return the wrong objcg for the root
memcg.

Link: https://lkml.kernel.org/r/20201029164429.58703-1-songmuchun@bytedance.com
Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Yafang Shao <laoar.shao@gmail.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Eugene Syromiatnikov <esyr@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Adrian Reber <areber@redhat.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memcontrol.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 29459a6ce1c7a..74b85077f89ad 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2987,6 +2987,7 @@ __always_inline struct obj_cgroup *get_obj_cgroup_from_current(void)
 		objcg = rcu_dereference(memcg->objcg);
 		if (objcg && obj_cgroup_tryget(objcg))
 			break;
+		objcg = NULL;
 	}
 	rcu_read_unlock();
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 450/717] mm: memcg/slab: fix use after free in obj_cgroup_charge
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (448 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 449/717] mm: memcg/slab: fix return of child memcg objcg for root memcg Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 451/717] mm/rmap: always do TTU_IGNORE_ACCESS Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Muchun Song, Roman Gushchin,
	Shakeel Butt, Johannes Weiner, Michal Hocko, Vladimir Davydov,
	Joonsoo Kim, Yafang Shao, Chris Down, Christian Brauner,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Muchun Song <songmuchun@bytedance.com>

[ Upstream commit eefbfa7fd678805b38a46293e78543f98f353d3e ]

The rcu_read_lock/unlock only can guarantee that the memcg will not be
freed, but it cannot guarantee the success of css_get to memcg.

If the whole process of a cgroup offlining is completed between reading a
objcg->memcg pointer and bumping the css reference on another CPU, and
there are exactly 0 external references to this memory cgroup (how we get
to the obj_cgroup_charge() then?), css_get() can change the ref counter
from 0 back to 1.

Link: https://lkml.kernel.org/r/20201028035013.99711-2-songmuchun@bytedance.com
Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Yafang Shao <laoar.shao@gmail.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memcontrol.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 74b85077f89ad..a717728cc7b4a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3247,8 +3247,10 @@ int obj_cgroup_charge(struct obj_cgroup *objcg, gfp_t gfp, size_t size)
 	 * independently later.
 	 */
 	rcu_read_lock();
+retry:
 	memcg = obj_cgroup_memcg(objcg);
-	css_get(&memcg->css);
+	if (unlikely(!css_tryget(&memcg->css)))
+		goto retry;
 	rcu_read_unlock();
 
 	nr_pages = size >> PAGE_SHIFT;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 451/717] mm/rmap: always do TTU_IGNORE_ACCESS
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (449 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 450/717] mm: memcg/slab: fix use after free in obj_cgroup_charge Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 452/717] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shakeel Butt, Johannes Weiner,
	Hugh Dickins, Jerome Glisse, Vlastimil Babka, Michal Hocko,
	Andrea Arcangeli, Dan Williams, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Shakeel Butt <shakeelb@google.com>

[ Upstream commit 013339df116c2ee0d796dd8bfb8f293a2030c063 ]

Since commit 369ea8242c0f ("mm/rmap: update to new mmu_notifier semantic
v2"), the code to check the secondary MMU's page table access bit is
broken for !(TTU_IGNORE_ACCESS) because the page is unmapped from the
secondary MMU's page table before the check.  More specifically for those
secondary MMUs which unmap the memory in
mmu_notifier_invalidate_range_start() like kvm.

However memory reclaim is the only user of !(TTU_IGNORE_ACCESS) or the
absence of TTU_IGNORE_ACCESS and it explicitly performs the page table
access check before trying to unmap the page.  So, at worst the reclaim
will miss accesses in a very short window if we remove page table access
check in unmapping code.

There is an unintented consequence of !(TTU_IGNORE_ACCESS) for the memcg
reclaim.  From memcg reclaim the page_referenced() only account the
accesses from the processes which are in the same memcg of the target page
but the unmapping code is considering accesses from all the processes, so,
decreasing the effectiveness of memcg reclaim.

The simplest solution is to always assume TTU_IGNORE_ACCESS in unmapping
code.

Link: https://lkml.kernel.org/r/20201104231928.1494083-1-shakeelb@google.com
Fixes: 369ea8242c0f ("mm/rmap: update to new mmu_notifier semantic v2")
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/rmap.h |  1 -
 mm/huge_memory.c     |  2 +-
 mm/memory-failure.c  |  2 +-
 mm/memory_hotplug.c  |  2 +-
 mm/migrate.c         |  8 +++-----
 mm/rmap.c            |  9 ---------
 mm/vmscan.c          | 14 +++++---------
 7 files changed, 11 insertions(+), 27 deletions(-)

diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 3a6adfa70fb0e..70085ca1a3fc9 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -91,7 +91,6 @@ enum ttu_flags {
 
 	TTU_SPLIT_HUGE_PMD	= 0x4,	/* split huge PMD if any */
 	TTU_IGNORE_MLOCK	= 0x8,	/* ignore mlock */
-	TTU_IGNORE_ACCESS	= 0x10,	/* don't age */
 	TTU_IGNORE_HWPOISON	= 0x20,	/* corrupted page is recoverable */
 	TTU_BATCH_FLUSH		= 0x40,	/* Batch TLB flushes where possible
 					 * and caller guarantees they will
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index ec2bb93f74314..85eda66eb625d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2321,7 +2321,7 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
 
 static void unmap_page(struct page *page)
 {
-	enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
+	enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK |
 		TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
 	bool unmap_success;
 
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 5d880d4eb9a26..71295bb984af6 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -989,7 +989,7 @@ static int get_hwpoison_page(struct page *page)
 static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
 				  int flags, struct page **hpagep)
 {
-	enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
+	enum ttu_flags ttu = TTU_IGNORE_MLOCK;
 	struct address_space *mapping;
 	LIST_HEAD(tokill);
 	bool unmap_success = true;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 63b2e46b65552..0f855deea4b2d 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1304,7 +1304,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 			if (WARN_ON(PageLRU(page)))
 				isolate_lru_page(page);
 			if (page_mapped(page))
-				try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS);
+				try_to_unmap(page, TTU_IGNORE_MLOCK);
 			continue;
 		}
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 5795cb82e27c3..8ea0c65f10756 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1122,8 +1122,7 @@ static int __unmap_and_move(struct page *page, struct page *newpage,
 		/* Establish migration ptes */
 		VM_BUG_ON_PAGE(PageAnon(page) && !PageKsm(page) && !anon_vma,
 				page);
-		try_to_unmap(page,
-			TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
+		try_to_unmap(page, TTU_MIGRATION|TTU_IGNORE_MLOCK);
 		page_was_mapped = 1;
 	}
 
@@ -1329,8 +1328,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
 
 	if (page_mapped(hpage)) {
 		bool mapping_locked = false;
-		enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK|
-					TTU_IGNORE_ACCESS;
+		enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK;
 
 		if (!PageAnon(hpage)) {
 			/*
@@ -2688,7 +2686,7 @@ static void migrate_vma_prepare(struct migrate_vma *migrate)
  */
 static void migrate_vma_unmap(struct migrate_vma *migrate)
 {
-	int flags = TTU_MIGRATION | TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
+	int flags = TTU_MIGRATION | TTU_IGNORE_MLOCK;
 	const unsigned long npages = migrate->npages;
 	const unsigned long start = migrate->start;
 	unsigned long addr, i, restore = 0;
diff --git a/mm/rmap.c b/mm/rmap.c
index 31b29321adfe1..6657000b18d41 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1533,15 +1533,6 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
 			goto discard;
 		}
 
-		if (!(flags & TTU_IGNORE_ACCESS)) {
-			if (ptep_clear_flush_young_notify(vma, address,
-						pvmw.pte)) {
-				ret = false;
-				page_vma_mapped_walk_done(&pvmw);
-				break;
-			}
-		}
-
 		/* Nuke the page table entry. */
 		flush_cache_page(vma, address, pte_pfn(*pvmw.pte));
 		if (should_defer_flush(mm, flags)) {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7b4e31eac2cff..0ec6321e98878 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1072,7 +1072,6 @@ static void page_check_dirty_writeback(struct page *page,
 static unsigned int shrink_page_list(struct list_head *page_list,
 				     struct pglist_data *pgdat,
 				     struct scan_control *sc,
-				     enum ttu_flags ttu_flags,
 				     struct reclaim_stat *stat,
 				     bool ignore_references)
 {
@@ -1297,7 +1296,7 @@ static unsigned int shrink_page_list(struct list_head *page_list,
 		 * processes. Try to unmap it here.
 		 */
 		if (page_mapped(page)) {
-			enum ttu_flags flags = ttu_flags | TTU_BATCH_FLUSH;
+			enum ttu_flags flags = TTU_BATCH_FLUSH;
 			bool was_swapbacked = PageSwapBacked(page);
 
 			if (unlikely(PageTransHuge(page)))
@@ -1514,7 +1513,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
 	}
 
 	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
-			TTU_IGNORE_ACCESS, &stat, true);
+					&stat, true);
 	list_splice(&clean_pages, page_list);
 	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
 			    -(long)nr_reclaimed);
@@ -1958,8 +1957,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
 	if (nr_taken == 0)
 		return 0;
 
-	nr_reclaimed = shrink_page_list(&page_list, pgdat, sc, 0,
-				&stat, false);
+	nr_reclaimed = shrink_page_list(&page_list, pgdat, sc, &stat, false);
 
 	spin_lock_irq(&pgdat->lru_lock);
 
@@ -2131,8 +2129,7 @@ unsigned long reclaim_pages(struct list_head *page_list)
 
 		nr_reclaimed += shrink_page_list(&node_page_list,
 						NODE_DATA(nid),
-						&sc, 0,
-						&dummy_stat, false);
+						&sc, &dummy_stat, false);
 		while (!list_empty(&node_page_list)) {
 			page = lru_to_page(&node_page_list);
 			list_del(&page->lru);
@@ -2145,8 +2142,7 @@ unsigned long reclaim_pages(struct list_head *page_list)
 	if (!list_empty(&node_page_list)) {
 		nr_reclaimed += shrink_page_list(&node_page_list,
 						NODE_DATA(nid),
-						&sc, 0,
-						&dummy_stat, false);
+						&sc, &dummy_stat, false);
 		while (!list_empty(&node_page_list)) {
 			page = lru_to_page(&node_page_list);
 			list_del(&page->lru);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 452/717] sparc: fix handling of page table constructor failure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (450 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 451/717] mm/rmap: always do TTU_IGNORE_ACCESS Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 453/717] mm/vmalloc: Fix unlock order in s_stop() Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle),
	David Hildenbrand, Mike Rapoport, Vlastimil Babka, David Miller,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit 06517c9a336f4c20f2064611bf4b1e7881a95fe1 ]

The page has just been allocated, so its refcount is 1.  free_unref_page()
is for use on pages which have a zero refcount.  Use __free_page() like
the other implementations of pte_alloc_one().

Link: https://lkml.kernel.org/r/20201125034655.27687-1-willy@infradead.org
Fixes: 1ae9ae5f7df7 ("sparc: handle pgtable_page_ctor() fail")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/mm/init_64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 96edf64d4fb30..182bb7bdaa0a1 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2894,7 +2894,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm)
 	if (!page)
 		return NULL;
 	if (!pgtable_pte_page_ctor(page)) {
-		free_unref_page(page);
+		__free_page(page);
 		return NULL;
 	}
 	return (pte_t *) page_address(page);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 453/717] mm/vmalloc: Fix unlock order in s_stop()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (451 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 452/717] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 454/717] mm/vmalloc.c: fix kasan shadow poisoning size Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Waiman Long, Uladzislau Rezki (Sony),
	David Hildenbrand, Matthew Wilcox, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Waiman Long <longman@redhat.com>

[ Upstream commit 0a7dd4e901b8a4ee040ba953900d1d7120b34ee5 ]

When multiple locks are acquired, they should be released in reverse
order. For s_start() and s_stop() in mm/vmalloc.c, that is not the
case.

  s_start: mutex_lock(&vmap_purge_lock); spin_lock(&vmap_area_lock);
  s_stop : mutex_unlock(&vmap_purge_lock); spin_unlock(&vmap_area_lock);

This unlock sequence, though allowed, is not optimal. If a waiter is
present, mutex_unlock() will need to go through the slowpath of waking
up the waiter with preemption disabled. Fix that by releasing the
spinlock first before the mutex.

Link: https://lkml.kernel.org/r/20201213180843.16938-1-longman@redhat.com
Fixes: e36176be1c39 ("mm/vmalloc: rework vmap_area_lock")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmalloc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 6ae491a8b210f..75913f685c71e 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3448,11 +3448,11 @@ static void *s_next(struct seq_file *m, void *p, loff_t *pos)
 }
 
 static void s_stop(struct seq_file *m, void *p)
-	__releases(&vmap_purge_lock)
 	__releases(&vmap_area_lock)
+	__releases(&vmap_purge_lock)
 {
-	mutex_unlock(&vmap_purge_lock);
 	spin_unlock(&vmap_area_lock);
+	mutex_unlock(&vmap_purge_lock);
 }
 
 static void show_numa_info(struct seq_file *m, struct vm_struct *v)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 454/717] mm/vmalloc.c: fix kasan shadow poisoning size
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (452 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 453/717] mm/vmalloc: Fix unlock order in s_stop() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 455/717] mm,memory_failure: always pin the page in madvise_inject_error Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincenzo Frascino, Andrey Konovalov,
	Dmitry Vyukov, Andrey Ryabinin, Alexander Potapenko, Marco Elver,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Vincenzo Frascino <vincenzo.frascino@arm.com>

[ Upstream commit c041098c690fe53cea5d20c62f128a4f7a5c19fe ]

The size of vm area can be affected by the presence or not of the guard
page.  In particular when VM_NO_GUARD is present, the actual accessible
size has to be considered like the real size minus the guard page.

Currently kasan does not keep into account this information during the
poison operation and in particular tries to poison the guard page as well.

This approach, even if incorrect, does not cause an issue because the tags
for the guard page are written in the shadow memory.  With the future
introduction of the Tag-Based KASAN, being the guard page inaccessible by
nature, the write tag operation on this page triggers a fault.

Fix kasan shadow poisoning size invoking get_vm_area_size() instead of
accessing directly the field in the data structure to detect the correct
value.

Link: https://lkml.kernel.org/r/20201027160213.32904-1-vincenzo.frascino@arm.com
Fixes: d98c9e83b5e7c ("kasan: fix crashes on access to memory mapped by vm_map_ram()")
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 75913f685c71e..279dc0c96568c 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2256,7 +2256,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
 	debug_check_no_locks_freed(area->addr, get_vm_area_size(area));
 	debug_check_no_obj_freed(area->addr, get_vm_area_size(area));
 
-	kasan_poison_vmalloc(area->addr, area->size);
+	kasan_poison_vmalloc(area->addr, get_vm_area_size(area));
 
 	vm_remove_mappings(area, deallocate_pages);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 455/717] mm,memory_failure: always pin the page in madvise_inject_error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (453 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 454/717] mm/vmalloc.c: fix kasan shadow poisoning size Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 456/717] hugetlb: fix an error code in hugetlb_reserve_pages() Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oscar Salvador, Vlastimil Babka,
	Naoya Horiguchi, Dan Williams, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Oscar Salvador <osalvador@suse.de>

[ Upstream commit 1e8aaedb182d6ddffc894b832e4962629907b3e0 ]

madvise_inject_error() uses get_user_pages_fast to translate the address
we specified to a page.  After [1], we drop the extra reference count for
memory_failure() path.  That commit says that memory_failure wanted to
keep the pin in order to take the page out of circulation.

The truth is that we need to keep the page pinned, otherwise the page
might be re-used after the put_page() and we can end up messing with
someone else's memory.

E.g:

CPU0
process X					CPU1
 madvise_inject_error
  get_user_pages
   put_page
					page gets reclaimed
					process Y allocates the page
  memory_failure
   // We mess with process Y memory

madvise() is meant to operate on a self address space, so messing with
pages that do not belong to us seems the wrong thing to do.
To avoid that, let us keep the page pinned for memory_failure as well.

Pages for DAX mappings will release this extra refcount in
memory_failure_dev_pagemap.

[1] ("23e7b5c2e271: mm, madvise_inject_error:
      Let memory_failure() optionally take a page reference")

Link: https://lkml.kernel.org/r/20201207094818.8518-1-osalvador@suse.de
Fixes: 23e7b5c2e271 ("mm, madvise_inject_error: Let memory_failure() optionally take a page reference")
Signed-off-by: Oscar Salvador <osalvador@suse.de>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/madvise.c        | 9 +--------
 mm/memory-failure.c | 6 ++++++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index 13f5677b93222..9abf4c5f2bce2 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -908,14 +908,7 @@ static int madvise_inject_error(int behavior,
 		} else {
 			pr_info("Injecting memory failure for pfn %#lx at process virtual address %#lx\n",
 				 pfn, start);
-			/*
-			 * Drop the page reference taken by get_user_pages_fast(). In
-			 * the absence of MF_COUNT_INCREASED the memory_failure()
-			 * routine is responsible for pinning the page to prevent it
-			 * from being released back to the page allocator.
-			 */
-			put_page(page);
-			ret = memory_failure(pfn, 0);
+			ret = memory_failure(pfn, MF_COUNT_INCREASED);
 		}
 
 		if (ret)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 71295bb984af6..fd653c9953cfd 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1231,6 +1231,12 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
 	loff_t start;
 	dax_entry_t cookie;
 
+	if (flags & MF_COUNT_INCREASED)
+		/*
+		 * Drop the extra refcount in case we come from madvise().
+		 */
+		put_page(page);
+
 	/*
 	 * Prevent the inode from being freed while we are interrogating
 	 * the address_space, typically this would be handled by
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 456/717] hugetlb: fix an error code in hugetlb_reserve_pages()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (454 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 455/717] mm,memory_failure: always pin the page in madvise_inject_error Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 457/717] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mike Kravetz,
	David Hildenbrand, Mina Almasry, David Rientjes, Andrew Morton,
	Linus Torvalds, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 7fc2513aa237e2ce239ab54d7b04d1d79b317110 ]

Preserve the error code from region_add() instead of returning success.

Link: https://lkml.kernel.org/r/X9NGZWnZl5/Mt99R@mwanda
Fixes: 0db9d74ed884 ("hugetlb: disable region_add file_region coalescing")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index d029d938d26d6..3b38ea958e954 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5115,6 +5115,7 @@ int hugetlb_reserve_pages(struct inode *inode,
 
 		if (unlikely(add < 0)) {
 			hugetlb_acct_memory(h, -gbl_reserve);
+			ret = add;
 			goto out_put_pages;
 		} else if (unlikely(chg > add)) {
 			/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 457/717] mm: dont wake kswapd prematurely when watermark boosting is disabled
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (455 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 456/717] hugetlb: fix an error code in hugetlb_reserve_pages() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 458/717] proc: fix lookup in /proc/net subdirectories after setns(2) Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Weiner, Mel Gorman,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Johannes Weiner <hannes@cmpxchg.org>

[ Upstream commit 597c892038e08098b17ccfe65afd9677e6979800 ]

On 2-node NUMA hosts we see bursts of kswapd reclaim and subsequent
pressure spikes and stalls from cache refaults while there is plenty of
free memory in the system.

Usually, kswapd is woken up when all eligible nodes in an allocation are
full.  But the code related to watermark boosting can wake kswapd on one
full node while the other one is mostly empty.  This may be justified to
fight fragmentation, but is currently unconditionally done whether
watermark boosting is occurring or not.

In our case, many of our workloads' throughput scales with available
memory, and pure utilization is a more tangible concern than trends
around longer-term fragmentation.  As a result we generally disable
watermark boosting.

Wake kswapd only woken when watermark boosting is requested.

Link: https://lkml.kernel.org/r/20201020175833.397286-1-hannes@cmpxchg.org
Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index eaa227a479e4a..32f783ddb5c3a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2470,12 +2470,12 @@ static bool can_steal_fallback(unsigned int order, int start_mt)
 	return false;
 }
 
-static inline void boost_watermark(struct zone *zone)
+static inline bool boost_watermark(struct zone *zone)
 {
 	unsigned long max_boost;
 
 	if (!watermark_boost_factor)
-		return;
+		return false;
 	/*
 	 * Don't bother in zones that are unlikely to produce results.
 	 * On small machines, including kdump capture kernels running
@@ -2483,7 +2483,7 @@ static inline void boost_watermark(struct zone *zone)
 	 * memory situation immediately.
 	 */
 	if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))
-		return;
+		return false;
 
 	max_boost = mult_frac(zone->_watermark[WMARK_HIGH],
 			watermark_boost_factor, 10000);
@@ -2497,12 +2497,14 @@ static inline void boost_watermark(struct zone *zone)
 	 * boosted watermark resulting in a hang.
 	 */
 	if (!max_boost)
-		return;
+		return false;
 
 	max_boost = max(pageblock_nr_pages, max_boost);
 
 	zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages,
 		max_boost);
+
+	return true;
 }
 
 /*
@@ -2540,8 +2542,7 @@ static void steal_suitable_fallback(struct zone *zone, struct page *page,
 	 * likelihood of future fallbacks. Wake kswapd now as the node
 	 * may be balanced overall and kswapd will not wake naturally.
 	 */
-	boost_watermark(zone);
-	if (alloc_flags & ALLOC_KSWAPD)
+	if (boost_watermark(zone) && (alloc_flags & ALLOC_KSWAPD))
 		set_bit(ZONE_BOOSTED_WATERMARK, &zone->flags);
 
 	/* We are not allowed to try stealing from the whole block */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 458/717] proc: fix lookup in /proc/net subdirectories after setns(2)
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (456 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 457/717] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 459/717] checkpatch: fix unescaped left brace Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Dobriyan, Rantala,
	Tommi T. (Nokia - FI/Espoo),
	Al Viro, Andrew Morton, Linus Torvalds, Sasha Levin

From: Alexey Dobriyan <adobriyan@gmail.com>

[ Upstream commit c6c75deda81344c3a95d1d1f606d5cee109e5d54 ]

Commit 1fde6f21d90f ("proc: fix /proc/net/* after setns(2)") only forced
revalidation of regular files under /proc/net/

However, /proc/net/ is unusual in the sense of /proc/net/foo handlers
take netns pointer from parent directory which is old netns.

Steps to reproduce:

	(void)open("/proc/net/sctp/snmp", O_RDONLY);
	unshare(CLONE_NEWNET);

	int fd = open("/proc/net/sctp/snmp", O_RDONLY);
	read(fd, &c, 1);

Read will read wrong data from original netns.

Patch forces lookup on every directory under /proc/net .

Link: https://lkml.kernel.org/r/20201205160916.GA109739@localhost.localdomain
Fixes: 1da4d377f943 ("proc: revalidate misc dentries")
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/generic.c       | 24 ++++++++++++++++++++++--
 fs/proc/internal.h      |  7 +++++++
 fs/proc/proc_net.c      | 16 ----------------
 include/linux/proc_fs.h |  8 +++++++-
 4 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index b84663252adda..6c0a05f55d6b1 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -349,6 +349,16 @@ static const struct file_operations proc_dir_operations = {
 	.iterate_shared		= proc_readdir,
 };
 
+static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+{
+	return 0;
+}
+
+const struct dentry_operations proc_net_dentry_ops = {
+	.d_revalidate	= proc_net_d_revalidate,
+	.d_delete	= always_delete_dentry,
+};
+
 /*
  * proc directories can do almost nothing..
  */
@@ -471,8 +481,8 @@ struct proc_dir_entry *proc_symlink(const char *name,
 }
 EXPORT_SYMBOL(proc_symlink);
 
-struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
-		struct proc_dir_entry *parent, void *data)
+struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
+		struct proc_dir_entry *parent, void *data, bool force_lookup)
 {
 	struct proc_dir_entry *ent;
 
@@ -484,10 +494,20 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
 		ent->data = data;
 		ent->proc_dir_ops = &proc_dir_operations;
 		ent->proc_iops = &proc_dir_inode_operations;
+		if (force_lookup) {
+			pde_force_lookup(ent);
+		}
 		ent = proc_register(parent, ent);
 	}
 	return ent;
 }
+EXPORT_SYMBOL_GPL(_proc_mkdir);
+
+struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
+		struct proc_dir_entry *parent, void *data)
+{
+	return _proc_mkdir(name, mode, parent, data, false);
+}
 EXPORT_SYMBOL_GPL(proc_mkdir_data);
 
 struct proc_dir_entry *proc_mkdir_mode(const char *name, umode_t mode,
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 917cc85e34663..afbe96b6bf77d 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -310,3 +310,10 @@ extern unsigned long task_statm(struct mm_struct *,
 				unsigned long *, unsigned long *,
 				unsigned long *, unsigned long *);
 extern void task_mem(struct seq_file *, struct mm_struct *);
+
+extern const struct dentry_operations proc_net_dentry_ops;
+static inline void pde_force_lookup(struct proc_dir_entry *pde)
+{
+	/* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+	pde->proc_dops = &proc_net_dentry_ops;
+}
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index ed8a6306990c4..1aa9236bf1af5 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -39,22 +39,6 @@ static struct net *get_proc_net(const struct inode *inode)
 	return maybe_get_net(PDE_NET(PDE(inode)));
 }
 
-static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
-{
-	return 0;
-}
-
-static const struct dentry_operations proc_net_dentry_ops = {
-	.d_revalidate	= proc_net_d_revalidate,
-	.d_delete	= always_delete_dentry,
-};
-
-static void pde_force_lookup(struct proc_dir_entry *pde)
-{
-	/* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
-	pde->proc_dops = &proc_net_dentry_ops;
-}
-
 static int seq_open_net(struct inode *inode, struct file *file)
 {
 	unsigned int state_size = PDE(inode)->state_size;
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 270cab43ca3da..000cc0533c336 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -80,6 +80,7 @@ extern void proc_flush_pid(struct pid *);
 
 extern struct proc_dir_entry *proc_symlink(const char *,
 		struct proc_dir_entry *, const char *);
+struct proc_dir_entry *_proc_mkdir(const char *, umode_t, struct proc_dir_entry *, void *, bool);
 extern struct proc_dir_entry *proc_mkdir(const char *, struct proc_dir_entry *);
 extern struct proc_dir_entry *proc_mkdir_data(const char *, umode_t,
 					      struct proc_dir_entry *, void *);
@@ -162,6 +163,11 @@ static inline struct proc_dir_entry *proc_symlink(const char *name,
 static inline struct proc_dir_entry *proc_mkdir(const char *name,
 	struct proc_dir_entry *parent) {return NULL;}
 static inline struct proc_dir_entry *proc_create_mount_point(const char *name) { return NULL; }
+static inline struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
+		struct proc_dir_entry *parent, void *data, bool force_lookup)
+{
+	return NULL;
+}
 static inline struct proc_dir_entry *proc_mkdir_data(const char *name,
 	umode_t mode, struct proc_dir_entry *parent, void *data) { return NULL; }
 static inline struct proc_dir_entry *proc_mkdir_mode(const char *name,
@@ -199,7 +205,7 @@ struct net;
 static inline struct proc_dir_entry *proc_net_mkdir(
 	struct net *net, const char *name, struct proc_dir_entry *parent)
 {
-	return proc_mkdir_data(name, 0, parent, net);
+	return _proc_mkdir(name, 0, parent, net, true);
 }
 
 struct ns_common;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 459/717] checkpatch: fix unescaped left brace
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (457 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 458/717] proc: fix lookup in /proc/net subdirectories after setns(2) Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 460/717] s390/test_unwind: fix CALL_ON_STACK tests Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dwaipayan Ray, Joe Perches,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Dwaipayan Ray <dwaipayanray1@gmail.com>

[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]

There is an unescaped left brace in a regex in OPEN_BRACE check.  This
throws a runtime error when checkpatch is run with --fix flag and the
OPEN_BRACE check is executed.

Fix it by escaping the left brace.

Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
Acked-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index fab38b493cef7..0ad235ee96f91 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -4384,7 +4384,7 @@ sub process {
 			    $fix) {
 				fix_delete_line($fixlinenr, $rawline);
 				my $fixed_line = $rawline;
-				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
+				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
 				my $line1 = $1;
 				my $line2 = $2;
 				fix_insert_line($fixlinenr, ltrim($line1));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 460/717] s390/test_unwind: fix CALL_ON_STACK tests
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (458 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 459/717] checkpatch: fix unescaped left brace Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 461/717] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sasha Levin

From: Heiko Carstens <hca@linux.ibm.com>

[ Upstream commit f22b9c219a798e1bf11110a3d2733d883e6da059 ]

The CALL_ON_STACK tests use the no_dat stack to switch to a different
stack for unwinding tests. If an interrupt or machine check happens
while using that stack, and previously being on the async stack, the
interrupt / machine check entry code (SWITCH_ASYNC) will assume that
the previous context did not use the async stack and happily use the
async stack again.

This will lead to stack corruption of the previous context.

To solve this disable both interrupts and machine checks before
switching to the no_dat stack.

Fixes: 7868249fbbc8 ("s390/test_unwind: add CALL_ON_STACK tests")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/lib/test_unwind.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/s390/lib/test_unwind.c b/arch/s390/lib/test_unwind.c
index 7c988994931f0..6bad84c372dcb 100644
--- a/arch/s390/lib/test_unwind.c
+++ b/arch/s390/lib/test_unwind.c
@@ -205,12 +205,15 @@ static noinline int unwindme_func3(struct unwindme *u)
 /* This function must appear in the backtrace. */
 static noinline int unwindme_func2(struct unwindme *u)
 {
+	unsigned long flags;
 	int rc;
 
 	if (u->flags & UWM_SWITCH_STACK) {
-		preempt_disable();
+		local_irq_save(flags);
+		local_mcck_disable();
 		rc = CALL_ON_STACK(unwindme_func3, S390_lowcore.nodat_stack, 1, u);
-		preempt_enable();
+		local_mcck_enable();
+		local_irq_restore(flags);
 		return rc;
 	} else {
 		return unwindme_func3(u);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 461/717] lan743x: fix rx_napi_poll/interrupt ping-pong
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (459 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 460/717] s390/test_unwind: fix CALL_ON_STACK tests Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Van Asbroeck, Jakub Kicinski,
	Sasha Levin

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 57030a0b620f735bf557696e5ceb9f32c2b3bb8f ]

Even if there is more rx data waiting on the chip, the rx napi poll fn
will never run more than once - it will always read a few buffers, then
bail out and re-arm interrupts. Which results in ping-pong between napi
and interrupt.

This defeats the purpose of napi, and is bad for performance.

Fix by making the rx napi poll behave identically to other ethernet
drivers:
1. initialize rx napi polling with an arbitrary budget (64).
2. in the polling fn, return full weight if rx queue is not depleted,
   this tells the napi core to "keep polling".
3. update the rx tail ("ring the doorbell") once for every 8 processed
   rx ring buffers.

Thanks to Jakub Kicinski, Eric Dumazet and Andrew Lunn for their expert
opinions and suggestions.

Tested with 20 seconds of full bandwidth receive (iperf3):
        rx irqs      softirqs(NET_RX)
        -----------------------------
before  23827        33620
after   129          4081

Tested-by: Sven Van Asbroeck <thesven73@gmail.com> # lan7430
Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
Link: https://lore.kernel.org/r/20201215161954.5950-1-TheSven73@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index b319c22c211cd..8947c3a628109 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1962,6 +1962,14 @@ static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
 				  length, GFP_ATOMIC | GFP_DMA);
 }
 
+static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index)
+{
+	/* update the tail once per 8 descriptors */
+	if ((index & 7) == 7)
+		lan743x_csr_write(rx->adapter, RX_TAIL(rx->channel_number),
+				  index);
+}
+
 static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
 					struct sk_buff *skb)
 {
@@ -1992,6 +2000,7 @@ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
 			    (length & RX_DESC_DATA0_BUF_LENGTH_MASK_));
 	skb_reserve(buffer_info->skb, RX_HEAD_PADDING);
+	lan743x_rx_update_tail(rx, index);
 
 	return 0;
 }
@@ -2010,6 +2019,7 @@ static void lan743x_rx_reuse_ring_element(struct lan743x_rx *rx, int index)
 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
 			    ((buffer_info->buffer_length) &
 			    RX_DESC_DATA0_BUF_LENGTH_MASK_));
+	lan743x_rx_update_tail(rx, index);
 }
 
 static void lan743x_rx_release_ring_element(struct lan743x_rx *rx, int index)
@@ -2220,6 +2230,7 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 {
 	struct lan743x_rx *rx = container_of(napi, struct lan743x_rx, napi);
 	struct lan743x_adapter *adapter = rx->adapter;
+	int result = RX_PROCESS_RESULT_NOTHING_TO_DO;
 	u32 rx_tail_flags = 0;
 	int count;
 
@@ -2228,27 +2239,19 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 		lan743x_csr_write(adapter, DMAC_INT_STS,
 				  DMAC_INT_BIT_RXFRM_(rx->channel_number));
 	}
-	count = 0;
-	while (count < weight) {
-		int rx_process_result = lan743x_rx_process_packet(rx);
-
-		if (rx_process_result == RX_PROCESS_RESULT_PACKET_RECEIVED) {
-			count++;
-		} else if (rx_process_result ==
-			RX_PROCESS_RESULT_NOTHING_TO_DO) {
+	for (count = 0; count < weight; count++) {
+		result = lan743x_rx_process_packet(rx);
+		if (result == RX_PROCESS_RESULT_NOTHING_TO_DO)
 			break;
-		} else if (rx_process_result ==
-			RX_PROCESS_RESULT_PACKET_DROPPED) {
-			continue;
-		}
 	}
 	rx->frame_count += count;
-	if (count == weight)
-		goto done;
+	if (count == weight || result == RX_PROCESS_RESULT_PACKET_RECEIVED)
+		return weight;
 
 	if (!napi_complete_done(napi, count))
-		goto done;
+		return count;
 
+	/* re-arm interrupts, must write to rx tail on some chip variants */
 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET)
 		rx_tail_flags |= RX_TAIL_SET_TOP_INT_VEC_EN_;
 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET) {
@@ -2258,10 +2261,10 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 				  INT_BIT_DMA_RX_(rx->channel_number));
 	}
 
-	/* update RX_TAIL */
-	lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
-			  rx_tail_flags | rx->last_tail);
-done:
+	if (rx_tail_flags)
+		lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
+				  rx_tail_flags | rx->last_tail);
+
 	return count;
 }
 
@@ -2405,7 +2408,7 @@ static int lan743x_rx_open(struct lan743x_rx *rx)
 
 	netif_napi_add(adapter->netdev,
 		       &rx->napi, lan743x_rx_napi_poll,
-		       rx->ring_size - 1);
+		       NAPI_POLL_WEIGHT);
 
 	lan743x_csr_write(adapter, DMAC_CMD,
 			  DMAC_CMD_RX_SWR_(rx->channel_number));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (460 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 461/717] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 18:54   ` Jakub Kicinski
  2020-12-28 12:47 ` [PATCH 5.10 463/717] i40e, " Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Jakub Kicinski, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]

On the Rx side, the next_to_use index points to the next item in the
HW ring to be refilled/allocated, and next_to_clean points to the next
item to potentially be processed.

When the HW Rx ring is fully refilled, i.e. no packets has been
processed, the next_to_use will be next_to_clean - 1. When the ring is
fully processed next_to_clean will be equal to next_to_use. The latter
case is where a bug is triggered.

If the next_to_use bits are not cleared, and the "fully processed"
state is entered, a stale descriptor can be processed.

The skb-path correctly clear the status bit for the next_to_use
descriptor, but the AF_XDP zero-copy path did not do that.

This change adds the status bits clearing of the next_to_use
descriptor.

Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_xsk.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
index 797886524054c..98101a8e2952d 100644
--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
+++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
@@ -446,8 +446,11 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count)
 		}
 	} while (--count);
 
-	if (rx_ring->next_to_use != ntu)
+	if (rx_ring->next_to_use != ntu) {
+		/* clear the status bits for the next_to_use descriptor */
+		rx_desc->wb.status_error0 = 0;
 		ice_release_rx_desc(rx_ring, ntu);
+	}
 
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 463/717] i40e, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (461 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 464/717] net: dsa: qca: ar9331: fix sleeping function called from invalid context bug Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Jakub Kicinski, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 64050b5b8706d304ba647591b06e1eddc55e8bd9 ]

On the Rx side, the next_to_use index points to the next item in the
HW ring to be refilled/allocated, and next_to_clean points to the next
item to potentially be processed.

When the HW Rx ring is fully refilled, i.e. no packets has been
processed, the next_to_use will be next_to_clean - 1. When the ring is
fully processed next_to_clean will be equal to next_to_use. The latter
case is where a bug is triggered.

If the next_to_use bits are not cleared, and the "fully processed"
state is entered, a stale descriptor can be processed.

The skb-path correctly clear the status bit for the next_to_use
descriptor, but the AF_XDP zero-copy path did not do that.

This change adds the status bits clearing of the next_to_use
descriptor.

Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_xsk.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index 567fd67e900ef..e402c62eb3137 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -219,8 +219,11 @@ bool i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count)
 	} while (count);
 
 no_buffers:
-	if (rx_ring->next_to_use != ntu)
+	if (rx_ring->next_to_use != ntu) {
+		/* clear the status bits for the next_to_use descriptor */
+		rx_desc->wb.qword1.status_error_len = 0;
 		i40e_release_rx_desc(rx_ring, ntu);
+	}
 
 	return ok;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 464/717] net: dsa: qca: ar9331: fix sleeping function called from invalid context bug
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (462 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 463/717] i40e, " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 465/717] dpaa2-eth: fix the size of the mapped SGT buffer Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, Vladimir Oltean,
	Jakub Kicinski, Sasha Levin

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 3e47495fc4de4122598dd51ae8527b09b8209646 ]

With lockdep enabled, we will get following warning:

 ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:935
 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 18, name: kworker/0:1
 INFO: lockdep is turned off.
 irq event stamp: 602
 hardirqs last  enabled at (601): [<8073fde0>] _raw_spin_unlock_irq+0x3c/0x80
 hardirqs last disabled at (602): [<8073a4f4>] __schedule+0x184/0x800
 softirqs last  enabled at (0): [<80080f60>] copy_process+0x578/0x14c8
 softirqs last disabled at (0): [<00000000>] 0x0
 CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 5.10.0-rc3-ar9331-00734-g7d644991df0c #31
 Workqueue: events deferred_probe_work_func
 Stack : 80980000 80980000 8089ef70 80890000 804b5414 80980000 00000002 80b53728
         00000000 800d1268 804b5414 ffffffde 00000017 800afe08 81943860 0f5bfc32
         00000000 00000000 8089ef70 819436c0 ffffffea 00000000 00000000 00000000
         8194390c 808e353c 0000000f 66657272 80980000 00000000 00000000 80890000
         804b5414 80980000 00000002 80b53728 00000000 00000000 00000000 80d40000
         ...
 Call Trace:
 [<80069ce0>] show_stack+0x9c/0x140
 [<800afe08>] ___might_sleep+0x220/0x244
 [<8073bfb0>] __mutex_lock+0x70/0x374
 [<8073c2e0>] mutex_lock_nested+0x2c/0x38
 [<804b5414>] regmap_update_bits_base+0x38/0x8c
 [<804ee584>] regmap_update_bits+0x1c/0x28
 [<804ee714>] ar9331_sw_unmask_irq+0x34/0x60
 [<800d91f0>] unmask_irq+0x48/0x70
 [<800d93d4>] irq_startup+0x114/0x11c
 [<800d65b4>] __setup_irq+0x4f4/0x6d0
 [<800d68a0>] request_threaded_irq+0x110/0x190
 [<804e3ef0>] phy_request_interrupt+0x4c/0xe4
 [<804df508>] phylink_bringup_phy+0x2c0/0x37c
 [<804df7bc>] phylink_of_phy_connect+0x118/0x130
 [<806c1a64>] dsa_slave_create+0x3d0/0x578
 [<806bc4ec>] dsa_register_switch+0x934/0xa20
 [<804eef98>] ar9331_sw_probe+0x34c/0x364
 [<804eb48c>] mdio_probe+0x44/0x70
 [<8049e3b4>] really_probe+0x30c/0x4f4
 [<8049ea10>] driver_probe_device+0x264/0x26c
 [<8049bc10>] bus_for_each_drv+0xb4/0xd8
 [<8049e684>] __device_attach+0xe8/0x18c
 [<8049ce58>] bus_probe_device+0x48/0xc4
 [<8049db70>] deferred_probe_work_func+0xdc/0xf8
 [<8009ff64>] process_one_work+0x2e4/0x4a0
 [<800a0770>] worker_thread+0x2a8/0x354
 [<800a774c>] kthread+0x16c/0x174
 [<8006306c>] ret_from_kernel_thread+0x14/0x1c

 ar9331_switch ethernet.1:10 lan1 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:02] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
 DSA: tree 0 setup

To fix it, it is better to move access to MDIO register to the .irq_bus_sync_unlock
call back.

Fixes: ec6698c272de ("net: dsa: add support for Atheros AR9331 built-in switch")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://lore.kernel.org/r/20201211110317.17061-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/qca/ar9331.c | 33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c
index e24a99031b80f..4d49c5f2b7905 100644
--- a/drivers/net/dsa/qca/ar9331.c
+++ b/drivers/net/dsa/qca/ar9331.c
@@ -159,6 +159,8 @@ struct ar9331_sw_priv {
 	struct dsa_switch ds;
 	struct dsa_switch_ops ops;
 	struct irq_domain *irqdomain;
+	u32 irq_mask;
+	struct mutex lock_irq;
 	struct mii_bus *mbus; /* mdio master */
 	struct mii_bus *sbus; /* mdio slave */
 	struct regmap *regmap;
@@ -520,32 +522,44 @@ static irqreturn_t ar9331_sw_irq(int irq, void *data)
 static void ar9331_sw_mask_irq(struct irq_data *d)
 {
 	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
-	struct regmap *regmap = priv->regmap;
-	int ret;
 
-	ret = regmap_update_bits(regmap, AR9331_SW_REG_GINT_MASK,
-				 AR9331_SW_GINT_PHY_INT, 0);
-	if (ret)
-		dev_err(priv->dev, "could not mask IRQ\n");
+	priv->irq_mask = 0;
 }
 
 static void ar9331_sw_unmask_irq(struct irq_data *d)
+{
+	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
+
+	priv->irq_mask = AR9331_SW_GINT_PHY_INT;
+}
+
+static void ar9331_sw_irq_bus_lock(struct irq_data *d)
+{
+	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
+
+	mutex_lock(&priv->lock_irq);
+}
+
+static void ar9331_sw_irq_bus_sync_unlock(struct irq_data *d)
 {
 	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
 	struct regmap *regmap = priv->regmap;
 	int ret;
 
 	ret = regmap_update_bits(regmap, AR9331_SW_REG_GINT_MASK,
-				 AR9331_SW_GINT_PHY_INT,
-				 AR9331_SW_GINT_PHY_INT);
+				 AR9331_SW_GINT_PHY_INT, priv->irq_mask);
 	if (ret)
-		dev_err(priv->dev, "could not unmask IRQ\n");
+		dev_err(priv->dev, "failed to change IRQ mask\n");
+
+	mutex_unlock(&priv->lock_irq);
 }
 
 static struct irq_chip ar9331_sw_irq_chip = {
 	.name = AR9331_SW_NAME,
 	.irq_mask = ar9331_sw_mask_irq,
 	.irq_unmask = ar9331_sw_unmask_irq,
+	.irq_bus_lock = ar9331_sw_irq_bus_lock,
+	.irq_bus_sync_unlock = ar9331_sw_irq_bus_sync_unlock,
 };
 
 static int ar9331_sw_irq_map(struct irq_domain *domain, unsigned int irq,
@@ -584,6 +598,7 @@ static int ar9331_sw_irq_init(struct ar9331_sw_priv *priv)
 		return irq ? irq : -EINVAL;
 	}
 
+	mutex_init(&priv->lock_irq);
 	ret = devm_request_threaded_irq(dev, irq, NULL, ar9331_sw_irq,
 					IRQF_ONESHOT, AR9331_SW_NAME, priv);
 	if (ret) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 465/717] dpaa2-eth: fix the size of the mapped SGT buffer
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (463 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 464/717] net: dsa: qca: ar9331: fix sleeping function called from invalid context bug Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 466/717] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Thompson, Ioana Ciornei,
	Jakub Kicinski, Sasha Levin

From: Ioana Ciornei <ioana.ciornei@nxp.com>

[ Upstream commit 54a57d1c449275ee727154ac106ec1accae012e3 ]

This patch fixes an error condition triggered when the code path which
transmits a S/G frame descriptor when the skb's headroom is not enough
for DPAA2's needs.

We are greated with a splat like the one below when a SGT structure is
recycled and that is because even though a dma_unmap is performed on the
Tx confirmation path, the unmap is not done with the proper size.

[  714.464927] WARNING: CPU: 13 PID: 0 at drivers/iommu/io-pgtable-arm.c:281 __arm_lpae_map+0x2d4/0x30c
(...)
[  714.465343] Call trace:
[  714.465348]  __arm_lpae_map+0x2d4/0x30c
[  714.465353]  __arm_lpae_map+0x114/0x30c
[  714.465357]  __arm_lpae_map+0x114/0x30c
[  714.465362]  __arm_lpae_map+0x114/0x30c
[  714.465366]  arm_lpae_map+0xf4/0x180
[  714.465373]  arm_smmu_map+0x4c/0xc0
[  714.465379]  __iommu_map+0x100/0x2bc
[  714.465385]  iommu_map_atomic+0x20/0x30
[  714.465391]  __iommu_dma_map+0xb0/0x110
[  714.465397]  iommu_dma_map_page+0xb8/0x120
[  714.465404]  dma_map_page_attrs+0x1a8/0x210
[  714.465413]  __dpaa2_eth_tx+0x384/0xbd0 [fsl_dpaa2_eth]
[  714.465421]  dpaa2_eth_tx+0x84/0x134 [fsl_dpaa2_eth]
[  714.465427]  dev_hard_start_xmit+0x10c/0x2b0
[  714.465433]  sch_direct_xmit+0x1a0/0x550
(...)

The dpaa2-eth driver uses an area of software annotations to transmit
necessary information from the Tx path to the Tx confirmation one. This
SWA structure has a different layout for each kind of frame that we are
dealing with: linear, S/G or XDP.

The commit referenced was incorrectly setting up the 'sgt_size' field
for the S/G type of SWA even though we are dealing with a linear skb
here.

Fixes: d70446ee1f40 ("dpaa2-eth: send a scatter-gather FD instead of realloc-ing")
Reported-by: Daniel Thompson <daniel.thompson@linaro.org>
Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20201211171607.108034-1-ciorneiioana@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index cf9400a9886d7..d880ab2a7d962 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -878,7 +878,7 @@ static int dpaa2_eth_build_sg_fd_single_buf(struct dpaa2_eth_priv *priv,
 	swa = (struct dpaa2_eth_swa *)sgt_buf;
 	swa->type = DPAA2_ETH_SWA_SINGLE;
 	swa->single.skb = skb;
-	swa->sg.sgt_size = sgt_buf_size;
+	swa->single.sgt_size = sgt_buf_size;
 
 	/* Separately map the SGT buffer */
 	sgt_addr = dma_map_single(dev, sgt_buf, sgt_buf_size, DMA_BIDIRECTIONAL);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 466/717] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (464 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 465/717] dpaa2-eth: fix the size of the mapped SGT buffer Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 467/717] net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Florian Fainelli,
	Jakub Kicinski, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]

If the 'register_netdev()' call fails, we must undo a previous
'bcmgenet_mii_init()' call.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index be85dad2e3bc4..fcca023f22e54 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -4069,8 +4069,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
 	clk_disable_unprepare(priv->clk);
 
 	err = register_netdev(dev);
-	if (err)
+	if (err) {
+		bcmgenet_mii_exit(dev);
 		goto err;
+	}
 
 	return err;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 467/717] net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (465 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 466/717] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 468/717] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Alexandre Belloni, Jakub Kicinski, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit f87675b836b324d270fd52f1f5e6d6bb9f4bd1d5 ]

In case of error after calling 'ocelot_init()', it must be undone by a
corresponding 'ocelot_deinit()' call, as already done in the remove
function.

Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201213114838.126922-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mscc/ocelot_vsc7514.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mscc/ocelot_vsc7514.c b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
index 1e7729421a825..9cf2bc5f42892 100644
--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
@@ -1267,7 +1267,7 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
 
 	err = mscc_ocelot_init_ports(pdev, ports);
 	if (err)
-		goto out_put_ports;
+		goto out_ocelot_deinit;
 
 	if (ocelot->ptp) {
 		err = ocelot_init_timestamp(ocelot, &ocelot_ptp_clock_info);
@@ -1282,8 +1282,14 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
 	register_switchdev_notifier(&ocelot_switchdev_nb);
 	register_switchdev_blocking_notifier(&ocelot_switchdev_blocking_nb);
 
+	of_node_put(ports);
+
 	dev_info(&pdev->dev, "Ocelot switch probed\n");
 
+	return 0;
+
+out_ocelot_deinit:
+	ocelot_deinit(ocelot);
 out_put_ports:
 	of_node_put(ports);
 	return err;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 468/717] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (466 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 467/717] net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 469/717] block/rnbd-clt: Get rid of warning regarding size argument in strlcpy Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Jakub Kicinski,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]

'irq_of_parse_and_map()' should be balanced by a corresponding
'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.

Add such a call in the error handling path of the probe function and in the
remove function.

Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 862ea44beea77..5ed80d9a6b9fe 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -828,13 +828,13 @@ static int emac_probe(struct platform_device *pdev)
 	db->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(db->clk)) {
 		ret = PTR_ERR(db->clk);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = clk_prepare_enable(db->clk);
 	if (ret) {
 		dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = sunxi_sram_claim(&pdev->dev);
@@ -893,6 +893,8 @@ out_release_sram:
 	sunxi_sram_release(&pdev->dev);
 out_clk_disable_unprepare:
 	clk_disable_unprepare(db->clk);
+out_dispose_mapping:
+	irq_dispose_mapping(ndev->irq);
 out_iounmap:
 	iounmap(db->membase);
 out:
@@ -911,6 +913,7 @@ static int emac_remove(struct platform_device *pdev)
 	unregister_netdev(ndev);
 	sunxi_sram_release(&pdev->dev);
 	clk_disable_unprepare(db->clk);
+	irq_dispose_mapping(ndev->irq);
 	iounmap(db->membase);
 	free_netdev(ndev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 469/717] block/rnbd-clt: Get rid of warning regarding size argument in strlcpy
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (467 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 468/717] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 470/717] block/rnbd-clt: Fix possible memleak Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Md Haris Iqbal,
	Jack Wang, Jens Axboe, Sasha Levin

From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>

[ Upstream commit e7508d48565060af5d89f10cb83c9359c8ae1310 ]

The kernel test robot triggerred the following warning,

>> drivers/block/rnbd/rnbd-clt.c:1397:42: warning: size argument in
'strlcpy' call appears to be size of the source; expected the size of the
destination [-Wstrlcpy-strlcat-size]
	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
					      ~~~~~~~^~~~~~~~~~~~~

To get rid of the above warning, use a kstrdup as Bart suggested.

Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rnbd/rnbd-clt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
index f180ebf1e11c9..7af1b60582fe5 100644
--- a/drivers/block/rnbd/rnbd-clt.c
+++ b/drivers/block/rnbd/rnbd-clt.c
@@ -1383,12 +1383,11 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
 		goto out_queues;
 	}
 
-	dev->pathname = kzalloc(strlen(pathname) + 1, GFP_KERNEL);
+	dev->pathname = kstrdup(pathname, GFP_KERNEL);
 	if (!dev->pathname) {
 		ret = -ENOMEM;
 		goto out_queues;
 	}
-	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
 
 	dev->clt_device_id	= ret;
 	dev->sess		= sess;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 470/717] block/rnbd-clt: Fix possible memleak
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (468 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 469/717] block/rnbd-clt: Get rid of warning regarding size argument in strlcpy Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 471/717] NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read() Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Wang, Md Haris Iqbal,
	Jens Axboe, Sasha Levin

From: Jack Wang <jinpu.wang@cloud.ionos.com>

[ Upstream commit 46067844efdb8275ade705923120fc5391543b53 ]

In error case, we do not free the memory for blk_symlink_name.

Do it by free the memory in error case, and set to NULL
afterwards.

Also fix the condition in rnbd_clt_remove_dev_symlink.

Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rnbd/rnbd-clt-sysfs.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
index d854f057056bb..d9dd138ca9c64 100644
--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
+++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
@@ -433,7 +433,7 @@ void rnbd_clt_remove_dev_symlink(struct rnbd_clt_dev *dev)
 	 * i.e. rnbd_clt_unmap_dev_store() leading to a sysfs warning because
 	 * of sysfs link already was removed already.
 	 */
-	if (strlen(dev->blk_symlink_name) && try_module_get(THIS_MODULE)) {
+	if (dev->blk_symlink_name && try_module_get(THIS_MODULE)) {
 		sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name);
 		kfree(dev->blk_symlink_name);
 		module_put(THIS_MODULE);
@@ -516,7 +516,8 @@ static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
 	return 0;
 
 out_err:
-	dev->blk_symlink_name[0] = '\0';
+	kfree(dev->blk_symlink_name);
+	dev->blk_symlink_name = NULL ;
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 471/717] NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (469 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 470/717] block/rnbd-clt: Fix possible memleak Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 472/717] net: korina: fix return value Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 52104f274e2d7f134d34bab11cada8913d4544e2 ]

Don't bump the index twice.

Fixes: 563c53e73b8b ("NFS: Fix flexfiles read failover")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 24bf5797f88ae..fd0eda328943b 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1056,7 +1056,7 @@ static void ff_layout_resend_pnfs_read(struct nfs_pgio_header *hdr)
 	u32 idx = hdr->pgio_mirror_idx + 1;
 	u32 new_idx = 0;
 
-	if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx + 1, &new_idx))
+	if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx, &new_idx))
 		ff_layout_send_layouterror(hdr->lseg);
 	else
 		pnfs_error_mark_layout_for_return(hdr->inode, hdr->lseg);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 472/717] net: korina: fix return value
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (470 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 471/717] NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 473/717] devlink: use _BITUL() macro instead of BIT() in the UAPI header Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Vincent Stehlé,
	Florian Fainelli, Sasha Levin

From: Vincent Stehlé <vincent.stehle@laposte.net>

[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]

The ndo_start_xmit() method must not attempt to free the skb to transmit
when returning NETDEV_TX_BUSY. Therefore, make sure the
korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.

Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/korina.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index bf48f0ded9c7d..925161959b9ba 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
 			dev_kfree_skb_any(skb);
 			spin_unlock_irqrestore(&lp->lock, flags);
 
-			return NETDEV_TX_BUSY;
+			return NETDEV_TX_OK;
 		}
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 473/717] devlink: use _BITUL() macro instead of BIT() in the UAPI header
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (471 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 472/717] net: korina: fix return value Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 474/717] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tobias Klauser, Jakub Kicinski, Sasha Levin

From: Tobias Klauser <tklauser@distanz.ch>

[ Upstream commit 75f4d4544db9fa34e1f04174f27d9f8a387be37d ]

The BIT() macro is not available for the UAPI headers. Moreover, it can
be defined differently in user space headers. Thus, replace its usage
with the _BITUL() macro which is already used in other macro definitions
in <linux/devlink.h>.

Fixes: dc64cc7c6310 ("devlink: Add devlink reload limit option")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Link: https://lore.kernel.org/r/20201215102531.16958-1-tklauser@distanz.ch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/devlink.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 5203f54a2be1c..cf89c318f2ac9 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -322,7 +322,7 @@ enum devlink_reload_limit {
 	DEVLINK_RELOAD_LIMIT_MAX = __DEVLINK_RELOAD_LIMIT_MAX - 1
 };
 
-#define DEVLINK_RELOAD_LIMITS_VALID_MASK (BIT(__DEVLINK_RELOAD_LIMIT_MAX) - 1)
+#define DEVLINK_RELOAD_LIMITS_VALID_MASK (_BITUL(__DEVLINK_RELOAD_LIMIT_MAX) - 1)
 
 enum devlink_attr {
 	/* don't change the order or add anything between, this is ABI! */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 474/717] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (472 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 473/717] devlink: use _BITUL() macro instead of BIT() in the UAPI header Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 475/717] powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dan Williams, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ]

Forget to set error code when nd_label_alloc_slot failed, and we
add it to avoid overwritten error code.

Fixes: 0ba1c634892b ("libnvdimm: write blk label set")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201205115056.2076523-1-zhangqilong3@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/label.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
index 47a4828b8b310..05c1f186a6be8 100644
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -999,8 +999,10 @@ static int __blk_label_update(struct nd_region *nd_region,
 		if (is_old_resource(res, old_res_list, old_num_resources))
 			continue; /* carry-over */
 		slot = nd_label_alloc_slot(ndd);
-		if (slot == UINT_MAX)
+		if (slot == UINT_MAX) {
+			rc = -ENXIO;
 			goto abort;
+		}
 		dev_dbg(ndd->dev, "allocated: %d\n", slot);
 
 		nd_label = to_label(ndd, slot);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 475/717] powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (473 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 474/717] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 476/717] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Nicholas Piggin,
	Michael Ellerman, Sasha Levin

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit c1bea0a840ac75dca19bc6aa05575a33eb9fd058 ]

Currently pmac32_defconfig with SMP=y doesn't build:

  arch/powerpc/platforms/powermac/smp.c:
  error: implicit declaration of function 'cleanup_cpu_mmu_context'

It would be nice for consistency if all platforms clear mm_cpumask and
flush TLBs on unplug, but the TLB invalidation bug described in commit
01b0f0eae081 ("powerpc/64s: Trim offlined CPUs from mm_cpumasks") only
applies to 64s and for now we only have the TLB flush code for that
platform.

So just add an empty version for 32-bit Book3S.

Fixes: 01b0f0eae081 ("powerpc/64s: Trim offlined CPUs from mm_cpumasks")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[mpe: Change log based on comments from Nick]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/book3s/32/mmu-hash.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/include/asm/book3s/32/mmu-hash.h b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
index 2e277ca0170fb..a8982d52f6b1d 100644
--- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
@@ -94,6 +94,7 @@ typedef struct {
 } mm_context_t;
 
 void update_bats(void);
+static inline void cleanup_cpu_mmu_context(void) { };
 
 /* patch sites */
 extern s32 patch__hash_page_A0, patch__hash_page_A1, patch__hash_page_A2;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 476/717] watchdog: qcom: Avoid context switch in restart handler
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (474 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 475/717] powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 477/717] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]

The use of msleep() in the restart handler will cause scheduler to
induce a context switch which is not desirable. This generates below
warning on SDX55 when WDT is the only available restart source:

[   39.800188] reboot: Restarting system
[   39.804115] ------------[ cut here ]------------
[   39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764
[   39.812538] Modules linked in:
[   39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47
[   39.824854] Hardware name: Generic DT based system
[   39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14)
[   39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0)
[   39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0)
[   39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8)
[   39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764)
[   39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640)
[   39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c)
[   39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4)
[   39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38)
[   39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc)
[   39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28)
[   39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84)
[   39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c)
[   39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0)
[   39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54)
[   39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0)
[   39.958855] bfa0:                   0001221c bed2fe24 fee1dead 28121969 01234567 00000000
[   39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000
[   39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580
[   39.980124] ---[ end trace 3f578288bad866e4 ]---

Hence, replace msleep() with mdelay() to fix this issue.

Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/qcom-wdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
index ab7465d186fda..cdf754233e53d 100644
--- a/drivers/watchdog/qcom-wdt.c
+++ b/drivers/watchdog/qcom-wdt.c
@@ -148,7 +148,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
 	 */
 	wmb();
 
-	msleep(150);
+	mdelay(150);
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 477/717] watchdog: coh901327: add COMMON_CLK dependency
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (475 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 476/717] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 478/717] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]

clang produces a build failure in configurations without COMMON_CLK
when a timeout calculation goes wrong:

arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'

Add a Kconfig dependency to only do build testing when COMMON_CLK
is enabled.

Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index f8e9be65036ae..db935d6b10c27 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -632,7 +632,7 @@ config SUNXI_WATCHDOG
 
 config COH901327_WATCHDOG
 	bool "ST-Ericsson COH 901 327 watchdog"
-	depends on ARCH_U300 || (ARM && COMPILE_TEST)
+	depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
 	default y if MACH_U300
 	select WATCHDOG_CORE
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 478/717] clk: ti: Fix memleak in ti_fapll_synth_setup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (476 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 477/717] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 479/717] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong,
	Tony Lindgren, Stephen Boyd, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]

If clk_register fails, we should goto free branch
before function returns to prevent memleak.

Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/fapll.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 95e36ba64accf..8024c6d2b9e95 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -498,6 +498,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 {
 	struct clk_init_data *init;
 	struct fapll_synth *synth;
+	struct clk *clk = ERR_PTR(-ENOMEM);
 
 	init = kzalloc(sizeof(*init), GFP_KERNEL);
 	if (!init)
@@ -520,13 +521,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 	synth->hw.init = init;
 	synth->clk_pll = pll_clk;
 
-	return clk_register(NULL, &synth->hw);
+	clk = clk_register(NULL, &synth->hw);
+	if (IS_ERR(clk)) {
+		pr_err("failed to register clock\n");
+		goto free;
+	}
+
+	return clk;
 
 free:
 	kfree(synth);
 	kfree(init);
 
-	return ERR_PTR(-ENOMEM);
+	return clk;
 }
 
 static void __init ti_fapll_setup(struct device_node *node)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 479/717] pwm: zx: Add missing cleanup in error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (477 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 478/717] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.10 481/717] pwm: imx27: Fix overflow for bigger periods Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Shawn Guo,
	Thierry Reding, Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]

zx_pwm_probe() called clk_prepare_enable() before; this must be undone
in the error path.

Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-zx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
index e2c21cc34a96a..3763ce5311ac2 100644
--- a/drivers/pwm/pwm-zx.c
+++ b/drivers/pwm/pwm-zx.c
@@ -238,6 +238,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
 	ret = pwmchip_add(&zpc->chip);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
+		clk_disable_unprepare(zpc->pclk);
 		return ret;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 481/717] pwm: imx27: Fix overflow for bigger periods
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (478 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 479/717] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 482/717] pwm: sun4i: Remove erroneous else branch Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
	Johannes Pointner, Thierry Reding, Sasha Levin

From: Uwe Kleine-König <uwe@kleine-koenig.org>

[ Upstream commit 1ce65396e6b2386b4fd54f87beff0647a772e1cd ]

The second parameter of do_div is an u32 and NSEC_PER_SEC * prescale
overflows this for bigger periods. Assuming the usual pwm input clk rate
of 66 MHz this happens starting at requested period > 606060 ns.

Splitting the division into two operations doesn't loose any precision.
It doesn't need to be feared that c / NSEC_PER_SEC doesn't fit into the
unsigned long variable "duty_cycles" because in this case the assignment
above to period_cycles would already have been overflowing as
period >= duty_cycle and then the calculation is moot anyhow.

Fixes: aef1a3799b5c ("pwm: imx27: Fix rounding behavior")
Signed-off-by: Uwe Kleine-König <uwe@kleine-koenig.org>
Tested-by: Johannes Pointner <johannes.pointner@br-automation.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-imx27.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-imx27.c b/drivers/pwm/pwm-imx27.c
index c50d453552bd4..86bcafd23e4f6 100644
--- a/drivers/pwm/pwm-imx27.c
+++ b/drivers/pwm/pwm-imx27.c
@@ -235,8 +235,9 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 
 	period_cycles /= prescale;
 	c = clkrate * state->duty_cycle;
-	do_div(c, NSEC_PER_SEC * prescale);
+	do_div(c, NSEC_PER_SEC);
 	duty_cycles = c;
+	duty_cycles /= prescale;
 
 	/*
 	 * according to imx pwm RM, the real period value should be PERIOD
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 482/717] pwm: sun4i: Remove erroneous else branch
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (479 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.10 481/717] pwm: imx27: Fix overflow for bigger periods Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 483/717] io_uring: cancel only requests of current task Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Taras Galchenko,
	Uwe Kleine-König, Thierry Reding, Sasha Levin

From: Thierry Reding <thierry.reding@gmail.com>

[ Upstream commit 6eefb79d6f5bc4086bd02c76f1072dd4a8d9d9f6 ]

Commit d3817a647059 ("pwm: sun4i: Remove redundant needs_delay") changed
the logic of an else branch so that the PWM_EN and PWM_CLK_GATING bits
are now cleared if the PWM is to be disabled, whereas previously the
condition was always false, and hence the branch never got executed.

This code is reported causing backlight issues on boards based on the
Allwinner A20 SoC. Fix this by removing the else branch, which restores
the behaviour prior to the offending commit.

Note that the PWM_EN and PWM_CLK_GATING bits still get cleared later in
sun4i_pwm_apply() if the PWM is to be disabled.

Fixes: d3817a647059 ("pwm: sun4i: Remove redundant needs_delay")
Reported-by: Taras Galchenko <tpgalchenko@gmail.com>
Suggested-by: Taras Galchenko <tpgalchenko@gmail.com>
Tested-by: Taras Galchenko <tpgalchenko@gmail.com>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-sun4i.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/pwm/pwm-sun4i.c b/drivers/pwm/pwm-sun4i.c
index 38a4c5c1317b2..482d5b9cec1fb 100644
--- a/drivers/pwm/pwm-sun4i.c
+++ b/drivers/pwm/pwm-sun4i.c
@@ -294,12 +294,8 @@ static int sun4i_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 
 	ctrl |= BIT_CH(PWM_CLK_GATING, pwm->hwpwm);
 
-	if (state->enabled) {
+	if (state->enabled)
 		ctrl |= BIT_CH(PWM_EN, pwm->hwpwm);
-	} else {
-		ctrl &= ~BIT_CH(PWM_EN, pwm->hwpwm);
-		ctrl &= ~BIT_CH(PWM_CLK_GATING, pwm->hwpwm);
-	}
 
 	sun4i_pwm_writel(sun4i_pwm, ctrl, PWM_CTRL_REG);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 483/717] io_uring: cancel only requests of current task
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (480 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 482/717] pwm: sun4i: Remove erroneous else branch Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 484/717] tools build: Add missing libcap to test-all.bin target Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe, Sasha Levin

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit df9923f96717d0aebb0a73adbcf6285fa79e38cb ]

io_uring_cancel_files() cancels all request that match files regardless
of task. There is no real need in that, cancel only requests of the
specified task. That also handles SQPOLL case as it already changes task
to it.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 23 +++++------------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 86dac2b2e2763..0621f581943cd 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8421,14 +8421,6 @@ static int io_uring_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static bool io_wq_files_match(struct io_wq_work *work, void *data)
-{
-	struct files_struct *files = data;
-
-	return !files || ((work->flags & IO_WQ_WORK_FILES) &&
-				work->identity->files == files);
-}
-
 /*
  * Returns true if 'preq' is the link parent of 'req'
  */
@@ -8566,21 +8558,20 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx,
  * Returns true if we found and killed one or more files pinning requests
  */
 static bool io_uring_cancel_files(struct io_ring_ctx *ctx,
+				  struct task_struct *task,
 				  struct files_struct *files)
 {
 	if (list_empty_careful(&ctx->inflight_list))
 		return false;
 
-	/* cancel all at once, should be faster than doing it one by one*/
-	io_wq_cancel_cb(ctx->io_wq, io_wq_files_match, files, true);
-
 	while (!list_empty_careful(&ctx->inflight_list)) {
 		struct io_kiocb *cancel_req = NULL, *req;
 		DEFINE_WAIT(wait);
 
 		spin_lock_irq(&ctx->inflight_lock);
 		list_for_each_entry(req, &ctx->inflight_list, inflight_entry) {
-			if (files && (req->work.flags & IO_WQ_WORK_FILES) &&
+			if (req->task == task &&
+			    (req->work.flags & IO_WQ_WORK_FILES) &&
 			    req->work.identity->files != files)
 				continue;
 			/* req is being completed, ignore */
@@ -8623,7 +8614,7 @@ static bool __io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
 {
 	bool ret;
 
-	ret = io_uring_cancel_files(ctx, files);
+	ret = io_uring_cancel_files(ctx, task, files);
 	if (!files) {
 		enum io_wq_cancel cret;
 
@@ -8662,11 +8653,7 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
 		io_sq_thread_park(ctx->sq_data);
 	}
 
-	if (files)
-		io_cancel_defer_files(ctx, NULL, files);
-	else
-		io_cancel_defer_files(ctx, task, NULL);
-
+	io_cancel_defer_files(ctx, task, files);
 	io_cqring_overflow_flush(ctx, true, task, files);
 
 	while (__io_uring_cancel_task_requests(ctx, task, files)) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 484/717] tools build: Add missing libcap to test-all.bin target
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (481 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 483/717] io_uring: cancel only requests of current task Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 485/717] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Alexander Shishkin,
	Ian Rogers, Igor Lubashev, Mark Rutland, Michael Petlan,
	Namhyung Kim, Peter Zijlstra, Stephane Eranian,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Jiri Olsa <jolsa@kernel.org>

[ Upstream commit 09d59c2f3465fb01e65a0c96698697b026ea8e79 ]

We're missing -lcap in test-all.bin target, so in case it's the only
library missing (if more are missing test-all.bin fails anyway), we will
falsely claim that we detected it and fail build, like:

  $ make
  ...
  Auto-detecting system features:
  ...                         dwarf: [ on  ]
  ...            dwarf_getlocations: [ on  ]
  ...                         glibc: [ on  ]
  ...                        libbfd: [ on  ]
  ...                libbfd-buildid: [ on  ]
  ...                        libcap: [ on  ]
  ...                        libelf: [ on  ]
  ...                       libnuma: [ on  ]
  ...        numa_num_possible_cpus: [ on  ]
  ...                       libperl: [ on  ]
  ...                     libpython: [ on  ]
  ...                     libcrypto: [ on  ]
  ...                     libunwind: [ on  ]
  ...            libdw-dwarf-unwind: [ on  ]
  ...                          zlib: [ on  ]
  ...                          lzma: [ on  ]
  ...                     get_cpuid: [ on  ]
  ...                           bpf: [ on  ]
  ...                        libaio: [ on  ]
  ...                       libzstd: [ on  ]
  ...        disassembler-four-args: [ on  ]

  ...

    CC       builtin-ftrace.o

  In file included from builtin-ftrace.c:29:
  util/cap.h:11:10: fatal error: sys/capability.h: No such file or directory
     11 | #include <sys/capability.h>
        |          ^~~~~~~~~~~~~~~~~~
  compilation terminated.

Fixes: 74d5f3d06f707eb5 ("tools build: Add capability-related feature detection")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Igor Lubashev <ilubashe@akamai.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lore.kernel.org/lkml/20201203230836.3751981-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/build/feature/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index cdde783f3018b..89ba522e377dc 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -90,7 +90,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$(
 ###############################
 
 $(OUTPUT)test-all.bin:
-	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd
+	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd -lcap
 
 $(OUTPUT)test-hello.bin:
 	$(BUILD)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 485/717] perf record: Fix memory leak when using --user-regs=? to list registers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (482 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 484/717] tools build: Add missing libcap to test-all.bin target Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 486/717] qlcnic: Fix error code in probe Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zheng Zengkai, Jiri Olsa,
	Alexander Shishkin, Li Bin, Mark Rutland, Namhyung Kim,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Zheng Zengkai <zhengzengkai@huawei.com>

[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]

When using 'perf record's option '-I' or '--user-regs=' along with
argument '?' to list available register names, memory of variable 'os'
allocated by strdup() needs to be released before __parse_regs()
returns, otherwise memory leak will occur.

Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/parse-regs-options.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
index e687497b3aac0..a4a100425b3a2 100644
--- a/tools/perf/util/parse-regs-options.c
+++ b/tools/perf/util/parse-regs-options.c
@@ -54,7 +54,7 @@ __parse_regs(const struct option *opt, const char *str, int unset, bool intr)
 #endif
 				fputc('\n', stderr);
 				/* just printing available regs */
-				return -1;
+				goto error;
 			}
 #ifdef HAVE_PERF_REGS_SUPPORT
 			for (r = sample_reg_masks; r->name; r++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 486/717] qlcnic: Fix error code in probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (483 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 485/717] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 487/717] nfp: move indirect block cleanup to flower app stop callback Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jakub Kicinski, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]

Return -EINVAL if we can't find the correct device.  Currently it
returns success.

Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 5a7e240fd4698..c2faf96fcade8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2492,6 +2492,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		qlcnic_sriov_vf_register_map(ahw);
 		break;
 	default:
+		err = -EINVAL;
 		goto err_out_free_hw_res;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 487/717] nfp: move indirect block cleanup to flower app stop callback
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (484 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 486/717] qlcnic: Fix error code in probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 488/717] vdpa/mlx5: Use write memory barrier after updating CQ index Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Horman, Louis Peens,
	Jakub Kicinski, Sasha Levin

From: Simon Horman <simon.horman@netronome.com>

[ Upstream commit 5b33afee93a1e7665a5ffae027fc66f9376f4ea7 ]

The indirect block cleanup may cause control messages to be sent
if offloaded flows are present. However, by the time the flower app
cleanup callback is called txbufs are no longer available and attempts
to send control messages result in a NULL-pointer dereference in
nfp_ctrl_tx_one().

This problem may be resolved by moving the indirect block cleanup
to the stop callback, where txbufs are still available.

As suggested by Jakub Kicinski and Louis Peens.

Fixes: a1db217861f3 ("net: flow_offload: fix flow_indr_dev_unregister path")
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Louis Peens <louis.peens@netronome.com>
Link: https://lore.kernel.org/r/20201216145701.30005-1-simon.horman@netronome.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/netronome/nfp/flower/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index bb448c82cdc28..c029950a81e20 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -860,9 +860,6 @@ static void nfp_flower_clean(struct nfp_app *app)
 	skb_queue_purge(&app_priv->cmsg_skbs_low);
 	flush_work(&app_priv->cmsg_work);
 
-	flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
-				 nfp_flower_setup_indr_tc_release);
-
 	if (app_priv->flower_ext_feats & NFP_FL_FEATS_VF_RLIM)
 		nfp_flower_qos_cleanup(app);
 
@@ -951,6 +948,9 @@ static int nfp_flower_start(struct nfp_app *app)
 static void nfp_flower_stop(struct nfp_app *app)
 {
 	nfp_tunnel_config_stop(app);
+
+	flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
+				 nfp_flower_setup_indr_tc_release);
 }
 
 static int
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 488/717] vdpa/mlx5: Use write memory barrier after updating CQ index
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (485 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 487/717] nfp: move indirect block cleanup to flower app stop callback Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 489/717] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eli Cohen, Michael S. Tsirkin, Sasha Levin

From: Eli Cohen <elic@nvidia.com>

[ Upstream commit 83ef73b27eb2363f44faf9c3ee28a3fe752cfd15 ]

Make sure to put dma write memory barrier after updating CQ consumer
index so the hardware knows that there are available CQE slots in the
queue.

Failure to do this can cause the update of the RX doorbell record to get
updated before the CQ consumer index resulting in CQ overrun.

Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
Signed-off-by: Eli Cohen <elic@nvidia.com>
Link: https://lore.kernel.org/r/20201209140004.15892-1-elic@nvidia.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vdpa/mlx5/net/mlx5_vnet.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 1fa6fcac82992..81b932f72e103 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -464,6 +464,11 @@ static int mlx5_vdpa_poll_one(struct mlx5_vdpa_cq *vcq)
 static void mlx5_vdpa_handle_completions(struct mlx5_vdpa_virtqueue *mvq, int num)
 {
 	mlx5_cq_set_ci(&mvq->cq.mcq);
+
+	/* make sure CQ cosumer update is visible to the hardware before updating
+	 * RX doorbell record.
+	 */
+	dma_wmb();
 	rx_post(&mvq->vqqp, num);
 	if (mvq->event_cb.callback)
 		mvq->event_cb.callback(mvq->event_cb.private);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 489/717] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (486 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 488/717] vdpa/mlx5: Use write memory barrier after updating CQ index Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 490/717] virtio_net: Fix error code in probe() Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ae93d8ea0fa701e84ab9df0db9fb60ec6c80d7b8 ]

There is a copy and paste bug in the error handling of this code and
it uses "ring_dma_addr" three times instead of "device_event_dma_addr"
and "driver_event_dma_addr".

Fixes: 1ce9e6055fa0 (" virtio_ring: introduce packed ring support")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGRJlEzyn+04u2@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index becc776979602..924b6b85376bd 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1676,9 +1676,9 @@ err_desc_extra:
 err_desc_state:
 	kfree(vq);
 err_vq:
-	vring_free_queue(vdev, event_size_in_bytes, device, ring_dma_addr);
+	vring_free_queue(vdev, event_size_in_bytes, device, device_event_dma_addr);
 err_device:
-	vring_free_queue(vdev, event_size_in_bytes, driver, ring_dma_addr);
+	vring_free_queue(vdev, event_size_in_bytes, driver, driver_event_dma_addr);
 err_driver:
 	vring_free_queue(vdev, ring_size_in_bytes, ring, ring_dma_addr);
 err_ring:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 490/717] virtio_net: Fix error code in probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (487 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 489/717] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 491/717] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 411ea23a76526e6efed0b601abb603d3c981b333 ]

Set a negative error code intead of returning success if the MTU has
been changed to something invalid.

Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGVJSeeCdII1Ys@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/virtio_net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 21b71148c5324..34bb95dd92392 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3072,6 +3072,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 			dev_err(&vdev->dev,
 				"device MTU appears to have changed it is now %d < %d",
 				mtu, dev->min_mtu);
+			err = -EINVAL;
 			goto free;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 491/717] virtio_ring: Fix two use after free bugs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (488 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 490/717] virtio_net: Fix error code in probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 492/717] vhost scsi: fix error return code in vhost_scsi_set_endpoint() Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit e152d8af4220a05c9797591609151d404866beaa ]

The "vq" struct is added to the "vdev->vqs" list prematurely.  If we
encounter an error later in the function then the "vq" is freed, but
since it is still on the list that could lead to a use after free bug.

Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 924b6b85376bd..71e16b53e9c18 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1608,7 +1608,6 @@ static struct virtqueue *vring_create_virtqueue_packed(
 	vq->num_added = 0;
 	vq->packed_ring = true;
 	vq->use_dma_api = vring_use_dma_api(vdev);
-	list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
 	vq->in_use = false;
 	vq->last_add_time_valid = false;
@@ -1669,6 +1668,7 @@ static struct virtqueue *vring_create_virtqueue_packed(
 			cpu_to_le16(vq->packed.event_flags_shadow);
 	}
 
+	list_add_tail(&vq->vq.list, &vdev->vqs);
 	return &vq->vq;
 
 err_desc_extra:
@@ -2085,7 +2085,6 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
 	vq->last_used_idx = 0;
 	vq->num_added = 0;
 	vq->use_dma_api = vring_use_dma_api(vdev);
-	list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
 	vq->in_use = false;
 	vq->last_add_time_valid = false;
@@ -2127,6 +2126,7 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
 	memset(vq->split.desc_state, 0, vring.num *
 			sizeof(struct vring_desc_state_split));
 
+	list_add_tail(&vq->vq.list, &vdev->vqs);
 	return &vq->vq;
 }
 EXPORT_SYMBOL_GPL(__vring_new_virtqueue);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 492/717] vhost scsi: fix error return code in vhost_scsi_set_endpoint()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (489 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 491/717] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 493/717] epoll: check for events when removing a timed out thread from the wait queue Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Michael S. Tsirkin, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 2e1139d613c7fb0956e82f72a8281c0a475ad4f8 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607071411-33484-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vhost/scsi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 6ff8a50966915..4ce9f00ae10e8 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1643,7 +1643,8 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
 			if (!vhost_vq_is_setup(vq))
 				continue;
 
-			if (vhost_scsi_setup_vq_cmds(vq, vq->num))
+			ret = vhost_scsi_setup_vq_cmds(vq, vq->num);
+			if (ret)
 				goto destroy_vq_cmds;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 493/717] epoll: check for events when removing a timed out thread from the wait queue
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (490 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 492/717] vhost scsi: fix error return code in vhost_scsi_set_endpoint() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 494/717] clk: bcm: dvp: Add MODULE_DEVICE_TABLE() Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Soheil Hassas Yeganeh, Guantao Liu,
	Linus Torvalds, Eric Dumazet, Willem de Bruijn,
	Khazhismel Kumykov, Davidlohr Bueso, Andrew Morton, Sasha Levin

From: Soheil Hassas Yeganeh <soheil@google.com>

[ Upstream commit 289caf5d8f6c61c6d2b7fd752a7f483cd153f182 ]

Patch series "simplify ep_poll".

This patch series is a followup based on the suggestions and feedback by
Linus:
https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com

The first patch in the series is a fix for the epoll race in presence of
timeouts, so that it can be cleanly backported to all affected stable
kernels.

The rest of the patch series simplify the ep_poll() implementation.  Some
of these simplifications result in minor performance enhancements as well.
We have kept these changes under self tests and internal benchmarks for a
few days, and there are minor (1-2%) performance enhancements as a result.

This patch (of 8):

After abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2)
timeout"), we break out of the ep_poll loop upon timeout, without checking
whether there is any new events available.  Prior to that patch-series we
always called ep_events_available() after exiting the loop.

This can cause races and missed wakeups.  For example, consider the
following scenario reported by Guantao Liu:

Suppose we have an eventfd added using EPOLLET to an epollfd.

Thread 1: Sleeps for just below 5ms and then writes to an eventfd.
Thread 2: Calls epoll_wait with a timeout of 5 ms. If it sees an
          event of the eventfd, it will write back on that fd.
Thread 3: Calls epoll_wait with a negative timeout.

Prior to abc610e01c66, it is guaranteed that Thread 3 will wake up either
by Thread 1 or Thread 2.  After abc610e01c66, Thread 3 can be blocked
indefinitely if Thread 2 sees a timeout right before the write to the
eventfd by Thread 1.  Thread 2 will be woken up from
schedule_hrtimeout_range and, with evail 0, it will not call
ep_send_events().

To fix this issue:
1) Simplify the timed_out case as suggested by Linus.
2) while holding the lock, recheck whether the thread was woken up
   after its time out has reached.

Note that (2) is different from Linus' original suggestion: It do not set
"eavail = ep_events_available(ep)" to avoid unnecessary contention (when
there are too many timed-out threads and a small number of events), as
well as races mentioned in the discussion thread.

This is the first patch in the series so that the backport to stable
releases is straightforward.

Link: https://lkml.kernel.org/r/20201106231635.3528496-1-soheil.kdev@gmail.com
Link: https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com
Link: https://lkml.kernel.org/r/20201106231635.3528496-2-soheil.kdev@gmail.com
Fixes: abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2) timeout")
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Tested-by: Guantao Liu <guantaol@google.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Guantao Liu <guantaol@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/eventpoll.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 4df61129566d4..117b1c395ae4a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1902,23 +1902,30 @@ fetch_events:
 		}
 		write_unlock_irq(&ep->lock);
 
-		if (eavail || res)
-			break;
+		if (!eavail && !res)
+			timed_out = !schedule_hrtimeout_range(to, slack,
+							      HRTIMER_MODE_ABS);
 
-		if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
-			timed_out = 1;
-			break;
-		}
-
-		/* We were woken up, thus go and try to harvest some events */
+		/*
+		 * We were woken up, thus go and try to harvest some events.
+		 * If timed out and still on the wait queue, recheck eavail
+		 * carefully under lock, below.
+		 */
 		eavail = 1;
-
 	} while (0);
 
 	__set_current_state(TASK_RUNNING);
 
 	if (!list_empty_careful(&wait.entry)) {
 		write_lock_irq(&ep->lock);
+		/*
+		 * If the thread timed out and is not on the wait queue, it
+		 * means that the thread was woken up after its timeout expired
+		 * before it could reacquire the lock. Thus, when wait.entry is
+		 * empty, it needs to harvest events.
+		 */
+		if (timed_out)
+			eavail = list_empty(&wait.entry);
 		__remove_wait_queue(&ep->wq, &wait);
 		write_unlock_irq(&ep->lock);
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 494/717] clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (491 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 493/717] epoll: check for events when removing a timed out thread from the wait queue Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 495/717] clk: at91: sama7g5: fix compilation error Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Saenz Julienne,
	Maxime Ripard, Stephen Boyd, Sasha Levin

From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>

[ Upstream commit be439cc4c404f646a8ba090fa786d53c10926b12 ]

Add MODULE_DEVICE_TABLE() so as to be able to use the driver as a
module. More precisely, for the driver to be loaded automatically at
boot.

Fixes: 1bc95972715a ("clk: bcm: Add BCM2711 DVP driver")
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20201202103518.21889-1-nsaenzjulienne@suse.de
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/bcm/clk-bcm2711-dvp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/bcm/clk-bcm2711-dvp.c b/drivers/clk/bcm/clk-bcm2711-dvp.c
index 8333e20dc9d22..69e2f85f7029d 100644
--- a/drivers/clk/bcm/clk-bcm2711-dvp.c
+++ b/drivers/clk/bcm/clk-bcm2711-dvp.c
@@ -108,6 +108,7 @@ static const struct of_device_id clk_dvp_dt_ids[] = {
 	{ .compatible = "brcm,brcm2711-dvp", },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, clk_dvp_dt_ids);
 
 static struct platform_driver clk_dvp_driver = {
 	.probe	= clk_dvp_probe,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 495/717] clk: at91: sama7g5: fix compilation error
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (492 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 494/717] clk: bcm: dvp: Add MODULE_DEVICE_TABLE() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 496/717] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Tudor Ambarus,
	Stephen Boyd, Sasha Levin

From: Claudiu Beznea <claudiu.beznea@microchip.com>

[ Upstream commit 91274497c79170aaadc491d4ffe4de35495a060d ]

pmc_data_allocate() has been changed. pmc_data_free() was removed.
Adapt the code taking this into consideration. With this the programmable
clocks were also saved in sama7g5_pmc so that they could be later
referenced.

Fixes: cb783bbbcf54 ("clk: at91: sama7g5: add clock support for sama7g5")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Tested-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/1605800597-16720-2-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/sama7g5.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c
index 0db2ab3eca147..a092a940baa40 100644
--- a/drivers/clk/at91/sama7g5.c
+++ b/drivers/clk/at91/sama7g5.c
@@ -838,7 +838,7 @@ static void __init sama7g5_pmc_setup(struct device_node *np)
 	sama7g5_pmc = pmc_data_allocate(PMC_I2S1_MUX + 1,
 					nck(sama7g5_systemck),
 					nck(sama7g5_periphck),
-					nck(sama7g5_gck));
+					nck(sama7g5_gck), 8);
 	if (!sama7g5_pmc)
 		return;
 
@@ -980,6 +980,8 @@ static void __init sama7g5_pmc_setup(struct device_node *np)
 						    sama7g5_prog_mux_table);
 		if (IS_ERR(hw))
 			goto err_free;
+
+		sama7g5_pmc->pchws[i] = hw;
 	}
 
 	for (i = 0; i < ARRAY_SIZE(sama7g5_systemck); i++) {
@@ -1052,7 +1054,7 @@ err_free:
 		kfree(alloc_mem);
 	}
 
-	pmc_data_free(sama7g5_pmc);
+	kfree(sama7g5_pmc);
 }
 
 /* Some clks are used for a clocksource */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 496/717] clk: at91: sam9x60: remove atmel,osc-bypass support
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (493 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 495/717] clk: at91: sama7g5: fix compilation error Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 497/717] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Stephen Boyd, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 01324f9e88b5cfc1f4c26eef66bdcb52596c9af8 ]

The sam9x60 doesn't have the MOSCXTBY bit to enable the crystal oscillator
bypass.

Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
Reported-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201202125816.168618-1-alexandre.belloni@bootlin.com
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/sam9x60.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
index 3c4c956035954..c8cbec5308f02 100644
--- a/drivers/clk/at91/sam9x60.c
+++ b/drivers/clk/at91/sam9x60.c
@@ -174,7 +174,6 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
 	struct regmap *regmap;
 	struct clk_hw *hw;
 	int i;
-	bool bypass;
 
 	i = of_property_match_string(np, "clock-names", "td_slck");
 	if (i < 0)
@@ -209,10 +208,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
 	if (IS_ERR(hw))
 		goto err_free;
 
-	bypass = of_property_read_bool(np, "atmel,osc-bypass");
-
-	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name,
-					bypass);
+	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name, 0);
 	if (IS_ERR(hw))
 		goto err_free;
 	main_osc_hw = hw;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 497/717] clk: s2mps11: Fix a resource leak in error handling paths in the probe function
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (494 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 496/717] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 498/717] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Krzysztof Kozlowski, Stephen Boyd, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]

Some resource should be released in the error handling path of the probe
function, as already done in the remove function.

The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
missing of_node_put and of_clk_del_provider")

Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-s2mps11.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index aa21371f9104c..a3e883a9f4067 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -195,6 +195,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
 	return ret;
 
 err_reg:
+	of_node_put(s2mps11_clks[0].clk_np);
 	while (--i >= 0)
 		clkdev_drop(s2mps11_clks[i].lookup);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 498/717] clk: sunxi-ng: Make sure divider tables have sentinel
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (495 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 497/717] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 499/717] clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts" Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard,
	Stephen Boyd, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]

Two clock divider tables are missing sentinel at the end. Effect of that
is that clock framework reads past the last entry. Fix that with adding
sentinel at the end.

Issue was discovered with KASan.

Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net
Acked-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index 5f66bf8797723..149cfde817cba 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -389,6 +389,7 @@ static struct clk_div_table ths_div_table[] = {
 	{ .val = 1, .div = 2 },
 	{ .val = 2, .div = 4 },
 	{ .val = 3, .div = 6 },
+	{ /* Sentinel */ },
 };
 static const char * const ths_parents[] = { "osc24M" };
 static struct ccu_div ths_clk = {
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 6b636362379ee..7e629a4493afd 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -322,6 +322,7 @@ static struct clk_div_table ths_div_table[] = {
 	{ .val = 1, .div = 2 },
 	{ .val = 2, .div = 4 },
 	{ .val = 3, .div = 6 },
+	{ /* Sentinel */ },
 };
 static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
 				     0x074, 0, 2, ths_div_table, BIT(31), 0);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 499/717] clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (496 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 498/717] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 500/717] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Luca Ceresoli,
	Stephen Boyd, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 4b003f5fcadfa2d0e087e907b0c65d023f6e29fb ]

Commit 45c940184b501fc6 ("dt-bindings: clk: versaclock5: convert to
yaml") accidentally changed "idt,voltage-microvolts" to
"idt,voltage-microvolt" in the DT bindings, while the driver still used
the former.

Update the driver to match the bindings, as
Documentation/devicetree/bindings/property-units.txt actually recommends
using "microvolt".

Fixes: 260249f929e81d3d ("clk: vc5: Enable addition output configurations of the Versaclock")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20201218125253.3815567-1-geert+renesas@glider.be
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-versaclock5.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index c90460e7ef215..43db67337bc06 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -739,8 +739,8 @@ static int vc5_update_power(struct device_node *np_output,
 {
 	u32 value;
 
-	if (!of_property_read_u32(np_output,
-				  "idt,voltage-microvolts", &value)) {
+	if (!of_property_read_u32(np_output, "idt,voltage-microvolt",
+				  &value)) {
 		clk_out->clk_output_cfg0_mask |= VC5_CLK_OUTPUT_CFG0_PWR_MASK;
 		switch (value) {
 		case 1800000:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 500/717] kconfig: fix return value of do_error_if()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (497 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 499/717] clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts" Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 501/717] powerpc/boot: Fix build of dts/fsl Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Sasha Levin

From: Masahiro Yamada <masahiroy@kernel.org>

[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]

$(error-if,...) is expanded to an empty string. Currently, it relies on
eval_clause() returning xstrdup("") when all attempts for expansion fail,
but the correct implementation is to make do_error_if() return xstrdup("").

Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kconfig/preprocess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 0243086fb1685..0590f86df6e40 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -114,7 +114,7 @@ static char *do_error_if(int argc, char *argv[])
 	if (!strcmp(argv[0], "y"))
 		pperror("%s", argv[1]);
 
-	return NULL;
+	return xstrdup("");
 }
 
 static char *do_filename(int argc, char *argv[])
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 501/717] powerpc/boot: Fix build of dts/fsl
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (498 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 500/717] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 502/717] powerpc/smp: Add __init to init_big_cores() Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Michael Ellerman,
	Sasha Levin

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit b36f835b636908e4122f2e17310b1dbc380a3b19 ]

The lkp robot reported that some configs fail to build, for example
mpc85xx_smp_defconfig, with:

  cc1: fatal error: opening output file arch/powerpc/boot/dts/fsl/.mpc8540ads.dtb.dts.tmp: No such file or directory

This bisects to:
  cc8a51ca6f05 ("kbuild: always create directories of targets")

Although that commit claims to be about in-tree builds, it somehow
breaks out-of-tree builds. But presumably it's just exposing a latent
bug in our Makefiles.

We can fix it by adding to targets for dts/fsl in the same way that we
do for dts.

Fixes: cc8a51ca6f05 ("kbuild: always create directories of targets")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201215032906.473460-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index f8ce6d2dde7b1..e4b364b5da9e7 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -368,6 +368,8 @@ initrd-y := $(filter-out $(image-y), $(initrd-y))
 targets	+= $(image-y) $(initrd-y)
 targets += $(foreach x, dtbImage uImage cuImage simpleImage treeImage, \
 		$(patsubst $(x).%, dts/%.dtb, $(filter $(x).%, $(image-y))))
+targets += $(foreach x, dtbImage uImage cuImage simpleImage treeImage, \
+		$(patsubst $(x).%, dts/fsl/%.dtb, $(filter $(x).%, $(image-y))))
 
 $(addprefix $(obj)/, $(initrd-y)): $(obj)/ramdisk.image.gz
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 502/717] powerpc/smp: Add __init to init_big_cores()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (499 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 501/717] powerpc/boot: Fix build of dts/fsl Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 503/717] ARM: 9044/1: vfp: use undef hook for VFP support detection Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cédric Le Goater,
	Michael Ellerman, Sasha Levin

From: Cédric Le Goater <clg@kaod.org>

[ Upstream commit 9014eab6a38c60fd185bc92ed60f46cf99a462ab ]

It fixes this link warning:

WARNING: modpost: vmlinux.o(.text.unlikely+0x2d98): Section mismatch in reference from the function init_big_cores.isra.0() to the function .init.text:init_thread_group_cache_map()
The function init_big_cores.isra.0() references
the function __init init_thread_group_cache_map().
This is often because init_big_cores.isra.0 lacks a __init
annotation or the annotation of init_thread_group_cache_map is wrong.

Fixes: 425752c63b6f ("powerpc: Detect the presence of big-cores via "ibm, thread-groups"")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201221074154.403779-1-clg@kaod.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 8c2857cbd9609..7d6cf75a7fd80 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -919,7 +919,7 @@ static struct sched_domain_topology_level powerpc_topology[] = {
 	{ NULL, },
 };
 
-static int init_big_cores(void)
+static int __init init_big_cores(void)
 {
 	int cpu;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 503/717] ARM: 9044/1: vfp: use undef hook for VFP support detection
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (500 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 502/717] powerpc/smp: Add __init to init_big_cores() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 504/717] ARM: 9036/1: uncompress: Fix dbgadtb size parameter name Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernelci.org bot, Ard Biesheuvel,
	Russell King, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 3cce9d44321e460e7c88cdec4e4537a6e9ad7c0d ]

Commit f77ac2e378be9dd6 ("ARM: 9030/1: entry: omit FP emulation for UND
exceptions taken in kernel mode") failed to take into account that there
is in fact a case where we relied on this code path: during boot, the
VFP detection code issues a read of FPSID, which will trigger an undef
exception on cores that lack VFP support.

So let's reinstate this logic using an undef hook which is registered
only for the duration of the initcall to vpf_init(), and which sets
VFP_arch to a non-zero value - as before - if no VFP support is present.

Fixes: f77ac2e378be9dd6 ("ARM: 9030/1: entry: omit FP emulation for UND ...")
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/vfp/entry.S     | 17 -----------------
 arch/arm/vfp/vfpmodule.c | 25 ++++++++++++++++++++-----
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
index 0186cf9da890b..27b0a1f27fbdf 100644
--- a/arch/arm/vfp/entry.S
+++ b/arch/arm/vfp/entry.S
@@ -37,20 +37,3 @@ ENDPROC(vfp_null_entry)
 	.align	2
 .LCvfp:
 	.word	vfp_vector
-
-@ This code is called if the VFP does not exist. It needs to flag the
-@ failure to the VFP initialisation code.
-
-	__INIT
-ENTRY(vfp_testing_entry)
-	dec_preempt_count_ti r10, r4
-	ldr	r0, VFP_arch_address
-	str	r0, [r0]		@ set to non-zero value
-	ret	r9			@ we have handled the fault
-ENDPROC(vfp_testing_entry)
-
-	.align	2
-VFP_arch_address:
-	.word	VFP_arch
-
-	__FINIT
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index c3b6451c18bda..2cb355c1b5b71 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -32,7 +32,6 @@
 /*
  * Our undef handlers (in entry.S)
  */
-asmlinkage void vfp_testing_entry(void);
 asmlinkage void vfp_support_entry(void);
 asmlinkage void vfp_null_entry(void);
 
@@ -43,7 +42,7 @@ asmlinkage void (*vfp_vector)(void) = vfp_null_entry;
  * Used in startup: set to non-zero if VFP checks fail
  * After startup, holds VFP architecture
  */
-unsigned int VFP_arch;
+static unsigned int __initdata VFP_arch;
 
 /*
  * The pointer to the vfpstate structure of the thread which currently
@@ -437,7 +436,7 @@ static void vfp_enable(void *unused)
  * present on all CPUs within a SMP complex. Needs to be called prior to
  * vfp_init().
  */
-void vfp_disable(void)
+void __init vfp_disable(void)
 {
 	if (VFP_arch) {
 		pr_debug("%s: should be called prior to vfp_init\n", __func__);
@@ -707,7 +706,7 @@ static int __init vfp_kmode_exception_hook_init(void)
 		register_undef_hook(&vfp_kmode_exception_hook[i]);
 	return 0;
 }
-core_initcall(vfp_kmode_exception_hook_init);
+subsys_initcall(vfp_kmode_exception_hook_init);
 
 /*
  * Kernel-side NEON support functions
@@ -753,6 +752,21 @@ EXPORT_SYMBOL(kernel_neon_end);
 
 #endif /* CONFIG_KERNEL_MODE_NEON */
 
+static int __init vfp_detect(struct pt_regs *regs, unsigned int instr)
+{
+	VFP_arch = UINT_MAX;	/* mark as not present */
+	regs->ARM_pc += 4;
+	return 0;
+}
+
+static struct undef_hook vfp_detect_hook __initdata = {
+	.instr_mask	= 0x0c000e00,
+	.instr_val	= 0x0c000a00,
+	.cpsr_mask	= MODE_MASK,
+	.cpsr_val	= SVC_MODE,
+	.fn		= vfp_detect,
+};
+
 /*
  * VFP support code initialisation.
  */
@@ -773,10 +787,11 @@ static int __init vfp_init(void)
 	 * The handler is already setup to just log calls, so
 	 * we just need to read the VFPSID register.
 	 */
-	vfp_vector = vfp_testing_entry;
+	register_undef_hook(&vfp_detect_hook);
 	barrier();
 	vfpsid = fmrx(FPSID);
 	barrier();
+	unregister_undef_hook(&vfp_detect_hook);
 	vfp_vector = vfp_null_entry;
 
 	pr_info("VFP support v0.3: ");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 504/717] ARM: 9036/1: uncompress: Fix dbgadtb size parameter name
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (501 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 503/717] ARM: 9044/1: vfp: use undef hook for VFP support detection Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 505/717] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Linus Walleij,
	Russell King, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ecec38547d415054fdb63a231234f44396b6d06 ]

The dbgadtb macro is passed the size of the appended DTB, not the end
address.

Fixes: c03e41470e901123 ("ARM: 9010/1: uncompress: Print the location of appended DTB")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/compressed/head.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index caa27322a0ab7..3a392983ac079 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -116,7 +116,7 @@
 		/*
 		 * Debug print of the final appended DTB location
 		 */
-		.macro dbgadtb, begin, end
+		.macro dbgadtb, begin, size
 #ifdef DEBUG
 		kputc   #'D'
 		kputc   #'T'
@@ -129,7 +129,7 @@
 		kputc	#'('
 		kputc	#'0'
 		kputc	#'x'
-		kphex	\end, 8		/* End of appended DTB */
+		kphex	\size, 8	/* Size of appended DTB */
 		kputc	#')'
 		kputc	#'\n'
 #endif
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 505/717] perf probe: Fix memory leak when synthesizing SDT probes
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (502 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 504/717] ARM: 9036/1: uncompress: Fix dbgadtb size parameter name Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 506/717] io_uring: fix racy IOPOLL flush overflow Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Alexander Shishkin,
	Alexandre Truong, Alexis Berlemont, He Zhe, Ian Rogers,
	Ingo Molnar, Jiri Olsa, John Garry, Mark Rutland,
	Masami Hiramatsu, Mathieu Poirier, Namhyung Kim, Peter Zijlstra,
	Sumanth Korikkar, Thomas Richter, Will Deacon,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Arnaldo Carvalho de Melo <acme@redhat.com>

[ Upstream commit 5149303fdfe5c67ddb51c911e23262f781cd75eb ]

The argv_split() function must be paired with argv_free(), else we must
keep a reference to the argv array received or do the freeing ourselves,
in synthesize_sdt_probe_command() we were simply leaking that argv[]
array.

Fixes: 3b1f8311f6963cd1 ("perf probe: Add sdt probes arguments into the uprobe cmd string")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Truong <alexandre.truong@arm.com>
Cc: Alexis Berlemont <alexis.berlemont@gmail.com>
Cc: He Zhe <zhe.he@windriver.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: John Garry <john.garry@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20201224135139.GF477817@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/probe-file.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index 064b63a6a3f31..bbecb449ea944 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -791,7 +791,7 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
 					const char *sdtgrp)
 {
 	struct strbuf buf;
-	char *ret = NULL, **args;
+	char *ret = NULL;
 	int i, args_count, err;
 	unsigned long long ref_ctr_offset;
 
@@ -813,12 +813,19 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
 		goto out;
 
 	if (note->args) {
-		args = argv_split(note->args, &args_count);
+		char **args = argv_split(note->args, &args_count);
+
+		if (args == NULL)
+			goto error;
 
 		for (i = 0; i < args_count; ++i) {
-			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0)
+			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0) {
+				argv_free(args);
 				goto error;
+			}
 		}
+
+		argv_free(args);
 	}
 
 out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 506/717] io_uring: fix racy IOPOLL flush overflow
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (503 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 505/717] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 507/717] io_uring: cancel reqs shouldnt kill overflow list Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe, Sasha Levin

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit 634578f800652035debba3098d8ab0d21af7c7a5 ]

It's not safe to call io_cqring_overflow_flush() for IOPOLL mode without
hodling uring_lock, because it does synchronisation differently. Make
sure we have it.

As for io_ring_exit_work(), we don't even need it there because
io_ring_ctx_wait_and_kill() already set force flag making all overflowed
requests to be dropped.

Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 0621f581943cd..b9d3209a5f9de 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8369,8 +8369,6 @@ static void io_ring_exit_work(struct work_struct *work)
 	 * as nobody else will be looking for them.
 	 */
 	do {
-		if (ctx->rings)
-			io_cqring_overflow_flush(ctx, true, NULL, NULL);
 		io_iopoll_try_reap_events(ctx);
 	} while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20));
 	io_ring_ctx_free(ctx);
@@ -8380,6 +8378,8 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
 {
 	mutex_lock(&ctx->uring_lock);
 	percpu_ref_kill(&ctx->refs);
+	if (ctx->rings)
+		io_cqring_overflow_flush(ctx, true, NULL, NULL);
 	mutex_unlock(&ctx->uring_lock);
 
 	io_kill_timeouts(ctx, NULL);
@@ -8389,8 +8389,6 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
 		io_wq_cancel_all(ctx->io_wq);
 
 	/* if we failed setting up the ctx, we might not have any rings */
-	if (ctx->rings)
-		io_cqring_overflow_flush(ctx, true, NULL, NULL);
 	io_iopoll_try_reap_events(ctx);
 	idr_for_each(&ctx->personality_idr, io_remove_personalities, ctx);
 
@@ -8654,7 +8652,9 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
 	}
 
 	io_cancel_defer_files(ctx, task, files);
+	io_ring_submit_lock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
 	io_cqring_overflow_flush(ctx, true, task, files);
+	io_ring_submit_unlock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
 
 	while (__io_uring_cancel_task_requests(ctx, task, files)) {
 		io_run_task_work();
@@ -8956,8 +8956,10 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
 	 */
 	ret = 0;
 	if (ctx->flags & IORING_SETUP_SQPOLL) {
+		io_ring_submit_lock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
 		if (!list_empty_careful(&ctx->cq_overflow_list))
 			io_cqring_overflow_flush(ctx, false, NULL, NULL);
+		io_ring_submit_unlock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
 		if (flags & IORING_ENTER_SQ_WAKEUP)
 			wake_up(&ctx->sq_data->wait);
 		if (flags & IORING_ENTER_SQ_WAIT)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 507/717] io_uring: cancel reqs shouldnt kill overflow list
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (504 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 506/717] io_uring: fix racy IOPOLL flush overflow Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 508/717] Smack: Handle io_uring kernel thread privileges Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe, Sasha Levin

From: Pavel Begunkov <asml.silence@gmail.com>

[ Upstream commit cda286f0715c82f8117e166afd42cca068876dde ]

io_uring_cancel_task_requests() doesn't imply that the ring is going
away, it may continue to work well after that. The problem is that it
sets ->cq_overflow_flushed effectively disabling the CQ overflow feature

Split setting cq_overflow_flushed from flush, and do the first one only
on exit. It's ok in terms of cancellations because there is a
io_uring->in_idle check in __io_cqring_fill_event().

It also fixes a race with setting ->cq_overflow_flushed in
io_uring_cancel_task_requests, whuch's is not atomic and a part of a
bitmask with other flags. Though, the only other flag that's not set
during init is drain_next, so it's not as bad for sane architectures.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Fixes: 0f2122045b946 ("io_uring: don't rely on weak ->files references")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index b9d3209a5f9de..e9219841923cc 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1641,10 +1641,6 @@ static bool io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force,
 
 	spin_lock_irqsave(&ctx->completion_lock, flags);
 
-	/* if force is set, the ring is going away. always drop after that */
-	if (force)
-		ctx->cq_overflow_flushed = 1;
-
 	cqe = NULL;
 	list_for_each_entry_safe(req, tmp, &ctx->cq_overflow_list, compl.list) {
 		if (tsk && req->task != tsk)
@@ -8378,6 +8374,8 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
 {
 	mutex_lock(&ctx->uring_lock);
 	percpu_ref_kill(&ctx->refs);
+	/* if force is set, the ring is going away. always drop after that */
+	ctx->cq_overflow_flushed = 1;
 	if (ctx->rings)
 		io_cqring_overflow_flush(ctx, true, NULL, NULL);
 	mutex_unlock(&ctx->uring_lock);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 508/717] Smack: Handle io_uring kernel thread privileges
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (505 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 507/717] io_uring: cancel reqs shouldnt kill overflow list Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 509/717] proc mountinfo: make splice available again Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jens Axboe, Eric W. Biederman,
	Casey Schaufler, Sasha Levin

From: Casey Schaufler <casey@schaufler-ca.com>

[ Upstream commit 942cb357ae7d9249088e3687ee6a00ed2745a0c7 ]

Smack assumes that kernel threads are privileged for smackfs
operations. This was necessary because the credential of the
kernel thread was not related to a user operation. With io_uring
the credential does reflect a user's rights and can be used.

Suggested-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smack_access.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index efe2406a39609..7eabb448acab4 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -688,9 +688,10 @@ bool smack_privileged_cred(int cap, const struct cred *cred)
 bool smack_privileged(int cap)
 {
 	/*
-	 * All kernel tasks are privileged
+	 * Kernel threads may not have credentials we can use.
+	 * The io_uring kernel threads do have reliable credentials.
 	 */
-	if (unlikely(current->flags & PF_KTHREAD))
+	if ((current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD)
 		return true;
 
 	return smack_privileged_cred(cap, current_cred());
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 750+ messages in thread

* [PATCH 5.10 509/717] proc mountinfo: make splice available again
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (506 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 508/717] Smack: Handle io_uring kernel thread privileges Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 510/717] io_uring: fix io_cqring_events()s noflush Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joan Bruguera Micó,
	Jussi Kivilinna, Christoph Hellwig, Linus Torvalds, Sasha Levin

From: Linus Torvalds <torvalds@linux-foundation.org>

[ Upstream commit 14e3e989f6a5d9646b6cf60690499cc8bdc11f7d ]

Since commit 36e2c7421f02 ("fs: don't allow splice read/write without
explicit ops") we've required that file operation structures explicitly
enable splice support, rather than falling back to the default handlers.

Most /proc files use the indirect 'struct proc_ops' to describe their
file operations, and were fixed up to support splice earlier in commits
40be821d627c..b24c30c67863, but the mountinfo files interact with the
VFS directly using their own 'struct file_operations' and got missed as
a result.

This adds the necessary support for splice to work for /proc/*/mountinfo
and friends.

Reported-by: Joan Bruguera Micó <joanbrugueram@gmail.com>
Reported-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209971
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc_namespace.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/fs/proc_namespace.c
+++ b/fs/proc_namespace.c
@@ -320,7 +320,8 @@ static int mountstats_open(struct inode
 
 const struct file_operations proc_mounts_operations = {
 	.open		= mounts_open,
-	.read		= seq_read,
+	.read_iter	= seq_read_iter,
+	.splice_read	= generic_file_splice_read,
 	.llseek		= seq_lseek,
 	.release	= mounts_release,
 	.poll		= mounts_poll,
@@ -328,7 +329,8 @@ const struct file_operations proc_mounts
 
 const struct file_operations proc_mountinfo_operations = {
 	.open		= mountinfo_open,
-	.read		= seq_read,
+	.read_iter	= seq_read_iter,
+	.splice_read	= generic_file_splice_read,
 	.llseek		= seq_lseek,
 	.release	= mounts_release,
 	.poll		= mounts_poll,
@@ -336,7 +338,8 @@ const struct file_operations proc_mounti
 
 const struct file_operations proc_mountstats_operations = {
 	.open		= mountstats_open,
-	.read		= seq_read,
+	.read_iter	= seq_read_iter,
+	.splice_read	= generic_file_splice_read,
 	.llseek		= seq_lseek,
 	.release	= mounts_release,
 };



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 510/717] io_uring: fix io_cqring_events()s noflush
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (507 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 509/717] proc mountinfo: make splice available again Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 511/717] io_uring: fix racy IOPOLL completions Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit 59850d226e4907a6f37c1d2fe5ba97546a8691a4 upstream.

Checking !list_empty(&ctx->cq_overflow_list) around noflush in
io_cqring_events() is racy, because if it fails but a request overflowed
just after that, io_cqring_overflow_flush() still will be called.

Remove the second check, it shouldn't be a problem for performance,
because there is cq_check_overflow bit check just above.

Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2242,7 +2242,7 @@ static unsigned io_cqring_events(struct
 		 * we wake up the task, and the next invocation will flush the
 		 * entries. We cannot safely to it from here.
 		 */
-		if (noflush && !list_empty(&ctx->cq_overflow_list))
+		if (noflush)
 			return -1U;
 
 		io_cqring_overflow_flush(ctx, false, NULL, NULL);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 511/717] io_uring: fix racy IOPOLL completions
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (508 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 510/717] io_uring: fix io_cqring_events()s noflush Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 512/717] io_uring: always let io_iopoll_complete() complete polled io Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit 31bff9a51b264df6d144931a6a5f1d6cc815ed4b upstream.

IOPOLL allows buffer remove/provide requests, but they doesn't
synchronise by rules of IOPOLL, namely it have to hold uring_lock.

Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |   23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3944,11 +3944,17 @@ static int io_remove_buffers(struct io_k
 	head = idr_find(&ctx->io_buffer_idr, p->bgid);
 	if (head)
 		ret = __io_remove_buffers(ctx, head, p->bgid, p->nbufs);
-
-	io_ring_submit_lock(ctx, !force_nonblock);
 	if (ret < 0)
 		req_set_fail_links(req);
-	__io_req_complete(req, ret, 0, cs);
+
+	/* need to hold the lock to complete IOPOLL requests */
+	if (ctx->flags & IORING_SETUP_IOPOLL) {
+		__io_req_complete(req, ret, 0, cs);
+		io_ring_submit_unlock(ctx, !force_nonblock);
+	} else {
+		io_ring_submit_unlock(ctx, !force_nonblock);
+		__io_req_complete(req, ret, 0, cs);
+	}
 	return 0;
 }
 
@@ -4033,10 +4039,17 @@ static int io_provide_buffers(struct io_
 		}
 	}
 out:
-	io_ring_submit_unlock(ctx, !force_nonblock);
 	if (ret < 0)
 		req_set_fail_links(req);
-	__io_req_complete(req, ret, 0, cs);
+
+	/* need to hold the lock to complete IOPOLL requests */
+	if (ctx->flags & IORING_SETUP_IOPOLL) {
+		__io_req_complete(req, ret, 0, cs);
+		io_ring_submit_unlock(ctx, !force_nonblock);
+	} else {
+		io_ring_submit_unlock(ctx, !force_nonblock);
+		__io_req_complete(req, ret, 0, cs);
+	}
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 512/717] io_uring: always let io_iopoll_complete() complete polled io
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (509 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 511/717] io_uring: fix racy IOPOLL completions Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 513/717] vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abaci Fuzz, Xiaoguang Wang,
	Pavel Begunkov, Joseph Qi, Jens Axboe

From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>

commit dad1b1242fd5717af18ae4ac9d12b9f65849e13a upstream.

Abaci Fuzz reported a double-free or invalid-free BUG in io_commit_cqring():
[   95.504842] BUG: KASAN: double-free or invalid-free in io_commit_cqring+0x3ec/0x8e0
[   95.505921]
[   95.506225] CPU: 0 PID: 4037 Comm: io_wqe_worker-0 Tainted: G    B
W         5.10.0-rc5+ #1
[   95.507434] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[   95.508248] Call Trace:
[   95.508683]  dump_stack+0x107/0x163
[   95.509323]  ? io_commit_cqring+0x3ec/0x8e0
[   95.509982]  print_address_description.constprop.0+0x3e/0x60
[   95.510814]  ? vprintk_func+0x98/0x140
[   95.511399]  ? io_commit_cqring+0x3ec/0x8e0
[   95.512036]  ? io_commit_cqring+0x3ec/0x8e0
[   95.512733]  kasan_report_invalid_free+0x51/0x80
[   95.513431]  ? io_commit_cqring+0x3ec/0x8e0
[   95.514047]  __kasan_slab_free+0x141/0x160
[   95.514699]  kfree+0xd1/0x390
[   95.515182]  io_commit_cqring+0x3ec/0x8e0
[   95.515799]  __io_req_complete.part.0+0x64/0x90
[   95.516483]  io_wq_submit_work+0x1fa/0x260
[   95.517117]  io_worker_handle_work+0xeac/0x1c00
[   95.517828]  io_wqe_worker+0xc94/0x11a0
[   95.518438]  ? io_worker_handle_work+0x1c00/0x1c00
[   95.519151]  ? __kthread_parkme+0x11d/0x1d0
[   95.519806]  ? io_worker_handle_work+0x1c00/0x1c00
[   95.520512]  ? io_worker_handle_work+0x1c00/0x1c00
[   95.521211]  kthread+0x396/0x470
[   95.521727]  ? _raw_spin_unlock_irq+0x24/0x30
[   95.522380]  ? kthread_mod_delayed_work+0x180/0x180
[   95.523108]  ret_from_fork+0x22/0x30
[   95.523684]
[   95.523985] Allocated by task 4035:
[   95.524543]  kasan_save_stack+0x1b/0x40
[   95.525136]  __kasan_kmalloc.constprop.0+0xc2/0xd0
[   95.525882]  kmem_cache_alloc_trace+0x17b/0x310
[   95.533930]  io_queue_sqe+0x225/0xcb0
[   95.534505]  io_submit_sqes+0x1768/0x25f0
[   95.535164]  __x64_sys_io_uring_enter+0x89e/0xd10
[   95.535900]  do_syscall_64+0x33/0x40
[   95.536465]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   95.537199]
[   95.537505] Freed by task 4035:
[   95.538003]  kasan_save_stack+0x1b/0x40
[   95.538599]  kasan_set_track+0x1c/0x30
[   95.539177]  kasan_set_free_info+0x1b/0x30
[   95.539798]  __kasan_slab_free+0x112/0x160
[   95.540427]  kfree+0xd1/0x390
[   95.540910]  io_commit_cqring+0x3ec/0x8e0
[   95.541516]  io_iopoll_complete+0x914/0x1390
[   95.542150]  io_do_iopoll+0x580/0x700
[   95.542724]  io_iopoll_try_reap_events.part.0+0x108/0x200
[   95.543512]  io_ring_ctx_wait_and_kill+0x118/0x340
[   95.544206]  io_uring_release+0x43/0x50
[   95.544791]  __fput+0x28d/0x940
[   95.545291]  task_work_run+0xea/0x1b0
[   95.545873]  do_exit+0xb6a/0x2c60
[   95.546400]  do_group_exit+0x12a/0x320
[   95.546967]  __x64_sys_exit_group+0x3f/0x50
[   95.547605]  do_syscall_64+0x33/0x40
[   95.548155]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

The reason is that once we got a non EAGAIN error in io_wq_submit_work(),
we'll complete req by calling io_req_complete(), which will hold completion_lock
to call io_commit_cqring(), but for polled io, io_iopoll_complete() won't
hold completion_lock to call io_commit_cqring(), then there maybe concurrent
access to ctx->defer_list, double free may happen.

To fix this bug, we always let io_iopoll_complete() complete polled io.

Cc: <stable@vger.kernel.org> # 5.5+
Reported-by: Abaci Fuzz <abaci@linux.alibaba.com>
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6083,8 +6083,19 @@ static struct io_wq_work *io_wq_submit_w
 	}
 
 	if (ret) {
-		req_set_fail_links(req);
-		io_req_complete(req, ret);
+		/*
+		 * io_iopoll_complete() does not hold completion_lock to complete
+		 * polled io, so here for polled io, just mark it done and still let
+		 * io_iopoll_complete() complete it.
+		 */
+		if (req->ctx->flags & IORING_SETUP_IOPOLL) {
+			struct kiocb *kiocb = &req->rw.kiocb;
+
+			kiocb_done(kiocb, ret, NULL);
+		} else {
+			req_set_fail_links(req);
+			io_req_complete(req, ret);
+		}
 	}
 
 	return io_steal_work(req);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 513/717] vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (510 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 512/717] io_uring: always let io_iopoll_complete() complete polled io Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 514/717] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Auger, Alex Williamson

From: Eric Auger <eric.auger@redhat.com>

commit 16b8fe4caf499ae8e12d2ab1b1324497e36a7b83 upstream.

In case an error occurs in vfio_pci_enable() before the call to
vfio_pci_probe_mmaps(), vfio_pci_disable() will  try to iterate
on an uninitialized list and cause a kernel panic.

Lets move to the initialization to vfio_pci_probe() to fix the
issue.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Fixes: 05f0c03fbac1 ("vfio-pci: Allow to mmap sub-page MMIO BARs if the mmio page is exclusive")
CC: Stable <stable@vger.kernel.org> # v4.7+
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vfio/pci/vfio_pci.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -161,8 +161,6 @@ static void vfio_pci_probe_mmaps(struct
 	int i;
 	struct vfio_pci_dummy_resource *dummy_res;
 
-	INIT_LIST_HEAD(&vdev->dummy_resources_list);
-
 	for (i = 0; i < PCI_STD_NUM_BARS; i++) {
 		int bar = i + PCI_STD_RESOURCES;
 
@@ -1966,6 +1964,7 @@ static int vfio_pci_probe(struct pci_dev
 	mutex_init(&vdev->igate);
 	spin_lock_init(&vdev->irqlock);
 	mutex_init(&vdev->ioeventfds_lock);
+	INIT_LIST_HEAD(&vdev->dummy_resources_list);
 	INIT_LIST_HEAD(&vdev->ioeventfds_list);
 	mutex_init(&vdev->vma_lock);
 	INIT_LIST_HEAD(&vdev->vma_list);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 514/717] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (511 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 513/717] vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 515/717] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Alex Williamson

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit d22f9a6c92de96304c81792942ae7c306f08ac77 upstream.

We execute certain NPU2 setup code (such as mapping an LPID to a device
in NPU2) unconditionally if an Nvlink bridge is detected. However this
cannot succeed on POWER8NVL machines as the init helpers return an error
other than ENODEV which means the device is there is and setup failed so
vfio_pci_enable() fails and pass through is not possible.

This changes the two NPU2 related init helpers to return -ENODEV if
there is no "memory-region" device tree property as this is
the distinction between NPU and NPU2.

Tested on
- POWER9 pvr=004e1201, Ubuntu 19.04 host, Ubuntu 18.04 vm,
  NVIDIA GV100 10de:1db1 driver 418.39
- POWER8 pvr=004c0100, RHEL 7.6 host, Ubuntu 16.10 vm,
  NVIDIA P100 10de:15f9 driver 396.47

Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver")
Cc: stable@vger.kernel.org # 5.0
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vfio/pci/vfio_pci_nvlink2.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -231,7 +231,7 @@ int vfio_pci_nvdia_v100_nvlink2_init(str
 		return -EINVAL;
 
 	if (of_property_read_u32(npu_node, "memory-region", &mem_phandle))
-		return -EINVAL;
+		return -ENODEV;
 
 	mem_node = of_find_node_by_phandle(mem_phandle);
 	if (!mem_node)
@@ -393,7 +393,7 @@ int vfio_pci_ibm_npu2_init(struct vfio_p
 	int ret;
 	struct vfio_pci_npu2_data *data;
 	struct device_node *nvlink_dn;
-	u32 nvlink_index = 0;
+	u32 nvlink_index = 0, mem_phandle = 0;
 	struct pci_dev *npdev = vdev->pdev;
 	struct device_node *npu_node = pci_device_to_OF_node(npdev);
 	struct pci_controller *hose = pci_bus_to_host(npdev->bus);
@@ -408,6 +408,9 @@ int vfio_pci_ibm_npu2_init(struct vfio_p
 	if (!pnv_pci_get_gpu_dev(vdev->pdev))
 		return -ENODEV;
 
+	if (of_property_read_u32(npu_node, "memory-region", &mem_phandle))
+		return -ENODEV;
+
 	/*
 	 * NPU2 normally has 8 ATSD registers (for concurrency) and 6 links
 	 * so we can allocate one register per link, using nvlink index as



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 515/717] media: gspca: Fix memory leak in probe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (512 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 514/717] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 516/717] io_uring: fix io_wqe->work_list corruption Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Stern, Hans Verkuil,
	Mauro Carvalho Chehab, syzbot+44e64397bd81d5e84cba

From: Alan Stern <stern@rowland.harvard.edu>

commit e469d0b09a19496e1972a20974bbf55b728151eb upstream.

The gspca driver leaks memory when a probe fails.  gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface).  But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference.  Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/gspca/gspca.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
 		input_unregister_device(gspca_dev->input_dev);
 #endif
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+	v4l2_device_unregister(&gspca_dev->v4l2_dev);
 	kfree(gspca_dev->usb_buf);
 	kfree(gspca_dev);
 	return ret;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 516/717] io_uring: fix io_wqe->work_list corruption
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (513 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 515/717] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 517/717] io_uring: fix 0-iov read buffer select Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaoguang Wang, Pavel Begunkov, Jens Axboe

From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>

commit 0020ef04e48571a88d4f482ad08f71052c5c5a08 upstream.

For the first time a req punted to io-wq, we'll initialize io_wq_work's
list to be NULL, then insert req to io_wqe->work_list. If this req is not
inserted into tail of io_wqe->work_list, this req's io_wq_work list will
point to another req's io_wq_work. For splitted bio case, this req maybe
inserted to io_wqe->work_list repeatedly, once we insert it to tail of
io_wqe->work_list for the second time, now io_wq_work->list->next will be
invalid pointer, which then result in many strang error, panic, kernel
soft-lockup, rcu stall, etc.

In my vm, kernel doest not have commit cc29e1bf0d63f7 ("block: disable
iopoll for split bio"), below fio job can reproduce this bug steadily:
[global]
name=iouring-sqpoll-iopoll-1
ioengine=io_uring
iodepth=128
numjobs=1
thread
rw=randread
direct=1
registerfiles=1
hipri=1
bs=4m
size=100M
runtime=120
time_based
group_reporting
randrepeat=0

[device]
directory=/home/feiman.wxg/mntpoint/  # an ext4 mount point

If we have commit cc29e1bf0d63f7 ("block: disable iopoll for split bio"),
there will no splitted bio case for polled io, but I think we still to need
to fix this list corruption, it also should maybe go to stable branchs.

To fix this corruption, if a req is inserted into tail of io_wqe->work_list,
initialize req->io_wq_work->list->next to bu NULL.

Cc: stable@vger.kernel.org
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io-wq.h |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -59,6 +59,7 @@ static inline void wq_list_add_tail(stru
 		list->last->next = node;
 		list->last = node;
 	}
+	node->next = NULL;
 }
 
 static inline void wq_list_cut(struct io_wq_work_list *list,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 517/717] io_uring: fix 0-iov read buffer select
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (514 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 516/717] io_uring: fix io_wqe->work_list corruption Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 518/717] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work() Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit dd20166236953c8cd14f4c668bf972af32f0c6be upstream.

Doing vectored buf-select read with 0 iovec passed is meaningless and
utterly broken, forbid it.

Cc: <stable@vger.kernel.org> # 5.7+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3048,9 +3048,7 @@ static ssize_t io_iov_buffer_select(stru
 		iov[0].iov_len = kbuf->len;
 		return 0;
 	}
-	if (!req->rw.len)
-		return 0;
-	else if (req->rw.len > 1)
+	if (req->rw.len != 1)
 		return -EINVAL;
 
 #ifdef CONFIG_COMPAT



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 518/717] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (515 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 517/717] io_uring: fix 0-iov read buffer select Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 519/717] io_uring: fix ignoring xa_store errors Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaoguang Wang, Pavel Begunkov, Jens Axboe

From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>

commit c07e6719511e77c4b289f62bfe96423eb6ea061d upstream.

io_iopoll_complete() does not hold completion_lock to complete polled io,
so in io_wq_submit_work(), we can not call io_req_complete() directly, to
complete polled io, otherwise there maybe concurrent access to cqring,
defer_list, etc, which is not safe. Commit dad1b1242fd5 ("io_uring: always
let io_iopoll_complete() complete polled io") has fixed this issue, but
Pavel reported that IOPOLL apart from rw can do buf reg/unreg requests(
IORING_OP_PROVIDE_BUFFERS or IORING_OP_REMOVE_BUFFERS), so the fix is not
good.

Given that io_iopoll_complete() is always called under uring_lock, so here
for polled io, we can also get uring_lock to fix this issue.

Fixes: dad1b1242fd5 ("io_uring: always let io_iopoll_complete() complete polled io")
Cc: <stable@vger.kernel.org> # 5.5+
Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
[axboe: don't deref 'req' after completing it']
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |   29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6081,19 +6081,28 @@ static struct io_wq_work *io_wq_submit_w
 	}
 
 	if (ret) {
+		struct io_ring_ctx *lock_ctx = NULL;
+
+		if (req->ctx->flags & IORING_SETUP_IOPOLL)
+			lock_ctx = req->ctx;
+
 		/*
-		 * io_iopoll_complete() does not hold completion_lock to complete
-		 * polled io, so here for polled io, just mark it done and still let
-		 * io_iopoll_complete() complete it.
+		 * io_iopoll_complete() does not hold completion_lock to
+		 * complete polled io, so here for polled io, we can not call
+		 * io_req_complete() directly, otherwise there maybe concurrent
+		 * access to cqring, defer_list, etc, which is not safe. Given
+		 * that io_iopoll_complete() is always called under uring_lock,
+		 * so here for polled io, we also get uring_lock to complete
+		 * it.
 		 */
-		if (req->ctx->flags & IORING_SETUP_IOPOLL) {
-			struct kiocb *kiocb = &req->rw.kiocb;
+		if (lock_ctx)
+			mutex_lock(&lock_ctx->uring_lock);
+
+		req_set_fail_links(req);
+		io_req_complete(req, ret);
 
-			kiocb_done(kiocb, ret, NULL);
-		} else {
-			req_set_fail_links(req);
-			io_req_complete(req, ret);
-		}
+		if (lock_ctx)
+			mutex_unlock(&lock_ctx->uring_lock);
 	}
 
 	return io_steal_work(req);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 519/717] io_uring: fix ignoring xa_store errors
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (516 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 518/717] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 520/717] io_uring: fix double io_uring free Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit a528b04ea40690ff40501f50d618a62a02b19620 upstream.

xa_store() may fail, check the result.

Cc: stable@vger.kernel.org # 5.10
Fixes: 0f2122045b946 ("io_uring: don't rely on weak ->files references")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8708,10 +8708,9 @@ static void io_uring_cancel_task_request
 static int io_uring_add_task_file(struct io_ring_ctx *ctx, struct file *file)
 {
 	struct io_uring_task *tctx = current->io_uring;
+	int ret;
 
 	if (unlikely(!tctx)) {
-		int ret;
-
 		ret = io_uring_alloc_task_context(current);
 		if (unlikely(ret))
 			return ret;
@@ -8722,7 +8721,12 @@ static int io_uring_add_task_file(struct
 
 		if (!old) {
 			get_file(file);
-			xa_store(&tctx->xa, (unsigned long)file, file, GFP_KERNEL);
+			ret = xa_err(xa_store(&tctx->xa, (unsigned long)file,
+						file, GFP_KERNEL));
+			if (ret) {
+				fput(file);
+				return ret;
+			}
 		}
 		tctx->last = file;
 	}



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 520/717] io_uring: fix double io_uring free
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (517 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 519/717] io_uring: fix ignoring xa_store errors Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 521/717] io_uring: make ctx cancel on exit targeted to actual ctx Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+c9937dfb2303a5f18640,
	Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit 9faadcc8abe4b83d0263216dc3a6321d5bbd616b upstream.

Once we created a file for current context during setup, we should not
call io_ring_ctx_wait_and_kill() directly as it'll be done by fput(file)

Cc: stable@vger.kernel.org # 5.10
Reported-by: syzbot+c9937dfb2303a5f18640@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
[axboe: fix unused 'ret' for !CONFIG_UNIX]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |   71 +++++++++++++++++++++++++++++++---------------------------
 1 file changed, 39 insertions(+), 32 deletions(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9195,55 +9195,52 @@ static int io_allocate_scq_urings(struct
 	return 0;
 }
 
+static int io_uring_install_fd(struct io_ring_ctx *ctx, struct file *file)
+{
+	int ret, fd;
+
+	fd = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
+	if (fd < 0)
+		return fd;
+
+	ret = io_uring_add_task_file(ctx, file);
+	if (ret) {
+		put_unused_fd(fd);
+		return ret;
+	}
+	fd_install(fd, file);
+	return fd;
+}
+
 /*
  * Allocate an anonymous fd, this is what constitutes the application
  * visible backing of an io_uring instance. The application mmaps this
  * fd to gain access to the SQ/CQ ring details. If UNIX sockets are enabled,
  * we have to tie this fd to a socket for file garbage collection purposes.
  */
-static int io_uring_get_fd(struct io_ring_ctx *ctx)
+static struct file *io_uring_get_file(struct io_ring_ctx *ctx)
 {
 	struct file *file;
+#if defined(CONFIG_UNIX)
 	int ret;
-	int fd;
 
-#if defined(CONFIG_UNIX)
 	ret = sock_create_kern(&init_net, PF_UNIX, SOCK_RAW, IPPROTO_IP,
 				&ctx->ring_sock);
 	if (ret)
-		return ret;
+		return ERR_PTR(ret);
 #endif
 
-	ret = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
-	if (ret < 0)
-		goto err;
-	fd = ret;
-
 	file = anon_inode_getfile("[io_uring]", &io_uring_fops, ctx,
 					O_RDWR | O_CLOEXEC);
-	if (IS_ERR(file)) {
-		put_unused_fd(fd);
-		ret = PTR_ERR(file);
-		goto err;
-	}
-
 #if defined(CONFIG_UNIX)
-	ctx->ring_sock->file = file;
-#endif
-	ret = io_uring_add_task_file(ctx, file);
-	if (ret) {
-		fput(file);
-		put_unused_fd(fd);
-		goto err;
+	if (IS_ERR(file)) {
+		sock_release(ctx->ring_sock);
+		ctx->ring_sock = NULL;
+	} else {
+		ctx->ring_sock->file = file;
 	}
-	fd_install(fd, file);
-	return fd;
-err:
-#if defined(CONFIG_UNIX)
-	sock_release(ctx->ring_sock);
-	ctx->ring_sock = NULL;
 #endif
-	return ret;
+	return file;
 }
 
 static int io_uring_create(unsigned entries, struct io_uring_params *p,
@@ -9251,6 +9248,7 @@ static int io_uring_create(unsigned entr
 {
 	struct user_struct *user = NULL;
 	struct io_ring_ctx *ctx;
+	struct file *file;
 	bool limit_mem;
 	int ret;
 
@@ -9397,13 +9395,22 @@ static int io_uring_create(unsigned entr
 		goto err;
 	}
 
+	file = io_uring_get_file(ctx);
+	if (IS_ERR(file)) {
+		ret = PTR_ERR(file);
+		goto err;
+	}
+
 	/*
 	 * Install ring fd as the very last thing, so we don't risk someone
 	 * having closed it before we finish setup
 	 */
-	ret = io_uring_get_fd(ctx);
-	if (ret < 0)
-		goto err;
+	ret = io_uring_install_fd(ctx, file);
+	if (ret < 0) {
+		/* fput will clean it up */
+		fput(file);
+		return ret;
+	}
 
 	trace_io_uring_create(ret, ctx, p->sq_entries, p->cq_entries, p->flags);
 	return ret;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 521/717] io_uring: make ctx cancel on exit targeted to actual ctx
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (518 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 520/717] io_uring: fix double io_uring free Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 522/717] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jens Axboe

From: Jens Axboe <axboe@kernel.dk>

commit 00c18640c2430c4bafaaeede1f9dd6f7ec0e4b25 upstream.

Before IORING_SETUP_ATTACH_WQ, we could just cancel everything on the
io-wq when exiting. But that's not the case if they are shared, so
cancel for the specific ctx instead.

Cc: stable@vger.kernel.org
Fixes: 24369c2e3bb0 ("io_uring: add io-wq workqueue sharing")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/io_uring.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8401,6 +8401,13 @@ static void io_ring_exit_work(struct wor
 	io_ring_ctx_free(ctx);
 }
 
+static bool io_cancel_ctx_cb(struct io_wq_work *work, void *data)
+{
+	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
+
+	return req->ctx == data;
+}
+
 static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
 {
 	mutex_lock(&ctx->uring_lock);
@@ -8415,7 +8422,7 @@ static void io_ring_ctx_wait_and_kill(st
 	io_poll_remove_all(ctx, NULL);
 
 	if (ctx->io_wq)
-		io_wq_cancel_all(ctx->io_wq);
+		io_wq_cancel_cb(ctx->io_wq, io_cancel_ctx_cb, ctx, true);
 
 	/* if we failed setting up the ctx, we might not have any rings */
 	io_iopoll_try_reap_events(ctx);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 522/717] media: sunxi-cir: ensure IR is handled when it is continuous
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (519 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 521/717] io_uring: make ctx cancel on exit targeted to actual ctx Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 523/717] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Maxime Ripard,
	Sean Young, Mauro Carvalho Chehab

From: Sean Young <sean@mess.org>

commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream.

If a user holds a button down on a remote, then no ir idle interrupt will
be generated until the user releases the button, depending on how quickly
the remote repeats. No IR is processed until that point, which means that
holding down a button may not do anything.

This also resolves an issue on a Cubieboard 1 where the IR receiver is
picking up ambient infrared as IR and spews out endless
"rc rc0: IR event FIFO is full!" messages unless you choose to live in
the dark.

Cc: stable@vger.kernel.org
Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/sunxi-cir.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -137,6 +137,8 @@ static irqreturn_t sunxi_ir_irq(int irqn
 	} else if (status & REG_RXSTA_RPE) {
 		ir_raw_event_set_idle(ir->rc, true);
 		ir_raw_event_handle(ir->rc);
+	} else {
+		ir_raw_event_handle(ir->rc);
 	}
 
 	spin_unlock(&ir->ir_lock);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 523/717] media: netup_unidvb: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (520 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 522/717] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 524/717] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mauro Carvalho Chehab,
	Kozlov Sergey, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit e297ddf296de35037fa97f4302782def196d350a upstream.

If the call to spi_register_master() fails on probe of the NetUP
Universal DVB driver, the spi_master struct is erroneously not freed.

Likewise, if spi_new_device() fails, the spi_controller struct is
not unregistered.  Plug the leaks.

While at it, fix an ordering issue in netup_spi_release() wherein
spi_unregister_master() is called after fiddling with the IRQ control
register.  The correct order is to call spi_unregister_master() *before*
this teardown step because bus accesses may still be ongoing until that
function returns.

Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: <stable@vger.kernel.org> # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Kozlov Sergey <serjk@netup.ru>
Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
@@ -175,7 +175,7 @@ int netup_spi_init(struct netup_unidvb_d
 	struct spi_master *master;
 	struct netup_spi *nspi;
 
-	master = spi_alloc_master(&ndev->pci_dev->dev,
+	master = devm_spi_alloc_master(&ndev->pci_dev->dev,
 		sizeof(struct netup_spi));
 	if (!master) {
 		dev_err(&ndev->pci_dev->dev,
@@ -208,6 +208,7 @@ int netup_spi_init(struct netup_unidvb_d
 		ndev->pci_slot,
 		ndev->pci_func);
 	if (!spi_new_device(master, &netup_spi_board)) {
+		spi_unregister_master(master);
 		ndev->spi = NULL;
 		dev_err(&ndev->pci_dev->dev,
 			"%s(): unable to create SPI device\n", __func__);
@@ -226,13 +227,13 @@ void netup_spi_release(struct netup_unid
 	if (!spi)
 		return;
 
+	spi_unregister_master(spi->master);
 	spin_lock_irqsave(&spi->lock, flags);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat);
 	spin_unlock_irqrestore(&spi->lock, flags);
-	spi_unregister_master(spi->master);
 	ndev->spi = NULL;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 524/717] media: ipu3-cio2: Remove traces of returned buffers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (521 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 523/717] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 525/717] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Andy Shevchenko,
	Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 upstream.

If starting a video buffer queue fails, the buffers are returned to
videobuf2. Remove the reference to the buffer from the driver's queue as
well.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org # v4.16 and up
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -791,6 +791,7 @@ static void cio2_vb2_return_all_buffers(
 			atomic_dec(&q->bufs_queued);
 			vb2_buffer_done(&q->bufs[i]->vbb.vb2_buf,
 					state);
+			q->bufs[i] = NULL;
 		}
 	}
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 525/717] media: ipu3-cio2: Return actual subdev format
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (522 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 524/717] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 526/717] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Sakari Ailus,
	Laurent Pinchart, Bingbu Cao, Andy Shevchenko,
	Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 8160e86702e0807bd36d40f82648f9f9820b9d5a upstream.

Return actual subdev format on ipu3-cio2 subdev pads. The earlier
implementation was based on an infinite recursion that exhausted the
stack.

Reported-by: Tsuchiya Yuto <kitakar@gmail.com>
Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1233,29 +1233,11 @@ static int cio2_subdev_get_fmt(struct v4
 			       struct v4l2_subdev_format *fmt)
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
-	struct v4l2_subdev_format format;
-	int ret;
 
-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
 		fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
-		return 0;
-	}
-
-	if (fmt->pad == CIO2_PAD_SINK) {
-		format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
-		ret = v4l2_subdev_call(sd, pad, get_fmt, NULL,
-				       &format);
-
-		if (ret)
-			return ret;
-		/* update colorspace etc */
-		q->subdev_fmt.colorspace = format.format.colorspace;
-		q->subdev_fmt.ycbcr_enc = format.format.ycbcr_enc;
-		q->subdev_fmt.quantization = format.format.quantization;
-		q->subdev_fmt.xfer_func = format.format.xfer_func;
-	}
-
-	fmt->format = q->subdev_fmt;
+	else
+		fmt->format = q->subdev_fmt;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 526/717] media: ipu3-cio2: Serialise access to pad format
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (523 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 525/717] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Laurent Pinchart,
	Bingbu Cao, Andy Shevchenko, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 55a6c6b2be3d6670bf5772364d8208bd8dc17da4 upstream.

Pad format can be accessed from user space. Serialise access to it.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   11 +++++++++++
 drivers/media/pci/intel/ipu3/ipu3-cio2.h |    1 +
 2 files changed, 12 insertions(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1234,11 +1234,15 @@ static int cio2_subdev_get_fmt(struct v4
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
 
+	mutex_lock(&q->subdev_lock);
+
 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
 		fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
 	else
 		fmt->format = q->subdev_fmt;
 
+	mutex_unlock(&q->subdev_lock);
+
 	return 0;
 }
 
@@ -1262,6 +1266,8 @@ static int cio2_subdev_set_fmt(struct v4
 	if (fmt->pad == CIO2_PAD_SOURCE)
 		return cio2_subdev_get_fmt(sd, cfg, fmt);
 
+	mutex_lock(&q->subdev_lock);
+
 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
 		*v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
 	} else {
@@ -1272,6 +1278,8 @@ static int cio2_subdev_set_fmt(struct v4
 		fmt->format = q->subdev_fmt;
 	}
 
+	mutex_unlock(&q->subdev_lock);
+
 	return 0;
 }
 
@@ -1530,6 +1538,7 @@ static int cio2_queue_init(struct cio2_d
 
 	/* Initialize miscellaneous variables */
 	mutex_init(&q->lock);
+	mutex_init(&q->subdev_lock);
 
 	/* Initialize formats to default values */
 	fmt = &q->subdev_fmt;
@@ -1646,6 +1655,7 @@ fail_vdev_media_entity:
 fail_subdev_media_entity:
 	cio2_fbpt_exit(q, &cio2->pci_dev->dev);
 fail_fbpt:
+	mutex_destroy(&q->subdev_lock);
 	mutex_destroy(&q->lock);
 
 	return r;
@@ -1658,6 +1668,7 @@ static void cio2_queue_exit(struct cio2_
 	v4l2_device_unregister_subdev(&q->subdev);
 	media_entity_cleanup(&q->subdev.entity);
 	cio2_fbpt_exit(q, &cio2->pci_dev->dev);
+	mutex_destroy(&q->subdev_lock);
 	mutex_destroy(&q->lock);
 }
 
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.h
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.h
@@ -335,6 +335,7 @@ struct cio2_queue {
 
 	/* Subdev, /dev/v4l-subdevX */
 	struct v4l2_subdev subdev;
+	struct mutex subdev_lock; /* Serialise acces to subdev_fmt field */
 	struct media_pad subdev_pads[CIO2_PADS];
 	struct v4l2_mbus_framefmt subdev_fmt;
 	atomic_t frame_sequence;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (524 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 526/717] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-30 12:25   ` Pavel Machek
  2020-12-28 12:48 ` [PATCH 5.10 528/717] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Andy Shevchenko,
	Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

Validate media bus code, width and height when setting the subdev format.

This effectively reworks how setting subdev format is implemented in the
driver.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1258,6 +1258,9 @@ static int cio2_subdev_set_fmt(struct v4
 			       struct v4l2_subdev_format *fmt)
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
+	struct v4l2_mbus_framefmt *mbus;
+	u32 mbus_code = fmt->format.code;
+	unsigned int i;
 
 	/*
 	 * Only allow setting sink pad format;
@@ -1266,18 +1269,26 @@ static int cio2_subdev_set_fmt(struct v4
 	if (fmt->pad == CIO2_PAD_SOURCE)
 		return cio2_subdev_get_fmt(sd, cfg, fmt);
 
-	mutex_lock(&q->subdev_lock);
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
+		mbus = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+	else
+		mbus = &q->subdev_fmt;
+
+	fmt->format.code = formats[0].mbus_code;
 
-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
-		*v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
-	} else {
-		/* It's the sink, allow changing frame size */
-		q->subdev_fmt.width = fmt->format.width;
-		q->subdev_fmt.height = fmt->format.height;
-		q->subdev_fmt.code = fmt->format.code;
-		fmt->format = q->subdev_fmt;
+	for (i = 0; i < ARRAY_SIZE(formats); i++) {
+		if (formats[i].mbus_code == fmt->format.code) {
+			fmt->format.code = mbus_code;
+			break;
+		}
 	}
 
+	fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
+	fmt->format.height = min_t(u32, fmt->format.height,
+				   CIO2_IMAGE_MAX_LENGTH);
+
+	mutex_lock(&q->subdev_lock);
+	*mbus = fmt->format;
 	mutex_unlock(&q->subdev_lock);
 
 	return 0;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 528/717] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (525 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 529/717] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Bingbu Cao,
	Andy Shevchenko, Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 219a8b9c04e54872f9a4d566633fb42f08bcbe2a upstream.

The ipu3-cio2 doesn't make use of the field and this is reflected in V4L2
buffers as well as the try format. Do this in active format, too.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1286,6 +1286,7 @@ static int cio2_subdev_set_fmt(struct v4
 	fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
 	fmt->format.height = min_t(u32, fmt->format.height,
 				   CIO2_IMAGE_MAX_LENGTH);
+	fmt->format.field = V4L2_FIELD_NONE;
 
 	mutex_lock(&q->subdev_lock);
 	*mbus = fmt->format;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 529/717] Input: cyapa_gen6 - fix out-of-bounds stack access
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (526 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 528/717] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 530/717] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dmitry Torokhov

From: Arnd Bergmann <arnd@arndb.de>

commit f051ae4f6c732c231046945b36234e977f8467c6 upstream.

gcc -Warray-bounds warns about a serious bug in
cyapa_pip_retrieve_data_structure:

drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':
include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
   40 |  *((__le16 *)p) = cpu_to_le16(val);
drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
  569 |  } __packed cmd;
      |             ^~~

Apparently the '-2' was added to the pointer instead of the value,
writing garbage into the stack next to this variable.

Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/cyapa_gen6.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/mouse/cyapa_gen6.c
+++ b/drivers/input/mouse/cyapa_gen6.c
@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_struc
 
 	memset(&cmd, 0, sizeof(cmd));
 	put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr);
-	put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2);
+	put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length);
 	cmd.head.report_id = PIP_APP_CMD_REPORT_ID;
 	cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE;
 	put_unaligned_le16(read_offset, &cmd.read_offset);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 530/717] ALSA: hda/ca0132 - Change Input Source enum strings.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (527 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 529/717] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 531/717] ACPI: NFIT: Fix input validation of bus-family Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Connor McAdams, Takashi Iwai

From: Connor McAdams <conmanx360@gmail.com>

commit 7079f785b50055a32b72eddcb7d9ba5688db24d0 upstream.

Change the Input Source enumerated control's strings to make it play
nice with pulseaudio.

Fixes: 7cb9d94c05de9 ("ALSA: hda/ca0132: add alt_select_in/out for R3Di + SBZ")
Cc: <stable@kernel.org>
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Link: https://lore.kernel.org/r/20201208195223.424753-2-conmanx360@gmail.com
Link: https://lore.kernel.org/r/20201210173550.2968-2-conmanx360@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_ca0132.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -95,7 +95,7 @@ enum {
 };
 
 /* Strings for Input Source Enum Control */
-static const char *const in_src_str[3] = {"Rear Mic", "Line", "Front Mic" };
+static const char *const in_src_str[3] = { "Microphone", "Line In", "Front Microphone" };
 #define IN_SRC_NUM_OF_INPUTS 3
 enum {
 	REAR_MIC,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 531/717] ACPI: NFIT: Fix input validation of bus-family
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (528 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 530/717] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 532/717] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dan Williams

From: Dan Williams <dan.j.williams@intel.com>

commit 9a7e3d7f056831a6193d6d737fb7a26dfdceb04b upstream.

Dan reports that smatch thinks userspace can craft an out-of-bound bus
family number. However, nd_cmd_clear_to_send() blocks all non-zero
values of bus-family since only the kernel can initiate these commands.
However, in the speculation path, family is a user controlled array
index value so mask it for speculation safety. Also, since the
nd_cmd_clear_to_send() safety is non-obvious and possibly may change in
the future include input validation as if userspace could get past the
nd_cmd_clear_to_send() gatekeeper.

Link: http://lore.kernel.org/r/20201111113000.GA1237157@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/nfit/core.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -5,6 +5,7 @@
 #include <linux/list_sort.h>
 #include <linux/libnvdimm.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/mutex.h>
 #include <linux/ndctl.h>
 #include <linux/sysfs.h>
@@ -478,8 +479,11 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
 		cmd_mask = nd_desc->cmd_mask;
 		if (cmd == ND_CMD_CALL && call_pkg->nd_family) {
 			family = call_pkg->nd_family;
-			if (!test_bit(family, &nd_desc->bus_family_mask))
+			if (family > NVDIMM_BUS_FAMILY_MAX ||
+			    !test_bit(family, &nd_desc->bus_family_mask))
 				return -EINVAL;
+			family = array_index_nospec(family,
+						    NVDIMM_BUS_FAMILY_MAX + 1);
 			dsm_mask = acpi_desc->family_dsm_mask[family];
 			guid = to_nfit_bus_uuid(family);
 		} else {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 532/717] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (529 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 531/717] ACPI: NFIT: Fix input validation of bus-family Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 533/717] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Mika Westerberg,
	Bjorn Helgaas

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

commit 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 upstream.

The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to
be reference counted for wakeup enabling, because they may be enabled
to signal wakeup on behalf of their subordinate devices and that
may happen for multiple times in a row, whereas for the other devices
it only makes sense to enable wakeup signaling once.

However, this becomes problematic if the bridge itself is suspended,
because it is treated as a "regular" device in that case and the
reference counting doesn't work.

For instance, suppose that there are two devices below a bridge and
they both can signal wakeup.  Every time one of them is suspended,
wakeup signaling is enabled for the bridge, so when they both have
been suspended, the bridge's wakeup reference counter value is 2.

Say that the bridge is suspended subsequently and acpi_pci_wakeup()
is called for it.  Because the bridge can signal wakeup, that
function will invoke acpi_pm_set_device_wakeup() to configure it
and __acpi_pm_set_device_wakeup() will be called with the last
argument equal to 1.  This causes __acpi_device_wakeup_enable()
invoked by it to omit the reference counting, because the reference
counter of the target device (the bridge) is 2 at that time.

Now say that the bridge resumes and one of the device below it
resumes too, so the bridge's reference counter becomes 0 and
wakeup signaling is disabled for it, but there is still the other
suspended device which may need the bridge to signal wakeup on its
behalf and that is not going to work.

To address this scenario, use wakeup enable reference counting for
all devices, not just for bridges, so drop the last argument from
__acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(),
which causes acpi_pm_set_device_wakeup() and
acpi_pm_set_bridge_wakeup() to become identical, so drop the latter
and use the former instead of it everywhere.

Fixes: 1ba51a7c1496 ("ACPI / PCI / PM: Rework acpi_pci_propagate_wakeup()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/device_pm.c |   41 ++++++++++++-----------------------------
 drivers/pci/pci-acpi.c   |    4 ++--
 include/acpi/acpi_bus.h  |    5 -----
 3 files changed, 14 insertions(+), 36 deletions(-)

--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -749,7 +749,7 @@ static void acpi_pm_notify_work_func(str
 static DEFINE_MUTEX(acpi_wakeup_lock);
 
 static int __acpi_device_wakeup_enable(struct acpi_device *adev,
-				       u32 target_state, int max_count)
+				       u32 target_state)
 {
 	struct acpi_device_wakeup *wakeup = &adev->wakeup;
 	acpi_status status;
@@ -757,9 +757,10 @@ static int __acpi_device_wakeup_enable(s
 
 	mutex_lock(&acpi_wakeup_lock);
 
-	if (wakeup->enable_count >= max_count)
+	if (wakeup->enable_count >= INT_MAX) {
+		acpi_handle_info(adev->handle, "Wakeup enable count out of bounds!\n");
 		goto out;
-
+	}
 	if (wakeup->enable_count > 0)
 		goto inc;
 
@@ -799,7 +800,7 @@ out:
  */
 static int acpi_device_wakeup_enable(struct acpi_device *adev, u32 target_state)
 {
-	return __acpi_device_wakeup_enable(adev, target_state, 1);
+	return __acpi_device_wakeup_enable(adev, target_state);
 }
 
 /**
@@ -829,8 +830,12 @@ out:
 	mutex_unlock(&acpi_wakeup_lock);
 }
 
-static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable,
-				       int max_count)
+/**
+ * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
+ * @dev: Device to enable/disable to generate wakeup events.
+ * @enable: Whether to enable or disable the wakeup functionality.
+ */
+int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
 {
 	struct acpi_device *adev;
 	int error;
@@ -850,37 +855,15 @@ static int __acpi_pm_set_device_wakeup(s
 		return 0;
 	}
 
-	error = __acpi_device_wakeup_enable(adev, acpi_target_system_state(),
-					    max_count);
+	error = __acpi_device_wakeup_enable(adev, acpi_target_system_state());
 	if (!error)
 		dev_dbg(dev, "Wakeup enabled by ACPI\n");
 
 	return error;
 }
-
-/**
- * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
- * @dev: Device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
-{
-	return __acpi_pm_set_device_wakeup(dev, enable, 1);
-}
 EXPORT_SYMBOL_GPL(acpi_pm_set_device_wakeup);
 
 /**
- * acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge.
- * @dev: Bridge device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
-	return __acpi_pm_set_device_wakeup(dev, enable, INT_MAX);
-}
-EXPORT_SYMBOL_GPL(acpi_pm_set_bridge_wakeup);
-
-/**
  * acpi_dev_pm_low_power - Put ACPI device into a low-power state.
  * @dev: Device to put into a low-power state.
  * @adev: ACPI device node corresponding to @dev.
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -1060,7 +1060,7 @@ static int acpi_pci_propagate_wakeup(str
 {
 	while (bus->parent) {
 		if (acpi_pm_device_can_wakeup(&bus->self->dev))
-			return acpi_pm_set_bridge_wakeup(&bus->self->dev, enable);
+			return acpi_pm_set_device_wakeup(&bus->self->dev, enable);
 
 		bus = bus->parent;
 	}
@@ -1068,7 +1068,7 @@ static int acpi_pci_propagate_wakeup(str
 	/* We have reached the root bus. */
 	if (bus->bridge) {
 		if (acpi_pm_device_can_wakeup(bus->bridge))
-			return acpi_pm_set_bridge_wakeup(bus->bridge, enable);
+			return acpi_pm_set_device_wakeup(bus->bridge, enable);
 	}
 	return 0;
 }
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -620,7 +620,6 @@ acpi_status acpi_remove_pm_notifier(stru
 bool acpi_pm_device_can_wakeup(struct device *dev);
 int acpi_pm_device_sleep_state(struct device *, int *, int);
 int acpi_pm_set_device_wakeup(struct device *dev, bool enable);
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable);
 #else
 static inline void acpi_pm_wakeup_event(struct device *dev)
 {
@@ -651,10 +650,6 @@ static inline int acpi_pm_set_device_wak
 {
 	return -ENODEV;
 }
-static inline int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
-	return -ENODEV;
-}
 #endif
 
 #ifdef CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 533/717] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (530 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 532/717] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 534/717] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Scally, Rafael J. Wysocki

From: Daniel Scally <djrscally@gmail.com>

commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream.

This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef.

Switching this function to AE_CTRL_TERMINATE broke the documented
behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in
fact, terminate the resource walk because acpi_walk_resource_buffer()
ignores it (specifically converting it to AE_OK), referring to that
value as "an OK termination by the user function". This means that
acpi_dev_get_resources() does not abort processing when the preproc
function returns a negative value.

Signed-off-by: Daniel Scally <djrscally@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/resource.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -541,7 +541,7 @@ static acpi_status acpi_dev_process_reso
 		ret = c->preproc(ares, c->preproc_data);
 		if (ret < 0) {
 			c->error = ret;
-			return AE_CTRL_TERMINATE;
+			return AE_ABORT_METHOD;
 		} else if (ret > 0) {
 			return AE_OK;
 		}



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 534/717] ACPI: PNP: compare the string length in the matching_id()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (531 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 533/717] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 535/717] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Hui Wang

From: Hui Wang <hui.wang@canonical.com>

commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream.

Recently we met a touchscreen problem on some Thinkpad machines, the
touchscreen driver (i2c-hid) is not loaded and the touchscreen can't
work.

An i2c ACPI device with the name WACF2200 is defined in the BIOS, with
the current rule in matching_id(), this device will be regarded as
a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and
this PNP device is attached to the acpi device as the 1st
physical_node, this will make the i2c bus match fail when i2c bus
calls acpi_companion_match() to match the acpi_id_table in the i2c-hid
driver.

WACF2200 is an i2c device instead of a PNP device, after adding the
string length comparing, the matching_id() will return false when
matching WACF2200 and WACFXXX, and it is reasonable to compare the
string length when matching two IDs.

Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpi_pnp.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/acpi/acpi_pnp.c
+++ b/drivers/acpi/acpi_pnp.c
@@ -319,6 +319,9 @@ static bool matching_id(const char *idst
 {
 	int i;
 
+	if (strlen(idstr) != strlen(list_id))
+		return false;
+
 	if (memcmp(idstr, list_id, 3))
 		return false;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 535/717] ALSA: hda: Fix regressions on clear and reconfig sysfs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (532 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 534/717] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 536/717] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 2506318e382c4c7daa77bdc48f80a0ee82804588 upstream.

It seems that the HD-audio clear and reconfig sysfs don't work any
longer after the recent driver core change.  There are multiple issues
around that: the linked list corruption and the dead device handling.
The former issue is fixed by another patch for the driver core itself,
while the latter patch needs to be addressed in HD-audio side.

This patch corresponds to the latter, it recovers those broken
functions by replacing the device detach and attach actions with the
standard core API functions, which are almost equivalent with unbind
and bind actions.

Fixes: 654888327e9f ("driver core: Avoid binding drivers to dead devices")
Cc: <stable@vger.kernel.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209207
Link: https://lore.kernel.org/r/20201209150119.7705-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_codec.c |    2 +-
 sound/pci/hda/hda_sysfs.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1803,7 +1803,7 @@ int snd_hda_codec_reset(struct hda_codec
 		return -EBUSY;
 
 	/* OK, let it free */
-	snd_hdac_device_unregister(&codec->core);
+	device_release_driver(hda_codec_dev(codec));
 
 	/* allow device access again */
 	snd_hda_unlock_devices(bus);
--- a/sound/pci/hda/hda_sysfs.c
+++ b/sound/pci/hda/hda_sysfs.c
@@ -139,7 +139,7 @@ static int reconfig_codec(struct hda_cod
 			   "The codec is being used, can't reconfigure.\n");
 		goto error;
 	}
-	err = snd_hda_codec_configure(codec);
+	err = device_reprobe(hda_codec_dev(codec));
 	if (err < 0)
 		goto error;
 	err = snd_card_register(codec->card);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 536/717] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (533 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 535/717] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 537/717] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Connor McAdams, Takashi Iwai

From: Connor McAdams <conmanx360@gmail.com>

commit c697ba85a94b8f65bf90dec5ef9af5c39c3e73b2 upstream.

The Windows driver sets the pincfg for the AE-5's rear-headphone to
report as a microphone. This causes issues with Pulseaudio mistakenly
believing there is no headphone plugged in. In Linux, we should instead
set it to be a headphone.

Fixes: a6b0961b39896 ("ALSA: hda/ca0132 - fix AE-5 pincfg")
Cc: <stable@kernel.org>
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Link: https://lore.kernel.org/r/20201208195223.424753-1-conmanx360@gmail.com
Link: https://lore.kernel.org/r/20201210173550.2968-1-conmanx360@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_ca0132.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1223,7 +1223,7 @@ static const struct hda_pintbl ae5_pincf
 	{ 0x0e, 0x01c510f0 }, /* SPDIF In */
 	{ 0x0f, 0x01017114 }, /* Port A -- Rear L/R. */
 	{ 0x10, 0x01017012 }, /* Port D -- Center/LFE or FP Hp */
-	{ 0x11, 0x01a170ff }, /* Port B -- LineMicIn2 / Rear Headphone */
+	{ 0x11, 0x012170ff }, /* Port B -- LineMicIn2 / Rear Headphone */
 	{ 0x12, 0x01a170f0 }, /* Port C -- LineIn1 */
 	{ 0x13, 0x908700f0 }, /* What U Hear In*/
 	{ 0x18, 0x50d000f0 }, /* N/A */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 537/717] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (534 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 536/717] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 538/717] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai

From: Hui Wang <hui.wang@canonical.com>

commit c72b9bfe0f914639cc475585f45722a3eb57a56d upstream.

This change could fix 2 issues on this machine:
 - the bass speaker's output volume can't be adjusted, that is because
   the bass speaker is routed to the DAC (Nid 0x6) which has no volume
   control.
 - after plugging a headset with vol+, vol- and pause buttons on it,
   press those buttons, nothing happens, this means those buttons
   don't work at all. This machine has alc287 codec, need to add the
   codec id to the disable/enable_headset_jack_key(), then the headset
   button could work.

The quirk of ALC285_FIXUP_THINKPAD_HEADSET_JACK could fix both of these
2 issues.

Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20201205051130.8122-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3104,6 +3104,7 @@ static void alc_disable_headset_jack_key
 	case 0x10ec0215:
 	case 0x10ec0225:
 	case 0x10ec0285:
+	case 0x10ec0287:
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
@@ -3130,6 +3131,7 @@ static void alc_enable_headset_jack_key(
 	case 0x10ec0215:
 	case 0x10ec0225:
 	case 0x10ec0285:
+	case 0x10ec0287:
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
@@ -8578,6 +8580,11 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170110},
 		{0x19, 0x04a11040},
 		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0287, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+		{0x14, 0x90170110},
+		{0x17, 0x90170111},
+		{0x19, 0x03a11030},
+		{0x21, 0x03211020}),
 	SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
 		{0x12, 0x90a60130},
 		{0x17, 0x90170110},



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 538/717] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (535 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 537/717] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 539/717] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 5cfca59604e423f720297e30a9dc493eea623493 upstream.

The ASUS laptop X430UN with ALC256 can't detect the headset microphone
until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201207072755.16210-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7958,6 +7958,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 539/717] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (536 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 538/717] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 540/717] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 7e413528474d5895e3e315c019fb0c43522eb6d9 upstream.

The ASUS laptop Q524UQK with ALC255 codec can't detect the headset
microphone until ALC255_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209045730.9972-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7979,6 +7979,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 540/717] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (537 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 539/717] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.10 541/717] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai

From: Kailang Yang <kailang@realtek.com>

commit 607184cb1635eaee239fe3fb9648a8b82a5232d7 upstream.

Add supported for more Lenovo ALC285 Headset Button.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/bb1f1da1526d460885aa4257be81eb94@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8577,6 +8577,10 @@ static const struct snd_hda_pin_quirk al
 		{0x12, 0x90a60130},
 		{0x19, 0x03a11020},
 		{0x21, 0x0321101f}),
+	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
+		{0x14, 0x90170110},
+		{0x19, 0x04a11040},
+		{0x21, 0x04211020}),
 	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
 		{0x12, 0x90a60130},
 		{0x14, 0x90170110},



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 541/717] ALSA: pcm: oss: Fix a few more UBSAN fixes
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (538 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 540/717] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 542/717] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+33ef0b6639a8d2d42b4c, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream.

There are a few places that call round{up|down}_pow_of_two() with the
value zero, and this causes undefined behavior warnings.  Avoid
calling those macros if such a nonsense value is passed; it's a minor
optimization as well, as we handle it as either an error or a value to
be skipped, instead.

Reported-by: syzbot+33ef0b6639a8d2d42b4c@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218161730.26596-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/oss/pcm_oss.c |   22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -693,6 +693,8 @@ static int snd_pcm_oss_period_size(struc
 
 	oss_buffer_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
+	if (!oss_buffer_size)
+		return -EINVAL;
 	oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
 	if (atomic_read(&substream->mmap_count)) {
 		if (oss_buffer_size > runtime->oss.mmap_bytes)
@@ -728,17 +730,21 @@ static int snd_pcm_oss_period_size(struc
 
 	min_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	min_period_size *= oss_frame_size;
-	min_period_size = roundup_pow_of_two(min_period_size);
-	if (oss_period_size < min_period_size)
-		oss_period_size = min_period_size;
+	if (min_period_size) {
+		min_period_size *= oss_frame_size;
+		min_period_size = roundup_pow_of_two(min_period_size);
+		if (oss_period_size < min_period_size)
+			oss_period_size = min_period_size;
+	}
 
 	max_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	max_period_size *= oss_frame_size;
-	max_period_size = rounddown_pow_of_two(max_period_size);
-	if (oss_period_size > max_period_size)
-		oss_period_size = max_period_size;
+	if (max_period_size) {
+		max_period_size *= oss_frame_size;
+		max_period_size = rounddown_pow_of_two(max_period_size);
+		if (oss_period_size > max_period_size)
+			oss_period_size = max_period_size;
+	}
 
 	oss_periods = oss_buffer_size / oss_period_size;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 542/717] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (539 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.10 541/717] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 543/717] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 13be30f156fda725b168ac89fc91f78651575307 upstream.

This Acer Veriton N4640G/N6640G/N2510G desktops have 2 headphone
jacks(front and rear), and a separate Mic In jack.

The rear headphone jack is actually a line out jack but always silent
while playing audio. The front 'Mic In' also fails the jack sensing.
Apply the ALC269_FIXUP_LIFEBOOK to have all audio jacks to work as
expected.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201222150459.9545-2-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7805,11 +7805,14 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+	SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", ALC269VC_FIXUP_ACER_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1025, 0x1166, "Acer Veriton N4640G", ALC269_FIXUP_LIFEBOOK),
+	SND_PCI_QUIRK(0x1025, 0x1167, "Acer Veriton N6640G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
 	SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
 	SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 543/717] ALSA: hda/realtek: Add quirk for MSI-GP73
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (540 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 542/717] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 544/717] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 09926202e939fd699650ac0fc0baa5757e069390 upstream.

MSI-GP73 (with SSID 1462:1229) requires yet again
ALC1220_FIXUP_CLEVO_P950 quirk like other MSI models.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210793
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201220080943.24839-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2516,6 +2516,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 544/717] ALSA: hda/realtek: Apply jack fixup for Quanta NL3
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (541 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 543/717] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 545/717] ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Chiu, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 6ca653e3f73a1af0f30dbf9c2c79d2897074989f upstream.

The Quanta NL3 laptop has both a headphone output jack and a headset
jack, on the right edge of the chassis.

The pin information suggests that both of these are at the Front.
The PulseAudio is confused to differentiate them so one of the jack
can neither get the jack sense working nor the audio output.

The ALC269_FIXUP_LIFEBOOK chained with ALC269_FIXUP_QUANTA_MUTE can
help to differentiate 2 jacks and get the 'Auto-Mute Mode' working
correctly.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201222150459.9545-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8021,6 +8021,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 545/717] ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (542 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 544/717] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 546/717] ALSA: hda/realtek - Supported Dell fixed type headset Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 34cdf405aa5de827b8bef79a6c82c39120b3729b upstream.

Acer TravelMate laptops P648/P658 series with codec ALC282 only have
one physical jack for headset but there's a confusing lineout pin on
NID 0x1b reported. Audio applications hence misunderstand that there
are a speaker and a lineout, and take the lineout as the default audio
output.

Add a new quirk to remove the useless lineout and enable the pin 0x18
for jack sensing and headset microphone.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201216125200.27053-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6369,6 +6369,7 @@ enum {
 	ALC287_FIXUP_HP_GPIO_LED,
 	ALC256_FIXUP_HP_HEADSET_MIC,
 	ALC236_FIXUP_DELL_AIO_HEADSET_MIC,
+	ALC282_FIXUP_ACER_DISABLE_LINEOUT,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -7792,6 +7793,16 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
 	},
+	[ALC282_FIXUP_ACER_DISABLE_LINEOUT] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1b, 0x411111f0 },
+			{ 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+			{ },
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8569,6 +8580,22 @@ static const struct snd_hda_pin_quirk al
 		{0x12, 0x90a60140},
 		{0x19, 0x04a11030},
 		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+		ALC282_STANDARD_PINS,
+		{0x12, 0x90a609c0},
+		{0x18, 0x03a11830},
+		{0x19, 0x04a19831},
+		{0x1a, 0x0481303f},
+		{0x1b, 0x04211020},
+		{0x21, 0x0321101f}),
+	SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
+		ALC282_STANDARD_PINS,
+		{0x12, 0x90a60940},
+		{0x18, 0x03a11830},
+		{0x19, 0x04a19831},
+		{0x1a, 0x0481303f},
+		{0x1b, 0x04211020},
+		{0x21, 0x0321101f}),
 	SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC282_STANDARD_PINS,
 		{0x12, 0x90a60130},



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 546/717] ALSA: hda/realtek - Supported Dell fixed type headset
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (543 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 545/717] ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 547/717] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai

From: Kailang Yang <kailang@realtek.com>

commit 150927c3674d7db4dd51a7269e01423c8c78e53b upstream.

This platform only supported iphone type headset.
It can't support Dell headset mode.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/b97e971978034bc9b772a08ec91265e8@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7885,6 +7885,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x09bf, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0a2e, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0a30, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1028, 0x0a58, "Dell Precision 3650 Tower", ALC255_FIXUP_DELL_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 547/717] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (544 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 546/717] ALSA: hda/realtek - Supported Dell fixed type headset Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 548/717] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amadej Kastelic, Emilio Moretti,
	Takashi Iwai

From: Amadej Kastelic <amadejkastelic7@gmail.com>

commit 725124d10d00b2f56bb5bd08b431cc74ab3b3ace upstream.

Add VID to support native DSD reproduction on FiiO devices.

Tested-by: Amadej Kastelic <amadejkastelic7@gmail.com>
Signed-off-by: Emilio Moretti <emilio.moretti@gmail.com>
Signed-off-by: Amadej Kastelic <amadejkastelic7@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/X9j7wdXSr4XyK7Bd@ryzen.localdomain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/quirks.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1799,6 +1799,7 @@ u64 snd_usb_interface_dsd_format_quirks(
 	case 0x25ce:  /* Mytek devices */
 	case 0x278b:  /* Rotel? */
 	case 0x292b:  /* Gustard/Ess based devices */
+	case 0x2972:  /* FiiO devices */
 	case 0x2ab6:  /* T+A devices */
 	case 0x3353:  /* Khadas devices */
 	case 0x3842:  /* EVGA */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 548/717] ALSA: usb-audio: Disable sample read check if firmware doesnt give back
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (545 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 547/717] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 549/717] ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d upstream.

Some buggy firmware don't give the current sample rate but leaves
zero.  Handle this case more gracefully without warning but just skip
the current rate verification from the next time.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218145858.2357-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/clock.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -531,6 +531,12 @@ static int set_sample_rate_v1(struct snd
 	}
 
 	crate = data[0] | (data[1] << 8) | (data[2] << 16);
+	if (!crate) {
+		dev_info(&dev->dev, "failed to read current rate; disabling the check\n");
+		chip->sample_rate_read_error = 3; /* three strikes, see above */
+		return 0;
+	}
+
 	if (crate != rate) {
 		dev_warn(&dev->dev, "current rate %d is different from the runtime rate %d\n", crate, rate);
 		// runtime->rate = crate;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 549/717] ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (546 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 548/717] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 550/717] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 525d9c57d0eeeb660d9b25e5b2d1c95975e3ba95 upstream.

ASUS PRIME TRX40 PRO-S mobo with 0b05:1918 needs the same quirk alias
for another ASUS mobo (0b05:1917) for the proper mixer mapping, etc.
Add the corresponding entry.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210783
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201221080159.24468-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/card.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -382,6 +382,9 @@ static const struct usb_audio_device_nam
 	/* ASUS ROG Strix */
 	PROFILE_NAME(0x0b05, 0x1917,
 		     "Realtek", "ALC1220-VB-DT", "Realtek-ALC1220-VB-Desktop"),
+	/* ASUS PRIME TRX40 PRO-S */
+	PROFILE_NAME(0x0b05, 0x1918,
+		     "Realtek", "ALC1220-VB-DT", "Realtek-ALC1220-VB-Desktop"),
 
 	/* Dell WD15 Dock */
 	PROFILE_NAME(0x0bda, 0x4014, "Dell", "WD15 Dock", "Dell-WD15-Dock"),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 550/717] ALSA: core: memalloc: add page alignment for iram
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (547 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 549/717] ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 551/717] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robin Gong, Takashi Iwai

From: Robin Gong <yibin.gong@nxp.com>

commit 74c64efa1557fef731b59eb813f115436d18078e upstream.

Since mmap for userspace is based on page alignment, add page alignment
for iram alloc from pool, otherwise, some good data located in the same
page of dmab->area maybe touched wrongly by userspace like pulseaudio.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1608221747-3474-1-git-send-email-yibin.gong@nxp.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/memalloc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/sound/core/memalloc.c
+++ b/sound/core/memalloc.c
@@ -77,7 +77,8 @@ static void snd_malloc_dev_iram(struct s
 	/* Assign the pool into private_data field */
 	dmab->private_data = pool;
 
-	dmab->area = gen_pool_dma_alloc(pool, size, &dmab->addr);
+	dmab->area = gen_pool_dma_alloc_align(pool, size, &dmab->addr,
+					PAGE_SIZE);
 }
 
 /**



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 551/717] s390/smp: perform initial CPU reset also for SMT siblings
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (548 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 550/717] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 552/717] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sven Schnelle, stable

From: Sven Schnelle <svens@linux.ibm.com>

commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream.

Not resetting the SMT siblings might leave them in unpredictable
state. One of the observed problems was that the CPU timer wasn't
reset and therefore large system time values where accounted during
CPU bringup.

Cc: <stable@kernel.org> # 4.0
Fixes: 10ad34bc76dfb ("s390: add SMT support")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/smp.c |   18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -896,24 +896,12 @@ static void __no_sanitize_address smp_st
 /* Upping and downing of CPUs */
 int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
-	struct pcpu *pcpu;
-	int base, i, rc;
+	struct pcpu *pcpu = pcpu_devices + cpu;
+	int rc;
 
-	pcpu = pcpu_devices + cpu;
 	if (pcpu->state != CPU_STATE_CONFIGURED)
 		return -EIO;
-	base = smp_get_base_cpu(cpu);
-	for (i = 0; i <= smp_cpu_mtid; i++) {
-		if (base + i < nr_cpu_ids)
-			if (cpu_online(base + i))
-				break;
-	}
-	/*
-	 * If this is the first CPU of the core to get online
-	 * do an initial CPU reset.
-	 */
-	if (i > smp_cpu_mtid &&
-	    pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) !=
+	if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) !=
 	    SIGP_CC_ORDER_CODE_ACCEPTED)
 		return -EIO;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 552/717] s390/kexec_file: fix diag308 subcode when loading crash kernel
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (549 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 551/717] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 553/717] s390/idle: add missing mt_cycles calculation Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Philipp Rudo, Xiaoying Yan,
	Lianbo Jiang, Heiko Carstens

From: Philipp Rudo <prudo@linux.ibm.com>

commit 613775d62ec60202f98d2c5f520e6e9ba6dd4ac4 upstream.

diag308 subcode 0 performes a clear reset which inlcudes the reset of
all registers in the system. While this is the preferred behavior when
loading a normal kernel via kexec it prevents the crash kernel to store
the register values in the dump. To prevent this use subcode 1 when
loading a crash kernel instead.

Fixes: ee337f5469fd ("s390/kexec_file: Add crash support to image loader")
Cc: <stable@vger.kernel.org> # 4.17
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reported-by: Xiaoying Yan <yiyan@redhat.com>
Tested-by: Lianbo Jiang <lijiang@redhat.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/purgatory/head.S |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/s390/purgatory/head.S
+++ b/arch/s390/purgatory/head.S
@@ -62,14 +62,15 @@
 	jh	10b
 .endm
 
-.macro START_NEXT_KERNEL base
+.macro START_NEXT_KERNEL base subcode
 	lg	%r4,kernel_entry-\base(%r13)
 	lg	%r5,load_psw_mask-\base(%r13)
 	ogr	%r4,%r5
 	stg	%r4,0(%r0)
 
 	xgr	%r0,%r0
-	diag	%r0,%r0,0x308
+	lghi	%r1,\subcode
+	diag	%r0,%r1,0x308
 .endm
 
 .text
@@ -123,7 +124,7 @@ ENTRY(purgatory_start)
 	je	.start_crash_kernel
 
 	/* start normal kernel */
-	START_NEXT_KERNEL .base_crash
+	START_NEXT_KERNEL .base_crash 0
 
 .return_old_kernel:
 	lmg	%r6,%r15,gprregs-.base_crash(%r13)
@@ -227,7 +228,7 @@ ENTRY(purgatory_start)
 	MEMCPY	%r9,%r10,%r11
 
 	/* start crash kernel */
-	START_NEXT_KERNEL .base_dst
+	START_NEXT_KERNEL .base_dst 1
 
 
 load_psw_mask:



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 553/717] s390/idle: add missing mt_cycles calculation
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (550 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 552/717] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 554/717] s390/idle: fix accounting with machine checks Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sven Schnelle

From: Sven Schnelle <svens@linux.ibm.com>

commit e259b3fafa7de362b04ecd86e7fa9a9e9273e5fb upstream.

During removal of the critical section cleanup the calculation
of mt_cycles during idle was removed. This causes invalid
accounting on systems with SMT enabled.

Fixes: 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S")
Cc: <stable@vger.kernel.org> # 5.8
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/entry.S |   34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -112,7 +112,7 @@ _LPP_OFFSET	= __LC_LPP
 
 	.macro	SWITCH_ASYNC savearea,timer
 	tmhh	%r8,0x0001		# interrupting from user ?
-	jnz	2f
+	jnz	4f
 #if IS_ENABLED(CONFIG_KVM)
 	lgr	%r14,%r9
 	larl	%r13,.Lsie_gmap
@@ -125,9 +125,25 @@ _LPP_OFFSET	= __LC_LPP
 #endif
 0:	larl	%r13,.Lpsw_idle_exit
 	cgr	%r13,%r9
-	jne	1f
+	jne	3f
 
-	mvc	__CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK
+	larl	%r1,smp_cpu_mtid
+	llgf	%r1,0(%r1)
+	ltgr	%r1,%r1
+	jz	2f			# no SMT, skip mt_cycles calculation
+	.insn	rsy,0xeb0000000017,%r1,5,__SF_EMPTY+80(%r15)
+	larl	%r3,mt_cycles
+	ag	%r3,__LC_PERCPU_OFFSET
+	la	%r4,__SF_EMPTY+16(%r15)
+1:	lg	%r0,0(%r3)
+	slg	%r0,0(%r4)
+	alg	%r0,64(%r4)
+	stg	%r0,0(%r3)
+	la	%r3,8(%r3)
+	la	%r4,8(%r4)
+	brct	%r1,1b
+
+2:	mvc	__CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK
 	mvc	__TIMER_IDLE_EXIT(8,%r2), __LC_ASYNC_ENTER_TIMER
 	# account system time going idle
 	ni	__LC_CPU_FLAGS+7,255-_CIF_ENABLED_WAIT
@@ -146,17 +162,17 @@ _LPP_OFFSET	= __LC_LPP
 	mvc	__LC_LAST_UPDATE_TIMER(8),__TIMER_IDLE_EXIT(%r2)
 
 	nihh	%r8,0xfcfd		# clear wait state and irq bits
-1:	lg	%r14,__LC_ASYNC_STACK	# are we already on the target stack?
+3:	lg	%r14,__LC_ASYNC_STACK	# are we already on the target stack?
 	slgr	%r14,%r15
 	srag	%r14,%r14,STACK_SHIFT
-	jnz	3f
+	jnz	5f
 	CHECK_STACK \savearea
 	aghi	%r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
-	j	4f
-2:	UPDATE_VTIME %r14,%r15,\timer
+	j	6f
+4:	UPDATE_VTIME %r14,%r15,\timer
 	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
-3:	lg	%r15,__LC_ASYNC_STACK	# load async stack
-4:	la	%r11,STACK_FRAME_OVERHEAD(%r15)
+5:	lg	%r15,__LC_ASYNC_STACK	# load async stack
+6:	la	%r11,STACK_FRAME_OVERHEAD(%r15)
 	.endm
 
 	.macro UPDATE_VTIME w1,w2,enter_timer



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 554/717] s390/idle: fix accounting with machine checks
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (551 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 553/717] s390/idle: add missing mt_cycles calculation Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 555/717] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sven Schnelle

From: Sven Schnelle <svens@linux.ibm.com>

commit 454efcf82ea17d7efeb86ebaa20775a21ec87d27 upstream.

When a machine check interrupt is triggered during idle, the code
is using the async timer/clock for idle time calculation. It should use
the machine check enter timer/clock which is passed to the macro.

Fixes: 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S")
Cc: <stable@vger.kernel.org> # 5.8
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/entry.S |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -110,7 +110,7 @@ _LPP_OFFSET	= __LC_LPP
 #endif
 	.endm
 
-	.macro	SWITCH_ASYNC savearea,timer
+	.macro	SWITCH_ASYNC savearea,timer,clock
 	tmhh	%r8,0x0001		# interrupting from user ?
 	jnz	4f
 #if IS_ENABLED(CONFIG_KVM)
@@ -143,8 +143,8 @@ _LPP_OFFSET	= __LC_LPP
 	la	%r4,8(%r4)
 	brct	%r1,1b
 
-2:	mvc	__CLOCK_IDLE_EXIT(8,%r2), __LC_INT_CLOCK
-	mvc	__TIMER_IDLE_EXIT(8,%r2), __LC_ASYNC_ENTER_TIMER
+2:	mvc	__CLOCK_IDLE_EXIT(8,%r2), \clock
+	mvc	__TIMER_IDLE_EXIT(8,%r2), \timer
 	# account system time going idle
 	ni	__LC_CPU_FLAGS+7,255-_CIF_ENABLED_WAIT
 
@@ -761,7 +761,7 @@ ENTRY(io_int_handler)
 	stmg	%r8,%r15,__LC_SAVE_AREA_ASYNC
 	lg	%r12,__LC_CURRENT
 	lmg	%r8,%r9,__LC_IO_OLD_PSW
-	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER
+	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER,__LC_INT_CLOCK
 	stmg	%r0,%r7,__PT_R0(%r11)
 	# clear user controlled registers to prevent speculative use
 	xgr	%r0,%r0
@@ -961,7 +961,7 @@ ENTRY(ext_int_handler)
 	stmg	%r8,%r15,__LC_SAVE_AREA_ASYNC
 	lg	%r12,__LC_CURRENT
 	lmg	%r8,%r9,__LC_EXT_OLD_PSW
-	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER
+	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER,__LC_INT_CLOCK
 	stmg	%r0,%r7,__PT_R0(%r11)
 	# clear user controlled registers to prevent speculative use
 	xgr	%r0,%r0
@@ -1183,7 +1183,7 @@ ENTRY(mcck_int_handler)
 	TSTMSK	__LC_MCCK_CODE,MCCK_CODE_PSW_IA_VALID
 	jno	.Lmcck_panic
 4:	ssm	__LC_PGM_NEW_PSW	# turn dat on, keep irqs off
-	SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+64,__LC_MCCK_ENTER_TIMER
+	SWITCH_ASYNC __LC_GPREGS_SAVE_AREA+64,__LC_MCCK_ENTER_TIMER,__LC_MCCK_CLOCK
 .Lmcck_skip:
 	lghi	%r14,__LC_GPREGS_SAVE_AREA+64
 	stmg	%r0,%r7,__PT_R0(%r11)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 555/717] s390/dasd: fix hanging device offline processing
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (552 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 554/717] s390/idle: fix accounting with machine checks Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 556/717] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 658a337a606f48b7ebe451591f7681d383fa115e upstream.

For an LCU update a read unit address configuration IO is required.
This is started using sleep_on(), which has early exit paths in case the
device is not usable for IO. For example when it is in offline processing.

In those cases the LCU update should fail and not be retried.
Therefore lcu_update_work checks if EOPNOTSUPP is returned or not.

Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
accidentally removed the EOPNOTSUPP return code from
read_unit_address_configuration(), which in turn might lead to an endless
loop of the LCU update in offline processing.

Fix by returning EOPNOTSUPP again if the device is not able to perform the
request.

Fixes: 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
Cc: stable@vger.kernel.org #5.3
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -462,11 +462,19 @@ static int read_unit_address_configurati
 	spin_unlock_irqrestore(&lcu->lock, flags);
 
 	rc = dasd_sleep_on(cqr);
-	if (rc && !suborder_not_supported(cqr)) {
+	if (!rc)
+		goto out;
+
+	if (suborder_not_supported(cqr)) {
+		/* suborder not supported or device unusable for IO */
+		rc = -EOPNOTSUPP;
+	} else {
+		/* IO failed but should be retried */
 		spin_lock_irqsave(&lcu->lock, flags);
 		lcu->flags |= NEED_UAC_UPDATE;
 		spin_unlock_irqrestore(&lcu->lock, flags);
 	}
+out:
 	dasd_sfree_request(cqr, cqr->memdev);
 	return rc;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 556/717] s390/dasd: prevent inconsistent LCU device data
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (553 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 555/717] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 557/717] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit a29ea01653493b94ea12bb2b89d1564a265081b6 upstream.

Prevent _lcu_update from adding a device to a pavgroup if the LCU still
requires an update. The data is not reliable any longer and in parallel
devices might have been moved on the lists already.
This might lead to list corruptions or invalid PAV grouping.
Only add devices to a pavgroup if the LCU is up to date. Additional steps
are taken by the scheduled lcu update.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -511,6 +511,14 @@ static int _lcu_update(struct dasd_devic
 		return rc;
 
 	spin_lock_irqsave(&lcu->lock, flags);
+	/*
+	 * there is another update needed skip the remaining handling
+	 * the data might already be outdated
+	 * but especially do not add the device to an LCU with pending
+	 * update
+	 */
+	if (lcu->flags & NEED_UAC_UPDATE)
+		goto out;
 	lcu->pav = NO_PAV;
 	for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
 		switch (lcu->uac->unit[i].ua_type) {
@@ -529,6 +537,7 @@ static int _lcu_update(struct dasd_devic
 				 alias_list) {
 		_add_device_to_lcu(lcu, device, refdev);
 	}
+out:
 	spin_unlock_irqrestore(&lcu->lock, flags);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 557/717] s390/dasd: fix list corruption of pavgroup group list
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (554 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 556/717] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 558/717] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream.

dasd_alias_add_device() moves devices to the active_devices list in case
of a scheduled LCU update regardless if they have previously been in a
pavgroup or not.

Example: device A and B are in the same pavgroup.

Device A has already been in a pavgroup and the private->pavgroup pointer
is set and points to a valid pavgroup. While going through dasd_add_device
it is moved from the pavgroup to the active_devices list.

In parallel device B might be removed from the same pavgroup in
remove_device_from_lcu() which in turn checks if the group is empty
and deletes it accordingly because device A has already been removed from
there.

When now device A enters remove_device_from_lcu() it is tried to remove it
from the pavgroup again because the pavgroup pointer is still set and again
the empty group will be cleaned up which leads to a list corruption.

Fix by setting private->pavgroup to NULL in dasd_add_device.

If the device has been the last device on the pavgroup an empty pavgroup
remains but this will be cleaned up by the scheduled lcu_update which
iterates over all existing pavgroups.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -642,6 +642,7 @@ int dasd_alias_add_device(struct dasd_de
 	}
 	if (lcu->flags & UPDATE_PENDING) {
 		list_move(&device->alias_list, &lcu->active_devices);
+		private->pavgroup = NULL;
 		_schedule_lcu_update(lcu, device);
 	}
 	spin_unlock_irqrestore(&lcu->lock, flags);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 558/717] s390/dasd: fix list corruption of lcu list
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (555 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 557/717] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 559/717] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream.

In dasd_alias_disconnect_device_from_lcu the device is removed from any
list on the LCU. Afterwards the LCU is removed from the lcu list if it
does not contain devices any longer.

The lcu->lock protects the lcu from parallel updates. But to cancel all
workers and wait for completion the lcu->lock has to be unlocked.

If two devices are removed in parallel and both are removed from the LCU
the first device that takes the lcu->lock again will delete the LCU because
it is already empty but the second device also tries to free the LCU which
leads to a list corruption of the lcu list.

Fix by removing the device right before the lcu is checked without
unlocking the lcu->lock in between.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_l
 		return;
 	device->discipline->get_uid(device, &uid);
 	spin_lock_irqsave(&lcu->lock, flags);
-	list_del_init(&device->alias_list);
 	/* make sure that the workers don't use this device */
 	if (device == lcu->suc_data.device) {
 		spin_unlock_irqrestore(&lcu->lock, flags);
@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_l
 
 	spin_lock_irqsave(&aliastree.lock, flags);
 	spin_lock(&lcu->lock);
+	list_del_init(&device->alias_list);
 	if (list_empty(&lcu->grouplist) &&
 	    list_empty(&lcu->active_devices) &&
 	    list_empty(&lcu->inactive_devices)) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 559/717] binder: add flag to clear buffer on txn complete
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (556 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 558/717] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 560/717] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Todd Kjos

From: Todd Kjos <tkjos@google.com>

commit 0f966cba95c78029f491b433ea95ff38f414a761 upstream.

Add a per-transaction flag to indicate that the buffer
must be cleared when the transaction is complete to
prevent copies of sensitive data from being preserved
in memory.

Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201120233743.3617529-1-tkjos@google.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/android/binder.c            |    1 
 drivers/android/binder_alloc.c      |   48 ++++++++++++++++++++++++++++++++++++
 drivers/android/binder_alloc.h      |    4 ++-
 include/uapi/linux/android/binder.h |    1 
 4 files changed, 53 insertions(+), 1 deletion(-)

--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3146,6 +3146,7 @@ static void binder_transaction(struct bi
 	t->buffer->debug_id = t->debug_id;
 	t->buffer->transaction = t;
 	t->buffer->target_node = target_node;
+	t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);
 	trace_binder_transaction_alloc_buf(t->buffer);
 
 	if (binder_alloc_copy_user_to_buffer(
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -696,6 +696,8 @@ static void binder_free_buf_locked(struc
 	binder_insert_free_buffer(alloc, buffer);
 }
 
+static void binder_alloc_clear_buf(struct binder_alloc *alloc,
+				   struct binder_buffer *buffer);
 /**
  * binder_alloc_free_buf() - free a binder buffer
  * @alloc:	binder_alloc for this proc
@@ -706,6 +708,18 @@ static void binder_free_buf_locked(struc
 void binder_alloc_free_buf(struct binder_alloc *alloc,
 			    struct binder_buffer *buffer)
 {
+	/*
+	 * We could eliminate the call to binder_alloc_clear_buf()
+	 * from binder_alloc_deferred_release() by moving this to
+	 * binder_alloc_free_buf_locked(). However, that could
+	 * increase contention for the alloc mutex if clear_on_free
+	 * is used frequently for large buffers. The mutex is not
+	 * needed for correctness here.
+	 */
+	if (buffer->clear_on_free) {
+		binder_alloc_clear_buf(alloc, buffer);
+		buffer->clear_on_free = false;
+	}
 	mutex_lock(&alloc->mutex);
 	binder_free_buf_locked(alloc, buffer);
 	mutex_unlock(&alloc->mutex);
@@ -802,6 +816,10 @@ void binder_alloc_deferred_release(struc
 		/* Transaction should already have been freed */
 		BUG_ON(buffer->transaction);
 
+		if (buffer->clear_on_free) {
+			binder_alloc_clear_buf(alloc, buffer);
+			buffer->clear_on_free = false;
+		}
 		binder_free_buf_locked(alloc, buffer);
 		buffers++;
 	}
@@ -1136,6 +1154,36 @@ static struct page *binder_alloc_get_pag
 }
 
 /**
+ * binder_alloc_clear_buf() - zero out buffer
+ * @alloc: binder_alloc for this proc
+ * @buffer: binder buffer to be cleared
+ *
+ * memset the given buffer to 0
+ */
+static void binder_alloc_clear_buf(struct binder_alloc *alloc,
+				   struct binder_buffer *buffer)
+{
+	size_t bytes = binder_alloc_buffer_size(alloc, buffer);
+	binder_size_t buffer_offset = 0;
+
+	while (bytes) {
+		unsigned long size;
+		struct page *page;
+		pgoff_t pgoff;
+		void *kptr;
+
+		page = binder_alloc_get_page(alloc, buffer,
+					     buffer_offset, &pgoff);
+		size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
+		kptr = kmap(page) + pgoff;
+		memset(kptr, 0, size);
+		kunmap(page);
+		bytes -= size;
+		buffer_offset += size;
+	}
+}
+
+/**
  * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
  * @alloc: binder_alloc for this proc
  * @buffer: binder buffer to be accessed
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -23,6 +23,7 @@ struct binder_transaction;
  * @entry:              entry alloc->buffers
  * @rb_node:            node for allocated_buffers/free_buffers rb trees
  * @free:               %true if buffer is free
+ * @clear_on_free:      %true if buffer must be zeroed after use
  * @allow_user_free:    %true if user is allowed to free buffer
  * @async_transaction:  %true if buffer is in use for an async txn
  * @debug_id:           unique ID for debugging
@@ -41,9 +42,10 @@ struct binder_buffer {
 	struct rb_node rb_node; /* free entry by size or allocated entry */
 				/* by address */
 	unsigned free:1;
+	unsigned clear_on_free:1;
 	unsigned allow_user_free:1;
 	unsigned async_transaction:1;
-	unsigned debug_id:29;
+	unsigned debug_id:28;
 
 	struct binder_transaction *transaction;
 
--- a/include/uapi/linux/android/binder.h
+++ b/include/uapi/linux/android/binder.h
@@ -248,6 +248,7 @@ enum transaction_flags {
 	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */
 	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */
 	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */
+	TF_CLEAR_BUF	= 0x20,	/* clear buffer on txn complete */
 };
 
 struct binder_transaction_data {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 560/717] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (557 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 559/717] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 561/717] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS) Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Mark Brown

From: Takashi Iwai <tiwai@suse.de>

commit 0d024a8bec084205fdd9fa17479ba91f45f85db3 upstream.

The cx2072x codec driver defines multiple DAIs with the same stream
name "Playback" and "Capture".  Although the current code works more
or less as is as the secondary streams are never used, it still leads
the error message like:
 debugfs: File 'Playback' in directory 'dapm' already present!
 debugfs: File 'Capture' in directory 'dapm' already present!

Fix it by renaming the secondary streams to unique names.

Fixes: a497a4363706 ("ASoC: Add support for Conexant CX2072X CODEC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20201208135154.9188-1-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/cx2072x.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/cx2072x.c
+++ b/sound/soc/codecs/cx2072x.c
@@ -1579,7 +1579,7 @@ static struct snd_soc_dai_driver soc_cod
 		.id	= CX2072X_DAI_DSP,
 		.probe = cx2072x_dsp_dai_probe,
 		.playback = {
-			.stream_name = "Playback",
+			.stream_name = "DSP Playback",
 			.channels_min = 2,
 			.channels_max = 2,
 			.rates = CX2072X_RATES_DSP,
@@ -1591,7 +1591,7 @@ static struct snd_soc_dai_driver soc_cod
 		.name = "cx2072x-aec",
 		.id	= 3,
 		.capture = {
-			.stream_name = "Capture",
+			.stream_name = "AEC Capture",
 			.channels_min = 2,
 			.channels_max = 2,
 			.rates = CX2072X_RATES_DSP,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 561/717] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS)
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (558 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 560/717] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 562/717] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision) Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Vijendar Mukunda, Mark Brown,
	Jaroslav Kysela

From: Jaroslav Kysela <perex@perex.cz>

commit 718c406e1ffaca4eac987b957bbb36ce1090797a upstream.

Users reported that some Lenovo AMD platforms do not have ACP microphone,
but the BIOS advertises it via ACPI.

This patch create a simple DMI table, where those machines with the broken
BIOS can be added. The DMI description for Lenovo IdeaPad 5 and
IdeaPad Flex 5 devices are added there.

Also describe the dmic_acpi_check kernel module parameter in a more
understandable way.

Cc: <stable@kernel.org>
Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20201208171200.2737620-1-perex@perex.cz
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/amd/renoir/rn-pci-acp3x.c |   28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

--- a/sound/soc/amd/renoir/rn-pci-acp3x.c
+++ b/sound/soc/amd/renoir/rn-pci-acp3x.c
@@ -6,6 +6,7 @@
 
 #include <linux/pci.h>
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/module.h>
 #include <linux/io.h>
 #include <linux/delay.h>
@@ -20,14 +21,13 @@ module_param(acp_power_gating, int, 0644
 MODULE_PARM_DESC(acp_power_gating, "Enable acp power gating");
 
 /**
- * dmic_acpi_check = -1 - Checks ACPI method to know DMIC hardware status runtime
- *                 = 0 - Skips the DMIC device creation and returns probe failure
- *                 = 1 - Assumes that platform has DMIC support and skips ACPI
- *                       method check
+ * dmic_acpi_check = -1 - Use ACPI/DMI method to detect the DMIC hardware presence at runtime
+ *                 =  0 - Skip the DMIC device creation and return probe failure
+ *                 =  1 - Force DMIC support
  */
 static int dmic_acpi_check = ACP_DMIC_AUTO;
 module_param(dmic_acpi_check, bint, 0644);
-MODULE_PARM_DESC(dmic_acpi_check, "checks Dmic hardware runtime");
+MODULE_PARM_DESC(dmic_acpi_check, "Digital microphone presence (-1=auto, 0=none, 1=force)");
 
 struct acp_dev_data {
 	void __iomem *acp_base;
@@ -163,6 +163,17 @@ static int rn_acp_deinit(void __iomem *a
 	return 0;
 }
 
+static const struct dmi_system_id rn_acp_quirk_table[] = {
+	{
+		/* Lenovo IdeaPad Flex 5 14ARE05, IdeaPad 5 15ARE05 */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"),
+		}
+	},
+	{}
+};
+
 static int snd_rn_acp_probe(struct pci_dev *pci,
 			    const struct pci_device_id *pci_id)
 {
@@ -172,6 +183,7 @@ static int snd_rn_acp_probe(struct pci_d
 	acpi_handle handle;
 	acpi_integer dmic_status;
 #endif
+	const struct dmi_system_id *dmi_id;
 	unsigned int irqflags;
 	int ret, index;
 	u32 addr;
@@ -232,6 +244,12 @@ static int snd_rn_acp_probe(struct pci_d
 			goto de_init;
 		}
 #endif
+		dmi_id = dmi_first_match(rn_acp_quirk_table);
+		if (dmi_id && !dmi_id->driver_data) {
+			dev_info(&pci->dev, "ACPI settings override using DMI (ACP mic is not present)");
+			ret = -ENODEV;
+			goto de_init;
+		}
 	}
 
 	adata->res = devm_kzalloc(&pci->dev,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 562/717] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (559 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 561/717] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS) Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 563/717] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Vijendar Mukunda, Mark Brown,
	Jaroslav Kysela

From: Jaroslav Kysela <perex@perex.cz>

commit 55d8e6a85bce21f748c42eedea63681219f70523 upstream.

The Raven and Renoir ACP can be distinguished by the PCI revision.
Let's do the check very early, otherwise the wrong probe code
can be run.

Link: https://lore.kernel.org/alsa-devel/2e4587f8-f602-cf23-4845-fd27a32b1cfc@amd.com/
Cc: <stable@kernel.org>
Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20201208181233.2745726-1-perex@perex.cz
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/amd/raven/pci-acp3x.c     |    4 ++++
 sound/soc/amd/renoir/rn-pci-acp3x.c |    4 ++++
 2 files changed, 8 insertions(+)

--- a/sound/soc/amd/raven/pci-acp3x.c
+++ b/sound/soc/amd/raven/pci-acp3x.c
@@ -118,6 +118,10 @@ static int snd_acp3x_probe(struct pci_de
 	int ret, i;
 	u32 addr, val;
 
+	/* Raven device detection */
+	if (pci->revision != 0x00)
+		return -ENODEV;
+
 	if (pci_enable_device(pci)) {
 		dev_err(&pci->dev, "pci_enable_device failed\n");
 		return -ENODEV;
--- a/sound/soc/amd/renoir/rn-pci-acp3x.c
+++ b/sound/soc/amd/renoir/rn-pci-acp3x.c
@@ -188,6 +188,10 @@ static int snd_rn_acp_probe(struct pci_d
 	int ret, index;
 	u32 addr;
 
+	/* Renoir device check */
+	if (pci->revision != 0x01)
+		return -ENODEV;
+
 	if (pci_enable_device(pci)) {
 		dev_err(&pci->dev, "pci_enable_device failed\n");
 		return -ENODEV;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 563/717] staging: comedi: mf6x4: Fix AI end-of-conversion detection
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (560 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 562/717] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision) Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 564/717] z3fold: simplify freeing slots Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rostislav Lisovy, Ian Abbott

From: Ian Abbott <abbotti@mev.co.uk>

commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream.

I have had reports from two different people that attempts to read the
analog input channels of the MF624 board fail with an `ETIMEDOUT` error.

After triggering the conversion, the code calls `comedi_timeout()` with
`mf6x4_ai_eoc()` as the callback function to check if the conversion is
complete.  The callback returns 0 if complete or `-EBUSY` if not yet
complete.  `comedi_timeout()` returns `-ETIMEDOUT` if it has not
completed within a timeout period which is propagated as an error to the
user application.

The existing code considers the conversion to be complete when the EOLC
bit is high.  However, according to the user manuals for the MF624 and
MF634 boards, this test is incorrect because EOLC is an active low
signal that goes high when the conversion is triggered, and goes low
when the conversion is complete.  Fix the problem by inverting the test
of the EOLC bit state.

Fixes: 04b565021a83 ("comedi: Humusoft MF634 and MF624 DAQ cards driver")
Cc: <stable@vger.kernel.org> # v4.4+
Cc: Rostislav Lisovy <lisovy@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20201207145806.4046-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/mf6x4.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/staging/comedi/drivers/mf6x4.c
+++ b/drivers/staging/comedi/drivers/mf6x4.c
@@ -112,8 +112,9 @@ static int mf6x4_ai_eoc(struct comedi_de
 	struct mf6x4_private *devpriv = dev->private;
 	unsigned int status;
 
+	/* EOLC goes low at end of conversion. */
 	status = ioread32(devpriv->gpioc_reg);
-	if (status & MF6X4_GPIOC_EOLC)
+	if ((status & MF6X4_GPIOC_EOLC) == 0)
 		return 0;
 	return -EBUSY;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 564/717] z3fold: simplify freeing slots
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (561 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 563/717] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 565/717] z3fold: stricter locking and more careful reclaim Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vitaly Wool, Mike Galbraith,
	Sebastian Andrzej Siewior, Andrew Morton, Linus Torvalds

From: Vitaly Wool <vitaly.wool@konsulko.com>

commit fc5488651c7d840c9cad9b0f273f2f31bd03413a upstream.

Patch series "z3fold: stability / rt fixes".

Address z3fold stability issues under stress load, primarily in the
reclaim and free aspects.  Besides, it fixes the locking problems that
were only seen in real-time kernel configuration.

This patch (of 3):

There used to be two places in the code where slots could be freed, namely
when freeing the last allocated handle from the slots and when releasing
the z3fold header these slots aree linked to.  The logic to decide on
whether to free certain slots was complicated and error prone in both
functions and it led to failures in RT case.

To fix that, make free_handle() the single point of freeing slots.

Link: https://lkml.kernel.org/r/20201209145151.18994-1-vitaly.wool@konsulko.com
Link: https://lkml.kernel.org/r/20201209145151.18994-2-vitaly.wool@konsulko.com
Signed-off-by: Vitaly Wool <vitaly.wool@konsulko.com>
Tested-by: Mike Galbraith <efault@gmx.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/z3fold.c |   55 +++++++++++++------------------------------------------
 1 file changed, 13 insertions(+), 42 deletions(-)

--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -90,7 +90,7 @@ struct z3fold_buddy_slots {
 	 * be enough slots to hold all possible variants
 	 */
 	unsigned long slot[BUDDY_MASK + 1];
-	unsigned long pool; /* back link + flags */
+	unsigned long pool; /* back link */
 	rwlock_t lock;
 };
 #define HANDLE_FLAG_MASK	(0x03)
@@ -182,13 +182,6 @@ enum z3fold_page_flags {
 };
 
 /*
- * handle flags, go under HANDLE_FLAG_MASK
- */
-enum z3fold_handle_flags {
-	HANDLES_ORPHANED = 0,
-};
-
-/*
  * Forward declarations
  */
 static struct z3fold_header *__z3fold_alloc(struct z3fold_pool *, size_t, bool);
@@ -303,10 +296,9 @@ static inline void put_z3fold_header(str
 		z3fold_page_unlock(zhdr);
 }
 
-static inline void free_handle(unsigned long handle)
+static inline void free_handle(unsigned long handle, struct z3fold_header *zhdr)
 {
 	struct z3fold_buddy_slots *slots;
-	struct z3fold_header *zhdr;
 	int i;
 	bool is_free;
 
@@ -316,22 +308,13 @@ static inline void free_handle(unsigned
 	if (WARN_ON(*(unsigned long *)handle == 0))
 		return;
 
-	zhdr = handle_to_z3fold_header(handle);
 	slots = handle_to_slots(handle);
 	write_lock(&slots->lock);
 	*(unsigned long *)handle = 0;
-	if (zhdr->slots == slots) {
-		write_unlock(&slots->lock);
-		return; /* simple case, nothing else to do */
-	}
+	if (zhdr->slots != slots)
+		zhdr->foreign_handles--;
 
-	/* we are freeing a foreign handle if we are here */
-	zhdr->foreign_handles--;
 	is_free = true;
-	if (!test_bit(HANDLES_ORPHANED, &slots->pool)) {
-		write_unlock(&slots->lock);
-		return;
-	}
 	for (i = 0; i <= BUDDY_MASK; i++) {
 		if (slots->slot[i]) {
 			is_free = false;
@@ -343,6 +326,8 @@ static inline void free_handle(unsigned
 	if (is_free) {
 		struct z3fold_pool *pool = slots_to_pool(slots);
 
+		if (zhdr->slots == slots)
+			zhdr->slots = NULL;
 		kmem_cache_free(pool->c_handle, slots);
 	}
 }
@@ -525,8 +510,6 @@ static void __release_z3fold_page(struct
 {
 	struct page *page = virt_to_page(zhdr);
 	struct z3fold_pool *pool = zhdr_to_pool(zhdr);
-	bool is_free = true;
-	int i;
 
 	WARN_ON(!list_empty(&zhdr->buddy));
 	set_bit(PAGE_STALE, &page->private);
@@ -536,21 +519,6 @@ static void __release_z3fold_page(struct
 		list_del_init(&page->lru);
 	spin_unlock(&pool->lock);
 
-	/* If there are no foreign handles, free the handles array */
-	read_lock(&zhdr->slots->lock);
-	for (i = 0; i <= BUDDY_MASK; i++) {
-		if (zhdr->slots->slot[i]) {
-			is_free = false;
-			break;
-		}
-	}
-	if (!is_free)
-		set_bit(HANDLES_ORPHANED, &zhdr->slots->pool);
-	read_unlock(&zhdr->slots->lock);
-
-	if (is_free)
-		kmem_cache_free(pool->c_handle, zhdr->slots);
-
 	if (locked)
 		z3fold_page_unlock(zhdr);
 
@@ -973,6 +941,9 @@ lookup:
 		}
 	}
 
+	if (zhdr && !zhdr->slots)
+		zhdr->slots = alloc_slots(pool,
+					can_sleep ? GFP_NOIO : GFP_ATOMIC);
 	return zhdr;
 }
 
@@ -1270,7 +1241,7 @@ static void z3fold_free(struct z3fold_po
 	}
 
 	if (!page_claimed)
-		free_handle(handle);
+		free_handle(handle, zhdr);
 	if (kref_put(&zhdr->refcount, release_z3fold_page_locked_list)) {
 		atomic64_dec(&pool->pages_nr);
 		return;
@@ -1429,19 +1400,19 @@ static int z3fold_reclaim_page(struct z3
 			ret = pool->ops->evict(pool, middle_handle);
 			if (ret)
 				goto next;
-			free_handle(middle_handle);
+			free_handle(middle_handle, zhdr);
 		}
 		if (first_handle) {
 			ret = pool->ops->evict(pool, first_handle);
 			if (ret)
 				goto next;
-			free_handle(first_handle);
+			free_handle(first_handle, zhdr);
 		}
 		if (last_handle) {
 			ret = pool->ops->evict(pool, last_handle);
 			if (ret)
 				goto next;
-			free_handle(last_handle);
+			free_handle(last_handle, zhdr);
 		}
 next:
 		if (test_bit(PAGE_HEADLESS, &page->private)) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 565/717] z3fold: stricter locking and more careful reclaim
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (562 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 564/717] z3fold: simplify freeing slots Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 566/717] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vitaly Wool, Mike Galbraith,
	Sebastian Andrzej Siewior, Andrew Morton, Linus Torvalds

From: Vitaly Wool <vitaly.wool@konsulko.com>

commit dcf5aedb24f899d537e21c18ea552c780598d352 upstream.

Use temporary slots in reclaim function to avoid possible race when
freeing those.

While at it, make sure we check CLAIMED flag under page lock in the
reclaim function to make sure we are not racing with z3fold_alloc().

Link: https://lkml.kernel.org/r/20201209145151.18994-4-vitaly.wool@konsulko.com
Signed-off-by: Vitaly Wool <vitaly.wool@konsulko.com>
Cc: <stable@vger.kernel.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/z3fold.c |  143 +++++++++++++++++++++++++++++++++++-------------------------
 1 file changed, 85 insertions(+), 58 deletions(-)

--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -182,6 +182,13 @@ enum z3fold_page_flags {
 };
 
 /*
+ * handle flags, go under HANDLE_FLAG_MASK
+ */
+enum z3fold_handle_flags {
+	HANDLES_NOFREE = 0,
+};
+
+/*
  * Forward declarations
  */
 static struct z3fold_header *__z3fold_alloc(struct z3fold_pool *, size_t, bool);
@@ -311,6 +318,12 @@ static inline void free_handle(unsigned
 	slots = handle_to_slots(handle);
 	write_lock(&slots->lock);
 	*(unsigned long *)handle = 0;
+
+	if (test_bit(HANDLES_NOFREE, &slots->pool)) {
+		write_unlock(&slots->lock);
+		return; /* simple case, nothing else to do */
+	}
+
 	if (zhdr->slots != slots)
 		zhdr->foreign_handles--;
 
@@ -621,6 +634,28 @@ static inline void add_to_unbuddied(stru
 	}
 }
 
+static inline enum buddy get_free_buddy(struct z3fold_header *zhdr, int chunks)
+{
+	enum buddy bud = HEADLESS;
+
+	if (zhdr->middle_chunks) {
+		if (!zhdr->first_chunks &&
+		    chunks <= zhdr->start_middle - ZHDR_CHUNKS)
+			bud = FIRST;
+		else if (!zhdr->last_chunks)
+			bud = LAST;
+	} else {
+		if (!zhdr->first_chunks)
+			bud = FIRST;
+		else if (!zhdr->last_chunks)
+			bud = LAST;
+		else
+			bud = MIDDLE;
+	}
+
+	return bud;
+}
+
 static inline void *mchunk_memmove(struct z3fold_header *zhdr,
 				unsigned short dst_chunk)
 {
@@ -682,18 +717,7 @@ static struct z3fold_header *compact_sin
 		if (WARN_ON(new_zhdr == zhdr))
 			goto out_fail;
 
-		if (new_zhdr->first_chunks == 0) {
-			if (new_zhdr->middle_chunks != 0 &&
-					chunks >= new_zhdr->start_middle) {
-				new_bud = LAST;
-			} else {
-				new_bud = FIRST;
-			}
-		} else if (new_zhdr->last_chunks == 0) {
-			new_bud = LAST;
-		} else if (new_zhdr->middle_chunks == 0) {
-			new_bud = MIDDLE;
-		}
+		new_bud = get_free_buddy(new_zhdr, chunks);
 		q = new_zhdr;
 		switch (new_bud) {
 		case FIRST:
@@ -815,9 +839,8 @@ static void do_compact_page(struct z3fol
 		return;
 	}
 
-	if (unlikely(PageIsolated(page) ||
-		     test_bit(PAGE_CLAIMED, &page->private) ||
-		     test_bit(PAGE_STALE, &page->private))) {
+	if (test_bit(PAGE_STALE, &page->private) ||
+	    test_and_set_bit(PAGE_CLAIMED, &page->private)) {
 		z3fold_page_unlock(zhdr);
 		return;
 	}
@@ -826,13 +849,16 @@ static void do_compact_page(struct z3fol
 	    zhdr->mapped_count == 0 && compact_single_buddy(zhdr)) {
 		if (kref_put(&zhdr->refcount, release_z3fold_page_locked))
 			atomic64_dec(&pool->pages_nr);
-		else
+		else {
+			clear_bit(PAGE_CLAIMED, &page->private);
 			z3fold_page_unlock(zhdr);
+		}
 		return;
 	}
 
 	z3fold_compact_page(zhdr);
 	add_to_unbuddied(pool, zhdr);
+	clear_bit(PAGE_CLAIMED, &page->private);
 	z3fold_page_unlock(zhdr);
 }
 
@@ -1080,17 +1106,8 @@ static int z3fold_alloc(struct z3fold_po
 retry:
 		zhdr = __z3fold_alloc(pool, size, can_sleep);
 		if (zhdr) {
-			if (zhdr->first_chunks == 0) {
-				if (zhdr->middle_chunks != 0 &&
-				    chunks >= zhdr->start_middle)
-					bud = LAST;
-				else
-					bud = FIRST;
-			} else if (zhdr->last_chunks == 0)
-				bud = LAST;
-			else if (zhdr->middle_chunks == 0)
-				bud = MIDDLE;
-			else {
+			bud = get_free_buddy(zhdr, chunks);
+			if (bud == HEADLESS) {
 				if (kref_put(&zhdr->refcount,
 					     release_z3fold_page_locked))
 					atomic64_dec(&pool->pages_nr);
@@ -1236,7 +1253,6 @@ static void z3fold_free(struct z3fold_po
 		pr_err("%s: unknown bud %d\n", __func__, bud);
 		WARN_ON(1);
 		put_z3fold_header(zhdr);
-		clear_bit(PAGE_CLAIMED, &page->private);
 		return;
 	}
 
@@ -1251,8 +1267,7 @@ static void z3fold_free(struct z3fold_po
 		z3fold_page_unlock(zhdr);
 		return;
 	}
-	if (unlikely(PageIsolated(page)) ||
-	    test_and_set_bit(NEEDS_COMPACTING, &page->private)) {
+	if (test_and_set_bit(NEEDS_COMPACTING, &page->private)) {
 		put_z3fold_header(zhdr);
 		clear_bit(PAGE_CLAIMED, &page->private);
 		return;
@@ -1316,6 +1331,10 @@ static int z3fold_reclaim_page(struct z3
 	struct page *page = NULL;
 	struct list_head *pos;
 	unsigned long first_handle = 0, middle_handle = 0, last_handle = 0;
+	struct z3fold_buddy_slots slots __attribute__((aligned(SLOTS_ALIGN)));
+
+	rwlock_init(&slots.lock);
+	slots.pool = (unsigned long)pool | (1 << HANDLES_NOFREE);
 
 	spin_lock(&pool->lock);
 	if (!pool->ops || !pool->ops->evict || retries == 0) {
@@ -1330,35 +1349,36 @@ static int z3fold_reclaim_page(struct z3
 		list_for_each_prev(pos, &pool->lru) {
 			page = list_entry(pos, struct page, lru);
 
-			/* this bit could have been set by free, in which case
-			 * we pass over to the next page in the pool.
-			 */
-			if (test_and_set_bit(PAGE_CLAIMED, &page->private)) {
-				page = NULL;
-				continue;
-			}
-
-			if (unlikely(PageIsolated(page))) {
-				clear_bit(PAGE_CLAIMED, &page->private);
-				page = NULL;
-				continue;
-			}
 			zhdr = page_address(page);
 			if (test_bit(PAGE_HEADLESS, &page->private))
 				break;
 
+			if (kref_get_unless_zero(&zhdr->refcount) == 0) {
+				zhdr = NULL;
+				break;
+			}
 			if (!z3fold_page_trylock(zhdr)) {
-				clear_bit(PAGE_CLAIMED, &page->private);
+				if (kref_put(&zhdr->refcount,
+						release_z3fold_page))
+					atomic64_dec(&pool->pages_nr);
 				zhdr = NULL;
 				continue; /* can't evict at this point */
 			}
-			if (zhdr->foreign_handles) {
-				clear_bit(PAGE_CLAIMED, &page->private);
-				z3fold_page_unlock(zhdr);
+
+			/* test_and_set_bit is of course atomic, but we still
+			 * need to do it under page lock, otherwise checking
+			 * that bit in __z3fold_alloc wouldn't make sense
+			 */
+			if (zhdr->foreign_handles ||
+			    test_and_set_bit(PAGE_CLAIMED, &page->private)) {
+				if (kref_put(&zhdr->refcount,
+						release_z3fold_page))
+					atomic64_dec(&pool->pages_nr);
+				else
+					z3fold_page_unlock(zhdr);
 				zhdr = NULL;
 				continue; /* can't evict such page */
 			}
-			kref_get(&zhdr->refcount);
 			list_del_init(&zhdr->buddy);
 			zhdr->cpu = -1;
 			break;
@@ -1380,12 +1400,16 @@ static int z3fold_reclaim_page(struct z3
 			first_handle = 0;
 			last_handle = 0;
 			middle_handle = 0;
+			memset(slots.slot, 0, sizeof(slots.slot));
 			if (zhdr->first_chunks)
-				first_handle = encode_handle(zhdr, FIRST);
+				first_handle = __encode_handle(zhdr, &slots,
+								FIRST);
 			if (zhdr->middle_chunks)
-				middle_handle = encode_handle(zhdr, MIDDLE);
+				middle_handle = __encode_handle(zhdr, &slots,
+								MIDDLE);
 			if (zhdr->last_chunks)
-				last_handle = encode_handle(zhdr, LAST);
+				last_handle = __encode_handle(zhdr, &slots,
+								LAST);
 			/*
 			 * it's safe to unlock here because we hold a
 			 * reference to this page
@@ -1400,19 +1424,16 @@ static int z3fold_reclaim_page(struct z3
 			ret = pool->ops->evict(pool, middle_handle);
 			if (ret)
 				goto next;
-			free_handle(middle_handle, zhdr);
 		}
 		if (first_handle) {
 			ret = pool->ops->evict(pool, first_handle);
 			if (ret)
 				goto next;
-			free_handle(first_handle, zhdr);
 		}
 		if (last_handle) {
 			ret = pool->ops->evict(pool, last_handle);
 			if (ret)
 				goto next;
-			free_handle(last_handle, zhdr);
 		}
 next:
 		if (test_bit(PAGE_HEADLESS, &page->private)) {
@@ -1426,9 +1447,11 @@ next:
 			spin_unlock(&pool->lock);
 			clear_bit(PAGE_CLAIMED, &page->private);
 		} else {
+			struct z3fold_buddy_slots *slots = zhdr->slots;
 			z3fold_page_lock(zhdr);
 			if (kref_put(&zhdr->refcount,
 					release_z3fold_page_locked)) {
+				kmem_cache_free(pool->c_handle, slots);
 				atomic64_dec(&pool->pages_nr);
 				return 0;
 			}
@@ -1544,8 +1567,7 @@ static bool z3fold_page_isolate(struct p
 	VM_BUG_ON_PAGE(!PageMovable(page), page);
 	VM_BUG_ON_PAGE(PageIsolated(page), page);
 
-	if (test_bit(PAGE_HEADLESS, &page->private) ||
-	    test_bit(PAGE_CLAIMED, &page->private))
+	if (test_bit(PAGE_HEADLESS, &page->private))
 		return false;
 
 	zhdr = page_address(page);
@@ -1557,6 +1579,8 @@ static bool z3fold_page_isolate(struct p
 	if (zhdr->mapped_count != 0 || zhdr->foreign_handles != 0)
 		goto out;
 
+	if (test_and_set_bit(PAGE_CLAIMED, &page->private))
+		goto out;
 	pool = zhdr_to_pool(zhdr);
 	spin_lock(&pool->lock);
 	if (!list_empty(&zhdr->buddy))
@@ -1583,16 +1607,17 @@ static int z3fold_page_migrate(struct ad
 
 	VM_BUG_ON_PAGE(!PageMovable(page), page);
 	VM_BUG_ON_PAGE(!PageIsolated(page), page);
+	VM_BUG_ON_PAGE(!test_bit(PAGE_CLAIMED, &page->private), page);
 	VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
 
 	zhdr = page_address(page);
 	pool = zhdr_to_pool(zhdr);
 
-	if (!z3fold_page_trylock(zhdr)) {
+	if (!z3fold_page_trylock(zhdr))
 		return -EAGAIN;
-	}
 	if (zhdr->mapped_count != 0 || zhdr->foreign_handles != 0) {
 		z3fold_page_unlock(zhdr);
+		clear_bit(PAGE_CLAIMED, &page->private);
 		return -EBUSY;
 	}
 	if (work_pending(&zhdr->work)) {
@@ -1634,6 +1659,7 @@ static int z3fold_page_migrate(struct ad
 	queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work);
 
 	page_mapcount_reset(page);
+	clear_bit(PAGE_CLAIMED, &page->private);
 	put_page(page);
 	return 0;
 }
@@ -1657,6 +1683,7 @@ static void z3fold_page_putback(struct p
 	spin_lock(&pool->lock);
 	list_add(&page->lru, &pool->lru);
 	spin_unlock(&pool->lock);
+	clear_bit(PAGE_CLAIMED, &page->private);
 	z3fold_page_unlock(zhdr);
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 566/717] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (563 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 565/717] z3fold: stricter locking and more careful reclaim Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 567/717] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andi Kleen, Kan Liang,
	Peter Zijlstra (Intel)

From: Kan Liang <kan.liang@linux.intel.com>

commit 306e3e91edf1c6739a55312edd110d298ff498dd upstream.

The event CYCLE_ACTIVITY.STALLS_MEM_ANY (0x14a3) should be available on
all 8 GP counters on ICL, but it's only scheduled on the first four
counters due to the current ICL constraint table.

Add a line for the CYCLE_ACTIVITY.STALLS_MEM_ANY event in the ICL
constraint table.
Correct the comments for the CYCLE_ACTIVITY.CYCLES_MEM_ANY event.

Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201019164529.32154-1-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -257,7 +257,8 @@ static struct event_constraint intel_icl
 	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x54, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x60, 0x8b, 0xf),
 	INTEL_UEVENT_CONSTRAINT(0x04a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_TOTAL */
-	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_MEM_ANY */
+	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */
+	INTEL_UEVENT_CONSTRAINT(0x14a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_MEM_ANY */
 	INTEL_EVENT_CONSTRAINT(0xa3, 0xf),      /* CYCLE_ACTIVITY.* */
 	INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 567/717] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (564 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 566/717] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 568/717] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles() Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel)

From: Kan Liang <kan.liang@linux.intel.com>

commit 46b72e1bf4fc571da0c29c6fb3e5b2a2107a4c26 upstream.

According to the event list from icelake_core_v1.09.json, the encoding
of the RTM_RETIRED.ABORTED event on Ice Lake should be,
    "EventCode": "0xc9",
    "UMask": "0x04",
    "EventName": "RTM_RETIRED.ABORTED",

Correct the wrong encoding.

Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201125213720.15692-1-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -5465,7 +5465,7 @@ __init int intel_pmu_init(void)
 		mem_attr = icl_events_attrs;
 		td_attr = icl_td_events_attrs;
 		tsx_attr = icl_tsx_events_attrs;
-		x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xca, .umask=0x02);
+		x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xc9, .umask=0x04);
 		x86_pmu.lbr_pt_coexist = true;
 		intel_pmu_pebs_data_source_skl(pmem);
 		x86_pmu.update_topdown_event = icl_update_topdown_event;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 568/717] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (565 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 567/717] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 569/717] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephane Eranian, Kan Liang,
	Peter Zijlstra (Intel)

From: Kan Liang <kan.liang@linux.intel.com>

commit f8129cd958b395575e5543ce25a8434874b04d3a upstream.

The cycle count of a timed LBR is always 1 in perf record -D.

The cycle count is stored in the first 16 bits of the IA32_LBR_x_INFO
register, but the get_lbr_cycles() return Boolean type.

Use u16 to replace the Boolean type.

Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
Reported-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201125213720.15692-2-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/lbr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -919,7 +919,7 @@ static __always_inline bool get_lbr_pred
 	return !(info & LBR_INFO_MISPRED);
 }
 
-static __always_inline bool get_lbr_cycles(u64 info)
+static __always_inline u16 get_lbr_cycles(u64 info)
 {
 	if (static_cpu_has(X86_FEATURE_ARCH_LBR) &&
 	    !(x86_pmu.lbr_timed_lbr && info & LBR_INFO_CYC_CNT_VALID))



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 569/717] powerpc/perf: Exclude kernel samples while counting events in user space.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (566 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 568/717] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 570/717] cpufreq: intel_pstate: Use most recent guaranteed performance values Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream.

Perf event attritube supports exclude_kernel flag to avoid
sampling/profiling in supervisor state (kernel). Based on this event
attr flag, Monitor Mode Control Register bit is set to freeze on
supervisor state. But sometimes (due to hardware limitation), Sampled
Instruction Address Register (SIAR) locks on to kernel address even
when freeze on supervisor is set. Patch here adds a check to drop
those samples.

Cc: stable@vger.kernel.org
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606289215-1433-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/perf/core-book3s.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2125,6 +2125,16 @@ static void record_and_restart(struct pe
 	perf_event_update_userpage(event);
 
 	/*
+	 * Due to hardware limitation, sometimes SIAR could sample a kernel
+	 * address even when freeze on supervisor state (kernel) is set in
+	 * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+	 * these cases.
+	 */
+	if (event->attr.exclude_kernel && record)
+		if (is_kernel_addr(mfspr(SPRN_SIAR)))
+			record = 0;
+
+	/*
 	 * Finally record data if requested.
 	 */
 	if (record) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 570/717] cpufreq: intel_pstate: Use most recent guaranteed performance values
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (567 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 569/717] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 571/717] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Rafael J. Wysocki

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

commit e40ad84c26b4deeee46666492ec66b9a534b8e59 upstream.

When turbo has been disabled by the BIOS, but HWP_CAP.GUARANTEED is
changed later, user space may want to take advantage of this increased
guaranteed performance.

HWP_CAP.GUARANTEED is not a static value.  It can be adjusted by an
out-of-band agent or during an Intel Speed Select performance level
change.  The HWP_CAP.MAX is still the maximum achievable performance
with turbo disabled by the BIOS, so HWP_CAP.GUARANTEED can still
change as long as it remains less than or equal to HWP_CAP.MAX.

When HWP_CAP.GUARANTEED is changed, the sysfs base_frequency
attribute shows the most recent guaranteed frequency value. This
attribute can be used by user space software to update the scaling
min/max limits of the CPU.

Currently, the ->setpolicy() callback already uses the latest
HWP_CAP values when setting HWP_REQ, but the ->verify() callback will
restrict the user settings to the to old guaranteed performance value
which prevents user space from making use of the extra CPU capacity
theoretically available to it after increasing HWP_CAP.GUARANTEED.

To address this, read HWP_CAP in intel_pstate_verify_cpu_policy()
to obtain the maximum P-state that can be used and use that to
confine the policy max limit instead of using the cached and
possibly stale pstate.max_freq value for this purpose.

For consistency, update intel_pstate_update_perf_limits() to use the
maximum available P-state returned by intel_pstate_get_hwp_max() to
compute the maximum frequency instead of using the return value of
intel_pstate_get_max_freq() which, again, may be stale.

This issue is a side-effect of fixing the scaling frequency limits in
commit eacc9c5a927e ("cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max()
for turbo disabled") which corrected the setting of the reduced scaling
frequency values, but caused stale HWP_CAP.GUARANTEED to be used in
the case at hand.

Fixes: eacc9c5a927e ("cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled")
Reported-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: 5.8+ <stable@vger.kernel.org> # 5.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpufreq/intel_pstate.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2207,9 +2207,9 @@ static void intel_pstate_update_perf_lim
 					    unsigned int policy_min,
 					    unsigned int policy_max)
 {
-	int max_freq = intel_pstate_get_max_freq(cpu);
 	int32_t max_policy_perf, min_policy_perf;
 	int max_state, turbo_max;
+	int max_freq;
 
 	/*
 	 * HWP needs some special consideration, because on BDX the
@@ -2223,6 +2223,7 @@ static void intel_pstate_update_perf_lim
 			cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
 		turbo_max = cpu->pstate.turbo_pstate;
 	}
+	max_freq = max_state * cpu->pstate.scaling;
 
 	max_policy_perf = max_state * policy_max / max_freq;
 	if (policy_max == policy_min) {
@@ -2325,9 +2326,18 @@ static void intel_pstate_adjust_policy_m
 static void intel_pstate_verify_cpu_policy(struct cpudata *cpu,
 					   struct cpufreq_policy_data *policy)
 {
+	int max_freq;
+
 	update_turbo_state();
-	cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-				     intel_pstate_get_max_freq(cpu));
+	if (hwp_active) {
+		int max_state, turbo_max;
+
+		intel_pstate_get_hwp_max(cpu->cpu, &turbo_max, &max_state);
+		max_freq = max_state * cpu->pstate.scaling;
+	} else {
+		max_freq = intel_pstate_get_max_freq(cpu);
+	}
+	cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq, max_freq);
 
 	intel_pstate_adjust_policy_max(cpu, policy);
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 571/717] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (568 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 570/717] cpufreq: intel_pstate: Use most recent guaranteed performance values Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 572/717] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu

From: Ard Biesheuvel <ardb@kernel.org>

commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream.

ecdh_set_secret() casts a void* pointer to a const u64* in order to
feed it into ecc_is_key_valid(). This is not generally permitted by
the C standard, and leads to actual misalignment faults on ARMv6
cores. In some cases, these are fixed up in software, but this still
leads to performance hits that are entirely avoidable.

So let's copy the key into the ctx buffer first, which we will do
anyway in the common case, and which guarantees correct alignment.

Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/ecdh.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -53,12 +53,13 @@ static int ecdh_set_secret(struct crypto
 		return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
 				       ctx->private_key);
 
-	if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
-			     (const u64 *)params.key, params.key_size) < 0)
-		return -EINVAL;
-
 	memcpy(ctx->private_key, params.key, params.key_size);
 
+	if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
+			     ctx->private_key, params.key_size) < 0) {
+		memzero_explicit(ctx->private_key, params.key_size);
+		return -EINVAL;
+	}
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 572/717] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (569 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 571/717] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 573/717] m68k: Fix WARNING splat in pmac_zilog driver Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu

From: Ard Biesheuvel <ardb@kernel.org>

commit f3456b9fd269c6d0c973b136c5449d46b2510f4b upstream.

ARM Cortex-A57 and Cortex-A72 cores running in 32-bit mode are affected
by silicon errata #1742098 and #1655431, respectively, where the second
instruction of a AES instruction pair may execute twice if an interrupt
is taken right after the first instruction consumes an input register of
which a single 32-bit lane has been updated the last time it was modified.

This is not such a rare occurrence as it may seem: in counter mode, only
the least significant 32-bit word is incremented in the absence of a
carry, which makes our counter mode implementation susceptible to these
errata.

So let's shuffle the counter assignments around a bit so that the most
recent updates when the AES instruction pair executes are 128-bit wide.

[0] ARM-EPM-049219 v23 Cortex-A57 MPCore Software Developers Errata Notice
[1] ARM-EPM-012079 v11.0 Cortex-A72 MPCore Software Developers Errata Notice

Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/crypto/aes-ce-core.S |   32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

--- a/arch/arm/crypto/aes-ce-core.S
+++ b/arch/arm/crypto/aes-ce-core.S
@@ -386,20 +386,32 @@ ENTRY(ce_aes_ctr_encrypt)
 .Lctrloop4x:
 	subs		r4, r4, #4
 	bmi		.Lctr1x
-	add		r6, r6, #1
+
+	/*
+	 * NOTE: the sequence below has been carefully tweaked to avoid
+	 * a silicon erratum that exists in Cortex-A57 (#1742098) and
+	 * Cortex-A72 (#1655431) cores, where AESE/AESMC instruction pairs
+	 * may produce an incorrect result if they take their input from a
+	 * register of which a single 32-bit lane has been updated the last
+	 * time it was modified. To work around this, the lanes of registers
+	 * q0-q3 below are not manipulated individually, and the different
+	 * counter values are prepared by successive manipulations of q7.
+	 */
+	add		ip, r6, #1
 	vmov		q0, q7
+	rev		ip, ip
+	add		lr, r6, #2
+	vmov		s31, ip			@ set lane 3 of q1 via q7
+	add		ip, r6, #3
+	rev		lr, lr
 	vmov		q1, q7
-	rev		ip, r6
-	add		r6, r6, #1
+	vmov		s31, lr			@ set lane 3 of q2 via q7
+	rev		ip, ip
 	vmov		q2, q7
-	vmov		s7, ip
-	rev		ip, r6
-	add		r6, r6, #1
+	vmov		s31, ip			@ set lane 3 of q3 via q7
+	add		r6, r6, #4
 	vmov		q3, q7
-	vmov		s11, ip
-	rev		ip, r6
-	add		r6, r6, #1
-	vmov		s15, ip
+
 	vld1.8		{q4-q5}, [r1]!
 	vld1.8		{q6}, [r1]!
 	vld1.8		{q15}, [r1]!



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 573/717] m68k: Fix WARNING splat in pmac_zilog driver
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (570 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 572/717] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 574/717] Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Ellerman,
	Benjamin Herrenschmidt, Paul Mackerras, Joshua Thompson,
	Jiri Slaby, Laurent Vivier, Finn Thain, Geert Uytterhoeven

From: Finn Thain <fthain@telegraphics.com.au>

commit a7b5458ce73b235be027cf2658c39b19b7e58cf2 upstream.

Don't add platform resources that won't be used. This avoids a
recently-added warning from the driver core, that can show up on a
multi-platform kernel when !MACH_IS_MAC.

------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at drivers/base/platform.c:224 platform_get_irq_optional+0x8e/0xce
0 is an invalid IRQ number
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-multi #1
Stack from 004b3f04:
        004b3f04 00462c2f 00462c2f 004b3f20 0002e128 004754db 004b6ad4 004b3f4c
        0002e19c 004754f7 000000e0 00285ba0 00000009 00000000 004b3f44 ffffffff
        004754db 004b3f64 004b3f74 00285ba0 004754f7 000000e0 00000009 004754db
        004fdf0c 005269e2 004fdf0c 00000000 004b3f88 00285cae 004b6964 00000000
        004fdf0c 004b3fac 0051cc68 004b6964 00000000 004b6964 00000200 00000000
        0051cc3e 0023c18a 004b3fc0 0051cd8a 004fdf0c 00000002 0052b43c 004b3fc8
Call Trace: [<0002e128>] __warn+0xa6/0xd6
 [<0002e19c>] warn_slowpath_fmt+0x44/0x76
 [<00285ba0>] platform_get_irq_optional+0x8e/0xce
 [<00285ba0>] platform_get_irq_optional+0x8e/0xce
 [<00285cae>] platform_get_irq+0x12/0x4c
 [<0051cc68>] pmz_init_port+0x2a/0xa6
 [<0051cc3e>] pmz_init_port+0x0/0xa6
 [<0023c18a>] strlen+0x0/0x22
 [<0051cd8a>] pmz_probe+0x34/0x88
 [<0051cde6>] pmz_console_init+0x8/0x28
 [<00511776>] console_init+0x1e/0x28
 [<0005a3bc>] printk+0x0/0x16
 [<0050a8a6>] start_kernel+0x368/0x4ce
 [<005094f8>] _sinittext+0x4f8/0xc48
random: get_random_bytes called from print_oops_end_marker+0x56/0x80 with crng_init=0
---[ end trace 392d8e82eed68d6c ]---

Commit a85a6c86c25b ("driver core: platform: Clarify that IRQ 0 is invalid"),
which introduced the WARNING, suggests that testing for irq == 0 is
undesirable. Instead of that comparison, just test for resource existence.

Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Joshua Thompson <funaho@jurai.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: stable@vger.kernel.org # v5.8+
Reported-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Link: https://lore.kernel.org/r/0c0fe1e4f11ccec202d4df09ea7d9d98155d101a.1606001297.git.fthain@telegraphics.com.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/m68k/mac/config.c          |   17 +++++++++--------
 drivers/tty/serial/pmac_zilog.c |   14 +++++++++-----
 2 files changed, 18 insertions(+), 13 deletions(-)

--- a/arch/m68k/mac/config.c
+++ b/arch/m68k/mac/config.c
@@ -777,16 +777,12 @@ static struct resource scc_b_rsrcs[] = {
 struct platform_device scc_a_pdev = {
 	.name           = "scc",
 	.id             = 0,
-	.num_resources  = ARRAY_SIZE(scc_a_rsrcs),
-	.resource       = scc_a_rsrcs,
 };
 EXPORT_SYMBOL(scc_a_pdev);
 
 struct platform_device scc_b_pdev = {
 	.name           = "scc",
 	.id             = 1,
-	.num_resources  = ARRAY_SIZE(scc_b_rsrcs),
-	.resource       = scc_b_rsrcs,
 };
 EXPORT_SYMBOL(scc_b_pdev);
 
@@ -813,10 +809,15 @@ static void __init mac_identify(void)
 
 	/* Set up serial port resources for the console initcall. */
 
-	scc_a_rsrcs[0].start = (resource_size_t) mac_bi_data.sccbase + 2;
-	scc_a_rsrcs[0].end   = scc_a_rsrcs[0].start;
-	scc_b_rsrcs[0].start = (resource_size_t) mac_bi_data.sccbase;
-	scc_b_rsrcs[0].end   = scc_b_rsrcs[0].start;
+	scc_a_rsrcs[0].start     = (resource_size_t)mac_bi_data.sccbase + 2;
+	scc_a_rsrcs[0].end       = scc_a_rsrcs[0].start;
+	scc_a_pdev.num_resources = ARRAY_SIZE(scc_a_rsrcs);
+	scc_a_pdev.resource      = scc_a_rsrcs;
+
+	scc_b_rsrcs[0].start     = (resource_size_t)mac_bi_data.sccbase;
+	scc_b_rsrcs[0].end       = scc_b_rsrcs[0].start;
+	scc_b_pdev.num_resources = ARRAY_SIZE(scc_b_rsrcs);
+	scc_b_pdev.resource      = scc_b_rsrcs;
 
 	switch (macintosh_config->scc_type) {
 	case MAC_SCC_PSC:
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -1693,22 +1693,26 @@ static int __init pmz_probe(void)
 
 #else
 
+/* On PCI PowerMacs, pmz_probe() does an explicit search of the OpenFirmware
+ * tree to obtain the device_nodes needed to start the console before the
+ * macio driver. On Macs without OpenFirmware, global platform_devices take
+ * the place of those device_nodes.
+ */
 extern struct platform_device scc_a_pdev, scc_b_pdev;
 
 static int __init pmz_init_port(struct uart_pmac_port *uap)
 {
-	struct resource *r_ports;
-	int irq;
+	struct resource *r_ports, *r_irq;
 
 	r_ports = platform_get_resource(uap->pdev, IORESOURCE_MEM, 0);
-	irq = platform_get_irq(uap->pdev, 0);
-	if (!r_ports || irq <= 0)
+	r_irq = platform_get_resource(uap->pdev, IORESOURCE_IRQ, 0);
+	if (!r_ports || !r_irq)
 		return -ENODEV;
 
 	uap->port.mapbase  = r_ports->start;
 	uap->port.membase  = (unsigned char __iomem *) r_ports->start;
 	uap->port.iotype   = UPIO_MEM;
-	uap->port.irq      = irq;
+	uap->port.irq      = r_irq->start;
 	uap->port.uartclk  = ZS_CLOCK;
 	uap->port.fifosize = 1;
 	uap->port.ops      = &pmz_pops;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 574/717] Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (571 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 573/717] m68k: Fix WARNING splat in pmac_zilog driver Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 575/717] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ahmed S. Darwish, Peter Zijlstra (Intel)

From: Ahmed S. Darwish <a.darwish@linutronix.de>

commit cf48647243cc28d15280600292db5777592606c5 upstream.

Sequence counters with an associated write serialization lock are called
seqcount_LOCKNAME_t. Fix the documentation accordingly.

While at it, remove a paragraph that inappropriately discussed a
seqlock.h implementation detail.

Fixes: 6dd699b13d53 ("seqlock: seqcount_LOCKNAME_t: Standardize naming convention")
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201206162143.14387-2-a.darwish@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/locking/seqlock.rst |   21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

--- a/Documentation/locking/seqlock.rst
+++ b/Documentation/locking/seqlock.rst
@@ -89,7 +89,7 @@ Read path::
 
 .. _seqcount_locktype_t:
 
-Sequence counters with associated locks (``seqcount_LOCKTYPE_t``)
+Sequence counters with associated locks (``seqcount_LOCKNAME_t``)
 -----------------------------------------------------------------
 
 As discussed at :ref:`seqcount_t`, sequence count write side critical
@@ -115,27 +115,26 @@ The following sequence counters with ass
   - ``seqcount_mutex_t``
   - ``seqcount_ww_mutex_t``
 
-The plain seqcount read and write APIs branch out to the specific
-seqcount_LOCKTYPE_t implementation at compile-time. This avoids kernel
-API explosion per each new seqcount LOCKTYPE.
+The sequence counter read and write APIs can take either a plain
+seqcount_t or any of the seqcount_LOCKNAME_t variants above.
 
-Initialization (replace "LOCKTYPE" with one of the supported locks)::
+Initialization (replace "LOCKNAME" with one of the supported locks)::
 
 	/* dynamic */
-	seqcount_LOCKTYPE_t foo_seqcount;
-	seqcount_LOCKTYPE_init(&foo_seqcount, &lock);
+	seqcount_LOCKNAME_t foo_seqcount;
+	seqcount_LOCKNAME_init(&foo_seqcount, &lock);
 
 	/* static */
-	static seqcount_LOCKTYPE_t foo_seqcount =
-		SEQCNT_LOCKTYPE_ZERO(foo_seqcount, &lock);
+	static seqcount_LOCKNAME_t foo_seqcount =
+		SEQCNT_LOCKNAME_ZERO(foo_seqcount, &lock);
 
 	/* C99 struct init */
 	struct {
-		.seq   = SEQCNT_LOCKTYPE_ZERO(foo.seq, &lock),
+		.seq   = SEQCNT_LOCKNAME_ZERO(foo.seq, &lock),
 	} foo;
 
 Write path: same as in :ref:`seqcount_t`, while running from a context
-with the associated LOCKTYPE lock acquired.
+with the associated write serialization lock acquired.
 
 Read path: same as in :ref:`seqcount_t`.
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 575/717] EDAC/i10nm: Use readl() to access MMIO registers
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (572 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 574/717] Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 576/717] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Qiuxu Zhuo, Tony Luck

From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>

commit 83ff51c4e3fecf6b8587ce4d46f6eac59f5d7c5a upstream.

Instead of raw access, use readl() to access MMIO registers of
memory controller to avoid possible compiler re-ordering.

Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors")
Cc: <stable@vger.kernel.org>
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/i10nm_base.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/io.h>
 #include <asm/cpu_device_id.h>
 #include <asm/intel-family.h>
 #include <asm/mce.h>
@@ -19,14 +20,16 @@
 #define i10nm_printk(level, fmt, arg...)	\
 	edac_printk(level, "i10nm", fmt, ##arg)
 
-#define I10NM_GET_SCK_BAR(d, reg)		\
+#define I10NM_GET_SCK_BAR(d, reg)	\
 	pci_read_config_dword((d)->uracu, 0xd0, &(reg))
 #define I10NM_GET_IMC_BAR(d, i, reg)	\
 	pci_read_config_dword((d)->uracu, 0xd8 + (i) * 4, &(reg))
 #define I10NM_GET_DIMMMTR(m, i, j)	\
-	(*(u32 *)((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4))
+	readl((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4)
 #define I10NM_GET_MCDDRTCFG(m, i, j)	\
-	(*(u32 *)((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4))
+	readl((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4)
+#define I10NM_GET_MCMTR(m, i)		\
+	readl((m)->mbase + 0x20ef8 + (i) * 0x4000)
 
 #define I10NM_GET_SCK_MMIO_BASE(reg)	(GET_BITFIELD(reg, 0, 28) << 23)
 #define I10NM_GET_IMC_MMIO_OFFSET(reg)	(GET_BITFIELD(reg, 0, 10) << 12)
@@ -148,7 +151,7 @@ static bool i10nm_check_ecc(struct skx_i
 {
 	u32 mcmtr;
 
-	mcmtr = *(u32 *)(imc->mbase + 0x20ef8 + chan * 0x4000);
+	mcmtr = I10NM_GET_MCMTR(imc, chan);
 	edac_dbg(1, "ch%d mcmtr reg %x\n", chan, mcmtr);
 
 	return !!GET_BITFIELD(mcmtr, 2, 2);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 576/717] EDAC/amd64: Fix PCI component registration
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (573 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 575/717] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 577/717] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Borislav Petkov

From: Borislav Petkov <bp@suse.de>

commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream.

In order to setup its PCI component, the driver needs any node private
instance in order to get a reference to the PCI device and hand that
into edac_pci_create_generic_ctl(). For convenience, it uses the 0th
memory controller descriptor under the assumption that if any, the 0th
will be always present.

However, this assumption goes wrong when the 0th node doesn't have
memory and the driver doesn't initialize an instance for it:

  EDAC amd64: F17h detected (node 0).
  ...
  EDAC amd64: Node 0: No DIMMs detected.

But looking up node instances is not really needed - all one needs is
the pointer to the proper device which gets discovered during instance
init.

So stash that pointer into a variable and use it when setting up the
EDAC PCI component.

Clear that variable when the driver needs to unwind due to some
instances failing init to avoid any registration imbalance.

Cc: <stable@vger.kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201122150815.13808-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/amd64_edac.c |   26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -18,6 +18,9 @@ static struct amd64_family_type *fam_typ
 /* Per-node stuff */
 static struct ecc_settings **ecc_stngs;
 
+/* Device for the PCI component */
+static struct device *pci_ctl_dev;
+
 /*
  * Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing
  * bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
@@ -2683,6 +2686,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
 			return -ENODEV;
 		}
 
+		if (!pci_ctl_dev)
+			pci_ctl_dev = &pvt->F0->dev;
+
 		edac_dbg(1, "F0: %s\n", pci_name(pvt->F0));
 		edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
 		edac_dbg(1, "F6: %s\n", pci_name(pvt->F6));
@@ -2707,6 +2713,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
 		return -ENODEV;
 	}
 
+	if (!pci_ctl_dev)
+		pci_ctl_dev = &pvt->F2->dev;
+
 	edac_dbg(1, "F1: %s\n", pci_name(pvt->F1));
 	edac_dbg(1, "F2: %s\n", pci_name(pvt->F2));
 	edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
@@ -3623,21 +3632,10 @@ static void remove_one_instance(unsigned
 
 static void setup_pci_device(void)
 {
-	struct mem_ctl_info *mci;
-	struct amd64_pvt *pvt;
-
 	if (pci_ctl)
 		return;
 
-	mci = edac_mc_find(0);
-	if (!mci)
-		return;
-
-	pvt = mci->pvt_info;
-	if (pvt->umc)
-		pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR);
-	else
-		pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
+	pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR);
 	if (!pci_ctl) {
 		pr_warn("%s(): Unable to create PCI control\n", __func__);
 		pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
@@ -3716,6 +3714,8 @@ static int __init amd64_edac_init(void)
 	return 0;
 
 err_pci:
+	pci_ctl_dev = NULL;
+
 	msrs_free(msrs);
 	msrs = NULL;
 
@@ -3745,6 +3745,8 @@ static void __exit amd64_edac_exit(void)
 	kfree(ecc_stngs);
 	ecc_stngs = NULL;
 
+	pci_ctl_dev = NULL;
+
 	msrs_free(msrs);
 	msrs = NULL;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 577/717] cpuset: fix race between hotplug work and later CPU offline
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (574 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 576/717] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 578/717] dyndbg: fix use before null check Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Jordan, Peter Zijlstra (Intel),
	Tejun Heo

From: Daniel Jordan <daniel.m.jordan@oracle.com>

commit 406100f3da08066c00105165db8520bbc7694a36 upstream.

One of our machines keeled over trying to rebuild the scheduler domains.
Mainline produces the same splat:

  BUG: unable to handle page fault for address: 0000607f820054db
  CPU: 2 PID: 149 Comm: kworker/1:1 Not tainted 5.10.0-rc1-master+ #6
  Workqueue: events cpuset_hotplug_workfn
  RIP: build_sched_domains
  Call Trace:
   partition_sched_domains_locked
   rebuild_sched_domains_locked
   cpuset_hotplug_workfn

It happens with cgroup2 and exclusive cpusets only.  This reproducer
triggers it on an 8-cpu vm and works most effectively with no
preexisting child cgroups:

  cd $UNIFIED_ROOT
  mkdir cg1
  echo 4-7 > cg1/cpuset.cpus
  echo root > cg1/cpuset.cpus.partition

  # with smt/control reading 'on',
  echo off > /sys/devices/system/cpu/smt/control

RIP maps to

  sd->shared = *per_cpu_ptr(sdd->sds, sd_id);

from sd_init().  sd_id is calculated earlier in the same function:

  cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
  sd_id = cpumask_first(sched_domain_span(sd));

tl->mask(cpu), which reads cpu_sibling_map on x86, returns an empty mask
and so cpumask_first() returns >= nr_cpu_ids, which leads to the bogus
value from per_cpu_ptr() above.

The problem is a race between cpuset_hotplug_workfn() and a later
offline of CPU N.  cpuset_hotplug_workfn() updates the effective masks
when N is still online, the offline clears N from cpu_sibling_map, and
then the worker uses the stale effective masks that still have N to
generate the scheduling domains, leading the worker to read
N's empty cpu_sibling_map in sd_init().

rebuild_sched_domains_locked() prevented the race during the cgroup2
cpuset series up until the Fixes commit changed its check.  Make the
check more robust so that it can detect an offline CPU in any exclusive
cpuset's effective mask, not just the top one.

Fixes: 0ccea8feb980 ("cpuset: Make generate_sched_domains() work with partition")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201112171711.639541-1-daniel.m.jordan@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/cgroup/cpuset.c |   33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -983,25 +983,48 @@ partition_and_rebuild_sched_domains(int
  */
 static void rebuild_sched_domains_locked(void)
 {
+	struct cgroup_subsys_state *pos_css;
 	struct sched_domain_attr *attr;
 	cpumask_var_t *doms;
+	struct cpuset *cs;
 	int ndoms;
 
 	lockdep_assert_cpus_held();
 	percpu_rwsem_assert_held(&cpuset_rwsem);
 
 	/*
-	 * We have raced with CPU hotplug. Don't do anything to avoid
+	 * If we have raced with CPU hotplug, return early to avoid
 	 * passing doms with offlined cpu to partition_sched_domains().
-	 * Anyways, hotplug work item will rebuild sched domains.
+	 * Anyways, cpuset_hotplug_workfn() will rebuild sched domains.
+	 *
+	 * With no CPUs in any subpartitions, top_cpuset's effective CPUs
+	 * should be the same as the active CPUs, so checking only top_cpuset
+	 * is enough to detect racing CPU offlines.
 	 */
 	if (!top_cpuset.nr_subparts_cpus &&
 	    !cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask))
 		return;
 
-	if (top_cpuset.nr_subparts_cpus &&
-	   !cpumask_subset(top_cpuset.effective_cpus, cpu_active_mask))
-		return;
+	/*
+	 * With subpartition CPUs, however, the effective CPUs of a partition
+	 * root should be only a subset of the active CPUs.  Since a CPU in any
+	 * partition root could be offlined, all must be checked.
+	 */
+	if (top_cpuset.nr_subparts_cpus) {
+		rcu_read_lock();
+		cpuset_for_each_descendant_pre(cs, pos_css, &top_cpuset) {
+			if (!is_partition_root(cs)) {
+				pos_css = css_rightmost_descendant(pos_css);
+				continue;
+			}
+			if (!cpumask_subset(cs->effective_cpus,
+					    cpu_active_mask)) {
+				rcu_read_unlock();
+				return;
+			}
+		}
+		rcu_read_unlock();
+	}
 
 	/* Generate domain masks and attrs */
 	ndoms = generate_sched_domains(&doms, &attr);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 578/717] dyndbg: fix use before null check
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (575 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 577/717] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 579/717] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jim Cromie

From: Jim Cromie <jim.cromie@gmail.com>

commit 3577afb0052fca65e67efdfc8e0859bb7bac87a6 upstream.

In commit a2d375eda771 ("dyndbg: refine export, rename to
dynamic_debug_exec_queries()"), a string is copied before checking it
isn't NULL.  Fix this, report a usage/interface error, and return the
proper error code.

Fixes: a2d375eda771 ("dyndbg: refine export, rename to dynamic_debug_exec_queries()")
Cc: stable@vger.kernel.org
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20201209183625.2432329-1-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/dynamic_debug.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -561,9 +561,14 @@ static int ddebug_exec_queries(char *que
 int dynamic_debug_exec_queries(const char *query, const char *modname)
 {
 	int rc;
-	char *qry = kstrndup(query, PAGE_SIZE, GFP_KERNEL);
+	char *qry; /* writable copy of query */
 
-	if (!query)
+	if (!query) {
+		pr_err("non-null query/command string expected\n");
+		return -EINVAL;
+	}
+	qry = kstrndup(query, PAGE_SIZE, GFP_KERNEL);
+	if (!qry)
 		return -ENOMEM;
 
 	rc = ddebug_exec_queries(qry, modname);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 579/717] USB: serial: mos7720: fix parallel-port state restore
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (576 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 578/717] dyndbg: fix use before null check Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 580/717] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream.

The parallel-port restore operations is called when a driver claims the
port and is supposed to restore the provided state (e.g. saved when
releasing the port).

Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Cc: stable <stable@vger.kernel.org>     # 2.6.35
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7720.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -639,6 +639,8 @@ static void parport_mos7715_restore_stat
 		spin_unlock(&release_lock);
 		return;
 	}
+	mos_parport->shadowDCR = s->u.pc.ctr;
+	mos_parport->shadowECR = s->u.pc.ecr;
 	write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
 				   mos_parport->shadowDCR);
 	write_parport_reg_nonblock(mos_parport, MOS7720_ECR,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 580/717] USB: serial: digi_acceleport: fix write-wakeup deadlocks
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (577 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 579/717] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 581/717] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 5098e77962e7c8947f87bd8c5869c83e000a522a upstream.

The driver must not call tty_wakeup() while holding its private lock as
line disciplines are allowed to call back into write() from
write_wakeup(), leading to a deadlock.

Also remove the unneeded work struct that was used to defer wakeup in
order to work around a possible race in ancient times (see comment about
n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove
changelogs and old todo entries")).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/digi_acceleport.c |   45 ++++++++++-------------------------
 1 file changed, 13 insertions(+), 32 deletions(-)

--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -19,7 +19,6 @@
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/workqueue.h>
 #include <linux/uaccess.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
@@ -198,14 +197,12 @@ struct digi_port {
 	int dp_throttle_restart;
 	wait_queue_head_t dp_flush_wait;
 	wait_queue_head_t dp_close_wait;	/* wait queue for close */
-	struct work_struct dp_wakeup_work;
 	struct usb_serial_port *dp_port;
 };
 
 
 /* Local Function Declarations */
 
-static void digi_wakeup_write_lock(struct work_struct *work);
 static int digi_write_oob_command(struct usb_serial_port *port,
 	unsigned char *buf, int count, int interruptible);
 static int digi_write_inb_command(struct usb_serial_port *port,
@@ -356,26 +353,6 @@ __releases(lock)
 	return timeout;
 }
 
-
-/*
- *  Digi Wakeup Write
- *
- *  Wake up port, line discipline, and tty processes sleeping
- *  on writes.
- */
-
-static void digi_wakeup_write_lock(struct work_struct *work)
-{
-	struct digi_port *priv =
-			container_of(work, struct digi_port, dp_wakeup_work);
-	struct usb_serial_port *port = priv->dp_port;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->dp_port_lock, flags);
-	tty_port_tty_wakeup(&port->port);
-	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
-}
-
 /*
  *  Digi Write OOB Command
  *
@@ -986,6 +963,7 @@ static void digi_write_bulk_callback(str
 	unsigned long flags;
 	int ret = 0;
 	int status = urb->status;
+	bool wakeup;
 
 	/* port and serial sanity check */
 	if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) {
@@ -1012,6 +990,7 @@ static void digi_write_bulk_callback(str
 	}
 
 	/* try to send any buffered data on this port */
+	wakeup = true;
 	spin_lock_irqsave(&priv->dp_port_lock, flags);
 	priv->dp_write_urb_in_use = 0;
 	if (priv->dp_out_buf_len > 0) {
@@ -1027,19 +1006,18 @@ static void digi_write_bulk_callback(str
 		if (ret == 0) {
 			priv->dp_write_urb_in_use = 1;
 			priv->dp_out_buf_len = 0;
+			wakeup = false;
 		}
 	}
-	/* wake up processes sleeping on writes immediately */
-	tty_port_tty_wakeup(&port->port);
-	/* also queue up a wakeup at scheduler time, in case we */
-	/* lost the race in write_chan(). */
-	schedule_work(&priv->dp_wakeup_work);
-
 	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+
 	if (ret && ret != -EPERM)
 		dev_err_console(port,
 			"%s: usb_submit_urb failed, ret=%d, port=%d\n",
 			__func__, ret, priv->dp_port_num);
+
+	if (wakeup)
+		tty_port_tty_wakeup(&port->port);
 }
 
 static int digi_write_room(struct tty_struct *tty)
@@ -1239,7 +1217,6 @@ static int digi_port_init(struct usb_ser
 	init_waitqueue_head(&priv->dp_transmit_idle_wait);
 	init_waitqueue_head(&priv->dp_flush_wait);
 	init_waitqueue_head(&priv->dp_close_wait);
-	INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
 	priv->dp_port = port;
 
 	init_waitqueue_head(&port->write_wait);
@@ -1508,13 +1485,14 @@ static int digi_read_oob_callback(struct
 			rts = C_CRTSCTS(tty);
 
 		if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
+			bool wakeup = false;
+
 			spin_lock_irqsave(&priv->dp_port_lock, flags);
 			/* convert from digi flags to termiox flags */
 			if (val & DIGI_READ_INPUT_SIGNALS_CTS) {
 				priv->dp_modem_signals |= TIOCM_CTS;
-				/* port must be open to use tty struct */
 				if (rts)
-					tty_port_tty_wakeup(&port->port);
+					wakeup = true;
 			} else {
 				priv->dp_modem_signals &= ~TIOCM_CTS;
 				/* port must be open to use tty struct */
@@ -1533,6 +1511,9 @@ static int digi_read_oob_callback(struct
 				priv->dp_modem_signals &= ~TIOCM_CD;
 
 			spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+
+			if (wakeup)
+				tty_port_tty_wakeup(&port->port);
 		} else if (opcode == DIGI_CMD_TRANSMIT_IDLE) {
 			spin_lock_irqsave(&priv->dp_port_lock, flags);
 			priv->dp_transmit_idle = 1;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 581/717] USB: serial: keyspan_pda: fix dropped unthrottle interrupts
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (578 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 580/717] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 582/717] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.

Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity
checks") broke write-unthrottle handling by dropping well-formed
unthrottle-interrupt packets which are precisely two bytes long. This
could lead to blocked writers not being woken up when buffer space again
becomes available.

Instead, stop unconditionally printing the third byte which is
(presumably) only valid on modem-line changes.

Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks")
Cc: stable <stable@vger.kernel.org>     # 4.11
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -172,11 +172,11 @@ static void keyspan_pda_rx_interrupt(str
 		break;
 	case 1:
 		/* status interrupt */
-		if (len < 3) {
+		if (len < 2) {
 			dev_warn(&port->dev, "short interrupt message received\n");
 			break;
 		}
-		dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
+		dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
 		switch (data[1]) {
 		case 1: /* modemline change */
 			break;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 582/717] USB: serial: keyspan_pda: fix write deadlock
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (579 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 581/717] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 583/717] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.

The write() callback can be called in interrupt context (e.g. when used
as a console) so interrupts must be disabled while holding the port lock
to prevent a possible deadlock.

Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.19
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_
 	int request_unthrottle = 0;
 	int rc = 0;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
 
 	priv = usb_get_serial_port_data(port);
 	/* guess how much room is left in the device's ring buffer, and if we
@@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_
 	   the TX urb is in-flight (wait until it completes)
 	   the device is full (wait until it says there is room)
 	*/
-	spin_lock_bh(&port->lock);
+	spin_lock_irqsave(&port->lock, flags);
 	if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
-		spin_unlock_bh(&port->lock);
+		spin_unlock_irqrestore(&port->lock, flags);
 		return 0;
 	}
 	clear_bit(0, &port->write_urbs_free);
-	spin_unlock_bh(&port->lock);
+	spin_unlock_irqrestore(&port->lock, flags);
 
 	/* At this point the URB is in our control, nobody else can submit it
 	   again (the only sudden transition was the one from EINPROGRESS to



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 583/717] USB: serial: keyspan_pda: fix stalled writes
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (580 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 582/717] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 584/717] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream.

Make sure to clear the write-busy flag also in case no new data was
submitted due to lack of device buffer space so that writing is
resumed once space again becomes available.

Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -548,7 +548,7 @@ static int keyspan_pda_write(struct tty_
 
 	rc = count;
 exit:
-	if (rc < 0)
+	if (rc <= 0)
 		set_bit(0, &port->write_urbs_free);
 	return rc;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 584/717] USB: serial: keyspan_pda: fix write-wakeup use-after-free
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (581 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 583/717] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 585/717] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 37faf50615412947868c49aee62f68233307f4e4 upstream.

The driver's deferred write wakeup was never flushed on disconnect,
something which could lead to the driver port data being freed while the
wakeup work is still scheduled.

Fix this by using the usb-serial write wakeup which gets cancelled
properly on disconnect.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |   17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -43,8 +43,7 @@
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
-	struct work_struct			wakeup_work;
-	struct work_struct			unthrottle_work;
+	struct work_struct	unthrottle_work;
 	struct usb_serial	*serial;
 	struct usb_serial_port	*port;
 };
@@ -97,15 +96,6 @@ static const struct usb_device_id id_tab
 };
 #endif
 
-static void keyspan_pda_wakeup_write(struct work_struct *work)
-{
-	struct keyspan_pda_private *priv =
-		container_of(work, struct keyspan_pda_private, wakeup_work);
-	struct usb_serial_port *port = priv->port;
-
-	tty_port_tty_wakeup(&port->port);
-}
-
 static void keyspan_pda_request_unthrottle(struct work_struct *work)
 {
 	struct keyspan_pda_private *priv =
@@ -183,7 +173,7 @@ static void keyspan_pda_rx_interrupt(str
 		case 2: /* tx unthrottle interrupt */
 			priv->tx_throttled = 0;
 			/* queue up a wakeup at scheduler time */
-			schedule_work(&priv->wakeup_work);
+			usb_serial_port_softint(port);
 			break;
 		default:
 			break;
@@ -563,7 +553,7 @@ static void keyspan_pda_write_bulk_callb
 	priv = usb_get_serial_port_data(port);
 
 	/* queue up a wakeup at scheduler time */
-	schedule_work(&priv->wakeup_work);
+	usb_serial_port_softint(port);
 }
 
 
@@ -715,7 +705,6 @@ static int keyspan_pda_port_probe(struct
 	if (!priv)
 		return -ENOMEM;
 
-	INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
 	INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
 	priv->serial = port->serial;
 	priv->port = port;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 585/717] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (582 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 584/717] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 586/717] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream.

The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.

Fix this by cancelling the unthrottle work when shutting down the port.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -647,8 +647,12 @@ error:
 }
 static void keyspan_pda_close(struct usb_serial_port *port)
 {
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+
 	usb_kill_urb(port->write_urb);
 	usb_kill_urb(port->interrupt_in_urb);
+
+	cancel_work_sync(&priv->unthrottle_work);
 }
 
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 586/717] USB: serial: keyspan_pda: fix write unthrottling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (583 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 585/717] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 587/717] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream.

The driver did not update its view of the available device buffer space
until write() was called in task context. This meant that write_room()
would return 0 even after the device had sent a write-unthrottle
notification, something which could lead to blocked writers not being
woken up (e.g. when using OPOST).

Note that we must also request an unthrottle notification is case a
write() request fills the device buffer exactly.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -40,6 +40,8 @@
 #define DRIVER_AUTHOR "Brian Warner <warner@lothar.com>"
 #define DRIVER_DESC "USB Keyspan PDA Converter driver"
 
+#define KEYSPAN_TX_THRESHOLD	16
+
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
@@ -110,7 +112,7 @@ static void keyspan_pda_request_unthrott
 				 7, /* request_unthrottle */
 				 USB_TYPE_VENDOR | USB_RECIP_INTERFACE
 				 | USB_DIR_OUT,
-				 16, /* value: threshold */
+				 KEYSPAN_TX_THRESHOLD,
 				 0, /* index */
 				 NULL,
 				 0,
@@ -129,6 +131,8 @@ static void keyspan_pda_rx_interrupt(str
 	int retval;
 	int status = urb->status;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
+
 	priv = usb_get_serial_port_data(port);
 
 	switch (status) {
@@ -171,7 +175,10 @@ static void keyspan_pda_rx_interrupt(str
 		case 1: /* modemline change */
 			break;
 		case 2: /* tx unthrottle interrupt */
+			spin_lock_irqsave(&port->lock, flags);
 			priv->tx_throttled = 0;
+			priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD);
+			spin_unlock_irqrestore(&port->lock, flags);
 			/* queue up a wakeup at scheduler time */
 			usb_serial_port_softint(port);
 			break;
@@ -505,7 +512,8 @@ static int keyspan_pda_write(struct tty_
 			goto exit;
 		}
 	}
-	if (count > priv->tx_room) {
+
+	if (count >= priv->tx_room) {
 		/* we're about to completely fill the Tx buffer, so
 		   we'll be throttled afterwards. */
 		count = priv->tx_room;
@@ -560,14 +568,17 @@ static void keyspan_pda_write_bulk_callb
 static int keyspan_pda_write_room(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct keyspan_pda_private *priv;
-	priv = usb_get_serial_port_data(port);
-	/* used by n_tty.c for processing of tabs and such. Giving it our
-	   conservative guess is probably good enough, but needs testing by
-	   running a console through the device. */
-	return priv->tx_room;
-}
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+	int room = 0;
+
+	spin_lock_irqsave(&port->lock, flags);
+	if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled)
+		room = priv->tx_room;
+	spin_unlock_irqrestore(&port->lock, flags);
 
+	return room;
+}
 
 static int keyspan_pda_chars_in_buffer(struct tty_struct *tty)
 {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 587/717] btrfs: do not shorten unpin len for caching block groups
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (584 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 586/717] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 588/717] btrfs: update last_byte_to_unpin in switch_commit_roots Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filipe Manana, Josef Bacik, David Sterba

From: Josef Bacik <josef@toxicpanda.com>

commit 9076dbd5ee837c3882fc42891c14cecd0354a849 upstream.

While fixing up our ->last_byte_to_unpin locking I noticed that we will
shorten len based on ->last_byte_to_unpin if we're caching when we're
adding back the free space.  This is correct for the free space, as we
cannot unpin more than ->last_byte_to_unpin, however we use len to
adjust the ->bytes_pinned counters and such, which need to track the
actual pinned usage.  This could result in
WARN_ON(space_info->bytes_pinned) triggering at unmount time.

Fix this by using a local variable for the amount to add to free space
cache, and leave len untouched in this case.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/extent-tree.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2816,10 +2816,10 @@ static int unpin_extent_range(struct btr
 		len = cache->start + cache->length - start;
 		len = min(len, end + 1 - start);
 
-		if (start < cache->last_byte_to_unpin) {
-			len = min(len, cache->last_byte_to_unpin - start);
-			if (return_free_space)
-				btrfs_add_free_space(cache, start, len);
+		if (start < cache->last_byte_to_unpin && return_free_space) {
+			u64 add_len = min(len, cache->last_byte_to_unpin - start);
+
+			btrfs_add_free_space(cache, start, add_len);
 		}
 
 		start += len;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 588/717] btrfs: update last_byte_to_unpin in switch_commit_roots
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (585 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 587/717] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 589/717] btrfs: fix race when defragmenting leads to unnecessary IO Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filipe Manana, Josef Bacik, David Sterba

From: Josef Bacik <josef@toxicpanda.com>

commit 27d56e62e4748c2135650c260024e9904b8c1a0a upstream.

While writing an explanation for the need of the commit_root_sem for
btrfs_prepare_extent_commit, I realized we have a slight hole that could
result in leaked space if we have to do the old style caching.  Consider
the following scenario

 commit root
 +----+----+----+----+----+----+----+
 |\\\\|    |\\\\|\\\\|    |\\\\|\\\\|
 +----+----+----+----+----+----+----+
 0    1    2    3    4    5    6    7

 new commit root
 +----+----+----+----+----+----+----+
 |    |    |    |\\\\|    |    |\\\\|
 +----+----+----+----+----+----+----+
 0    1    2    3    4    5    6    7

Prior to this patch, we run btrfs_prepare_extent_commit, which updates
the last_byte_to_unpin, and then we subsequently run
switch_commit_roots.  In this example lets assume that
caching_ctl->progress == 1 at btrfs_prepare_extent_commit() time, which
means that cache->last_byte_to_unpin == 1.  Then we go and do the
switch_commit_roots(), but in the meantime the caching thread has made
some more progress, because we drop the commit_root_sem and re-acquired
it.  Now caching_ctl->progress == 3.  We swap out the commit root and
carry on to unpin.

The race can happen like:

  1) The caching thread was running using the old commit root when it
     found the extent for [2, 3);

  2) Then it released the commit_root_sem because it was in the last
     item of a leaf and the semaphore was contended, and set ->progress
     to 3 (value of 'last'), as the last extent item in the current leaf
     was for the extent for range [2, 3);

  3) Next time it gets the commit_root_sem, will start using the new
     commit root and search for a key with offset 3, so it never finds
     the hole for [2, 3).

  So the caching thread never saw [2, 3) as free space in any of the
  commit roots, and by the time finish_extent_commit() was called for
  the range [0, 3), ->last_byte_to_unpin was 1, so it only returned the
  subrange [0, 1) to the free space cache, skipping [2, 3).

In the unpin code we have last_byte_to_unpin == 1, so we unpin [0,1),
but do not unpin [2,3).  However because caching_ctl->progress == 3 we
do not see the newly freed section of [2,3), and thus do not add it to
our free space cache.  This results in us missing a chunk of free space
in memory (on disk too, unless we have a power failure before writing
the free space cache to disk).

Fix this by making sure the ->last_byte_to_unpin is set at the same time
that we swap the commit roots, this ensures that we will always be
consistent.

CC: stable@vger.kernel.org # 5.8+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[ update changelog with Filipe's review comments ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/ctree.h       |    1 -
 fs/btrfs/extent-tree.c |   25 -------------------------
 fs/btrfs/transaction.c |   42 ++++++++++++++++++++++++++++++++++++++++--
 3 files changed, 40 insertions(+), 28 deletions(-)

--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2593,7 +2593,6 @@ int btrfs_free_reserved_extent(struct bt
 			       u64 start, u64 len, int delalloc);
 int btrfs_pin_reserved_extent(struct btrfs_trans_handle *trans, u64 start,
 			      u64 len);
-void btrfs_prepare_extent_commit(struct btrfs_fs_info *fs_info);
 int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans);
 int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
 			 struct btrfs_ref *generic_ref);
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2730,31 +2730,6 @@ btrfs_inc_block_group_reservations(struc
 	atomic_inc(&bg->reservations);
 }
 
-void btrfs_prepare_extent_commit(struct btrfs_fs_info *fs_info)
-{
-	struct btrfs_caching_control *next;
-	struct btrfs_caching_control *caching_ctl;
-	struct btrfs_block_group *cache;
-
-	down_write(&fs_info->commit_root_sem);
-
-	list_for_each_entry_safe(caching_ctl, next,
-				 &fs_info->caching_block_groups, list) {
-		cache = caching_ctl->block_group;
-		if (btrfs_block_group_done(cache)) {
-			cache->last_byte_to_unpin = (u64)-1;
-			list_del_init(&caching_ctl->list);
-			btrfs_put_caching_control(caching_ctl);
-		} else {
-			cache->last_byte_to_unpin = caching_ctl->progress;
-		}
-	}
-
-	up_write(&fs_info->commit_root_sem);
-
-	btrfs_update_global_block_rsv(fs_info);
-}
-
 /*
  * Returns the free cluster for the given space info and sets empty_cluster to
  * what it should be based on the mount options.
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -155,6 +155,7 @@ static noinline void switch_commit_roots
 	struct btrfs_transaction *cur_trans = trans->transaction;
 	struct btrfs_fs_info *fs_info = trans->fs_info;
 	struct btrfs_root *root, *tmp;
+	struct btrfs_caching_control *caching_ctl, *next;
 
 	down_write(&fs_info->commit_root_sem);
 	list_for_each_entry_safe(root, tmp, &cur_trans->switch_commits,
@@ -180,6 +181,45 @@ static noinline void switch_commit_roots
 		spin_lock(&cur_trans->dropped_roots_lock);
 	}
 	spin_unlock(&cur_trans->dropped_roots_lock);
+
+	/*
+	 * We have to update the last_byte_to_unpin under the commit_root_sem,
+	 * at the same time we swap out the commit roots.
+	 *
+	 * This is because we must have a real view of the last spot the caching
+	 * kthreads were while caching.  Consider the following views of the
+	 * extent tree for a block group
+	 *
+	 * commit root
+	 * +----+----+----+----+----+----+----+
+	 * |\\\\|    |\\\\|\\\\|    |\\\\|\\\\|
+	 * +----+----+----+----+----+----+----+
+	 * 0    1    2    3    4    5    6    7
+	 *
+	 * new commit root
+	 * +----+----+----+----+----+----+----+
+	 * |    |    |    |\\\\|    |    |\\\\|
+	 * +----+----+----+----+----+----+----+
+	 * 0    1    2    3    4    5    6    7
+	 *
+	 * If the cache_ctl->progress was at 3, then we are only allowed to
+	 * unpin [0,1) and [2,3], because the caching thread has already
+	 * processed those extents.  We are not allowed to unpin [5,6), because
+	 * the caching thread will re-start it's search from 3, and thus find
+	 * the hole from [4,6) to add to the free space cache.
+	 */
+	list_for_each_entry_safe(caching_ctl, next,
+				 &fs_info->caching_block_groups, list) {
+		struct btrfs_block_group *cache = caching_ctl->block_group;
+
+		if (btrfs_block_group_done(cache)) {
+			cache->last_byte_to_unpin = (u64)-1;
+			list_del_init(&caching_ctl->list);
+			btrfs_put_caching_control(caching_ctl);
+		} else {
+			cache->last_byte_to_unpin = caching_ctl->progress;
+		}
+	}
 	up_write(&fs_info->commit_root_sem);
 }
 
@@ -2293,8 +2333,6 @@ int btrfs_commit_transaction(struct btrf
 		goto unlock_tree_log;
 	}
 
-	btrfs_prepare_extent_commit(fs_info);
-
 	cur_trans = fs_info->running_transaction;
 
 	btrfs_set_root_node(&fs_info->tree_root->root_item,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 589/717] btrfs: fix race when defragmenting leads to unnecessary IO
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (586 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 588/717] btrfs: update last_byte_to_unpin in switch_commit_roots Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 590/717] ext4: fix an IS_ERR() vs NULL check Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Josef Bacik, Filipe Manana, David Sterba

From: Filipe Manana <fdmanana@suse.com>

commit 7f458a3873ae94efe1f37c8b96c97e7298769e98 upstream.

When defragmenting we skip ranges that have holes or inline extents, so that
we don't do unnecessary IO and waste space. We do this check when calling
should_defrag_range() at btrfs_defrag_file(). However we do it without
holding the inode's lock. The reason we do it like this is to avoid
blocking other tasks for too long, that possibly want to operate on other
file ranges, since after the call to should_defrag_range() and before
locking the inode, we trigger a synchronous page cache readahead. However
before we were able to lock the inode, some other task might have punched
a hole in our range, or we may now have an inline extent there, in which
case we should not set the range for defrag anymore since that would cause
unnecessary IO and make us waste space (i.e. allocating extents to contain
zeros for a hole).

So after we locked the inode and the range in the iotree, check again if
we have holes or an inline extent, and if we do, just skip the range.

I hit this while testing my next patch that fixes races when updating an
inode's number of bytes (subject "btrfs: update the number of bytes used
by an inode atomically"), and it depends on this change in order to work
correctly. Alternatively I could rework that other patch to detect holes
and flag their range with the 'new delalloc' bit, but this itself fixes
an efficiency problem due a race that from a functional point of view is
not harmful (it could be triggered with btrfs/062 from fstests).

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/ioctl.c |   39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1275,6 +1275,7 @@ static int cluster_pages_for_defrag(stru
 	u64 page_end;
 	u64 page_cnt;
 	u64 start = (u64)start_index << PAGE_SHIFT;
+	u64 search_start;
 	int ret;
 	int i;
 	int i_done;
@@ -1371,6 +1372,40 @@ again:
 
 	lock_extent_bits(&BTRFS_I(inode)->io_tree,
 			 page_start, page_end - 1, &cached_state);
+
+	/*
+	 * When defragmenting we skip ranges that have holes or inline extents,
+	 * (check should_defrag_range()), to avoid unnecessary IO and wasting
+	 * space. At btrfs_defrag_file(), we check if a range should be defragged
+	 * before locking the inode and then, if it should, we trigger a sync
+	 * page cache readahead - we lock the inode only after that to avoid
+	 * blocking for too long other tasks that possibly want to operate on
+	 * other file ranges. But before we were able to get the inode lock,
+	 * some other task may have punched a hole in the range, or we may have
+	 * now an inline extent, in which case we should not defrag. So check
+	 * for that here, where we have the inode and the range locked, and bail
+	 * out if that happened.
+	 */
+	search_start = page_start;
+	while (search_start < page_end) {
+		struct extent_map *em;
+
+		em = btrfs_get_extent(BTRFS_I(inode), NULL, 0, search_start,
+				      page_end - search_start);
+		if (IS_ERR(em)) {
+			ret = PTR_ERR(em);
+			goto out_unlock_range;
+		}
+		if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
+			free_extent_map(em);
+			/* Ok, 0 means we did not defrag anything */
+			ret = 0;
+			goto out_unlock_range;
+		}
+		search_start = extent_map_end(em);
+		free_extent_map(em);
+	}
+
 	clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start,
 			  page_end - 1, EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING |
 			  EXTENT_DEFRAG, 0, 0, &cached_state);
@@ -1401,6 +1436,10 @@ again:
 	btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT);
 	extent_changeset_free(data_reserved);
 	return i_done;
+
+out_unlock_range:
+	unlock_extent_cached(&BTRFS_I(inode)->io_tree,
+			     page_start, page_end - 1, &cached_state);
 out:
 	for (i = 0; i < i_done; i++) {
 		unlock_page(pages[i]);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 590/717] ext4: fix an IS_ERR() vs NULL check
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (587 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 589/717] btrfs: fix race when defragmenting leads to unnecessary IO Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 591/717] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jan Kara,
	Theodore Tso, stable

From: Dan Carpenter <dan.carpenter@oracle.com>

commit bc18546bf68e47996a359d2533168d5770a22024 upstream.

The ext4_find_extent() function never returns NULL, it returns error
pointers.

Fixes: 44059e503b03 ("ext4: fast commit recovery path")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20201023112232.GB282278@mwanda
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/extents.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5815,8 +5815,8 @@ int ext4_ext_replay_update_ex(struct ino
 	int ret;
 
 	path = ext4_find_extent(inode, start, NULL, 0);
-	if (!path)
-		return -EINVAL;
+	if (IS_ERR(path))
+		return PTR_ERR(path);
 	ex = path[path->p_depth].p_ext;
 	if (!ex) {
 		ret = -EFSCORRUPTED;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 591/717] ext4: fix a memory leak of ext4_free_data
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (588 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 590/717] ext4: fix an IS_ERR() vs NULL check Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 592/717] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunguang Xu, Theodore Tso, stable

From: Chunguang Xu <brookxu@tencent.com>

commit cca415537244f6102cbb09b5b90db6ae2c953bdd upstream.

When freeing metadata, we will create an ext4_free_data and
insert it into the pending free list.  After the current
transaction is committed, the object will be freed.

ext4_mb_free_metadata() will check whether the area to be freed
overlaps with the pending free list. If true, return directly. At this
time, ext4_free_data is leaked.  Fortunately, the probability of this
problem is small, since it only occurs if the file system is corrupted
such that a block is claimed by more one inode and those inodes are
deleted within a single jbd2 transaction.

Signed-off-by: Chunguang Xu <brookxu@tencent.com>
Link: https://lore.kernel.org/r/1604764698-4269-8-git-send-email-brookxu@tencent.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/mballoc.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -5126,6 +5126,7 @@ ext4_mb_free_metadata(handle_t *handle,
 				ext4_group_first_block_no(sb, group) +
 				EXT4_C2B(sbi, cluster),
 				"Block already on to-be-freed list");
+			kmem_cache_free(ext4_free_data_cachep, new_entry);
 			return 0;
 		}
 	}



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 592/717] ext4: fix deadlock with fs freezing and EA inodes
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (589 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 591/717] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 593/717] ext4: dont remount read-only with errors=continue on reboot Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Kara, Andreas Dilger, Theodore Tso

From: Jan Kara <jack@suse.cz>

commit 46e294efc355c48d1dd4d58501aa56dac461792a upstream.

Xattr code using inodes with large xattr data can end up dropping last
inode reference (and thus deleting the inode) from places like
ext4_xattr_set_entry(). That function is called with transaction started
and so ext4_evict_inode() can deadlock against fs freezing like:

CPU1					CPU2

removexattr()				freeze_super()
  vfs_removexattr()
    ext4_xattr_set()
      handle = ext4_journal_start()
      ...
      ext4_xattr_set_entry()
        iput(old_ea_inode)
          ext4_evict_inode(old_ea_inode)
					  sb->s_writers.frozen = SB_FREEZE_FS;
					  sb_wait_write(sb, SB_FREEZE_FS);
					  ext4_freeze()
					    jbd2_journal_lock_updates()
					      -> blocks waiting for all
					         handles to stop
            sb_start_intwrite()
	      -> blocks as sb is already in SB_FREEZE_FS state

Generally it is advisable to delete inodes from a separate transaction
as it can consume quite some credits however in this case it would be
quite clumsy and furthermore the credits for inode deletion are quite
limited and already accounted for. So just tweak ext4_evict_inode() to
avoid freeze protection if we have transaction already started and thus
it is not really needed anyway.

Cc: stable@vger.kernel.org
Fixes: dec214d00e0d ("ext4: xattr inode deduplication")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/20201127110649.24730-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |   21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -175,6 +175,7 @@ void ext4_evict_inode(struct inode *inod
 	 */
 	int extra_credits = 6;
 	struct ext4_xattr_inode_array *ea_inode_array = NULL;
+	bool freeze_protected = false;
 
 	trace_ext4_evict_inode(inode);
 
@@ -232,9 +233,14 @@ void ext4_evict_inode(struct inode *inod
 
 	/*
 	 * Protect us against freezing - iput() caller didn't have to have any
-	 * protection against it
-	 */
-	sb_start_intwrite(inode->i_sb);
+	 * protection against it. When we are in a running transaction though,
+	 * we are already protected against freezing and we cannot grab further
+	 * protection due to lock ordering constraints.
+	 */
+	if (!ext4_journal_current_handle()) {
+		sb_start_intwrite(inode->i_sb);
+		freeze_protected = true;
+	}
 
 	if (!IS_NOQUOTA(inode))
 		extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
@@ -253,7 +259,8 @@ void ext4_evict_inode(struct inode *inod
 		 * cleaned up.
 		 */
 		ext4_orphan_del(NULL, inode);
-		sb_end_intwrite(inode->i_sb);
+		if (freeze_protected)
+			sb_end_intwrite(inode->i_sb);
 		goto no_delete;
 	}
 
@@ -294,7 +301,8 @@ void ext4_evict_inode(struct inode *inod
 stop_handle:
 		ext4_journal_stop(handle);
 		ext4_orphan_del(NULL, inode);
-		sb_end_intwrite(inode->i_sb);
+		if (freeze_protected)
+			sb_end_intwrite(inode->i_sb);
 		ext4_xattr_inode_array_free(ea_inode_array);
 		goto no_delete;
 	}
@@ -323,7 +331,8 @@ stop_handle:
 	else
 		ext4_free_inode(handle, inode);
 	ext4_journal_stop(handle);
-	sb_end_intwrite(inode->i_sb);
+	if (freeze_protected)
+		sb_end_intwrite(inode->i_sb);
 	ext4_xattr_inode_array_free(ea_inode_array);
 	return;
 no_delete:



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 593/717] ext4: dont remount read-only with errors=continue on reboot
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (590 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 592/717] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 594/717] RISC-V: Fix usage of memblock_enforce_memory_limit Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Kara, Andreas Dilger, stable,
	Theodore Tso

From: Jan Kara <jack@suse.cz>

commit b08070eca9e247f60ab39d79b2c25d274750441f upstream.

ext4_handle_error() with errors=continue mount option can accidentally
remount the filesystem read-only when the system is rebooting. Fix that.

Fixes: 1dc1097ff60e ("ext4: avoid panic during forced reboot")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20201127113405.26867-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |   14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -666,19 +666,17 @@ static bool system_going_down(void)
 
 static void ext4_handle_error(struct super_block *sb)
 {
+	journal_t *journal = EXT4_SB(sb)->s_journal;
+
 	if (test_opt(sb, WARN_ON_ERROR))
 		WARN_ON_ONCE(1);
 
-	if (sb_rdonly(sb))
+	if (sb_rdonly(sb) || test_opt(sb, ERRORS_CONT))
 		return;
 
-	if (!test_opt(sb, ERRORS_CONT)) {
-		journal_t *journal = EXT4_SB(sb)->s_journal;
-
-		ext4_set_mount_flag(sb, EXT4_MF_FS_ABORTED);
-		if (journal)
-			jbd2_journal_abort(journal, -EIO);
-	}
+	ext4_set_mount_flag(sb, EXT4_MF_FS_ABORTED);
+	if (journal)
+		jbd2_journal_abort(journal, -EIO);
 	/*
 	 * We force ERRORS_RO behavior when system is rebooting. Otherwise we
 	 * could panic during 'reboot -f' as the underlying device got already



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 594/717] RISC-V: Fix usage of memblock_enforce_memory_limit
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (591 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 593/717] ext4: dont remount read-only with errors=continue on reboot Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 595/717] arm64: dts: ti: k3-am65: mark dss as dma-coherent Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bin Meng, Mike Rapoport, Atish Patra,
	Palmer Dabbelt

From: Atish Patra <atish.patra@wdc.com>

commit de043da0b9e71147ca610ed542d34858aadfc61c upstream.

memblock_enforce_memory_limit accepts the maximum memory size not the
maximum address that can be handled by kernel. Fix the function invocation
accordingly.

Fixes: 1bd14a66ee52 ("RISC-V: Remove any memblock representing unusable memory area")
Cc: stable@vger.kernel.org
Reported-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/riscv/mm/init.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -174,7 +174,7 @@ void __init setup_bootmem(void)
 	 * Make sure that any memory beyond mem_start + (-PAGE_OFFSET) is removed
 	 * as it is unusable by kernel.
 	 */
-	memblock_enforce_memory_limit(mem_start - PAGE_OFFSET);
+	memblock_enforce_memory_limit(-PAGE_OFFSET);
 
 	/* Reserve from the start of the kernel to the end of the kernel */
 	memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 595/717] arm64: dts: ti: k3-am65: mark dss as dma-coherent
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (592 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 594/717] RISC-V: Fix usage of memblock_enforce_memory_limit Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 596/717] arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040 Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Nishanth Menon,
	Nikhil Devshatwar

From: Tomi Valkeinen <tomi.valkeinen@ti.com>

commit 50301e8815c681bc5de8ca7050c4b426923d4e19 upstream.

DSS is IO coherent on AM65, so we should mark it as such with
'dma-coherent' property in the DT file.

Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
Cc: stable@vger.kernel.org # v5.8+
Link: https://lore.kernel.org/r/20201102134650.55321-1-tomi.valkeinen@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/boot/dts/ti/k3-am65-main.dtsi |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
@@ -867,6 +867,8 @@
 
 		status = "disabled";
 
+		dma-coherent;
+
 		dss_ports: ports {
 			#address-cells = <1>;
 			#size-cells = <0>;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 596/717] arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (593 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 595/717] arm64: dts: ti: k3-am65: mark dss as dma-coherent Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 597/717] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomasz Nowicki, Gregory CLEMENT

From: Tomasz Nowicki <tn@semihalf.com>

commit f43cadef2df260101497a6aace05e24201f00202 upstream.

FW has to configure devices' StreamIDs so that SMMU is able to lookup
context and do proper translation later on. For Armada 7040 & 8040 and
publicly available FW, most of the devices are configured properly,
but some like ap_sdhci0, PCIe, NIC still remain unassigned which
results in SMMU faults about unmatched StreamID (assuming
ARM_SMMU_DISABLE_BYPASS_BY_DEFAUL=y).

Since there is dependency on custom FW let SMMU be disabled by default.
People who still willing to use SMMU need to enable manually and
use ARM_SMMU_DISABLE_BYPASS_BY_DEFAUL=n (or via kernel command line)
with extra caution.

Fixes: 83a3545d9c37 ("arm64: dts: marvell: add SMMU support")
Cc: <stable@vger.kernel.org> # 5.9+
Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/boot/dts/marvell/armada-7040.dtsi |    4 ----
 arch/arm64/boot/dts/marvell/armada-8040.dtsi |    4 ----
 2 files changed, 8 deletions(-)

--- a/arch/arm64/boot/dts/marvell/armada-7040.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-7040.dtsi
@@ -15,10 +15,6 @@
 		     "marvell,armada-ap806";
 };
 
-&smmu {
-	status = "okay";
-};
-
 &cp0_pcie0 {
 	iommu-map =
 		<0x0   &smmu 0x480 0x20>,
--- a/arch/arm64/boot/dts/marvell/armada-8040.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-8040.dtsi
@@ -15,10 +15,6 @@
 		     "marvell,armada-ap806";
 };
 
-&smmu {
-	status = "okay";
-};
-
 &cp0_pcie0 {
 	iommu-map =
 		<0x0   &smmu 0x480 0x20>,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 597/717] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (594 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 596/717] arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 598/717] KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Morse, Marc Zyngier

From: Marc Zyngier <maz@kernel.org>

commit ca4e514774930f30b66375a974b5edcbebaf0e7e upstream.

ARMv8.2 introduced TTBCR2, which shares TCR_EL1 with TTBCR.
Gracefully handle traps to this register when HCR_EL2.TVM is set.

Cc: stable@vger.kernel.org
Reported-by: James Morse <james.morse@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/kvm_host.h |    1 +
 arch/arm64/kvm/sys_regs.c         |    1 +
 2 files changed, 2 insertions(+)

--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -214,6 +214,7 @@ enum vcpu_sysreg {
 #define c2_TTBR1	(TTBR1_EL1 * 2)	/* Translation Table Base Register 1 */
 #define c2_TTBR1_high	(c2_TTBR1 + 1)	/* TTBR1 top 32 bits */
 #define c2_TTBCR	(TCR_EL1 * 2)	/* Translation Table Base Control R. */
+#define c2_TTBCR2	(c2_TTBCR + 1)	/* Translation Table Base Control R. 2 */
 #define c3_DACR		(DACR32_EL2 * 2)/* Domain Access Control Register */
 #define c5_DFSR		(ESR_EL1 * 2)	/* Data Fault Status Register */
 #define c5_IFSR		(IFSR32_EL2 * 2)/* Instruction Fault Status Register */
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1987,6 +1987,7 @@ static const struct sys_reg_desc cp15_re
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
+	{ Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, c2_TTBCR2 },
 	{ Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, c3_DACR },
 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, c5_DFSR },
 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, c5_IFSR },



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 598/717] KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (595 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 597/717] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 599/717] KVM: SVM: Remove the call to sev_platform_status() during setup Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Denis V. Lunev, Paolo Bonzini

From: Paolo Bonzini <pbonzini@redhat.com>

commit 39485ed95d6b83b62fa75c06c2c4d33992e0d971 upstream.

Until commit e7c587da1252 ("x86/speculation: Use synthetic bits for
IBRS/IBPB/STIBP"), KVM was testing both Intel and AMD CPUID bits before
allowing the guest to write MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD.
Testing only Intel bits on VMX processors, or only AMD bits on SVM
processors, fails if the guests are created with the "opposite" vendor
as the host.

While at it, also tweak the host CPU check to use the vendor-agnostic
feature bit X86_FEATURE_IBPB, since we only care about the availability
of the MSR on the host here and not about specific CPUID bits.

Fixes: e7c587da1252 ("x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP")
Cc: stable@vger.kernel.org
Reported-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/cpuid.h   |   14 ++++++++++++++
 arch/x86/kvm/svm/svm.c |   14 ++++----------
 arch/x86/kvm/vmx/vmx.c |    8 ++++----
 3 files changed, 22 insertions(+), 14 deletions(-)

--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -264,6 +264,20 @@ static inline int guest_cpuid_stepping(s
 	return x86_stepping(best->eax);
 }
 
+static inline bool guest_has_spec_ctrl_msr(struct kvm_vcpu *vcpu)
+{
+	return (guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) ||
+		guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) ||
+		guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) ||
+		guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD));
+}
+
+static inline bool guest_has_pred_cmd_msr(struct kvm_vcpu *vcpu)
+{
+	return (guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) ||
+		guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBPB));
+}
+
 static inline bool supports_cpuid_fault(struct kvm_vcpu *vcpu)
 {
 	return vcpu->arch.msr_platform_info & MSR_PLATFORM_INFO_CPUID_FAULT;
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2543,10 +2543,7 @@ static int svm_get_msr(struct kvm_vcpu *
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr_info->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
+		    !guest_has_spec_ctrl_msr(vcpu))
 			return 1;
 
 		msr_info->data = svm->spec_ctrl;
@@ -2630,10 +2627,7 @@ static int svm_set_msr(struct kvm_vcpu *
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
+		    !guest_has_spec_ctrl_msr(vcpu))
 			return 1;
 
 		if (kvm_spec_ctrl_test_value(data))
@@ -2658,12 +2652,12 @@ static int svm_set_msr(struct kvm_vcpu *
 		break;
 	case MSR_IA32_PRED_CMD:
 		if (!msr->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBPB))
+		    !guest_has_pred_cmd_msr(vcpu))
 			return 1;
 
 		if (data & ~PRED_CMD_IBPB)
 			return 1;
-		if (!boot_cpu_has(X86_FEATURE_AMD_IBPB))
+		if (!boot_cpu_has(X86_FEATURE_IBPB))
 			return 1;
 		if (!data)
 			break;
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1826,7 +1826,7 @@ static int vmx_get_msr(struct kvm_vcpu *
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr_info->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+		    !guest_has_spec_ctrl_msr(vcpu))
 			return 1;
 
 		msr_info->data = to_vmx(vcpu)->spec_ctrl;
@@ -2028,7 +2028,7 @@ static int vmx_set_msr(struct kvm_vcpu *
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr_info->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+		    !guest_has_spec_ctrl_msr(vcpu))
 			return 1;
 
 		if (kvm_spec_ctrl_test_value(data))
@@ -2063,12 +2063,12 @@ static int vmx_set_msr(struct kvm_vcpu *
 		goto find_uret_msr;
 	case MSR_IA32_PRED_CMD:
 		if (!msr_info->host_initiated &&
-		    !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+		    !guest_has_pred_cmd_msr(vcpu))
 			return 1;
 
 		if (data & ~PRED_CMD_IBPB)
 			return 1;
-		if (!boot_cpu_has(X86_FEATURE_SPEC_CTRL))
+		if (!boot_cpu_has(X86_FEATURE_IBPB))
 			return 1;
 		if (!data)
 			break;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 599/717] KVM: SVM: Remove the call to sev_platform_status() during setup
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (596 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 598/717] KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 600/717] iommu/arm-smmu: Allow implementation specific write_s2cr Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Lendacky, Paolo Bonzini

From: Tom Lendacky <thomas.lendacky@amd.com>

commit 9d4747d02376aeb8de38afa25430de79129c5799 upstream.

When both KVM support and the CCP driver are built into the kernel instead
of as modules, KVM initialization can happen before CCP initialization. As
a result, sev_platform_status() will return a failure when it is called
from sev_hardware_setup(), when this isn't really an error condition.

Since sev_platform_status() doesn't need to be called at this time anyway,
remove the invocation from sev_hardware_setup().

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <618380488358b56af558f2682203786f09a49483.1607620209.git.thomas.lendacky@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/svm/sev.c |   22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -1127,9 +1127,6 @@ void sev_vm_destroy(struct kvm *kvm)
 
 int __init sev_hardware_setup(void)
 {
-	struct sev_user_data_status *status;
-	int rc;
-
 	/* Maximum number of encrypted guests supported simultaneously */
 	max_sev_asid = cpuid_ecx(0x8000001F);
 
@@ -1148,26 +1145,9 @@ int __init sev_hardware_setup(void)
 	if (!sev_reclaim_asid_bitmap)
 		return 1;
 
-	status = kmalloc(sizeof(*status), GFP_KERNEL);
-	if (!status)
-		return 1;
-
-	/*
-	 * Check SEV platform status.
-	 *
-	 * PLATFORM_STATUS can be called in any state, if we failed to query
-	 * the PLATFORM status then either PSP firmware does not support SEV
-	 * feature or SEV firmware is dead.
-	 */
-	rc = sev_platform_status(status, NULL);
-	if (rc)
-		goto err;
-
 	pr_info("SEV supported\n");
 
-err:
-	kfree(status);
-	return rc;
+	return 0;
 }
 
 void sev_hardware_teardown(void)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 600/717] iommu/arm-smmu: Allow implementation specific write_s2cr
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (597 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 599/717] KVM: SVM: Remove the call to sev_platform_status() during setup Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.10 601/717] iommu/arm-smmu-qcom: Read back stream mappings Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Steev Klimaszewski,
	Robin Murphy, Will Deacon

From: Bjorn Andersson <bjorn.andersson@linaro.org>

commit 56b75b51ed6d5e7bffda59440404409bca2dff00 upstream.

The firmware found in some Qualcomm platforms intercepts writes to the
S2CR register in order to replace the BYPASS type with FAULT. Further
more it treats faults at this level as catastrophic and restarts the
device.

Add support for providing implementation specific versions of the S2CR
write function, to allow the Qualcomm driver to work around this
behavior.

Cc: <stable@vger.kernel.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Tested-by: Steev Klimaszewski <steev@kali.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20201019182323.3162386-2-bjorn.andersson@linaro.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/arm/arm-smmu/arm-smmu.c |   13 ++++++++++---
 drivers/iommu/arm/arm-smmu/arm-smmu.h |    1 +
 2 files changed, 11 insertions(+), 3 deletions(-)

--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c
@@ -929,9 +929,16 @@ static void arm_smmu_write_smr(struct ar
 static void arm_smmu_write_s2cr(struct arm_smmu_device *smmu, int idx)
 {
 	struct arm_smmu_s2cr *s2cr = smmu->s2crs + idx;
-	u32 reg = FIELD_PREP(ARM_SMMU_S2CR_TYPE, s2cr->type) |
-		  FIELD_PREP(ARM_SMMU_S2CR_CBNDX, s2cr->cbndx) |
-		  FIELD_PREP(ARM_SMMU_S2CR_PRIVCFG, s2cr->privcfg);
+	u32 reg;
+
+	if (smmu->impl && smmu->impl->write_s2cr) {
+		smmu->impl->write_s2cr(smmu, idx);
+		return;
+	}
+
+	reg = FIELD_PREP(ARM_SMMU_S2CR_TYPE, s2cr->type) |
+	      FIELD_PREP(ARM_SMMU_S2CR_CBNDX, s2cr->cbndx) |
+	      FIELD_PREP(ARM_SMMU_S2CR_PRIVCFG, s2cr->privcfg);
 
 	if (smmu->features & ARM_SMMU_FEAT_EXIDS && smmu->smrs &&
 	    smmu->smrs[idx].valid)
--- a/drivers/iommu/arm/arm-smmu/arm-smmu.h
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.h
@@ -436,6 +436,7 @@ struct arm_smmu_impl {
 	int (*alloc_context_bank)(struct arm_smmu_domain *smmu_domain,
 				  struct arm_smmu_device *smmu,
 				  struct device *dev, int start);
+	void (*write_s2cr)(struct arm_smmu_device *smmu, int idx);
 };
 
 #define INVALID_SMENDX			-1



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 601/717] iommu/arm-smmu-qcom: Read back stream mappings
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (598 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 600/717] iommu/arm-smmu: Allow implementation specific write_s2cr Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 602/717] iommu/arm-smmu-qcom: Implement S2CR quirk Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Steev Klimaszewski,
	Robin Murphy, Will Deacon

From: Bjorn Andersson <bjorn.andersson@linaro.org>

commit 07a7f2caaa5a2619934491bab3c47b261c554fb0 upstream.

The Qualcomm boot loader configures stream mapping for the peripherals
that it accesses and in particular it sets up the stream mapping for the
display controller to be allowed to scan out a splash screen or EFI
framebuffer.

Read back the stream mappings during initialization and make the
arm-smmu driver maintain the streams in bypass mode.

Cc: <stable@vger.kernel.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Tested-by: Steev Klimaszewski <steev@kali.org>
Acked-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20201019182323.3162386-3-bjorn.andersson@linaro.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c |   23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -23,6 +23,28 @@ static const struct of_device_id qcom_sm
 	{ }
 };
 
+static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
+{
+	u32 smr;
+	int i;
+
+	for (i = 0; i < smmu->num_mapping_groups; i++) {
+		smr = arm_smmu_gr0_read(smmu, ARM_SMMU_GR0_SMR(i));
+
+		if (FIELD_GET(ARM_SMMU_SMR_VALID, smr)) {
+			smmu->smrs[i].id = FIELD_GET(ARM_SMMU_SMR_ID, smr);
+			smmu->smrs[i].mask = FIELD_GET(ARM_SMMU_SMR_MASK, smr);
+			smmu->smrs[i].valid = true;
+
+			smmu->s2crs[i].type = S2CR_TYPE_BYPASS;
+			smmu->s2crs[i].privcfg = S2CR_PRIVCFG_DEFAULT;
+			smmu->s2crs[i].cbndx = 0xff;
+		}
+	}
+
+	return 0;
+}
+
 static int qcom_smmu_def_domain_type(struct device *dev)
 {
 	const struct of_device_id *match =
@@ -61,6 +83,7 @@ static int qcom_smmu500_reset(struct arm
 }
 
 static const struct arm_smmu_impl qcom_smmu_impl = {
+	.cfg_probe = qcom_smmu_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
 	.reset = qcom_smmu500_reset,
 };



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 602/717] iommu/arm-smmu-qcom: Implement S2CR quirk
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (599 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.10 601/717] iommu/arm-smmu-qcom: Read back stream mappings Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 603/717] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Steev Klimaszewski,
	Robin Murphy, Will Deacon

From: Bjorn Andersson <bjorn.andersson@linaro.org>

commit f9081b8ff5934b8d69c748d0200e844cadd2c667 upstream.

The firmware found in some Qualcomm platforms intercepts writes to S2CR
in order to replace bypass type streams with fault; and ignore S2CR
updates of type fault.

Detect this behavior and implement a custom write_s2cr function in order
to trick the firmware into supporting bypass streams by the means of
configuring the stream for translation using a reserved and disabled
context bank.

Also circumvent the problem of configuring faulting streams by
configuring the stream as bypass.

Cc: <stable@vger.kernel.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Tested-by: Steev Klimaszewski <steev@kali.org>
Acked-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20201019182323.3162386-4-bjorn.andersson@linaro.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c |   67 +++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -10,8 +10,15 @@
 
 struct qcom_smmu {
 	struct arm_smmu_device smmu;
+	bool bypass_quirk;
+	u8 bypass_cbndx;
 };
 
+static struct qcom_smmu *to_qcom_smmu(struct arm_smmu_device *smmu)
+{
+	return container_of(smmu, struct qcom_smmu, smmu);
+}
+
 static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = {
 	{ .compatible = "qcom,adreno" },
 	{ .compatible = "qcom,mdp4" },
@@ -25,9 +32,33 @@ static const struct of_device_id qcom_sm
 
 static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
 {
+	unsigned int last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1);
+	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	u32 reg;
 	u32 smr;
 	int i;
 
+	/*
+	 * With some firmware versions writes to S2CR of type FAULT are
+	 * ignored, and writing BYPASS will end up written as FAULT in the
+	 * register. Perform a write to S2CR to detect if this is the case and
+	 * if so reserve a context bank to emulate bypass streams.
+	 */
+	reg = FIELD_PREP(ARM_SMMU_S2CR_TYPE, S2CR_TYPE_BYPASS) |
+	      FIELD_PREP(ARM_SMMU_S2CR_CBNDX, 0xff) |
+	      FIELD_PREP(ARM_SMMU_S2CR_PRIVCFG, S2CR_PRIVCFG_DEFAULT);
+	arm_smmu_gr0_write(smmu, last_s2cr, reg);
+	reg = arm_smmu_gr0_read(smmu, last_s2cr);
+	if (FIELD_GET(ARM_SMMU_S2CR_TYPE, reg) != S2CR_TYPE_BYPASS) {
+		qsmmu->bypass_quirk = true;
+		qsmmu->bypass_cbndx = smmu->num_context_banks - 1;
+
+		set_bit(qsmmu->bypass_cbndx, smmu->context_map);
+
+		reg = FIELD_PREP(ARM_SMMU_CBAR_TYPE, CBAR_TYPE_S1_TRANS_S2_BYPASS);
+		arm_smmu_gr1_write(smmu, ARM_SMMU_GR1_CBAR(qsmmu->bypass_cbndx), reg);
+	}
+
 	for (i = 0; i < smmu->num_mapping_groups; i++) {
 		smr = arm_smmu_gr0_read(smmu, ARM_SMMU_GR0_SMR(i));
 
@@ -45,6 +76,41 @@ static int qcom_smmu_cfg_probe(struct ar
 	return 0;
 }
 
+static void qcom_smmu_write_s2cr(struct arm_smmu_device *smmu, int idx)
+{
+	struct arm_smmu_s2cr *s2cr = smmu->s2crs + idx;
+	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	u32 cbndx = s2cr->cbndx;
+	u32 type = s2cr->type;
+	u32 reg;
+
+	if (qsmmu->bypass_quirk) {
+		if (type == S2CR_TYPE_BYPASS) {
+			/*
+			 * Firmware with quirky S2CR handling will substitute
+			 * BYPASS writes with FAULT, so point the stream to the
+			 * reserved context bank and ask for translation on the
+			 * stream
+			 */
+			type = S2CR_TYPE_TRANS;
+			cbndx = qsmmu->bypass_cbndx;
+		} else if (type == S2CR_TYPE_FAULT) {
+			/*
+			 * Firmware with quirky S2CR handling will ignore FAULT
+			 * writes, so trick it to write FAULT by asking for a
+			 * BYPASS.
+			 */
+			type = S2CR_TYPE_BYPASS;
+			cbndx = 0xff;
+		}
+	}
+
+	reg = FIELD_PREP(ARM_SMMU_S2CR_TYPE, type) |
+	      FIELD_PREP(ARM_SMMU_S2CR_CBNDX, cbndx) |
+	      FIELD_PREP(ARM_SMMU_S2CR_PRIVCFG, s2cr->privcfg);
+	arm_smmu_gr0_write(smmu, ARM_SMMU_GR0_S2CR(idx), reg);
+}
+
 static int qcom_smmu_def_domain_type(struct device *dev)
 {
 	const struct of_device_id *match =
@@ -86,6 +152,7 @@ static const struct arm_smmu_impl qcom_s
 	.cfg_probe = qcom_smmu_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
 	.reset = qcom_smmu500_reset,
+	.write_s2cr = qcom_smmu_write_s2cr,
 };
 
 struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 603/717] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (600 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 602/717] iommu/arm-smmu-qcom: Implement S2CR quirk Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 604/717] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller, Tony Lindgren

From: H. Nikolaus Schaller <hns@goldelico.com>

commit df9dbaf2c415cd94ad520067a1eccfee62f00a33 upstream.

The pinmux control register offset passed to OMAP4_IOPAD is odd.

Fixes: ab9a13665e7c ("ARM: dts: pandaboard: add gpio user button")
Cc: stable@vger.kernel.org
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/omap4-panda-es.dts |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/omap4-panda-es.dts
+++ b/arch/arm/boot/dts/omap4-panda-es.dts
@@ -46,7 +46,7 @@
 
 	button_pins: pinmux_button_pins {
 		pinctrl-single,pins = <
-			OMAP4_IOPAD(0x11b, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
+			OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
 		>;
 	};
 };



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 604/717] ARM: dts: at91: sama5d2: fix CAN message ram offset and size
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (601 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 603/717] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 605/717] ARM: tegra: Populate OPP table for Tegra20 Ventana Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Sneddon, Nicolas Ferre,
	Alexandre Belloni, Cristian Birsan

From: Nicolas Ferre <nicolas.ferre@microchip.com>

commit 85b8350ae99d1300eb6dc072459246c2649a8e50 upstream.

CAN0 and CAN1 instances share the same message ram configured
at 0x210000 on sama5d2 Linux systems.
According to current configuration of CAN0, we need 0x1c00 bytes
so that the CAN1 don't overlap its message ram:
64 x RX FIFO0 elements => 64 x 72 bytes
32 x TXE (TX Event FIFO) elements => 32 x 8 bytes
32 x TXB (TX Buffer) elements => 32 x 72 bytes
So a total of 7168 bytes (0x1C00).

Fix offset to match this needed size.
Make the CAN0 message ram ioremap match exactly this size so that is
easily understandable.  Adapt CAN1 size accordingly.

Fixes: bc6d5d7666b7 ("ARM: dts: at91: sama5d2: add m_can nodes")
Reported-by: Dan Sneddon <dan.sneddon@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Tested-by: Cristian Birsan <cristian.birsan@microchip.com>
Cc: stable@vger.kernel.org # v4.13+
Link: https://lore.kernel.org/r/20201203091949.9015-1-nicolas.ferre@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/sama5d2.dtsi |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -725,7 +725,7 @@
 
 			can0: can@f8054000 {
 				compatible = "bosch,m_can";
-				reg = <0xf8054000 0x4000>, <0x210000 0x4000>;
+				reg = <0xf8054000 0x4000>, <0x210000 0x1c00>;
 				reg-names = "m_can", "message_ram";
 				interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>,
 					     <64 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1131,7 +1131,7 @@
 
 			can1: can@fc050000 {
 				compatible = "bosch,m_can";
-				reg = <0xfc050000 0x4000>, <0x210000 0x4000>;
+				reg = <0xfc050000 0x4000>, <0x210000 0x3800>;
 				reg-names = "m_can", "message_ram";
 				interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>,
 					     <65 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1141,7 +1141,7 @@
 				assigned-clocks = <&pmc PMC_TYPE_GCK 57>;
 				assigned-clock-parents = <&pmc PMC_TYPE_CORE PMC_UTMI>;
 				assigned-clock-rates = <40000000>;
-				bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>;
+				bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>;
 				status = "disabled";
 			};
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 605/717] ARM: tegra: Populate OPP table for Tegra20 Ventana
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (602 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 604/717] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 606/717] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jon Hunter, Thierry Reding

From: Jon Hunter <jonathanh@nvidia.com>

commit bd7cd7e05a42491469ca19861da44abc3168cf5f upstream.

Commit 9ce274630495 ("cpufreq: tegra20: Use generic cpufreq-dt driver
(Tegra30 supported now)") update the Tegra20 CPUFREQ driver to use the
generic CPUFREQ device-tree driver. Since this change CPUFREQ support
on the Tegra20 Ventana platform has been broken because the necessary
device-tree nodes with the operating point information are not populated
for this platform. Fix this by updating device-tree for Venata to
include the operating point informration for Tegra20.

Fixes: 9ce274630495 ("cpufreq: tegra20: Use generic cpufreq-dt driver (Tegra30 supported now)")
Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/tegra20-ventana.dts |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/arch/arm/boot/dts/tegra20-ventana.dts
+++ b/arch/arm/boot/dts/tegra20-ventana.dts
@@ -3,6 +3,7 @@
 
 #include <dt-bindings/input/input.h>
 #include "tegra20.dtsi"
+#include "tegra20-cpu-opp.dtsi"
 
 / {
 	model = "NVIDIA Tegra20 Ventana evaluation board";
@@ -592,6 +593,16 @@
 		#clock-cells = <0>;
 	};
 
+	cpus {
+		cpu0: cpu@0 {
+			operating-points-v2 = <&cpu0_opp_table>;
+		};
+
+		cpu@1 {
+			operating-points-v2 = <&cpu0_opp_table>;
+		};
+	};
+
 	gpio-keys {
 		compatible = "gpio-keys";
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 606/717] xprtrdma: Fix XDRBUF_SPARSE_PAGES support
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (603 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 605/717] ARM: tegra: Populate OPP table for Tegra20 Ventana Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 607/717] powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olga Kornievskaia, Chuck Lever,
	Trond Myklebust

From: Chuck Lever <chuck.lever@oracle.com>

commit 15261b9126cd5bb2ad8521da49d8f5c042d904c7 upstream.

Olga K. observed that rpcrdma_marsh_req() allocates sparse pages
only when it has determined that a Reply chunk is necessary. There
are plenty of cases where no Reply chunk is needed, but the
XDRBUF_SPARSE_PAGES flag is set. The result would be a crash in
rpcrdma_inline_fixup() when it tries to copy parts of the received
Reply into a missing page.

To avoid crashing, handle sparse page allocation up front.

Until XATTR support was added, this issue did not appear often
because the only SPARSE_PAGES consumer always expected a reply large
enough to always require a Reply chunk.

Reported-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/rpc_rdma.c |   40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -179,6 +179,31 @@ rpcrdma_nonpayload_inline(const struct r
 		r_xprt->rx_ep->re_max_inline_recv;
 }
 
+/* ACL likes to be lazy in allocating pages. For TCP, these
+ * pages can be allocated during receive processing. Not true
+ * for RDMA, which must always provision receive buffers
+ * up front.
+ */
+static noinline int
+rpcrdma_alloc_sparse_pages(struct xdr_buf *buf)
+{
+	struct page **ppages;
+	int len;
+
+	len = buf->page_len;
+	ppages = buf->pages + (buf->page_base >> PAGE_SHIFT);
+	while (len > 0) {
+		if (!*ppages)
+			*ppages = alloc_page(GFP_NOWAIT | __GFP_NOWARN);
+		if (!*ppages)
+			return -ENOBUFS;
+		ppages++;
+		len -= PAGE_SIZE;
+	}
+
+	return 0;
+}
+
 /* Split @vec on page boundaries into SGEs. FMR registers pages, not
  * a byte range. Other modes coalesce these SGEs into a single MR
  * when they can.
@@ -233,15 +258,6 @@ rpcrdma_convert_iovs(struct rpcrdma_xprt
 	ppages = xdrbuf->pages + (xdrbuf->page_base >> PAGE_SHIFT);
 	page_base = offset_in_page(xdrbuf->page_base);
 	while (len) {
-		/* ACL likes to be lazy in allocating pages - ACLs
-		 * are small by default but can get huge.
-		 */
-		if (unlikely(xdrbuf->flags & XDRBUF_SPARSE_PAGES)) {
-			if (!*ppages)
-				*ppages = alloc_page(GFP_NOWAIT | __GFP_NOWARN);
-			if (!*ppages)
-				return -ENOBUFS;
-		}
 		seg->mr_page = *ppages;
 		seg->mr_offset = (char *)page_base;
 		seg->mr_len = min_t(u32, PAGE_SIZE - page_base, len);
@@ -867,6 +883,12 @@ rpcrdma_marshal_req(struct rpcrdma_xprt
 	__be32 *p;
 	int ret;
 
+	if (unlikely(rqst->rq_rcv_buf.flags & XDRBUF_SPARSE_PAGES)) {
+		ret = rpcrdma_alloc_sparse_pages(&rqst->rq_rcv_buf);
+		if (ret)
+			return ret;
+	}
+
 	rpcrdma_set_xdrlen(&req->rl_hdrbuf, 0);
 	xdr_init_encode(xdr, &req->rl_hdrbuf, rdmab_data(req->rl_rdmabuf),
 			rqst);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 607/717] powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (604 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 606/717] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 608/717] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit d5c243989fb0cb03c74d7340daca3b819f706ee7 upstream.

We need r1 to be properly set before activating MMU, otherwise any new
exception taken while saving registers into the stack in syscall
prologs will use the user stack, which is wrong and will even lockup
or crash when KUAP is selected.

Do that by switching the meaning of r11 and r1 until we have saved r1
to the stack: copy r1 into r11 and setup the new stack pointer in r1.
To avoid complicating and impacting all generic and specific prolog
code (and more), copy back r1 into r11 once r11 is save onto
the stack.

We could get rid of copying r1 back and forth at the cost of rewriting
everything to use r1 instead of r11 all the way when CONFIG_VMAP_STACK
is set, but the effort is probably not worth it for now.

Fixes: da7bb43ab9da ("powerpc/32: Fix vmap stack - Properly set r1 before activating MMU")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/a3d819d5c348cee9783a311d5d3f3ba9b48fd219.1608531452.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/head_32.h |   25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

--- a/arch/powerpc/kernel/head_32.h
+++ b/arch/powerpc/kernel/head_32.h
@@ -131,18 +131,28 @@
 #ifdef CONFIG_VMAP_STACK
 	mfspr	r11, SPRN_SRR0
 	mtctr	r11
-#endif
 	andi.	r11, r9, MSR_PR
-	lwz	r11,TASK_STACK-THREAD(r12)
+	mr	r11, r1
+	lwz	r1,TASK_STACK-THREAD(r12)
 	beq-	99f
-	addi	r11, r11, THREAD_SIZE - INT_FRAME_SIZE
-#ifdef CONFIG_VMAP_STACK
+	addi	r1, r1, THREAD_SIZE - INT_FRAME_SIZE
 	li	r10, MSR_KERNEL & ~(MSR_IR | MSR_RI) /* can take DTLB miss */
 	mtmsr	r10
 	isync
+	tovirt(r12, r12)
+	stw	r11,GPR1(r1)
+	stw	r11,0(r1)
+	mr	r11, r1
+#else
+	andi.	r11, r9, MSR_PR
+	lwz	r11,TASK_STACK-THREAD(r12)
+	beq-	99f
+	addi	r11, r11, THREAD_SIZE - INT_FRAME_SIZE
+	tophys(r11, r11)
+	stw	r1,GPR1(r11)
+	stw	r1,0(r11)
+	tovirt(r1, r11)		/* set new kernel sp */
 #endif
-	tovirt_vmstack r12, r12
-	tophys_novmstack r11, r11
 	mflr	r10
 	stw	r10, _LINK(r11)
 #ifdef CONFIG_VMAP_STACK
@@ -150,9 +160,6 @@
 #else
 	mfspr	r10,SPRN_SRR0
 #endif
-	stw	r1,GPR1(r11)
-	stw	r1,0(r11)
-	tovirt_novmstack r1, r11	/* set new kernel sp */
 	stw	r10,_NIP(r11)
 	mfcr	r10
 	rlwinm	r10,r10,0,4,2	/* Clear SO bit in CR */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 608/717] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (605 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 607/717] powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 609/717] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Desnoyers, Christophe Leroy,
	Segher Boessenkool, Michael Ellerman

From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

commit d85be8a49e733dcd23674aa6202870d54bf5600d upstream.

The placeholder for instruction selection should use the second
argument's operand, which is %1, not %0. This could generate incorrect
assembly code if the memory addressing of operand %0 is a different
form from that of operand %1.

Also remove the %Un placeholder because having %Un placeholders
for two operands which are based on the same local var (ptep) doesn't
make much sense. By the way, it doesn't change the current behaviour
because "<>" constraint is missing for the associated "=m".

[chleroy: revised commit log iaw segher's comments and removed %U0]

Fixes: 9bf2b5cdc5fe ("powerpc: Fixes for CONFIG_PTE_64BIT for SMP support")
Cc: <stable@vger.kernel.org> # v2.6.28+
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/96354bd77977a6a933fe9020da57629007fdb920.1603358942.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/book3s/32/pgtable.h |    4 ++--
 arch/powerpc/include/asm/nohash/pgtable.h    |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -524,9 +524,9 @@ static inline void __set_pte_at(struct m
 	if (pte_val(*ptep) & _PAGE_HASHPTE)
 		flush_hash_entry(mm, ptep, addr);
 	__asm__ __volatile__("\
-		stw%U0%X0 %2,%0\n\
+		stw%X0 %2,%0\n\
 		eieio\n\
-		stw%U0%X0 %L2,%1"
+		stw%X1 %L2,%1"
 	: "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
 	: "r" (pte) : "memory");
 
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -192,9 +192,9 @@ static inline void __set_pte_at(struct m
 	 */
 	if (IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_PTE_64BIT) && !percpu) {
 		__asm__ __volatile__("\
-			stw%U0%X0 %2,%0\n\
+			stw%X0 %2,%0\n\
 			eieio\n\
-			stw%U0%X0 %L2,%1"
+			stw%X1 %L2,%1"
 		: "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
 		: "r" (pte) : "memory");
 		return;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 609/717] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (606 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 608/717] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 610/717] powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tyrel Datwyler, Michael Ellerman

From: Tyrel Datwyler <tyreld@linux.ibm.com>

commit f10881a46f8914428110d110140a455c66bdf27b upstream.

Commit bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
introduced the following error when invoking the errinjct userspace
tool:

  [root@ltcalpine2-lp5 librtas]# errinjct open
  [327884.071171] sys_rtas: RTAS call blocked - exploit attempt?
  [327884.071186] sys_rtas: token=0x26, nargs=0 (called by errinjct)
  errinjct: Could not open RTAS error injection facility
  errinjct: librtas: open: Unexpected I/O error

The entry for ibm,open-errinjct in rtas_filter array has a typo where
the "j" is omitted in the rtas call name. After fixing this typo the
errinjct tool functions again as expected.

  [root@ltcalpine2-lp5 linux]# errinjct open
  RTAS error injection facility open, token = 1

Fixes: bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201208195434.8289-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/rtas.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1030,7 +1030,7 @@ static struct rtas_filter rtas_filters[]
 	{ "ibm,display-message", -1, 0, -1, -1, -1 },
 	{ "ibm,errinjct", -1, 2, -1, -1, -1, 1024 },
 	{ "ibm,close-errinjct", -1, -1, -1, -1, -1 },
-	{ "ibm,open-errinct", -1, -1, -1, -1, -1 },
+	{ "ibm,open-errinjct", -1, -1, -1, -1, -1 },
 	{ "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 },
 	{ "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 },
 	{ "ibm,get-indices", -1, 2, 3, -1, -1 },



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 610/717] powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (607 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 609/717] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 611/717] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Segher Boessenkool,
	Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 1891ef21d92c4801ea082ee8ed478e304ddc6749 upstream.

fls() and fls64() are using __builtin_ctz() and _builtin_ctzll().
On powerpc, those builtins trivially use ctlzw and ctlzd power
instructions.

Allthough those instructions provide the expected result with
input argument 0, __builtin_ctz() and __builtin_ctzll() are
documented as undefined for value 0.

The easiest fix would be to use fls() and fls64() functions
defined in include/asm-generic/bitops/builtin-fls.h and
include/asm-generic/bitops/fls64.h, but GCC output is not optimal:

00000388 <testfls>:
 388:   2c 03 00 00     cmpwi   r3,0
 38c:   41 82 00 10     beq     39c <testfls+0x14>
 390:   7c 63 00 34     cntlzw  r3,r3
 394:   20 63 00 20     subfic  r3,r3,32
 398:   4e 80 00 20     blr
 39c:   38 60 00 00     li      r3,0
 3a0:   4e 80 00 20     blr

000003b0 <testfls64>:
 3b0:   2c 03 00 00     cmpwi   r3,0
 3b4:   40 82 00 1c     bne     3d0 <testfls64+0x20>
 3b8:   2f 84 00 00     cmpwi   cr7,r4,0
 3bc:   38 60 00 00     li      r3,0
 3c0:   4d 9e 00 20     beqlr   cr7
 3c4:   7c 83 00 34     cntlzw  r3,r4
 3c8:   20 63 00 20     subfic  r3,r3,32
 3cc:   4e 80 00 20     blr
 3d0:   7c 63 00 34     cntlzw  r3,r3
 3d4:   20 63 00 40     subfic  r3,r3,64
 3d8:   4e 80 00 20     blr

When the input of fls(x) is a constant, just check x for nullity and
return either 0 or __builtin_clz(x). Otherwise, use cntlzw instruction
directly.

For fls64() on PPC64, do the same but with __builtin_clzll() and
cntlzd instruction. On PPC32, lets take the generic fls64() which
will use our fls(). The result is as expected:

00000388 <testfls>:
 388:   7c 63 00 34     cntlzw  r3,r3
 38c:   20 63 00 20     subfic  r3,r3,32
 390:   4e 80 00 20     blr

000003a0 <testfls64>:
 3a0:   2c 03 00 00     cmpwi   r3,0
 3a4:   40 82 00 10     bne     3b4 <testfls64+0x14>
 3a8:   7c 83 00 34     cntlzw  r3,r4
 3ac:   20 63 00 20     subfic  r3,r3,32
 3b0:   4e 80 00 20     blr
 3b4:   7c 63 00 34     cntlzw  r3,r3
 3b8:   20 63 00 40     subfic  r3,r3,64
 3bc:   4e 80 00 20     blr

Fixes: 2fcff790dcb4 ("powerpc: Use builtin functions for fls()/__fls()/fls64()")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/348c2d3f19ffcff8abe50d52513f989c4581d000.1603375524.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/bitops.h |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -216,15 +216,34 @@ static inline void arch___clear_bit_unlo
  */
 static inline int fls(unsigned int x)
 {
-	return 32 - __builtin_clz(x);
+	int lz;
+
+	if (__builtin_constant_p(x))
+		return x ? 32 - __builtin_clz(x) : 0;
+	asm("cntlzw %0,%1" : "=r" (lz) : "r" (x));
+	return 32 - lz;
 }
 
 #include <asm-generic/bitops/builtin-__fls.h>
 
+/*
+ * 64-bit can do this using one cntlzd (count leading zeroes doubleword)
+ * instruction; for 32-bit we use the generic version, which does two
+ * 32-bit fls calls.
+ */
+#ifdef CONFIG_PPC64
 static inline int fls64(__u64 x)
 {
-	return 64 - __builtin_clzll(x);
+	int lz;
+
+	if (__builtin_constant_p(x))
+		return x ? 64 - __builtin_clzll(x) : 0;
+	asm("cntlzd %0,%1" : "=r" (lz) : "r" (x));
+	return 64 - lz;
 }
+#else
+#include <asm-generic/bitops/fls64.h>
+#endif
 
 #ifdef CONFIG_PPC64
 unsigned int __arch_hweight8(unsigned int w);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 611/717] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (608 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 610/717] powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 612/717] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 197493af414ee22427be3343637ac290a791925a upstream.

G2_LE has a 603 core, add CPU_FTR_NOEXECUTE.

Fixes: 385e89d5b20f ("powerpc/mm: add exec protection on powerpc 603")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/39a530ee41d83f49747ab3af8e39c056450b9b4d.1602489653.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/cputable.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -369,7 +369,7 @@ static inline void cpu_feature_keys_init
 	    CPU_FTR_PPC_LE | CPU_FTR_NEED_PAIRED_STWCX)
 #define CPU_FTRS_82XX	(CPU_FTR_COMMON | CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_NOEXECUTE)
 #define CPU_FTRS_G2_LE	(CPU_FTR_COMMON | CPU_FTR_MAYBE_CAN_DOZE | \
-	    CPU_FTR_MAYBE_CAN_NAP)
+	    CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_NOEXECUTE)
 #define CPU_FTRS_E300	(CPU_FTR_MAYBE_CAN_DOZE | \
 	    CPU_FTR_MAYBE_CAN_NAP | \
 	    CPU_FTR_COMMON  | CPU_FTR_NOEXECUTE)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 612/717] powerpc/xmon: Change printk() to pr_cont()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (609 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 611/717] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 613/717] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 7c6c86b36a36dd4a13d30bba07718e767aa2e7a1 upstream.

Since some time now, printk() adds carriage return, leading to
unusable xmon output if there is no udbg backend available:

  [   54.288722] sysrq: Entering xmon
  [   54.292209] Vector: 0  at [cace3d2c]
  [   54.292274]     pc:
  [   54.292331] c0023650
  [   54.292468] : xmon+0x28/0x58
  [   54.292519]
  [   54.292574]     lr:
  [   54.292630] c0023724
  [   54.292749] : sysrq_handle_xmon+0xa4/0xfc
  [   54.292801]
  [   54.292867]     sp: cace3de8
  [   54.292931]    msr: 9032
  [   54.292999]   current = 0xc28d0000
  [   54.293072]     pid   = 377, comm = sh
  [   54.293157] Linux version 5.10.0-rc6-s3k-dev-01364-gedf13f0ccd76-dirty (root@po17688vm.idsi0.si.c-s.fr) (powerpc64-linux-gcc (GCC) 10.1.0, GNU ld (GNU Binutils) 2.34) #4211 PREEMPT Fri Dec 4 09:32:11 UTC 2020
  [   54.293287] enter ? for help
  [   54.293470] [cace3de8]
  [   54.293532] c0023724
  [   54.293654]  sysrq_handle_xmon+0xa4/0xfc
  [   54.293711]  (unreliable)
  ...
  [   54.296002]
  [   54.296159] --- Exception: c01 (System Call) at
  [   54.296217] 0fd4e784
  [   54.296303]
  [   54.296375] SP (7fca6ff0) is in userspace
  [   54.296431] mon>
  [   54.296484]  <no input ...>

Use pr_cont() instead.

Fixes: 4bcc595ccd80 ("printk: reinstate KERN_CONT for printing continuation lines")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Mention that it only happens when udbg is not available]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/c8a6ec704416ecd5ff2bd26213c9bc026bdd19de.1607077340.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/xmon/nonstdio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/xmon/nonstdio.c
+++ b/arch/powerpc/xmon/nonstdio.c
@@ -178,7 +178,7 @@ void xmon_printf(const char *format, ...
 
 	if (n && rc == 0) {
 		/* No udbg hooks, fallback to printk() - dangerous */
-		printk("%s", xmon_outbuf);
+		pr_cont("%s", xmon_outbuf);
 	}
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 613/717] powerpc/8xx: Fix early debug when SMC1 is relocated
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (610 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 612/717] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 614/717] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 1e78f723d6a52966bfe3804209dbf404fdc9d3bb upstream.

When SMC1 is relocated and early debug is selected, the
board hangs is ppc_md.setup_arch(). This is because ones
the microcode has been loaded and SMC1 relocated, early
debug writes in the weed.

To allow smooth continuation, the SMC1 parameter RAM set up
by the bootloader have to be copied into the new location.

Fixes: 43db76f41824 ("powerpc/8xx: Add microcode patch to move SMC parameter RAM.")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/b2f71f39eca543f1e4ec06596f09a8b12235c701.1607076683.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/cpm1.h         |    1 +
 arch/powerpc/platforms/8xx/micropatch.c |   11 +++++++++++
 2 files changed, 12 insertions(+)

--- a/arch/powerpc/include/asm/cpm1.h
+++ b/arch/powerpc/include/asm/cpm1.h
@@ -68,6 +68,7 @@ extern void cpm_reset(void);
 #define PROFF_SPI	((uint)0x0180)
 #define PROFF_SCC3	((uint)0x0200)
 #define PROFF_SMC1	((uint)0x0280)
+#define PROFF_DSP1	((uint)0x02c0)
 #define PROFF_SCC4	((uint)0x0300)
 #define PROFF_SMC2	((uint)0x0380)
 
--- a/arch/powerpc/platforms/8xx/micropatch.c
+++ b/arch/powerpc/platforms/8xx/micropatch.c
@@ -360,6 +360,17 @@ void __init cpm_load_patch(cpm8xx_t *cp)
 	if (IS_ENABLED(CONFIG_SMC_UCODE_PATCH)) {
 		smc_uart_t *smp;
 
+		if (IS_ENABLED(CONFIG_PPC_EARLY_DEBUG_CPM)) {
+			int i;
+
+			for (i = 0; i < sizeof(*smp); i += 4) {
+				u32 __iomem *src = (u32 __iomem *)&cp->cp_dparam[PROFF_SMC1 + i];
+				u32 __iomem *dst = (u32 __iomem *)&cp->cp_dparam[PROFF_DSP1 + i];
+
+				out_be32(dst, in_be32(src));
+			}
+		}
+
 		smp = (smc_uart_t *)&cp->cp_dparam[PROFF_SMC1];
 		out_be16(&smp->smc_rpbase, 0x1ec0);
 		smp = (smc_uart_t *)&cp->cp_dparam[PROFF_SMC2];



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 614/717] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (611 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 613/717] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 615/717] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 17179aeb9d34cc81e1a4ae3f85e5b12b13a1f8d0 upstream.

MMU_FTR_TYPE_44x cannot be checked by cpu_has_feature()

Use mmu_has_feature() instead

Fixes: 23eb7f560a2a ("powerpc: Convert flush_icache_range & friends to C")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/ceede82fadf37f3b8275e61fcf8cf29a3e2ec7fe.1602351011.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/mm/mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -532,7 +532,7 @@ void __flush_dcache_icache(void *p)
 	 * space occurs, before returning to user space.
 	 */
 
-	if (cpu_has_feature(MMU_FTR_TYPE_44x))
+	if (mmu_has_feature(MMU_FTR_TYPE_44x))
 		return;
 
 	invalidate_icache_range(addr, addr + PAGE_SIZE);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 615/717] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (612 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 614/717] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 616/717] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Michael Ellerman

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit b1198a88230f2ce50c271e22b82a8b8610b2eea9 upstream.

We execute certain NPU2 setup code (such as mapping an LPID to a device
in NPU2) unconditionally if an Nvlink bridge is detected. However this
cannot succeed on POWER8NVL machines and errors appear in dmesg. This is
harmless as skiboot returns an error and the only place we check it is
vfio-pci but that code does not get called on P8+ either.

This adds a check if pnv_npu2_xxx helpers are called on a machine with
NPU2 which initializes pnv_phb::npu in pnv_npu2_init();
pnv_phb::npu==NULL on POWER8/NVL (Naples).

While at this, fix NULL derefencing in pnv_npu_peers_take_ownership/
pnv_npu_peers_release_ownership which occurs when GPUs on mentioned P8s
cause EEH which happens if "vfio-pci" disables devices using
the D3 power state; the vfio-pci's disable_idle_d3 module parameter
controls this and must be set on Naples. The EEH handling clears
the entire pnv_ioda_pe struct in pnv_ioda_free_pe() hence
the NULL derefencing. We cannot recover from that but at least we stop
crashing.

Tested on
- POWER9 pvr=004e1201, Ubuntu 19.04 host, Ubuntu 18.04 vm,
  NVIDIA GV100 10de:1db1 driver 418.39
- POWER8 pvr=004c0100, RHEL 7.6 host, Ubuntu 16.10 vm,
  NVIDIA P100 10de:15f9 driver 396.47

Fixes: 1b785611e119 ("powerpc/powernv/npu: Add release_ownership hook")
Cc: stable@vger.kernel.org # 5.0
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201122073828.15446-1-aik@ozlabs.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/npu-dma.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -385,7 +385,8 @@ static void pnv_npu_peers_take_ownership
 	for (i = 0; i < npucomp->pe_num; ++i) {
 		struct pnv_ioda_pe *pe = npucomp->pe[i];
 
-		if (!pe->table_group.ops->take_ownership)
+		if (!pe->table_group.ops ||
+		    !pe->table_group.ops->take_ownership)
 			continue;
 		pe->table_group.ops->take_ownership(&pe->table_group);
 	}
@@ -401,7 +402,8 @@ static void pnv_npu_peers_release_owners
 	for (i = 0; i < npucomp->pe_num; ++i) {
 		struct pnv_ioda_pe *pe = npucomp->pe[i];
 
-		if (!pe->table_group.ops->release_ownership)
+		if (!pe->table_group.ops ||
+		    !pe->table_group.ops->release_ownership)
 			continue;
 		pe->table_group.ops->release_ownership(&pe->table_group);
 	}
@@ -623,6 +625,11 @@ int pnv_npu2_map_lpar_dev(struct pci_dev
 		return -ENODEV;
 
 	hose = pci_bus_to_host(npdev->bus);
+	if (hose->npu == NULL) {
+		dev_info_once(&npdev->dev, "Nvlink1 does not support contexts");
+		return 0;
+	}
+
 	nphb = hose->private_data;
 
 	dev_dbg(&gpdev->dev, "Map LPAR opalid=%llu lparid=%u\n",
@@ -670,6 +677,11 @@ int pnv_npu2_unmap_lpar_dev(struct pci_d
 		return -ENODEV;
 
 	hose = pci_bus_to_host(npdev->bus);
+	if (hose->npu == NULL) {
+		dev_info_once(&npdev->dev, "Nvlink1 does not support contexts");
+		return 0;
+	}
+
 	nphb = hose->private_data;
 
 	dev_dbg(&gpdev->dev, "destroy context opalid=%llu\n",



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 616/717] powerpc/powernv/memtrace: Dont leak kernel memory to user space
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (613 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 615/717] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 617/717] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Ellerman, David Hildenbrand,
	Oscar Salvador

From: David Hildenbrand <david@redhat.com>

commit c74cf7a3d59a21b290fe0468f5b470d0b8ee37df upstream.

We currently leak kernel memory to user space, because memory
offlining doesn't do any implicit clearing of memory and we are
missing explicit clearing of memory.

Let's keep it simple and clear pages before removing the linear
mapping.

Reproduced in QEMU/TCG with 10 GiB of main memory:
  [root@localhost ~]# dd obs=9G if=/dev/urandom of=/dev/null
  [... wait until "free -m" used counter no longer changes and cancel]
  19665802+0 records in
  1+0 records out
  9663676416 bytes (9.7 GB, 9.0 GiB) copied, 135.548 s, 71.3 MB/s
  [root@localhost ~]# cat /sys/devices/system/memory/block_size_bytes
  40000000
  [root@localhost ~]# echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
  [  402.978663][ T1086] page:000000001bc4bc74 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24900
  [  402.980063][ T1086] flags: 0x7ffff000001000(reserved)
  [  402.980415][ T1086] raw: 007ffff000001000 c00c000000924008 c00c000000924008 0000000000000000
  [  402.980627][ T1086] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
  [  402.980845][ T1086] page dumped because: unmovable page
  [  402.989608][ T1086] Offlined Pages 16384
  [  403.324155][ T1086] memtrace: Allocated trace memory on node 0 at 0x0000000200000000

Before this patch:
  [root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace  | head
  00000000  c8 25 72 51 4d 26 36 c5  5c c2 56 15 d5 1a cd 10  |.%rQM&6.\.V.....|
  00000010  19 b9 50 b2 cb e3 60 b8  ec 0a f3 ec 4b 3c 39 f0  |..P...`.....K<9.|$
  00000020  4e 5a 4c cf bd 26 19 ff  37 79 13 67 24 b7 b8 57  |NZL..&..7y.g$..W|$
  00000030  98 3e f5 be 6f 14 6a bd  a4 52 bc 6e e9 e0 c1 5d  |.>..o.j..R.n...]|$
  00000040  76 b3 ae b5 88 d7 da e3  64 23 85 2c 10 88 07 b6  |v.......d#.,....|$
  00000050  9a d8 91 de f7 50 27 69  2e 64 9c 6f d3 19 45 79  |.....P'i.d.o..Ey|$
  00000060  6a 6f 8a 61 71 19 1f c7  f1 df 28 26 ca 0f 84 55  |jo.aq.....(&...U|$
  00000070  01 3f be e4 e2 e1 da ff  7b 8c 8e 32 37 b4 24 53  |.?......{..27.$S|$
  00000080  1b 70 30 45 56 e6 8c c4  0e b5 4c fb 9f dd 88 06  |.p0EV.....L.....|$
  00000090  ef c4 18 79 f1 60 b1 5c  79 59 4d f4 36 d7 4a 5c  |...y.`.\yYM.6.J\|$

After this patch:
  [root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace  | head
  00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  40000000

Fixes: 9d5171a8f248 ("powerpc/powernv: Enable removal of memory for in memory tracing")
Cc: stable@vger.kernel.org # v4.14+
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111145322.15793-2-david@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/memtrace.c |   22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -67,6 +67,23 @@ static int change_memblock_state(struct
 	return 0;
 }
 
+static void memtrace_clear_range(unsigned long start_pfn,
+				 unsigned long nr_pages)
+{
+	unsigned long pfn;
+
+	/*
+	 * As pages are offline, we cannot trust the memmap anymore. As HIGHMEM
+	 * does not apply, avoid passing around "struct page" and use
+	 * clear_page() instead directly.
+	 */
+	for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+		if (IS_ALIGNED(pfn, PAGES_PER_SECTION))
+			cond_resched();
+		clear_page(__va(PFN_PHYS(pfn)));
+	}
+}
+
 /* called with device_hotplug_lock held */
 static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
 {
@@ -112,6 +129,11 @@ static u64 memtrace_alloc_node(u32 nid,
 	for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
 		if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
 			/*
+			 * Clear the range while we still have a linear
+			 * mapping.
+			 */
+			memtrace_clear_range(base_pfn, nr_pages);
+			/*
 			 * Remove memory in memory block size chunks so that
 			 * iomem resources are always split to the same size and
 			 * we never try to remove memory that spans two iomem



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 617/717] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (614 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 616/717] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 618/717] ovl: make ioctl() safe Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Hildenbrand, Oscar Salvador,
	Michael Ellerman

From: David Hildenbrand <david@redhat.com>

commit d6718941a2767fb383e105d257d2105fe4f15f0e upstream.

It's very easy to crash the kernel right now by simply trying to
enable memtrace concurrently, hammering on the "enable" interface

loop.sh:
  #!/bin/bash

  dmesg --console-off

  while true; do
          echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
  done

[root@localhost ~]# loop.sh &
[root@localhost ~]# loop.sh &

Resulting quickly in a kernel crash. Let's properly protect using a
mutex.

Fixes: 9d5171a8f248 ("powerpc/powernv: Enable removal of memory for in memory tracing")
Cc: stable@vger.kernel.org# v4.14+
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111145322.15793-3-david@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/memtrace.c |   22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -30,6 +30,7 @@ struct memtrace_entry {
 	char name[16];
 };
 
+static DEFINE_MUTEX(memtrace_mutex);
 static u64 memtrace_size;
 
 static struct memtrace_entry *memtrace_array;
@@ -279,6 +280,7 @@ static int memtrace_online(void)
 
 static int memtrace_enable_set(void *data, u64 val)
 {
+	int rc = -EAGAIN;
 	u64 bytes;
 
 	/*
@@ -291,25 +293,31 @@ static int memtrace_enable_set(void *dat
 		return -EINVAL;
 	}
 
+	mutex_lock(&memtrace_mutex);
+
 	/* Re-add/online previously removed/offlined memory */
 	if (memtrace_size) {
 		if (memtrace_online())
-			return -EAGAIN;
+			goto out_unlock;
 	}
 
-	if (!val)
-		return 0;
+	if (!val) {
+		rc = 0;
+		goto out_unlock;
+	}
 
 	/* Offline and remove memory */
 	if (memtrace_init_regions_runtime(val))
-		return -EINVAL;
+		goto out_unlock;
 
 	if (memtrace_init_debugfs())
-		return -EINVAL;
+		goto out_unlock;
 
 	memtrace_size = val;
-
-	return 0;
+	rc = 0;
+out_unlock:
+	mutex_unlock(&memtrace_mutex);
+	return rc;
 }
 
 static int memtrace_enable_get(void *data, u64 *val)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 618/717] ovl: make ioctl() safe
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (615 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 617/717] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 619/717] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Miklos Szeredi,
	Amir Goldstein

From: Miklos Szeredi <mszeredi@redhat.com>

commit 89bdfaf93d9157499c3a0d61f489df66f2dead7f upstream.

ovl_ioctl_set_flags() does a capability check using flags, but then the
real ioctl double-fetches flags and uses potentially different value.

The "Check the capability before cred override" comment misleading: user
can skip this check by presenting benign flags first and then overwriting
them to non-benign flags.

Just remove the cred override for now, hoping this doesn't cause a
regression.

The proper solution is to create a new setxflags i_op (patches are in the
works).

Xfstests don't show a regression.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support")
Cc: <stable@vger.kernel.org> # v4.19
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/overlayfs/file.c |   87 +++++++++-------------------------------------------
 1 file changed, 16 insertions(+), 71 deletions(-)

--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -541,46 +541,31 @@ static long ovl_real_ioctl(struct file *
 			   unsigned long arg)
 {
 	struct fd real;
-	const struct cred *old_cred;
 	long ret;
 
 	ret = ovl_real_fdget(file, &real);
 	if (ret)
 		return ret;
 
-	old_cred = ovl_override_creds(file_inode(file)->i_sb);
 	ret = security_file_ioctl(real.file, cmd, arg);
-	if (!ret)
+	if (!ret) {
+		/*
+		 * Don't override creds, since we currently can't safely check
+		 * permissions before doing so.
+		 */
 		ret = vfs_ioctl(real.file, cmd, arg);
-	revert_creds(old_cred);
+	}
 
 	fdput(real);
 
 	return ret;
 }
 
-static unsigned int ovl_iflags_to_fsflags(unsigned int iflags)
-{
-	unsigned int flags = 0;
-
-	if (iflags & S_SYNC)
-		flags |= FS_SYNC_FL;
-	if (iflags & S_APPEND)
-		flags |= FS_APPEND_FL;
-	if (iflags & S_IMMUTABLE)
-		flags |= FS_IMMUTABLE_FL;
-	if (iflags & S_NOATIME)
-		flags |= FS_NOATIME_FL;
-
-	return flags;
-}
-
 static long ovl_ioctl_set_flags(struct file *file, unsigned int cmd,
-				unsigned long arg, unsigned int flags)
+				unsigned long arg)
 {
 	long ret;
 	struct inode *inode = file_inode(file);
-	unsigned int oldflags;
 
 	if (!inode_owner_or_capable(inode))
 		return -EACCES;
@@ -591,10 +576,13 @@ static long ovl_ioctl_set_flags(struct f
 
 	inode_lock(inode);
 
-	/* Check the capability before cred override */
-	oldflags = ovl_iflags_to_fsflags(READ_ONCE(inode->i_flags));
-	ret = vfs_ioc_setflags_prepare(inode, oldflags, flags);
-	if (ret)
+	/*
+	 * Prevent copy up if immutable and has no CAP_LINUX_IMMUTABLE
+	 * capability.
+	 */
+	ret = -EPERM;
+	if (!ovl_has_upperdata(inode) && IS_IMMUTABLE(inode) &&
+	    !capable(CAP_LINUX_IMMUTABLE))
 		goto unlock;
 
 	ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
@@ -613,46 +601,6 @@ unlock:
 
 }
 
-static long ovl_ioctl_set_fsflags(struct file *file, unsigned int cmd,
-				  unsigned long arg)
-{
-	unsigned int flags;
-
-	if (get_user(flags, (int __user *) arg))
-		return -EFAULT;
-
-	return ovl_ioctl_set_flags(file, cmd, arg, flags);
-}
-
-static unsigned int ovl_fsxflags_to_fsflags(unsigned int xflags)
-{
-	unsigned int flags = 0;
-
-	if (xflags & FS_XFLAG_SYNC)
-		flags |= FS_SYNC_FL;
-	if (xflags & FS_XFLAG_APPEND)
-		flags |= FS_APPEND_FL;
-	if (xflags & FS_XFLAG_IMMUTABLE)
-		flags |= FS_IMMUTABLE_FL;
-	if (xflags & FS_XFLAG_NOATIME)
-		flags |= FS_NOATIME_FL;
-
-	return flags;
-}
-
-static long ovl_ioctl_set_fsxflags(struct file *file, unsigned int cmd,
-				   unsigned long arg)
-{
-	struct fsxattr fa;
-
-	memset(&fa, 0, sizeof(fa));
-	if (copy_from_user(&fa, (void __user *) arg, sizeof(fa)))
-		return -EFAULT;
-
-	return ovl_ioctl_set_flags(file, cmd, arg,
-				   ovl_fsxflags_to_fsflags(fa.fsx_xflags));
-}
-
 long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	long ret;
@@ -663,12 +611,9 @@ long ovl_ioctl(struct file *file, unsign
 		ret = ovl_real_ioctl(file, cmd, arg);
 		break;
 
-	case FS_IOC_SETFLAGS:
-		ret = ovl_ioctl_set_fsflags(file, cmd, arg);
-		break;
-
 	case FS_IOC_FSSETXATTR:
-		ret = ovl_ioctl_set_fsxflags(file, cmd, arg);
+	case FS_IOC_SETFLAGS:
+		ret = ovl_ioctl_set_flags(file, cmd, arg);
 		break;
 
 	default:



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 619/717] ima: Dont modify file descriptor mode on the fly
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (616 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 618/717] ovl: make ioctl() safe Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 620/717] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roberto Sassu, Christoph Hellwig, Mimi Zohar

From: Roberto Sassu <roberto.sassu@huawei.com>

commit 207cdd565dfc95a0a5185263a567817b7ebf5467 upstream.

Commit a408e4a86b36b ("ima: open a new file instance if no read
permissions") already introduced a second open to measure a file when the
original file descriptor does not allow it. However, it didn't remove the
existing method of changing the mode of the original file descriptor, which
is still necessary if the current process does not have enough privileges
to open a new one.

Changing the mode isn't really an option, as the filesystem might need to
do preliminary steps to make the read possible. Thus, this patch removes
the code and keeps the second open as the only option to measure a file
when it is unreadable with the original file descriptor.

Cc: <stable@vger.kernel.org> # 4.20.x: 0014cc04e8ec0 ima: Set file->f_mode
Fixes: 2fe5d6def1672 ("ima: integrity appraisal extension")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/ima/ima_crypto.c |   20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -537,7 +537,7 @@ int ima_calc_file_hash(struct file *file
 	loff_t i_size;
 	int rc;
 	struct file *f = file;
-	bool new_file_instance = false, modified_mode = false;
+	bool new_file_instance = false;
 
 	/*
 	 * For consistency, fail file's opened with the O_DIRECT flag on
@@ -555,18 +555,10 @@ int ima_calc_file_hash(struct file *file
 				O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
 		flags |= O_RDONLY;
 		f = dentry_open(&file->f_path, flags, file->f_cred);
-		if (IS_ERR(f)) {
-			/*
-			 * Cannot open the file again, lets modify f_mode
-			 * of original and continue
-			 */
-			pr_info_ratelimited("Unable to reopen file for reading.\n");
-			f = file;
-			f->f_mode |= FMODE_READ;
-			modified_mode = true;
-		} else {
-			new_file_instance = true;
-		}
+		if (IS_ERR(f))
+			return PTR_ERR(f);
+
+		new_file_instance = true;
 	}
 
 	i_size = i_size_read(file_inode(f));
@@ -581,8 +573,6 @@ int ima_calc_file_hash(struct file *file
 out:
 	if (new_file_instance)
 		fput(f);
-	else if (modified_mode)
-		f->f_mode &= ~FMODE_READ;
 	return rc;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 620/717] um: Remove use of asprinf in umid.c
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (617 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 619/717] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 621/717] um: Fix time-travel mode Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

commit 97be7ceaf7fea68104824b6aa874cff235333ac1 upstream.

asprintf is not compatible with the existing uml memory allocation
mechanism. Its use on the "user" side of UML results in a corrupt slab
state.

Fixes: 0d4e5ac7e780 ("um: remove uses of variable length arrays")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/um/os-Linux/umid.c |   17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

--- a/arch/um/os-Linux/umid.c
+++ b/arch/um/os-Linux/umid.c
@@ -137,20 +137,13 @@ static inline int is_umdir_used(char *di
 {
 	char pid[sizeof("nnnnnnnnn")], *end, *file;
 	int dead, fd, p, n, err;
-	size_t filelen;
+	size_t filelen = strlen(dir) + sizeof("/pid") + 1;
 
-	err = asprintf(&file, "%s/pid", dir);
-	if (err < 0)
-		return 0;
+	file = malloc(filelen);
+	if (!file)
+		return -ENOMEM;
 
-	filelen = strlen(file);
-
-	n = snprintf(file, filelen, "%s/pid", dir);
-	if (n >= filelen) {
-		printk(UM_KERN_ERR "is_umdir_used - pid filename too long\n");
-		err = -E2BIG;
-		goto out;
-	}
+	snprintf(file, filelen, "%s/pid", dir);
 
 	dead = 0;
 	fd = open(file, O_RDONLY);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 621/717] um: Fix time-travel mode
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (618 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 620/717] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 622/717] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Richard Weinberger

From: Johannes Berg <johannes.berg@intel.com>

commit ff9632d2a66512436d616ef4c380a0e73f748db1 upstream.

Since the time-travel rework, basic time-travel mode hasn't worked
properly, but there's no longer a need for this WARN_ON() so just
remove it and thereby fix things.

Cc: stable@vger.kernel.org
Fixes: 4b786e24ca80 ("um: time-travel: Rewrite as an event scheduler")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/um/kernel/time.c |    5 -----
 1 file changed, 5 deletions(-)

--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@@ -260,11 +260,6 @@ static void __time_travel_add_event(stru
 	struct time_travel_event *tmp;
 	bool inserted = false;
 
-	if (WARN(time_travel_mode == TT_MODE_BASIC &&
-		 e != &time_travel_timer_event,
-		 "only timer events can be handled in basic mode"))
-		return;
-
 	if (e->pending)
 		return;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 622/717] ceph: fix race in concurrent __ceph_remove_cap invocations
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (619 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 621/717] um: Fix time-travel mode Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 623/717] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Layton, Luis Henriques, Ilya Dryomov

From: Luis Henriques <lhenriques@suse.de>

commit e5cafce3ad0f8652d6849314d951459c2bff7233 upstream.

A NULL pointer dereference may occur in __ceph_remove_cap with some of the
callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and
remove_session_caps_cb. Those callers hold the session->s_mutex, so they
are prevented from concurrent execution, but ceph_evict_inode does not.

Since the callers of this function hold the i_ceph_lock, the fix is simply
a matter of returning immediately if caps->ci is NULL.

Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/43272
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ceph/caps.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1140,12 +1140,19 @@ void __ceph_remove_cap(struct ceph_cap *
 {
 	struct ceph_mds_session *session = cap->session;
 	struct ceph_inode_info *ci = cap->ci;
-	struct ceph_mds_client *mdsc =
-		ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
+	struct ceph_mds_client *mdsc;
 	int removed = 0;
 
+	/* 'ci' being NULL means the remove have already occurred */
+	if (!ci) {
+		dout("%s: cap inode is NULL\n", __func__);
+		return;
+	}
+
 	dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
 
+	mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
+
 	/* remove from inode's cap rbtree, and clear auth cap */
 	rb_erase(&cap->ci_node, &ci->i_caps);
 	if (ci->i_auth_cap == cap) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 623/717] SMB3: avoid confusing warning message on mount to Azure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (620 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 622/717] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 624/717] SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ronnie Sahlberg, Steve French

From: Steve French <stfrench@microsoft.com>

commit ebcd6de98754d9b6a5f89d7835864b1c365d432f upstream.

Mounts to Azure cause an unneeded warning message in dmesg
   "CIFS: VFS: parse_server_interfaces: incomplete interface info"

Azure rounds up the size (by 8 additional bytes, to a
16 byte boundary) of the structure returned on the query
of the server interfaces at mount time.  This is permissible
even though different than other servers so do not log a warning
if query network interfaces response is only rounded up by 8
bytes or fewer.

CC: Stable <stable@vger.kernel.org>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2ops.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -477,7 +477,8 @@ parse_server_interfaces(struct network_i
 		goto out;
 	}
 
-	if (bytes_left || p->Next)
+	/* Azure rounds the buffer size up 8, to a 16 byte boundary */
+	if ((bytes_left > 8) || p->Next)
 		cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
 
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 624/717] SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (621 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 623/717] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 625/717] SMB3.1.1: do not log warning message if server doesnt populate salt Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French

From: Steve French <stfrench@microsoft.com>

commit bc7c4129d4cdc56d1b5477c1714246f27df914dd upstream.

Azure does not send an SPNEGO blob in the negotiate protocol response,
so we shouldn't assume that it is there when validating the location
of the first negotiate context.  This avoids the potential confusing
mount warning:

   CIFS: Invalid negotiate context offset

CC: Stable <stable@vger.kernel.org>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2misc.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -94,6 +94,8 @@ static const __le16 smb2_rsp_struct_size
 	/* SMB2_OPLOCK_BREAK */ cpu_to_le16(24)
 };
 
+#define SMB311_NEGPROT_BASE_SIZE (sizeof(struct smb2_sync_hdr) + sizeof(struct smb2_negotiate_rsp))
+
 static __u32 get_neg_ctxt_len(struct smb2_sync_hdr *hdr, __u32 len,
 			      __u32 non_ctxlen)
 {
@@ -109,11 +111,17 @@ static __u32 get_neg_ctxt_len(struct smb
 
 	/* Make sure that negotiate contexts start after gss security blob */
 	nc_offset = le32_to_cpu(pneg_rsp->NegotiateContextOffset);
-	if (nc_offset < non_ctxlen) {
-		pr_warn_once("Invalid negotiate context offset\n");
+	if (nc_offset + 1 < non_ctxlen) {
+		pr_warn_once("Invalid negotiate context offset %d\n", nc_offset);
 		return 0;
-	}
-	size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen;
+	} else if (nc_offset + 1 == non_ctxlen) {
+		cifs_dbg(FYI, "no SPNEGO security blob in negprot rsp\n");
+		size_of_pad_before_neg_ctxts = 0;
+	} else if (non_ctxlen == SMB311_NEGPROT_BASE_SIZE)
+		/* has padding, but no SPNEGO blob */
+		size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen + 1;
+	else
+		size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen;
 
 	/* Verify that at least minimal negotiate contexts fit within frame */
 	if (len < nc_offset + (neg_count * sizeof(struct smb2_neg_context))) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 625/717] SMB3.1.1: do not log warning message if server doesnt populate salt
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (622 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 624/717] SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 626/717] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shyam Prasad N, Pavel Shilovsky,
	Steve French

From: Steve French <stfrench@microsoft.com>

commit 7955f105afb6034af344038d663bc98809483cdd upstream.

In the negotiate protocol preauth context, the server is not required
to populate the salt (although it is done by most servers) so do
not warn on mount.

We retain the checks (warn) that the preauth context is the minimum
size and that the salt does not exceed DataLength of the SMB response.
Although we use the defaults in the case that the preauth context
response is invalid, these checks may be useful in the future
as servers add support for additional mechanisms.

CC: Stable <stable@vger.kernel.org>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2pdu.c |    7 +++++--
 fs/cifs/smb2pdu.h |   14 +++++++++++---
 2 files changed, 16 insertions(+), 5 deletions(-)

--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -427,8 +427,8 @@ build_preauth_ctxt(struct smb2_preauth_n
 	pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
 	pneg_ctxt->DataLength = cpu_to_le16(38);
 	pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
-	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
-	get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
+	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_LINUX_CLIENT_SALT_SIZE);
+	get_random_bytes(pneg_ctxt->Salt, SMB311_LINUX_CLIENT_SALT_SIZE);
 	pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
 }
 
@@ -566,6 +566,9 @@ static void decode_preauth_context(struc
 	if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
 		pr_warn_once("server sent bad preauth context\n");
 		return;
+	} else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) {
+		pr_warn_once("server sent invalid SaltLength\n");
+		return;
 	}
 	if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
 		pr_warn_once("Invalid SMB3 hash algorithm count\n");
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -333,12 +333,20 @@ struct smb2_neg_context {
 	/* Followed by array of data */
 } __packed;
 
-#define SMB311_SALT_SIZE			32
+#define SMB311_LINUX_CLIENT_SALT_SIZE			32
 /* Hash Algorithm Types */
 #define SMB2_PREAUTH_INTEGRITY_SHA512	cpu_to_le16(0x0001)
 #define SMB2_PREAUTH_HASH_SIZE 64
 
-#define MIN_PREAUTH_CTXT_DATA_LEN	(SMB311_SALT_SIZE + 6)
+/*
+ * SaltLength that the server send can be zero, so the only three required
+ * fields (all __le16) end up six bytes total, so the minimum context data len
+ * in the response is six bytes which accounts for
+ *
+ *      HashAlgorithmCount, SaltLength, and 1 HashAlgorithm.
+ */
+#define MIN_PREAUTH_CTXT_DATA_LEN 6
+
 struct smb2_preauth_neg_context {
 	__le16	ContextType; /* 1 */
 	__le16	DataLength;
@@ -346,7 +354,7 @@ struct smb2_preauth_neg_context {
 	__le16	HashAlgorithmCount; /* 1 */
 	__le16	SaltLength;
 	__le16	HashAlgorithms; /* HashAlgorithms[0] since only one defined */
-	__u8	Salt[SMB311_SALT_SIZE];
+	__u8	Salt[SMB311_LINUX_CLIENT_SALT_SIZE];
 } __packed;
 
 /* Encryption Algorithms Ciphers */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 626/717] ubifs: wbuf: Dont leak kernel memory to flash
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (623 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 625/717] SMB3.1.1: do not log warning message if server doesnt populate salt Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 627/717] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Zhihao Cheng

From: Richard Weinberger <richard@nod.at>

commit 20f1431160c6b590cdc269a846fc5a448abf5b98 upstream.

Write buffers use a kmalloc()'ed buffer, they can leak
up to seven bytes of kernel memory to flash if writes are not
aligned.
So use ubifs_pad() to fill these gaps with padding bytes.
This was never a problem while scanning because the scanner logic
manually aligns node lengths and skips over these gaps.

Cc: <stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ubifs/io.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -319,7 +319,7 @@ void ubifs_pad(const struct ubifs_info *
 {
 	uint32_t crc;
 
-	ubifs_assert(c, pad >= 0 && !(pad & 7));
+	ubifs_assert(c, pad >= 0);
 
 	if (pad >= UBIFS_PAD_NODE_SZ) {
 		struct ubifs_ch *ch = buf;
@@ -764,6 +764,10 @@ int ubifs_wbuf_write_nolock(struct ubifs
 		 * write-buffer.
 		 */
 		memcpy(wbuf->buf + wbuf->used, buf, len);
+		if (aligned_len > len) {
+			ubifs_assert(c, aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
+		}
 
 		if (aligned_len == wbuf->avail) {
 			dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -856,13 +860,18 @@ int ubifs_wbuf_write_nolock(struct ubifs
 	}
 
 	spin_lock(&wbuf->lock);
-	if (aligned_len)
+	if (aligned_len) {
 		/*
 		 * And now we have what's left and what does not take whole
 		 * max. write unit, so write it to the write-buffer and we are
 		 * done.
 		 */
 		memcpy(wbuf->buf, buf + written, len);
+		if (aligned_len > len) {
+			ubifs_assert(c, aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + len, aligned_len - len);
+		}
+	}
 
 	if (c->leb_size - wbuf->offs >= c->max_write_size)
 		wbuf->size = c->max_write_size;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 627/717] jffs2: Fix GC exit abnormally
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (624 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 626/717] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 628/717] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhe Li, Richard Weinberger

From: Zhe Li <lizhe67@huawei.com>

commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.

The log of this problem is:
jffs2: Error garbage collecting node at 0x***!
jffs2: No space for garbage collection. Aborting GC thread

This is because GC believe that it do nothing, so it abort.

After going over the image of jffs2, I find a scene that
can trigger this problem stably.
The scene is: there is a normal dirent node at summary-area,
but abnormal at corresponding not-summary-area with error
name_crc.

The reason that GC exit abnormally is because it find that
abnormal dirent node to GC, but when it goes to function
jffs2_add_fd_to_list, it cannot meet the condition listed
below:

if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))

So no node is marked obsolete, statistical information of
erase_block do not change, which cause GC exit abnormally.

The root cause of this problem is: we do not check the
name_crc of the abnormal dirent node with summary is enabled.

Noticed that in function jffs2_scan_dirent_node, we use
function jffs2_scan_dirty_space to deal with the dirent
node with error name_crc. So this patch add a checking
code in function read_direntry to ensure the correctness
of dirent node. If checked failed, the dirent node will
be marked obsolete so GC will pass this node and this
problem will be fixed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Zhe Li <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jffs2/readinode.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -672,6 +672,22 @@ static inline int read_direntry(struct j
 			jffs2_free_full_dirent(fd);
 			return -EIO;
 		}
+
+#ifdef CONFIG_JFFS2_SUMMARY
+		/*
+		 * we use CONFIG_JFFS2_SUMMARY because without it, we
+		 * have checked it while mounting
+		 */
+		crc = crc32(0, fd->name, rd->nsize);
+		if (unlikely(crc != je32_to_cpu(rd->name_crc))) {
+			JFFS2_NOTICE("name CRC failed on dirent node at"
+			   "%#08x: read %#08x,calculated %#08x\n",
+			   ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
+			jffs2_mark_node_obsolete(c, ref);
+			jffs2_free_full_dirent(fd);
+			return 0;
+		}
+#endif
 	}
 
 	fd->nhash = full_name_hash(NULL, fd->name, rd->nsize);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 628/717] jffs2: Fix ignoring mounting options problem during remounting
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (625 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 627/717] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 629/717] fsnotify: generalize handle_inode_event() Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, lizhe, Richard Weinberger

From: lizhe <lizhe67@huawei.com>

commit 08cd274f9b8283a1da93e2ccab216a336da83525 upstream.

The jffs2 mount options will be ignored when remounting jffs2.
It can be easily reproduced with the steps listed below.
1. mount -t jffs2 -o compr=none /dev/mtdblockx /mnt
2. mount -o remount compr=zlib /mnt

Since ec10a24f10c8, the option parsing happens before fill_super and
then pass fc, which contains the options parsing results, to function
jffs2_reconfigure during remounting. But function jffs2_reconfigure do
not update c->mount_opts.

This patch add a function jffs2_update_mount_opts to fix this problem.

By the way, I notice that tmpfs use the same way to update remounting
options. If it is necessary to unify them?

Cc: <stable@vger.kernel.org>
Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
Signed-off-by: lizhe <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jffs2/super.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -215,11 +215,28 @@ static int jffs2_parse_param(struct fs_c
 	return 0;
 }
 
+static inline void jffs2_update_mount_opts(struct fs_context *fc)
+{
+	struct jffs2_sb_info *new_c = fc->s_fs_info;
+	struct jffs2_sb_info *c = JFFS2_SB_INFO(fc->root->d_sb);
+
+	mutex_lock(&c->alloc_sem);
+	if (new_c->mount_opts.override_compr) {
+		c->mount_opts.override_compr = new_c->mount_opts.override_compr;
+		c->mount_opts.compr = new_c->mount_opts.compr;
+	}
+	if (new_c->mount_opts.rp_size)
+		c->mount_opts.rp_size = new_c->mount_opts.rp_size;
+	mutex_unlock(&c->alloc_sem);
+}
+
 static int jffs2_reconfigure(struct fs_context *fc)
 {
 	struct super_block *sb = fc->root->d_sb;
 
 	sync_filesystem(sb);
+	jffs2_update_mount_opts(fc);
+
 	return jffs2_do_remount_fs(sb, fc);
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 629/717] fsnotify: generalize handle_inode_event()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (626 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 628/717] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 630/717] inotify: convert to handle_inode_event() interface Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amir Goldstein, Jan Kara

From: Amir Goldstein <amir73il@gmail.com>

commit 950cc0d2bef078e1f6459900ca4d4b2a2e0e3c37 upstream.

The handle_inode_event() interface was added as (quoting comment):
"a simple variant of handle_event() for groups that only have inode
marks and don't have ignore mask".

In other words, all backends except fanotify.  The inotify backend
also falls under this category, but because it required extra arguments
it was left out of the initial pass of backends conversion to the
simple interface.

This results in code duplication between the generic helper
fsnotify_handle_event() and the inotify_handle_event() callback
which also happen to be buggy code.

Generalize the handle_inode_event() arguments and add the check for
FS_EXCL_UNLINK flag to the generic helper, so inotify backend could
be converted to use the simple interface.

Link: https://lore.kernel.org/r/20201202120713.702387-2-amir73il@gmail.com
CC: stable@vger.kernel.org
Fixes: b9a1b9772509 ("fsnotify: create method handle_inode_event() in fsnotify_operations")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/filecache.c              |    2 +-
 fs/notify/dnotify/dnotify.c      |    2 +-
 fs/notify/fsnotify.c             |   31 ++++++++++++++++++++++++-------
 include/linux/fsnotify_backend.h |    3 ++-
 kernel/audit_fsnotify.c          |    2 +-
 kernel/audit_tree.c              |    2 +-
 kernel/audit_watch.c             |    2 +-
 7 files changed, 31 insertions(+), 13 deletions(-)

--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -600,7 +600,7 @@ static struct notifier_block nfsd_file_l
 static int
 nfsd_file_fsnotify_handle_event(struct fsnotify_mark *mark, u32 mask,
 				struct inode *inode, struct inode *dir,
-				const struct qstr *name)
+				const struct qstr *name, u32 cookie)
 {
 	trace_nfsd_file_fsnotify_handle_event(inode, mask);
 
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -72,7 +72,7 @@ static void dnotify_recalc_inode_mask(st
  */
 static int dnotify_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
 				struct inode *inode, struct inode *dir,
-				const struct qstr *name)
+				const struct qstr *name, u32 cookie)
 {
 	struct dnotify_mark *dn_mark;
 	struct dnotify_struct *dn;
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -232,6 +232,26 @@ notify:
 }
 EXPORT_SYMBOL_GPL(__fsnotify_parent);
 
+static int fsnotify_handle_inode_event(struct fsnotify_group *group,
+				       struct fsnotify_mark *inode_mark,
+				       u32 mask, const void *data, int data_type,
+				       struct inode *dir, const struct qstr *name,
+				       u32 cookie)
+{
+	const struct path *path = fsnotify_data_path(data, data_type);
+	struct inode *inode = fsnotify_data_inode(data, data_type);
+	const struct fsnotify_ops *ops = group->ops;
+
+	if (WARN_ON_ONCE(!ops->handle_inode_event))
+		return 0;
+
+	if ((inode_mark->mask & FS_EXCL_UNLINK) &&
+	    path && d_unlinked(path->dentry))
+		return 0;
+
+	return ops->handle_inode_event(inode_mark, mask, inode, dir, name, cookie);
+}
+
 static int fsnotify_handle_event(struct fsnotify_group *group, __u32 mask,
 				 const void *data, int data_type,
 				 struct inode *dir, const struct qstr *name,
@@ -239,13 +259,8 @@ static int fsnotify_handle_event(struct
 {
 	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
 	struct fsnotify_mark *child_mark = fsnotify_iter_child_mark(iter_info);
-	struct inode *inode = fsnotify_data_inode(data, data_type);
-	const struct fsnotify_ops *ops = group->ops;
 	int ret;
 
-	if (WARN_ON_ONCE(!ops->handle_inode_event))
-		return 0;
-
 	if (WARN_ON_ONCE(fsnotify_iter_sb_mark(iter_info)) ||
 	    WARN_ON_ONCE(fsnotify_iter_vfsmount_mark(iter_info)))
 		return 0;
@@ -262,7 +277,8 @@ static int fsnotify_handle_event(struct
 		name = NULL;
 	}
 
-	ret = ops->handle_inode_event(inode_mark, mask, inode, dir, name);
+	ret = fsnotify_handle_inode_event(group, inode_mark, mask, data, data_type,
+					  dir, name, cookie);
 	if (ret || !child_mark)
 		return ret;
 
@@ -272,7 +288,8 @@ static int fsnotify_handle_event(struct
 	 * report the event once to parent dir with name and once to child
 	 * without name.
 	 */
-	return ops->handle_inode_event(child_mark, mask, inode, NULL, NULL);
+	return fsnotify_handle_inode_event(group, child_mark, mask, data, data_type,
+					   NULL, NULL, 0);
 }
 
 static int send_to_group(__u32 mask, const void *data, int data_type,
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -137,6 +137,7 @@ struct mem_cgroup;
  *		if @file_name is not NULL, this is the directory that
  *		@file_name is relative to.
  * @file_name:	optional file name associated with event
+ * @cookie:	inotify rename cookie
  *
  * free_group_priv - called when a group refcnt hits 0 to clean up the private union
  * freeing_mark - called when a mark is being destroyed for some reason.  The group
@@ -151,7 +152,7 @@ struct fsnotify_ops {
 			    struct fsnotify_iter_info *iter_info);
 	int (*handle_inode_event)(struct fsnotify_mark *mark, u32 mask,
 			    struct inode *inode, struct inode *dir,
-			    const struct qstr *file_name);
+			    const struct qstr *file_name, u32 cookie);
 	void (*free_group_priv)(struct fsnotify_group *group);
 	void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
 	void (*free_event)(struct fsnotify_event *event);
--- a/kernel/audit_fsnotify.c
+++ b/kernel/audit_fsnotify.c
@@ -154,7 +154,7 @@ static void audit_autoremove_mark_rule(s
 /* Update mark data in audit rules based on fsnotify events. */
 static int audit_mark_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
 				   struct inode *inode, struct inode *dir,
-				   const struct qstr *dname)
+				   const struct qstr *dname, u32 cookie)
 {
 	struct audit_fsnotify_mark *audit_mark;
 
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -1037,7 +1037,7 @@ static void evict_chunk(struct audit_chu
 
 static int audit_tree_handle_event(struct fsnotify_mark *mark, u32 mask,
 				   struct inode *inode, struct inode *dir,
-				   const struct qstr *file_name)
+				   const struct qstr *file_name, u32 cookie)
 {
 	return 0;
 }
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -466,7 +466,7 @@ void audit_remove_watch_rule(struct audi
 /* Update watch data in audit rules based on fsnotify events. */
 static int audit_watch_handle_event(struct fsnotify_mark *inode_mark, u32 mask,
 				    struct inode *inode, struct inode *dir,
-				    const struct qstr *dname)
+				    const struct qstr *dname, u32 cookie)
 {
 	struct audit_parent *parent;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 630/717] inotify: convert to handle_inode_event() interface
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (627 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 629/717] fsnotify: generalize handle_inode_event() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 631/717] fsnotify: fix events reported to watching parent and child Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amir Goldstein, Jan Kara

From: Amir Goldstein <amir73il@gmail.com>

commit 1a2620a99803ad660edc5d22fd9c66cce91ceb1c upstream.

Convert inotify to use the simple handle_inode_event() interface to
get rid of the code duplication between the generic helper
fsnotify_handle_event() and the inotify_handle_event() callback, which
also happen to be buggy code.

The bug will be fixed in the generic helper.

Link: https://lore.kernel.org/r/20201202120713.702387-3-amir73il@gmail.com
CC: stable@vger.kernel.org
Fixes: b9a1b9772509 ("fsnotify: create method handle_inode_event() in fsnotify_operations")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/notify/inotify/inotify.h          |    9 ++----
 fs/notify/inotify/inotify_fsnotify.c |   51 +++++------------------------------
 fs/notify/inotify/inotify_user.c     |    8 +----
 3 files changed, 14 insertions(+), 54 deletions(-)

--- a/fs/notify/inotify/inotify.h
+++ b/fs/notify/inotify/inotify.h
@@ -24,11 +24,10 @@ static inline struct inotify_event_info
 
 extern void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark,
 					   struct fsnotify_group *group);
-extern int inotify_handle_event(struct fsnotify_group *group, u32 mask,
-				const void *data, int data_type,
-				struct inode *dir,
-				const struct qstr *file_name, u32 cookie,
-				struct fsnotify_iter_info *iter_info);
+extern int inotify_handle_inode_event(struct fsnotify_mark *inode_mark,
+				      u32 mask, struct inode *inode,
+				      struct inode *dir,
+				      const struct qstr *name, u32 cookie);
 
 extern const struct fsnotify_ops inotify_fsnotify_ops;
 extern struct kmem_cache *inotify_inode_mark_cachep;
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -55,25 +55,21 @@ static int inotify_merge(struct list_hea
 	return event_compare(last_event, event);
 }
 
-static int inotify_one_event(struct fsnotify_group *group, u32 mask,
-			     struct fsnotify_mark *inode_mark,
-			     const struct path *path,
-			     const struct qstr *file_name, u32 cookie)
+int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
+			       struct inode *inode, struct inode *dir,
+			       const struct qstr *name, u32 cookie)
 {
 	struct inotify_inode_mark *i_mark;
 	struct inotify_event_info *event;
 	struct fsnotify_event *fsn_event;
+	struct fsnotify_group *group = inode_mark->group;
 	int ret;
 	int len = 0;
 	int alloc_len = sizeof(struct inotify_event_info);
 	struct mem_cgroup *old_memcg;
 
-	if ((inode_mark->mask & FS_EXCL_UNLINK) &&
-	    path && d_unlinked(path->dentry))
-		return 0;
-
-	if (file_name) {
-		len = file_name->len;
+	if (name) {
+		len = name->len;
 		alloc_len += len + 1;
 	}
 
@@ -117,7 +113,7 @@ static int inotify_one_event(struct fsno
 	event->sync_cookie = cookie;
 	event->name_len = len;
 	if (len)
-		strcpy(event->name, file_name->name);
+		strcpy(event->name, name->name);
 
 	ret = fsnotify_add_event(group, fsn_event, inotify_merge);
 	if (ret) {
@@ -131,37 +127,6 @@ static int inotify_one_event(struct fsno
 	return 0;
 }
 
-int inotify_handle_event(struct fsnotify_group *group, u32 mask,
-			 const void *data, int data_type, struct inode *dir,
-			 const struct qstr *file_name, u32 cookie,
-			 struct fsnotify_iter_info *iter_info)
-{
-	const struct path *path = fsnotify_data_path(data, data_type);
-	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
-	struct fsnotify_mark *child_mark = fsnotify_iter_child_mark(iter_info);
-	int ret = 0;
-
-	if (WARN_ON(fsnotify_iter_vfsmount_mark(iter_info)))
-		return 0;
-
-	/*
-	 * Some events cannot be sent on both parent and child marks
-	 * (e.g. IN_CREATE).  Those events are always sent on inode_mark.
-	 * For events that are possible on both parent and child (e.g. IN_OPEN),
-	 * event is sent on inode_mark with name if the parent is watching and
-	 * is sent on child_mark without name if child is watching.
-	 * If both parent and child are watching, report the event with child's
-	 * name here and report another event without child's name below.
-	 */
-	if (inode_mark)
-		ret = inotify_one_event(group, mask, inode_mark, path,
-					file_name, cookie);
-	if (ret || !child_mark)
-		return ret;
-
-	return inotify_one_event(group, mask, child_mark, path, NULL, 0);
-}
-
 static void inotify_freeing_mark(struct fsnotify_mark *fsn_mark, struct fsnotify_group *group)
 {
 	inotify_ignored_and_remove_idr(fsn_mark, group);
@@ -227,7 +192,7 @@ static void inotify_free_mark(struct fsn
 }
 
 const struct fsnotify_ops inotify_fsnotify_ops = {
-	.handle_event = inotify_handle_event,
+	.handle_inode_event = inotify_handle_inode_event,
 	.free_group_priv = inotify_free_group_priv,
 	.free_event = inotify_free_event,
 	.freeing_mark = inotify_freeing_mark,
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -486,14 +486,10 @@ void inotify_ignored_and_remove_idr(stru
 				    struct fsnotify_group *group)
 {
 	struct inotify_inode_mark *i_mark;
-	struct fsnotify_iter_info iter_info = { };
-
-	fsnotify_iter_set_report_type_mark(&iter_info, FSNOTIFY_OBJ_TYPE_INODE,
-					   fsn_mark);
 
 	/* Queue ignore event for the watch */
-	inotify_handle_event(group, FS_IN_IGNORED, NULL, FSNOTIFY_EVENT_NONE,
-			     NULL, NULL, 0, &iter_info);
+	inotify_handle_inode_event(fsn_mark, FS_IN_IGNORED, NULL, NULL, NULL,
+				   0);
 
 	i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
 	/* remove this mark from the idr */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 631/717] fsnotify: fix events reported to watching parent and child
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (628 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 630/717] inotify: convert to handle_inode_event() interface Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 632/717] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hugh Dickins, Amir Goldstein, Jan Kara

From: Amir Goldstein <amir73il@gmail.com>

commit fecc4559780d52d174ea05e3bf543669165389c3 upstream.

fsnotify_parent() used to send two separate events to backends when a
parent inode is watching children and the child inode is also watching.
In an attempt to avoid duplicate events in fanotify, we unified the two
backend callbacks to a single callback and handled the reporting of the
two separate events for the relevant backends (inotify and dnotify).
However the handling is buggy and can result in inotify and dnotify
listeners receiving events of the type they never asked for or spurious
events.

The problem is the unified event callback with two inode marks (parent and
child) is called when any of the parent and child inodes are watched and
interested in the event, but the parent inode's mark that is interested
in the event on the child is not necessarily the one we are currently
reporting to (it could belong to a different group).

So before reporting the parent or child event flavor to backend we need
to check that the mark is really interested in that event flavor.

The semantics of INODE and CHILD marks were hard to follow and made the
logic more complicated than it should have been.  Replace it with INODE
and PARENT marks semantics to hopefully make the logic more clear.

Thanks to Hugh Dickins for spotting a bug in the earlier version of this
patch.

Fixes: 497b0c5a7c06 ("fsnotify: send event to parent and child with single callback")
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201202120713.702387-4-amir73il@gmail.com
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/notify/fanotify/fanotify.c    |    7 +--
 fs/notify/fsnotify.c             |   84 +++++++++++++++++++++++----------------
 include/linux/fsnotify_backend.h |    6 +-
 3 files changed, 57 insertions(+), 40 deletions(-)

--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -268,12 +268,11 @@ static u32 fanotify_group_event_mask(str
 			continue;
 
 		/*
-		 * If the event is for a child and this mark is on a parent not
+		 * If the event is on a child and this mark is on a parent not
 		 * watching children, don't send it!
 		 */
-		if (event_mask & FS_EVENT_ON_CHILD &&
-		    type == FSNOTIFY_OBJ_TYPE_INODE &&
-		     !(mark->mask & FS_EVENT_ON_CHILD))
+		if (type == FSNOTIFY_OBJ_TYPE_PARENT &&
+		    !(mark->mask & FS_EVENT_ON_CHILD))
 			continue;
 
 		marks_mask |= mark->mask;
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -152,6 +152,13 @@ static bool fsnotify_event_needs_parent(
 	if (mask & FS_ISDIR)
 		return false;
 
+	/*
+	 * All events that are possible on child can also may be reported with
+	 * parent/name info to inode/sb/mount.  Otherwise, a watching parent
+	 * could result in events reported with unexpected name info to sb/mount.
+	 */
+	BUILD_BUG_ON(FS_EVENTS_POSS_ON_CHILD & ~FS_EVENTS_POSS_TO_PARENT);
+
 	/* Did either inode/sb/mount subscribe for events with parent/name? */
 	marks_mask |= fsnotify_parent_needed_mask(inode->i_fsnotify_mask);
 	marks_mask |= fsnotify_parent_needed_mask(inode->i_sb->s_fsnotify_mask);
@@ -249,6 +256,10 @@ static int fsnotify_handle_inode_event(s
 	    path && d_unlinked(path->dentry))
 		return 0;
 
+	/* Check interest of this mark in case event was sent with two marks */
+	if (!(mask & inode_mark->mask & ALL_FSNOTIFY_EVENTS))
+		return 0;
+
 	return ops->handle_inode_event(inode_mark, mask, inode, dir, name, cookie);
 }
 
@@ -258,38 +269,46 @@ static int fsnotify_handle_event(struct
 				 u32 cookie, struct fsnotify_iter_info *iter_info)
 {
 	struct fsnotify_mark *inode_mark = fsnotify_iter_inode_mark(iter_info);
-	struct fsnotify_mark *child_mark = fsnotify_iter_child_mark(iter_info);
+	struct fsnotify_mark *parent_mark = fsnotify_iter_parent_mark(iter_info);
 	int ret;
 
 	if (WARN_ON_ONCE(fsnotify_iter_sb_mark(iter_info)) ||
 	    WARN_ON_ONCE(fsnotify_iter_vfsmount_mark(iter_info)))
 		return 0;
 
-	/*
-	 * An event can be sent on child mark iterator instead of inode mark
-	 * iterator because of other groups that have interest of this inode
-	 * and have marks on both parent and child.  We can simplify this case.
-	 */
-	if (!inode_mark) {
-		inode_mark = child_mark;
-		child_mark = NULL;
+	if (parent_mark) {
+		/*
+		 * parent_mark indicates that the parent inode is watching
+		 * children and interested in this event, which is an event
+		 * possible on child. But is *this mark* watching children and
+		 * interested in this event?
+		 */
+		if (parent_mark->mask & FS_EVENT_ON_CHILD) {
+			ret = fsnotify_handle_inode_event(group, parent_mark, mask,
+							  data, data_type, dir, name, 0);
+			if (ret)
+				return ret;
+		}
+		if (!inode_mark)
+			return 0;
+	}
+
+	if (mask & FS_EVENT_ON_CHILD) {
+		/*
+		 * Some events can be sent on both parent dir and child marks
+		 * (e.g. FS_ATTRIB).  If both parent dir and child are
+		 * watching, report the event once to parent dir with name (if
+		 * interested) and once to child without name (if interested).
+		 * The child watcher is expecting an event without a file name
+		 * and without the FS_EVENT_ON_CHILD flag.
+		 */
+		mask &= ~FS_EVENT_ON_CHILD;
 		dir = NULL;
 		name = NULL;
 	}
 
-	ret = fsnotify_handle_inode_event(group, inode_mark, mask, data, data_type,
-					  dir, name, cookie);
-	if (ret || !child_mark)
-		return ret;
-
-	/*
-	 * Some events can be sent on both parent dir and child marks
-	 * (e.g. FS_ATTRIB).  If both parent dir and child are watching,
-	 * report the event once to parent dir with name and once to child
-	 * without name.
-	 */
-	return fsnotify_handle_inode_event(group, child_mark, mask, data, data_type,
-					   NULL, NULL, 0);
+	return fsnotify_handle_inode_event(group, inode_mark, mask, data, data_type,
+					   dir, name, cookie);
 }
 
 static int send_to_group(__u32 mask, const void *data, int data_type,
@@ -447,7 +466,7 @@ int fsnotify(__u32 mask, const void *dat
 	struct fsnotify_iter_info iter_info = {};
 	struct super_block *sb;
 	struct mount *mnt = NULL;
-	struct inode *child = NULL;
+	struct inode *parent = NULL;
 	int ret = 0;
 	__u32 test_mask, marks_mask;
 
@@ -459,11 +478,10 @@ int fsnotify(__u32 mask, const void *dat
 		inode = dir;
 	} else if (mask & FS_EVENT_ON_CHILD) {
 		/*
-		 * Event on child - report on TYPE_INODE to dir if it is
-		 * watching children and on TYPE_CHILD to child.
+		 * Event on child - report on TYPE_PARENT to dir if it is
+		 * watching children and on TYPE_INODE to child.
 		 */
-		child = inode;
-		inode = dir;
+		parent = dir;
 	}
 	sb = inode->i_sb;
 
@@ -477,7 +495,7 @@ int fsnotify(__u32 mask, const void *dat
 	if (!sb->s_fsnotify_marks &&
 	    (!mnt || !mnt->mnt_fsnotify_marks) &&
 	    (!inode || !inode->i_fsnotify_marks) &&
-	    (!child || !child->i_fsnotify_marks))
+	    (!parent || !parent->i_fsnotify_marks))
 		return 0;
 
 	marks_mask = sb->s_fsnotify_mask;
@@ -485,8 +503,8 @@ int fsnotify(__u32 mask, const void *dat
 		marks_mask |= mnt->mnt_fsnotify_mask;
 	if (inode)
 		marks_mask |= inode->i_fsnotify_mask;
-	if (child)
-		marks_mask |= child->i_fsnotify_mask;
+	if (parent)
+		marks_mask |= parent->i_fsnotify_mask;
 
 
 	/*
@@ -509,9 +527,9 @@ int fsnotify(__u32 mask, const void *dat
 		iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
 			fsnotify_first_mark(&inode->i_fsnotify_marks);
 	}
-	if (child) {
-		iter_info.marks[FSNOTIFY_OBJ_TYPE_CHILD] =
-			fsnotify_first_mark(&child->i_fsnotify_marks);
+	if (parent) {
+		iter_info.marks[FSNOTIFY_OBJ_TYPE_PARENT] =
+			fsnotify_first_mark(&parent->i_fsnotify_marks);
 	}
 
 	/*
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -278,7 +278,7 @@ static inline const struct path *fsnotif
 
 enum fsnotify_obj_type {
 	FSNOTIFY_OBJ_TYPE_INODE,
-	FSNOTIFY_OBJ_TYPE_CHILD,
+	FSNOTIFY_OBJ_TYPE_PARENT,
 	FSNOTIFY_OBJ_TYPE_VFSMOUNT,
 	FSNOTIFY_OBJ_TYPE_SB,
 	FSNOTIFY_OBJ_TYPE_COUNT,
@@ -286,7 +286,7 @@ enum fsnotify_obj_type {
 };
 
 #define FSNOTIFY_OBJ_TYPE_INODE_FL	(1U << FSNOTIFY_OBJ_TYPE_INODE)
-#define FSNOTIFY_OBJ_TYPE_CHILD_FL	(1U << FSNOTIFY_OBJ_TYPE_CHILD)
+#define FSNOTIFY_OBJ_TYPE_PARENT_FL	(1U << FSNOTIFY_OBJ_TYPE_PARENT)
 #define FSNOTIFY_OBJ_TYPE_VFSMOUNT_FL	(1U << FSNOTIFY_OBJ_TYPE_VFSMOUNT)
 #define FSNOTIFY_OBJ_TYPE_SB_FL		(1U << FSNOTIFY_OBJ_TYPE_SB)
 #define FSNOTIFY_OBJ_ALL_TYPES_MASK	((1U << FSNOTIFY_OBJ_TYPE_COUNT) - 1)
@@ -331,7 +331,7 @@ static inline struct fsnotify_mark *fsno
 }
 
 FSNOTIFY_ITER_FUNCS(inode, INODE)
-FSNOTIFY_ITER_FUNCS(child, CHILD)
+FSNOTIFY_ITER_FUNCS(parent, PARENT)
 FSNOTIFY_ITER_FUNCS(vfsmount, VFSMOUNT)
 FSNOTIFY_ITER_FUNCS(sb, SB)
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 632/717] jfs: Fix array index bounds check in dbAdjTree
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (629 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 631/717] fsnotify: fix events reported to watching parent and child Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 633/717] drm/panfrost: Fix job timeout handling Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Kleikamp, butt3rflyh4ck

From: Dave Kleikamp <dave.kleikamp@oracle.com>

commit c61b3e4839007668360ed8b87d7da96d2e59fc6c upstream.

Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jfs/jfs_dmap.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -183,7 +183,7 @@ typedef union dmtree {
 #define	dmt_leafidx	t1.leafidx
 #define	dmt_height	t1.height
 #define	dmt_budmin	t1.budmin
-#define	dmt_stree	t1.stree
+#define	dmt_stree	t2.stree
 
 /*
  *	on-disk aggregate disk allocation map descriptor.



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 633/717] drm/panfrost: Fix job timeout handling
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (630 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 632/717] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 634/717] drm/panfrost: Move the GPU reset bits outside the timeout handler Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Steven Price

From: Boris Brezillon <boris.brezillon@collabora.com>

commit 1a11a88cfd9a97e13be8bc880c4795f9844fbbec upstream.

If more than two jobs end up timeout-ing concurrently, only one of them
(the one attached to the scheduler acquiring the lock) is fully handled.
The other one remains in a dangling state where it's no longer part of
the scheduling queue, but still blocks something in scheduler, leading
to repetitive timeouts when new jobs are queued.

Let's make sure all bad jobs are properly handled by the thread
acquiring the lock.

v3:
- Add Steven's R-b
- Don't take the sched_lock when stopping the schedulers

v2:
- Fix the subject prefix
- Stop the scheduler before returning from panfrost_job_timedout()
- Call cancel_delayed_work_sync() after drm_sched_stop() to make sure
  no timeout handlers are in flight when we reset the GPU (Steven Price)
- Make sure we release the reset lock before restarting the
  schedulers (Steven Price)

Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201002122506.1374183-1-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/panfrost/panfrost_job.c |   62 +++++++++++++++++++++++++++-----
 1 file changed, 53 insertions(+), 9 deletions(-)

--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -25,7 +25,8 @@
 
 struct panfrost_queue_state {
 	struct drm_gpu_scheduler sched;
-
+	bool stopped;
+	struct mutex lock;
 	u64 fence_context;
 	u64 emit_seqno;
 };
@@ -369,6 +370,24 @@ void panfrost_job_enable_interrupts(stru
 	job_write(pfdev, JOB_INT_MASK, irq_mask);
 }
 
+static bool panfrost_scheduler_stop(struct panfrost_queue_state *queue,
+				    struct drm_sched_job *bad)
+{
+	bool stopped = false;
+
+	mutex_lock(&queue->lock);
+	if (!queue->stopped) {
+		drm_sched_stop(&queue->sched, bad);
+		if (bad)
+			drm_sched_increase_karma(bad);
+		queue->stopped = true;
+		stopped = true;
+	}
+	mutex_unlock(&queue->lock);
+
+	return stopped;
+}
+
 static void panfrost_job_timedout(struct drm_sched_job *sched_job)
 {
 	struct panfrost_job *job = to_panfrost_job(sched_job);
@@ -392,19 +411,39 @@ static void panfrost_job_timedout(struct
 		job_read(pfdev, JS_TAIL_LO(js)),
 		sched_job);
 
+	/* Scheduler is already stopped, nothing to do. */
+	if (!panfrost_scheduler_stop(&pfdev->js->queue[js], sched_job))
+		return;
+
 	if (!mutex_trylock(&pfdev->reset_lock))
 		return;
 
 	for (i = 0; i < NUM_JOB_SLOTS; i++) {
 		struct drm_gpu_scheduler *sched = &pfdev->js->queue[i].sched;
 
-		drm_sched_stop(sched, sched_job);
-		if (js != i)
-			/* Ensure any timeouts on other slots have finished */
+		/*
+		 * If the queue is still active, make sure we wait for any
+		 * pending timeouts.
+		 */
+		if (!pfdev->js->queue[i].stopped)
+			cancel_delayed_work_sync(&sched->work_tdr);
+
+		/*
+		 * If the scheduler was not already stopped, there's a tiny
+		 * chance a timeout has expired just before we stopped it, and
+		 * drm_sched_stop() does not flush pending works. Let's flush
+		 * them now so the timeout handler doesn't get called in the
+		 * middle of a reset.
+		 */
+		if (panfrost_scheduler_stop(&pfdev->js->queue[i], NULL))
 			cancel_delayed_work_sync(&sched->work_tdr);
-	}
 
-	drm_sched_increase_karma(sched_job);
+		/*
+		 * Now that we cancelled the pending timeouts, we can safely
+		 * reset the stopped state.
+		 */
+		pfdev->js->queue[i].stopped = false;
+	}
 
 	spin_lock_irqsave(&pfdev->js->job_lock, flags);
 	for (i = 0; i < NUM_JOB_SLOTS; i++) {
@@ -421,11 +460,11 @@ static void panfrost_job_timedout(struct
 	for (i = 0; i < NUM_JOB_SLOTS; i++)
 		drm_sched_resubmit_jobs(&pfdev->js->queue[i].sched);
 
+	mutex_unlock(&pfdev->reset_lock);
+
 	/* restart scheduler after GPU is usable again */
 	for (i = 0; i < NUM_JOB_SLOTS; i++)
 		drm_sched_start(&pfdev->js->queue[i].sched, true);
-
-	mutex_unlock(&pfdev->reset_lock);
 }
 
 static const struct drm_sched_backend_ops panfrost_sched_ops = {
@@ -558,6 +597,7 @@ int panfrost_job_open(struct panfrost_fi
 	int ret, i;
 
 	for (i = 0; i < NUM_JOB_SLOTS; i++) {
+		mutex_init(&js->queue[i].lock);
 		sched = &js->queue[i].sched;
 		ret = drm_sched_entity_init(&panfrost_priv->sched_entity[i],
 					    DRM_SCHED_PRIORITY_NORMAL, &sched,
@@ -570,10 +610,14 @@ int panfrost_job_open(struct panfrost_fi
 
 void panfrost_job_close(struct panfrost_file_priv *panfrost_priv)
 {
+	struct panfrost_device *pfdev = panfrost_priv->pfdev;
+	struct panfrost_job_slot *js = pfdev->js;
 	int i;
 
-	for (i = 0; i < NUM_JOB_SLOTS; i++)
+	for (i = 0; i < NUM_JOB_SLOTS; i++) {
 		drm_sched_entity_destroy(&panfrost_priv->sched_entity[i]);
+		mutex_destroy(&js->queue[i].lock);
+	}
 }
 
 int panfrost_job_is_idle(struct panfrost_device *pfdev)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 634/717] drm/panfrost: Move the GPU reset bits outside the timeout handler
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (631 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 633/717] drm/panfrost: Fix job timeout handling Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Steven Price

From: Boris Brezillon <boris.brezillon@collabora.com>

commit 5bc5cc2819c2c0adb644919e3e790b504ea47e0a upstream.

We've fixed many races in panfrost_job_timedout() but some remain.
Instead of trying to fix it again, let's simplify the logic and move
the reset bits to a separate work scheduled when one of the queue
reports a timeout.

v5:
- Simplify panfrost_scheduler_stop() (Steven Price)
- Always restart the queue in panfrost_scheduler_start() even if
  the status is corrupted (Steven Price)

v4:
- Rework the logic to prevent a race between drm_sched_start()
  (reset work) and drm_sched_job_timedout() (timeout work)
- Drop Steven's R-b
- Add dma_fence annotation to the panfrost_reset() function (Daniel Vetter)

v3:
- Replace the atomic_cmpxchg() by an atomic_xchg() (Robin Murphy)
- Add Steven's R-b

v2:
- Use atomic_cmpxchg() to conditionally schedule the reset work
  (Steven Price)

Fixes: 1a11a88cfd9a ("drm/panfrost: Fix job timeout handling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201105151704.2010667-1-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/panfrost/panfrost_device.c |    1 
 drivers/gpu/drm/panfrost/panfrost_device.h |    6 
 drivers/gpu/drm/panfrost/panfrost_job.c    |  187 +++++++++++++++++++----------
 3 files changed, 130 insertions(+), 64 deletions(-)

--- a/drivers/gpu/drm/panfrost/panfrost_device.c
+++ b/drivers/gpu/drm/panfrost/panfrost_device.c
@@ -206,7 +206,6 @@ int panfrost_device_init(struct panfrost
 	struct resource *res;
 
 	mutex_init(&pfdev->sched_lock);
-	mutex_init(&pfdev->reset_lock);
 	INIT_LIST_HEAD(&pfdev->scheduled_jobs);
 	INIT_LIST_HEAD(&pfdev->as_lru_list);
 
--- a/drivers/gpu/drm/panfrost/panfrost_device.h
+++ b/drivers/gpu/drm/panfrost/panfrost_device.h
@@ -105,7 +105,11 @@ struct panfrost_device {
 	struct panfrost_perfcnt *perfcnt;
 
 	struct mutex sched_lock;
-	struct mutex reset_lock;
+
+	struct {
+		struct work_struct work;
+		atomic_t pending;
+	} reset;
 
 	struct mutex shrinker_lock;
 	struct list_head shrinker_list;
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -20,12 +20,21 @@
 #include "panfrost_gpu.h"
 #include "panfrost_mmu.h"
 
+#define JOB_TIMEOUT_MS 500
+
 #define job_write(dev, reg, data) writel(data, dev->iomem + (reg))
 #define job_read(dev, reg) readl(dev->iomem + (reg))
 
+enum panfrost_queue_status {
+	PANFROST_QUEUE_STATUS_ACTIVE,
+	PANFROST_QUEUE_STATUS_STOPPED,
+	PANFROST_QUEUE_STATUS_STARTING,
+	PANFROST_QUEUE_STATUS_FAULT_PENDING,
+};
+
 struct panfrost_queue_state {
 	struct drm_gpu_scheduler sched;
-	bool stopped;
+	atomic_t status;
 	struct mutex lock;
 	u64 fence_context;
 	u64 emit_seqno;
@@ -373,28 +382,61 @@ void panfrost_job_enable_interrupts(stru
 static bool panfrost_scheduler_stop(struct panfrost_queue_state *queue,
 				    struct drm_sched_job *bad)
 {
+	enum panfrost_queue_status old_status;
 	bool stopped = false;
 
 	mutex_lock(&queue->lock);
-	if (!queue->stopped) {
-		drm_sched_stop(&queue->sched, bad);
-		if (bad)
-			drm_sched_increase_karma(bad);
-		queue->stopped = true;
-		stopped = true;
-	}
+	old_status = atomic_xchg(&queue->status,
+				 PANFROST_QUEUE_STATUS_STOPPED);
+	if (old_status == PANFROST_QUEUE_STATUS_STOPPED)
+		goto out;
+
+	WARN_ON(old_status != PANFROST_QUEUE_STATUS_ACTIVE);
+	drm_sched_stop(&queue->sched, bad);
+	if (bad)
+		drm_sched_increase_karma(bad);
+
+	stopped = true;
+
+	/*
+	 * Set the timeout to max so the timer doesn't get started
+	 * when we return from the timeout handler (restored in
+	 * panfrost_scheduler_start()).
+	 */
+	queue->sched.timeout = MAX_SCHEDULE_TIMEOUT;
+
+out:
 	mutex_unlock(&queue->lock);
 
 	return stopped;
 }
 
+static void panfrost_scheduler_start(struct panfrost_queue_state *queue)
+{
+	enum panfrost_queue_status old_status;
+
+	mutex_lock(&queue->lock);
+	old_status = atomic_xchg(&queue->status,
+				 PANFROST_QUEUE_STATUS_STARTING);
+	WARN_ON(old_status != PANFROST_QUEUE_STATUS_STOPPED);
+
+	/* Restore the original timeout before starting the scheduler. */
+	queue->sched.timeout = msecs_to_jiffies(JOB_TIMEOUT_MS);
+	drm_sched_resubmit_jobs(&queue->sched);
+	drm_sched_start(&queue->sched, true);
+	old_status = atomic_xchg(&queue->status,
+				 PANFROST_QUEUE_STATUS_ACTIVE);
+	if (old_status == PANFROST_QUEUE_STATUS_FAULT_PENDING)
+		drm_sched_fault(&queue->sched);
+
+	mutex_unlock(&queue->lock);
+}
+
 static void panfrost_job_timedout(struct drm_sched_job *sched_job)
 {
 	struct panfrost_job *job = to_panfrost_job(sched_job);
 	struct panfrost_device *pfdev = job->pfdev;
 	int js = panfrost_job_get_slot(job);
-	unsigned long flags;
-	int i;
 
 	/*
 	 * If the GPU managed to complete this jobs fence, the timeout is
@@ -415,56 +457,9 @@ static void panfrost_job_timedout(struct
 	if (!panfrost_scheduler_stop(&pfdev->js->queue[js], sched_job))
 		return;
 
-	if (!mutex_trylock(&pfdev->reset_lock))
-		return;
-
-	for (i = 0; i < NUM_JOB_SLOTS; i++) {
-		struct drm_gpu_scheduler *sched = &pfdev->js->queue[i].sched;
-
-		/*
-		 * If the queue is still active, make sure we wait for any
-		 * pending timeouts.
-		 */
-		if (!pfdev->js->queue[i].stopped)
-			cancel_delayed_work_sync(&sched->work_tdr);
-
-		/*
-		 * If the scheduler was not already stopped, there's a tiny
-		 * chance a timeout has expired just before we stopped it, and
-		 * drm_sched_stop() does not flush pending works. Let's flush
-		 * them now so the timeout handler doesn't get called in the
-		 * middle of a reset.
-		 */
-		if (panfrost_scheduler_stop(&pfdev->js->queue[i], NULL))
-			cancel_delayed_work_sync(&sched->work_tdr);
-
-		/*
-		 * Now that we cancelled the pending timeouts, we can safely
-		 * reset the stopped state.
-		 */
-		pfdev->js->queue[i].stopped = false;
-	}
-
-	spin_lock_irqsave(&pfdev->js->job_lock, flags);
-	for (i = 0; i < NUM_JOB_SLOTS; i++) {
-		if (pfdev->jobs[i]) {
-			pm_runtime_put_noidle(pfdev->dev);
-			panfrost_devfreq_record_idle(&pfdev->pfdevfreq);
-			pfdev->jobs[i] = NULL;
-		}
-	}
-	spin_unlock_irqrestore(&pfdev->js->job_lock, flags);
-
-	panfrost_device_reset(pfdev);
-
-	for (i = 0; i < NUM_JOB_SLOTS; i++)
-		drm_sched_resubmit_jobs(&pfdev->js->queue[i].sched);
-
-	mutex_unlock(&pfdev->reset_lock);
-
-	/* restart scheduler after GPU is usable again */
-	for (i = 0; i < NUM_JOB_SLOTS; i++)
-		drm_sched_start(&pfdev->js->queue[i].sched, true);
+	/* Schedule a reset if there's no reset in progress. */
+	if (!atomic_xchg(&pfdev->reset.pending, 1))
+		schedule_work(&pfdev->reset.work);
 }
 
 static const struct drm_sched_backend_ops panfrost_sched_ops = {
@@ -496,6 +491,8 @@ static irqreturn_t panfrost_job_irq_hand
 		job_write(pfdev, JOB_INT_CLEAR, mask);
 
 		if (status & JOB_INT_MASK_ERR(j)) {
+			enum panfrost_queue_status old_status;
+
 			job_write(pfdev, JS_COMMAND_NEXT(j), JS_COMMAND_NOP);
 
 			dev_err(pfdev->dev, "js fault, js=%d, status=%s, head=0x%x, tail=0x%x",
@@ -504,7 +501,18 @@ static irqreturn_t panfrost_job_irq_hand
 				job_read(pfdev, JS_HEAD_LO(j)),
 				job_read(pfdev, JS_TAIL_LO(j)));
 
-			drm_sched_fault(&pfdev->js->queue[j].sched);
+			/*
+			 * When the queue is being restarted we don't report
+			 * faults directly to avoid races between the timeout
+			 * and reset handlers. panfrost_scheduler_start() will
+			 * call drm_sched_fault() after the queue has been
+			 * started if status == FAULT_PENDING.
+			 */
+			old_status = atomic_cmpxchg(&pfdev->js->queue[j].status,
+						    PANFROST_QUEUE_STATUS_STARTING,
+						    PANFROST_QUEUE_STATUS_FAULT_PENDING);
+			if (old_status == PANFROST_QUEUE_STATUS_ACTIVE)
+				drm_sched_fault(&pfdev->js->queue[j].sched);
 		}
 
 		if (status & JOB_INT_MASK_DONE(j)) {
@@ -531,11 +539,66 @@ static irqreturn_t panfrost_job_irq_hand
 	return IRQ_HANDLED;
 }
 
+static void panfrost_reset(struct work_struct *work)
+{
+	struct panfrost_device *pfdev = container_of(work,
+						     struct panfrost_device,
+						     reset.work);
+	unsigned long flags;
+	unsigned int i;
+	bool cookie;
+
+	cookie = dma_fence_begin_signalling();
+	for (i = 0; i < NUM_JOB_SLOTS; i++) {
+		/*
+		 * We want pending timeouts to be handled before we attempt
+		 * to stop the scheduler. If we don't do that and the timeout
+		 * handler is in flight, it might have removed the bad job
+		 * from the list, and we'll lose this job if the reset handler
+		 * enters the critical section in panfrost_scheduler_stop()
+		 * before the timeout handler.
+		 *
+		 * Timeout is set to MAX_SCHEDULE_TIMEOUT - 1 because we need
+		 * something big enough to make sure the timer will not expire
+		 * before we manage to stop the scheduler, but we can't use
+		 * MAX_SCHEDULE_TIMEOUT because drm_sched_get_cleanup_job()
+		 * considers that as 'timer is not running' and will dequeue
+		 * the job without making sure the timeout handler is not
+		 * running.
+		 */
+		pfdev->js->queue[i].sched.timeout = MAX_SCHEDULE_TIMEOUT - 1;
+		cancel_delayed_work_sync(&pfdev->js->queue[i].sched.work_tdr);
+		panfrost_scheduler_stop(&pfdev->js->queue[i], NULL);
+	}
+
+	/* All timers have been stopped, we can safely reset the pending state. */
+	atomic_set(&pfdev->reset.pending, 0);
+
+	spin_lock_irqsave(&pfdev->js->job_lock, flags);
+	for (i = 0; i < NUM_JOB_SLOTS; i++) {
+		if (pfdev->jobs[i]) {
+			pm_runtime_put_noidle(pfdev->dev);
+			panfrost_devfreq_record_idle(&pfdev->pfdevfreq);
+			pfdev->jobs[i] = NULL;
+		}
+	}
+	spin_unlock_irqrestore(&pfdev->js->job_lock, flags);
+
+	panfrost_device_reset(pfdev);
+
+	for (i = 0; i < NUM_JOB_SLOTS; i++)
+		panfrost_scheduler_start(&pfdev->js->queue[i]);
+
+	dma_fence_end_signalling(cookie);
+}
+
 int panfrost_job_init(struct panfrost_device *pfdev)
 {
 	struct panfrost_job_slot *js;
 	int ret, j, irq;
 
+	INIT_WORK(&pfdev->reset.work, panfrost_reset);
+
 	pfdev->js = js = devm_kzalloc(pfdev->dev, sizeof(*js), GFP_KERNEL);
 	if (!js)
 		return -ENOMEM;
@@ -558,7 +621,7 @@ int panfrost_job_init(struct panfrost_de
 
 		ret = drm_sched_init(&js->queue[j].sched,
 				     &panfrost_sched_ops,
-				     1, 0, msecs_to_jiffies(500),
+				     1, 0, msecs_to_jiffies(JOB_TIMEOUT_MS),
 				     "pan_js");
 		if (ret) {
 			dev_err(pfdev->dev, "Failed to create scheduler: %d.", ret);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (632 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 634/717] drm/panfrost: Move the GPU reset bits outside the timeout handler Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-29 19:42   ` Bas Nieuwenhuizen
  2020-12-28 12:50 ` [PATCH 5.10 636/717] drm/amdgpu: only set DP subconnector type on DP and eDP connectors Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bas Nieuwenhuizen, Alex Deucher,
	Nicholas Kazlauskas

From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>

commit be7b9b327e79cd2db07b659af599867b629b2f66 upstream.

With modifiers I'd like to support non-dedicated buffers for
images.

Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Cc: stable@vger.kernel.org # 5.1.0
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3746,6 +3746,7 @@ fill_plane_dcc_attributes(struct amdgpu_
 	struct dc *dc = adev->dm.dc;
 	struct dc_dcc_surface_param input;
 	struct dc_surface_dcc_cap output;
+	uint64_t plane_address = afb->address + afb->base.offsets[0];
 	uint32_t offset = AMDGPU_TILING_GET(info, DCC_OFFSET_256B);
 	uint32_t i64b = AMDGPU_TILING_GET(info, DCC_INDEPENDENT_64B) != 0;
 	uint64_t dcc_address;
@@ -3789,7 +3790,7 @@ fill_plane_dcc_attributes(struct amdgpu_
 		AMDGPU_TILING_GET(info, DCC_PITCH_MAX) + 1;
 	dcc->independent_64b_blks = i64b;
 
-	dcc_address = get_dcc_address(afb->address, info);
+	dcc_address = get_dcc_address(plane_address, info);
 	address->grph.meta_addr.low_part = lower_32_bits(dcc_address);
 	address->grph.meta_addr.high_part = upper_32_bits(dcc_address);
 
@@ -3820,6 +3821,8 @@ fill_plane_buffer_attributes(struct amdg
 	address->tmz_surface = tmz_surface;
 
 	if (format < SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) {
+		uint64_t addr = afb->address + fb->offsets[0];
+
 		plane_size->surface_size.x = 0;
 		plane_size->surface_size.y = 0;
 		plane_size->surface_size.width = fb->width;
@@ -3828,9 +3831,10 @@ fill_plane_buffer_attributes(struct amdg
 			fb->pitches[0] / fb->format->cpp[0];
 
 		address->type = PLN_ADDR_TYPE_GRAPHICS;
-		address->grph.addr.low_part = lower_32_bits(afb->address);
-		address->grph.addr.high_part = upper_32_bits(afb->address);
+		address->grph.addr.low_part = lower_32_bits(addr);
+		address->grph.addr.high_part = upper_32_bits(addr);
 	} else if (format < SURFACE_PIXEL_FORMAT_INVALID) {
+		uint64_t luma_addr = afb->address + fb->offsets[0];
 		uint64_t chroma_addr = afb->address + fb->offsets[1];
 
 		plane_size->surface_size.x = 0;
@@ -3851,9 +3855,9 @@ fill_plane_buffer_attributes(struct amdg
 
 		address->type = PLN_ADDR_TYPE_VIDEO_PROGRESSIVE;
 		address->video_progressive.luma_addr.low_part =
-			lower_32_bits(afb->address);
+			lower_32_bits(luma_addr);
 		address->video_progressive.luma_addr.high_part =
-			upper_32_bits(afb->address);
+			upper_32_bits(luma_addr);
 		address->video_progressive.chroma_addr.low_part =
 			lower_32_bits(chroma_addr);
 		address->video_progressive.chroma_addr.high_part =



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 636/717] drm/amdgpu: only set DP subconnector type on DP and eDP connectors
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (633 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kris Karas, Oleg Vasilev, Alex Deucher

From: Alex Deucher <alexander.deucher@amd.com>

commit 05211e7fbbf042dd7f51155ebe64eb2ecacb25cb upstream.

Fixes a crash in drm_object_property_set_value() because the property
is not set for internal DP ports that connect to a bridge chips
(e.g., DP to VGA or DP to LVDS).

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=210739
Fixes: 65bf2cf95d3ade ("drm/amdgpu: utilize subconnector property for DP through atombios")
Tested-By: Kris Karas <bugs-a17@moonlit-rail.com>
Cc: Oleg Vasilev <oleg.vasilev@intel.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 5.10.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -1414,10 +1414,12 @@ out:
 		pm_runtime_put_autosuspend(connector->dev->dev);
 	}
 
-	drm_dp_set_subconnector_property(&amdgpu_connector->base,
-					 ret,
-					 amdgpu_dig_connector->dpcd,
-					 amdgpu_dig_connector->downstream_ports);
+	if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+	    connector->connector_type == DRM_MODE_CONNECTOR_eDP)
+		drm_dp_set_subconnector_property(&amdgpu_connector->base,
+						 ret,
+						 amdgpu_dig_connector->dpcd,
+						 amdgpu_dig_connector->downstream_ports);
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (634 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 636/717] drm/amdgpu: only set DP subconnector type on DP and eDP connectors Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2021-01-04 19:04   ` Andre Tomt
  2020-12-28 12:50 ` [PATCH 5.10 638/717] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  718 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, Alex Deucher,
	Nicholas Kazlauskas, Stylon Wang

From: Stylon Wang <stylon.wang@amd.com>

commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.

EDID parsing in S3 resume pushes new display modes
to probed_modes list but doesn't consolidate to actual
mode list. This creates a race condition when
amdgpu_dm_connector_ddc_get_modes() re-initializes the
list head without walking the list and results in  memory leak.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=209987
Acked-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Stylon Wang <stylon.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2278,7 +2278,8 @@ void amdgpu_dm_update_connector_after_de
 
 			drm_connector_update_edid_property(connector,
 							   aconnector->edid);
-			drm_add_edid_modes(connector, aconnector->edid);
+			aconnector->num_modes = drm_add_edid_modes(connector, aconnector->edid);
+			drm_connector_list_update(connector);
 
 			if (aconnector->dc_link->aux_mode)
 				drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 638/717] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (635 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 639/717] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zwane Mwaikambo, Lyude Paul

From: Zwane Mwaikambo <zwane@yosper.io>

commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream.

I observed this when unplugging a DP monitor whilst a computer is asleep
and then waking it up. This left DP chardev nodes still being present on
the filesystem and accessing these device nodes caused an oops because
drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
This can also be reproduced by creating a device node with mknod(1) and
issuing an open(2)

[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
[166164.933202] #PF: supervisor read access in kernel mode
[166164.933204] #PF: error_code(0x0000) - not-present page
[166164.933205] PGD 0 P4D 0
[166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
[166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G        W
5.8.0-rc6+ #1
[166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
(1.11 ) 04/21/2020
[166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
[drm_kms_helper]
[166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
<8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
[166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
[166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
[166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
[166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
[166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
[166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
[166164.933244] FS:  00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
knlGS:0000000000000000
[166164.933245] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
[166164.933247] Call Trace:
[166164.933264]  auxdev_open+0x1b/0x40 [drm_kms_helper]
[166164.933278]  chrdev_open+0xa7/0x1c0
[166164.933282]  ? cdev_put.part.0+0x20/0x20
[166164.933287]  do_dentry_open+0x161/0x3c0
[166164.933291]  vfs_open+0x2d/0x30
[166164.933297]  path_openat+0xb27/0x10e0
[166164.933306]  ? atime_needs_update+0x73/0xd0
[166164.933309]  do_filp_open+0x91/0x100
[166164.933313]  ? __alloc_fd+0xb2/0x150
[166164.933316]  do_sys_openat2+0x210/0x2d0
[166164.933318]  do_sys_open+0x46/0x80
[166164.933320]  __x64_sys_openat+0x20/0x30
[166164.933328]  do_syscall_64+0x52/0xc0
[166164.933336]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
   0x0000000000017b10 <+0>:     callq  0x17b15 <drm_dp_aux_dev_get_by_minor+5>
   0x0000000000017b15 <+5>:     push   %rbp
   0x0000000000017b16 <+6>:     mov    %rsp,%rbp
   0x0000000000017b19 <+9>:     push   %r12
   0x0000000000017b1b <+11>:    mov    %edi,%r12d
   0x0000000000017b1e <+14>:    mov    $0x0,%rdi
   0x0000000000017b25 <+21>:    callq  0x17b2a <drm_dp_aux_dev_get_by_minor+26>
   0x0000000000017b2a <+26>:    mov    %r12d,%esi
   0x0000000000017b2d <+29>:    mov    $0x0,%rdi
   0x0000000000017b34 <+36>:    callq  0x17b39 <drm_dp_aux_dev_get_by_minor+41>
   0x0000000000017b39 <+41>:    mov    0x18(%rax),%edx <=========
   0x0000000000017b3c <+44>:    mov    %rax,%r12
   0x0000000000017b3f <+47>:    lea    0x18(%rax),%rdi
   0x0000000000017b43 <+51>:    test   %edx,%edx
   0x0000000000017b45 <+53>:    je     0x17b7a <drm_dp_aux_dev_get_by_minor+106>
   0x0000000000017b47 <+55>:    lea    0x1(%rdx),%ecx
   0x0000000000017b4a <+58>:    mov    %edx,%eax
   0x0000000000017b4c <+60>:    lock cmpxchg %ecx,(%rdi)
   0x0000000000017b50 <+64>:    jne    0x17b76 <drm_dp_aux_dev_get_by_minor+102>
   0x0000000000017b52 <+66>:    test   %edx,%edx
   0x0000000000017b54 <+68>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
   0x0000000000017b56 <+70>:    test   %ecx,%ecx
   0x0000000000017b58 <+72>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
   0x0000000000017b5a <+74>:    mov    $0x0,%rdi
   0x0000000000017b61 <+81>:    callq  0x17b66 <drm_dp_aux_dev_get_by_minor+86>
   0x0000000000017b66 <+86>:    mov    %r12,%rax
   0x0000000000017b69 <+89>:    pop    %r12
   0x0000000000017b6b <+91>:    pop    %rbp
   0x0000000000017b6c <+92>:    retq
   0x0000000000017b6d <+93>:    xor    %esi,%esi
   0x0000000000017b6f <+95>:    callq  0x17b74 <drm_dp_aux_dev_get_by_minor+100>
   0x0000000000017b74 <+100>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
   0x0000000000017b76 <+102>:   mov    %eax,%edx
   0x0000000000017b78 <+104>:   jmp    0x17b43 <drm_dp_aux_dev_get_by_minor+51>
   0x0000000000017b7a <+106>:   xor    %r12d,%r12d
   0x0000000000017b7d <+109>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.

(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60      static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61      {
62              struct drm_dp_aux_dev *aux_dev = NULL;
63
64              mutex_lock(&aux_idr_mutex);
65              aux_dev = idr_find(&aux_idr, index);
66              if (!kref_get_unless_zero(&aux_dev->refcount))
67                      aux_dev = NULL;
68              mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18

Looking at the caller, checks on the minor are pushed down to
drm_dp_aux_dev_get_by_minor()

static int auxdev_open(struct inode *inode, struct file *file)
{
    unsigned int minor = iminor(inode);
    struct drm_dp_aux_dev *aux_dev;

    aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
    if (!aux_dev)
        return -ENODEV;

    file->private_data = aux_dev;
    return 0;
}

Fixes: e94cb37b34eb ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Zwane Mwaikambo <zwane@yosper.io>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[added Cc to stable]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_aux_dev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_dp_aux_dev.c
+++ b/drivers/gpu/drm/drm_dp_aux_dev.c
@@ -63,7 +63,7 @@ static struct drm_dp_aux_dev *drm_dp_aux
 
 	mutex_lock(&aux_idr_mutex);
 	aux_dev = idr_find(&aux_idr, index);
-	if (!kref_get_unless_zero(&aux_dev->refcount))
+	if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
 		aux_dev = NULL;
 	mutex_unlock(&aux_idr_mutex);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 639/717] drm/i915: Fix mismatch between misplaced vma check and vma insert
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (636 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 638/717] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 640/717] iio: ad_sigma_delta: Dont put SPI transfer buffer on the stack Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, CQ Tang, Chris Wilson, Matthew Auld,
	Jani Nikula

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 0e53656ad8abc99e0a80c3de611e593ebbf55829 upstream.

When inserting a VMA, we restrict the placement to the low 4G unless the
caller opts into using the full range. This was done to allow usersapce
the opportunity to transition slowly from a 32b address space, and to
avoid breaking inherent 32b assumptions of some commands.

However, for insert we limited ourselves to 4G-4K, but on verification
we allowed the full 4G. This causes some attempts to bind a new buffer
to sporadically fail with -ENOSPC, but at other times be bound
successfully.

commit 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1
page") suggests that there is a genuine problem with stateless addressing
that cannot utilize the last page in 4G and so we purposefully excluded
it. This means that the quick pin pass may cause us to utilize a buggy
placement.

Reported-by: CQ Tang <cq.tang@intel.com>
Testcase: igt/gem_exec_params/larger-than-life-batch
Fixes: 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1 page")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: CQ Tang <cq.tang@intel.com>
Reviewed-by: CQ Tang <cq.tang@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v4.5+
Link: https://patchwork.freedesktop.org/patch/msgid/20201216092951.7124-1-chris@chris-wilson.co.uk
(cherry picked from commit 5f22cc0b134ab702d7f64b714e26018f7288ffee)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -382,7 +382,7 @@ eb_vma_misplaced(const struct drm_i915_g
 		return true;
 
 	if (!(flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) &&
-	    (vma->node.start + vma->node.size - 1) >> 32)
+	    (vma->node.start + vma->node.size + 4095) >> 32)
 		return true;
 
 	if (flags & __EXEC_OBJECT_NEEDS_MAP &&



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 640/717] iio: ad_sigma_delta: Dont put SPI transfer buffer on the stack
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (637 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 639/717] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 641/717] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen,
	Alexandru Ardelean, Stable, Jonathan Cameron

From: Lars-Peter Clausen <lars@metafoo.de>

commit 0fb6ee8d0b5e90b72f870f76debc8bd31a742014 upstream.

Use a heap allocated memory for the SPI transfer buffer. Using stack memory
can corrupt stack memory when using DMA on some systems.

This change moves the buffer from the stack of the trigger handler call to
the heap of the buffer of the state struct. The size increases takes into
account the alignment for the timestamp, which is 8 bytes.

The 'data' buffer is split into 'tx_buf' and 'rx_buf', to make a clearer
separation of which part of the buffer should be used for TX & RX.

Fixes: af3008485ea03 ("iio:adc: Add common code for ADI Sigma Delta devices")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20201124123807.19717-1-alexandru.ardelean@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/ad_sigma_delta.c       |   18 ++++++++----------
 include/linux/iio/adc/ad_sigma_delta.h |    6 +++++-
 2 files changed, 13 insertions(+), 11 deletions(-)

--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -57,7 +57,7 @@ EXPORT_SYMBOL_GPL(ad_sd_set_comm);
 int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
 	unsigned int size, unsigned int val)
 {
-	uint8_t *data = sigma_delta->data;
+	uint8_t *data = sigma_delta->tx_buf;
 	struct spi_transfer t = {
 		.tx_buf		= data,
 		.len		= size + 1,
@@ -99,7 +99,7 @@ EXPORT_SYMBOL_GPL(ad_sd_write_reg);
 static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta,
 	unsigned int reg, unsigned int size, uint8_t *val)
 {
-	uint8_t *data = sigma_delta->data;
+	uint8_t *data = sigma_delta->tx_buf;
 	int ret;
 	struct spi_transfer t[] = {
 		{
@@ -146,22 +146,22 @@ int ad_sd_read_reg(struct ad_sigma_delta
 {
 	int ret;
 
-	ret = ad_sd_read_reg_raw(sigma_delta, reg, size, sigma_delta->data);
+	ret = ad_sd_read_reg_raw(sigma_delta, reg, size, sigma_delta->rx_buf);
 	if (ret < 0)
 		goto out;
 
 	switch (size) {
 	case 4:
-		*val = get_unaligned_be32(sigma_delta->data);
+		*val = get_unaligned_be32(sigma_delta->rx_buf);
 		break;
 	case 3:
-		*val = get_unaligned_be24(&sigma_delta->data[0]);
+		*val = get_unaligned_be24(sigma_delta->rx_buf);
 		break;
 	case 2:
-		*val = get_unaligned_be16(sigma_delta->data);
+		*val = get_unaligned_be16(sigma_delta->rx_buf);
 		break;
 	case 1:
-		*val = sigma_delta->data[0];
+		*val = sigma_delta->rx_buf[0];
 		break;
 	default:
 		ret = -EINVAL;
@@ -395,11 +395,9 @@ static irqreturn_t ad_sd_trigger_handler
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ad_sigma_delta *sigma_delta = iio_device_get_drvdata(indio_dev);
+	uint8_t *data = sigma_delta->rx_buf;
 	unsigned int reg_size;
 	unsigned int data_reg;
-	uint8_t data[16];
-
-	memset(data, 0x00, 16);
 
 	reg_size = indio_dev->channels[0].scan_type.realbits +
 			indio_dev->channels[0].scan_type.shift;
--- a/include/linux/iio/adc/ad_sigma_delta.h
+++ b/include/linux/iio/adc/ad_sigma_delta.h
@@ -79,8 +79,12 @@ struct ad_sigma_delta {
 	/*
 	 * DMA (thus cache coherency maintenance) requires the
 	 * transfer buffers to live in their own cache lines.
+	 * 'tx_buf' is up to 32 bits.
+	 * 'rx_buf' is up to 32 bits per sample + 64 bit timestamp,
+	 * rounded to 16 bytes to take into account padding.
 	 */
-	uint8_t				data[4] ____cacheline_aligned;
+	uint8_t				tx_buf[4] ____cacheline_aligned;
+	uint8_t				rx_buf[16] __aligned(8);
 };
 
 static inline int ad_sigma_delta_set_channel(struct ad_sigma_delta *sd,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 641/717] spi: pxa2xx: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (638 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 640/717] iio: ad_sigma_delta: Dont put SPI transfer buffer on the stack Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 642/717] spi: spi-sh: " Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5626308bb94d9f930aa5f7c77327df4c6daa7759 upstream.

pxa2xx_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master/slave() helper
which keeps the private data accessible until the driver has unbound.

Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v2.6.17+
Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-pxa2xx.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1686,9 +1686,9 @@ static int pxa2xx_spi_probe(struct platf
 	}
 
 	if (platform_info->is_slave)
-		controller = spi_alloc_slave(dev, sizeof(struct driver_data));
+		controller = devm_spi_alloc_slave(dev, sizeof(*drv_data));
 	else
-		controller = spi_alloc_master(dev, sizeof(struct driver_data));
+		controller = devm_spi_alloc_master(dev, sizeof(*drv_data));
 
 	if (!controller) {
 		dev_err(&pdev->dev, "cannot alloc spi_controller\n");
@@ -1911,7 +1911,6 @@ out_error_dma_irq_alloc:
 	free_irq(ssp->irq, drv_data);
 
 out_error_controller_alloc:
-	spi_controller_put(controller);
 	pxa_ssp_free(ssp);
 	return status;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 642/717] spi: spi-sh: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (639 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 641/717] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 643/717] spi: atmel-quadspi: " Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Axel Lin, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.

spi_sh_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.0+
Cc: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-sh.c |   13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

--- a/drivers/spi/spi-sh.c
+++ b/drivers/spi/spi-sh.c
@@ -440,7 +440,7 @@ static int spi_sh_probe(struct platform_
 	if (irq < 0)
 		return irq;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
 	if (master == NULL) {
 		dev_err(&pdev->dev, "spi_alloc_master error.\n");
 		return -ENOMEM;
@@ -458,16 +458,14 @@ static int spi_sh_probe(struct platform_
 		break;
 	default:
 		dev_err(&pdev->dev, "No support width\n");
-		ret = -ENODEV;
-		goto error1;
+		return -ENODEV;
 	}
 	ss->irq = irq;
 	ss->master = master;
 	ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
 	if (ss->addr == NULL) {
 		dev_err(&pdev->dev, "ioremap error.\n");
-		ret = -ENOMEM;
-		goto error1;
+		return -ENOMEM;
 	}
 	INIT_LIST_HEAD(&ss->queue);
 	spin_lock_init(&ss->lock);
@@ -477,7 +475,7 @@ static int spi_sh_probe(struct platform_
 	ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "request_irq error\n");
-		goto error1;
+		return ret;
 	}
 
 	master->num_chipselect = 2;
@@ -496,9 +494,6 @@ static int spi_sh_probe(struct platform_
 
  error3:
 	free_irq(irq, ss);
- error1:
-	spi_master_put(master);
-
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 643/717] spi: atmel-quadspi: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (640 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 642/717] spi: spi-sh: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 644/717] spi: spi-mtk-nor: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Piotr Bugalski, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit c7b884561cb5b641f3dbba950094110794119a6d upstream.

atmel_qspi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.0+
Cc: Piotr Bugalski <bugalski.piotr@gmail.com>
Link: https://lore.kernel.org/r/4b05c65cf6f1ea3251484fe9a00b4c65478a1ae3.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |   15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -535,7 +535,7 @@ static int atmel_qspi_probe(struct platf
 	struct resource *res;
 	int irq, err = 0;
 
-	ctrl = spi_alloc_master(&pdev->dev, sizeof(*aq));
+	ctrl = devm_spi_alloc_master(&pdev->dev, sizeof(*aq));
 	if (!ctrl)
 		return -ENOMEM;
 
@@ -557,8 +557,7 @@ static int atmel_qspi_probe(struct platf
 	aq->regs = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(aq->regs)) {
 		dev_err(&pdev->dev, "missing registers\n");
-		err = PTR_ERR(aq->regs);
-		goto exit;
+		return PTR_ERR(aq->regs);
 	}
 
 	/* Map the AHB memory */
@@ -566,8 +565,7 @@ static int atmel_qspi_probe(struct platf
 	aq->mem = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(aq->mem)) {
 		dev_err(&pdev->dev, "missing AHB memory\n");
-		err = PTR_ERR(aq->mem);
-		goto exit;
+		return PTR_ERR(aq->mem);
 	}
 
 	aq->mmap_size = resource_size(res);
@@ -579,15 +577,14 @@ static int atmel_qspi_probe(struct platf
 
 	if (IS_ERR(aq->pclk)) {
 		dev_err(&pdev->dev, "missing peripheral clock\n");
-		err = PTR_ERR(aq->pclk);
-		goto exit;
+		return PTR_ERR(aq->pclk);
 	}
 
 	/* Enable the peripheral clock */
 	err = clk_prepare_enable(aq->pclk);
 	if (err) {
 		dev_err(&pdev->dev, "failed to enable the peripheral clock\n");
-		goto exit;
+		return err;
 	}
 
 	aq->caps = of_device_get_match_data(&pdev->dev);
@@ -638,8 +635,6 @@ disable_qspick:
 	clk_disable_unprepare(aq->qspick);
 disable_pclk:
 	clk_disable_unprepare(aq->pclk);
-exit:
-	spi_controller_put(ctrl);
 
 	return err;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 644/717] spi: spi-mtk-nor: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (641 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 643/717] spi: atmel-quadspi: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 645/717] spi: ar934x: " Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Ikjoon Jang,
	Chuanhong Guo, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 0f4ad8d59f33b24dd86739f3be23e6af1a86f5a9 upstream.

If the call to devm_spi_register_controller() fails on probe of the
MediaTek SPI NOR driver, the spi_controller struct is erroneously not
freed.

Since commit a1daaa991ed1 ("spi: spi-mtk-nor: use dma_alloc_coherent()
for bounce buffer"), the same happens if the call to
dmam_alloc_coherent() fails.

Since commit 3bfd9103c7af ("spi: spi-mtk-nor: Add power management
support"), the same happens if the call to mtk_nor_enable_clk() fails.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Ikjoon Jang <ikjn@chromium.org>
Cc: <stable@vger.kernel.org> # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.7+
Cc: Chuanhong Guo <gch981213@gmail.com>
Link: https://lore.kernel.org/r/d5b9f0289465394e73dedb8ec51e180a8f1dffc9.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mtk-nor.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-mtk-nor.c
+++ b/drivers/spi/spi-mtk-nor.c
@@ -768,7 +768,7 @@ static int mtk_nor_probe(struct platform
 		return -EINVAL;
 	}
 
-	ctlr = spi_alloc_master(&pdev->dev, sizeof(*sp));
+	ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*sp));
 	if (!ctlr) {
 		dev_err(&pdev->dev, "failed to allocate spi controller\n");
 		return -ENOMEM;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 645/717] spi: ar934x: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (642 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 644/717] spi: spi-mtk-nor: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 646/717] spi: davinci: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Chuanhong Guo, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 236924ee531d6251c8d10e9177b7742a60534ed5 upstream.

If the call to devm_spi_register_controller() fails on probe of the
Qualcomm Atheros AR934x/QCA95xx SPI driver, the spi_controller struct is
erroneously not freed.  Fix by switching over to the new
devm_spi_alloc_master() helper.

Moreover, the controller's clock is enabled on probe but not disabled if
any of the subsequent probe steps fail.

Finally, there's an ordering issue in ar934x_spi_remove() wherein the
clock is disabled even though the controller is not yet unregistered.
It is unregistered after ar934x_spi_remove() by the devres framework.
As long as it is not unregistered, SPI transfers may still be ongoing
and disabling the clock may break them.  It is not possible to use
devm_spi_register_controller() in this case, so move to the non-devm
variant.

All of these bugs have existed since the driver was first introduced,
so it seems fair to fix them together in a single commit.

Fixes: 047980c582af ("spi: add driver for ar934x spi controller")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.7+
Cc: Chuanhong Guo <gch981213@gmail.com>
Link: https://lore.kernel.org/r/1d58367d74d55741e0c2730a51a2b65012c8ab33.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-ar934x.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-ar934x.c
+++ b/drivers/spi/spi-ar934x.c
@@ -176,10 +176,11 @@ static int ar934x_spi_probe(struct platf
 	if (ret)
 		return ret;
 
-	ctlr = spi_alloc_master(&pdev->dev, sizeof(*sp));
+	ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*sp));
 	if (!ctlr) {
 		dev_info(&pdev->dev, "failed to allocate spi controller\n");
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_clk_disable;
 	}
 
 	/* disable flash mapping and expose spi controller registers */
@@ -202,7 +203,13 @@ static int ar934x_spi_probe(struct platf
 	sp->clk_freq = clk_get_rate(clk);
 	sp->ctlr = ctlr;
 
-	return devm_spi_register_controller(&pdev->dev, ctlr);
+	ret = spi_register_controller(ctlr);
+	if (!ret)
+		return 0;
+
+err_clk_disable:
+	clk_disable_unprepare(clk);
+	return ret;
 }
 
 static int ar934x_spi_remove(struct platform_device *pdev)
@@ -213,6 +220,7 @@ static int ar934x_spi_remove(struct plat
 	ctlr = dev_get_drvdata(&pdev->dev);
 	sp = spi_controller_get_devdata(ctlr);
 
+	spi_unregister_controller(ctlr);
 	clk_disable_unprepare(sp->clk);
 
 	return 0;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 646/717] spi: davinci: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (643 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 645/717] spi: ar934x: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 647/717] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Peter Ujfalusi, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 373afef350a93519b4b8d636b0895da8650b714b upstream.

davinci_spi_remove() accesses the driver's private data after it's been
freed with spi_master_put().

Fix by moving the spi_master_put() to the end of the function.

Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: <stable@vger.kernel.org> # v4.7+
Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-davinci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -1040,13 +1040,13 @@ static int davinci_spi_remove(struct pla
 	spi_bitbang_stop(&dspi->bitbang);
 
 	clk_disable_unprepare(dspi->clk);
-	spi_master_put(master);
 
 	if (dspi->dma_rx) {
 		dma_release_channel(dspi->dma_rx);
 		dma_release_channel(dspi->dma_tx);
 	}
 
+	spi_master_put(master);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 647/717] spi: fsl: fix use of spisel_boot signal on MPC8309
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (644 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 646/717] spi: davinci: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 648/717] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Linus Walleij,
	Rasmus Villemoes, Mark Brown

From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

commit 122541f2b10897b08f7f7e6db5f1eb693e51f0a1 upstream.

Commit 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
broke the use of the SPISEL_BOOT signal as a chip select on the
MPC8309.

pdata->max_chipselect, which becomes master->num_chipselect, must be
initialized to take into account the possibility that there's one more
chip select in use than the number of GPIO chip selects.

Cc: stable@vger.kernel.org # v5.4+
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
Cc: Linus Walleij <linus.walleij@linaro.org>
Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Link: https://lore.kernel.org/r/20201127152947.376-1-rasmus.villemoes@prevas.dk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-fsl-spi.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -716,10 +716,11 @@ static int of_fsl_spi_probe(struct platf
 	type = fsl_spi_get_type(&ofdev->dev);
 	if (type == TYPE_FSL) {
 		struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
+		bool spisel_boot = false;
 #if IS_ENABLED(CONFIG_FSL_SOC)
 		struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(pdata);
-		bool spisel_boot = of_property_read_bool(np, "fsl,spisel_boot");
 
+		spisel_boot = of_property_read_bool(np, "fsl,spisel_boot");
 		if (spisel_boot) {
 			pinfo->immr_spi_cs = ioremap(get_immrbase() + IMMR_SPI_CS_OFFSET, 4);
 			if (!pinfo->immr_spi_cs)
@@ -734,10 +735,14 @@ static int of_fsl_spi_probe(struct platf
 		 * supported on the GRLIB variant.
 		 */
 		ret = gpiod_count(dev, "cs");
-		if (ret <= 0)
+		if (ret < 0)
+			ret = 0;
+		if (ret == 0 && !spisel_boot) {
 			pdata->max_chipselect = 1;
-		else
+		} else {
+			pdata->max_chipselect = ret + spisel_boot;
 			pdata->cs_control = fsl_spi_cs_control;
+		}
 	}
 
 	ret = of_address_to_resource(np, 0, &mem);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 648/717] spi: gpio: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (645 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 647/717] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 649/717] spi: mxic: " Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Linus Walleij,
	Navid Emamdoost, Andrey Smirnov, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 7174dc655ef0578877b0b4598e69619d2be28b4d upstream.

If the call to devm_spi_register_master() fails on probe of the GPIO SPI
driver, the spi_master struct is erroneously not freed:

After allocating the spi_master, its reference count is 1.  The driver
unconditionally decrements the reference count on unbind using a devm
action.  Before calling devm_spi_register_master(), the driver
unconditionally increments the reference count because on success,
that function will decrement the reference count on unbind.  However on
failure, devm_spi_register_master() does *not* decrement the reference
count, so the spi_master is leaked.

The issue was introduced by commits 8b797490b4db ("spi: gpio: Make sure
spi_master_put() is called in every error path") and 79567c1a321e ("spi:
gpio: Use devm_spi_register_master()"), which sought to plug leaks
introduced by 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO
descriptors") but missed this remaining leak.

The situation was later aggravated by commit d3b0ffa1d75d ("spi: gpio:
prevent memory leak in spi_gpio_probe"), which introduced a
use-after-free because it releases a reference on the spi_master if
devm_add_action_or_reset() fails even though the function already
does that.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.1-: 8b797490b4db: spi: gpio: Make sure spi_master_put() is called in every error path
Cc: <stable@vger.kernel.org> # v5.1-: 45beec351998: spi: bitbang: Introduce spi_bitbang_init()
Cc: <stable@vger.kernel.org> # v5.1-: 79567c1a321e: spi: gpio: Use devm_spi_register_master()
Cc: <stable@vger.kernel.org> # v5.4-: d3b0ffa1d75d: spi: gpio: prevent memory leak in spi_gpio_probe
Cc: <stable@vger.kernel.org> # v4.17+
Cc: Navid Emamdoost <navid.emamdoost@gmail.com>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Link: https://lore.kernel.org/r/86eaed27431c3d709e3748eb76ceecbfc790dd37.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-gpio.c |   15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -350,11 +350,6 @@ static int spi_gpio_probe_pdata(struct p
 	return 0;
 }
 
-static void spi_gpio_put(void *data)
-{
-	spi_master_put(data);
-}
-
 static int spi_gpio_probe(struct platform_device *pdev)
 {
 	int				status;
@@ -363,16 +358,10 @@ static int spi_gpio_probe(struct platfor
 	struct device			*dev = &pdev->dev;
 	struct spi_bitbang		*bb;
 
-	master = spi_alloc_master(dev, sizeof(*spi_gpio));
+	master = devm_spi_alloc_master(dev, sizeof(*spi_gpio));
 	if (!master)
 		return -ENOMEM;
 
-	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master);
-	if (status) {
-		spi_master_put(master);
-		return status;
-	}
-
 	if (pdev->dev.of_node)
 		status = spi_gpio_probe_dt(pdev, master);
 	else
@@ -432,7 +421,7 @@ static int spi_gpio_probe(struct platfor
 	if (status)
 		return status;
 
-	return devm_spi_register_master(&pdev->dev, spi_master_get(master));
+	return devm_spi_register_master(&pdev->dev, master);
 }
 
 MODULE_ALIAS("platform:" DRIVER_NAME);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 649/717] spi: mxic: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (646 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 648/717] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 650/717] spi: npcm-fiu: Disable clock " Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mason Yang, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit cc53711b2191cf3b3210283ae89bf0abb98c70a3 upstream.

If the calls to devm_clk_get() or devm_ioremap_resource() fail on probe
of the Macronix SPI driver, the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: b942d80b0a39 ("spi: Add MXIC controller driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.0+
Cc: Mason Yang <masonccyang@mxic.com.tw>
Link: https://lore.kernel.org/r/4fa6857806e7e75741c05d057ac9df3564460114.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mxic.c |   10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

--- a/drivers/spi/spi-mxic.c
+++ b/drivers/spi/spi-mxic.c
@@ -529,7 +529,7 @@ static int mxic_spi_probe(struct platfor
 	struct mxic_spi *mxic;
 	int ret;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(struct mxic_spi));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(struct mxic_spi));
 	if (!master)
 		return -ENOMEM;
 
@@ -574,15 +574,9 @@ static int mxic_spi_probe(struct platfor
 	ret = spi_register_master(master);
 	if (ret) {
 		dev_err(&pdev->dev, "spi_register_master failed\n");
-		goto err_put_master;
+		pm_runtime_disable(&pdev->dev);
 	}
 
-	return 0;
-
-err_put_master:
-	spi_master_put(master);
-	pm_runtime_disable(&pdev->dev);
-
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 650/717] spi: npcm-fiu: Disable clock in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (647 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 649/717] spi: mxic: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 651/717] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tomer Maimon, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 234266a5168bbe8220d263e3aa7aa80cf921c483 upstream.

If the call to devm_spi_register_master() fails on probe of the NPCM FIU
SPI driver, the clock "fiu->clk" is erroneously not unprepared and
disabled.  Fix it.

Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.4+
Cc: Tomer Maimon <tmaimon77@gmail.com>
Link: https://lore.kernel.org/r/9ae62f4e1cfe542bec57ac2743e6fca9f9548f55.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-npcm-fiu.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -677,7 +677,7 @@ static int npcm_fiu_probe(struct platfor
 	struct npcm_fiu_spi *fiu;
 	void __iomem *regbase;
 	struct resource *res;
-	int id;
+	int id, ret;
 
 	ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
 	if (!ctrl)
@@ -735,7 +735,11 @@ static int npcm_fiu_probe(struct platfor
 	ctrl->num_chipselect = fiu->info->max_cs;
 	ctrl->dev.of_node = dev->of_node;
 
-	return devm_spi_register_master(dev, ctrl);
+	ret = devm_spi_register_master(dev, ctrl);
+	if (ret)
+		clk_disable_unprepare(fiu->clk);
+
+	return ret;
 }
 
 static int npcm_fiu_remove(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 651/717] spi: pic32: Dont leak DMA channels in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (648 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 650/717] spi: npcm-fiu: Disable clock " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 652/717] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Purna Chandra Mandal,
	Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit c575e9113bff5e024d75481613faed5ef9d465b2 upstream.

If the calls to devm_request_irq() or devm_spi_register_master() fail
on probe of the PIC32 SPI driver, the DMA channels requested by
pic32_spi_dma_prep() are erroneously not released.  Plug the leak.

Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.7+
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Link: https://lore.kernel.org/r/9624250e3a7aa61274b38219a62375bac1def637.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-pic32.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -839,6 +839,7 @@ static int pic32_spi_probe(struct platfo
 	return 0;
 
 err_bailout:
+	pic32_spi_dma_unprep(pic32s);
 	clk_disable_unprepare(pic32s->clk);
 err_master:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 652/717] spi: rb4xx: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (649 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 651/717] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 653/717] spi: rpc-if: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bert Vermeulen, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.

If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Bert Vermeulen <bert@biot.com>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-rb4xx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-rb4xx.c
+++ b/drivers/spi/spi-rb4xx.c
@@ -143,7 +143,7 @@ static int rb4xx_spi_probe(struct platfo
 	if (IS_ERR(spi_base))
 		return PTR_ERR(spi_base);
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
 	if (!master)
 		return -ENOMEM;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 653/717] spi: rpc-if: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (650 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 652/717] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 654/717] spi: sc18is602: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Sergei Shtylyov, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 393f981ca5f797b58b882d42b7621fb6e43c7f5b upstream.

rpcif_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.9+
Cc: Sergei Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/c5da472c28021da2f6517441685cef033d40b140.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-rpc-if.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

--- a/drivers/spi/spi-rpc-if.c
+++ b/drivers/spi/spi-rpc-if.c
@@ -134,7 +134,7 @@ static int rpcif_spi_probe(struct platfo
 	struct rpcif *rpc;
 	int error;
 
-	ctlr = spi_alloc_master(&pdev->dev, sizeof(*rpc));
+	ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*rpc));
 	if (!ctlr)
 		return -ENOMEM;
 
@@ -159,13 +159,8 @@ static int rpcif_spi_probe(struct platfo
 	error = spi_register_controller(ctlr);
 	if (error) {
 		dev_err(&pdev->dev, "spi_register_controller failed\n");
-		goto err_put_ctlr;
+		rpcif_disable_rpm(rpc);
 	}
-	return 0;
-
-err_put_ctlr:
-	rpcif_disable_rpm(rpc);
-	spi_controller_put(ctlr);
 
 	return error;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 654/717] spi: sc18is602: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (651 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 653/717] spi: rpc-if: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 655/717] spi: spi-geni-qcom: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Phil Reid, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5b8c88462d83331dacb48aeaec8388117fef82e0 upstream.

If the call to devm_gpiod_get_optional() fails on probe of the NXP
SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: f99008013e19 ("spi: sc18is602: Add reset control via gpio pin.")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.9+
Cc: Phil Reid <preid@electromag.com.au>
Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-sc18is602.c |   13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/spi/spi-sc18is602.c
+++ b/drivers/spi/spi-sc18is602.c
@@ -238,13 +238,12 @@ static int sc18is602_probe(struct i2c_cl
 	struct sc18is602_platform_data *pdata = dev_get_platdata(dev);
 	struct sc18is602 *hw;
 	struct spi_master *master;
-	int error;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C |
 				     I2C_FUNC_SMBUS_WRITE_BYTE_DATA))
 		return -EINVAL;
 
-	master = spi_alloc_master(dev, sizeof(struct sc18is602));
+	master = devm_spi_alloc_master(dev, sizeof(struct sc18is602));
 	if (!master)
 		return -ENOMEM;
 
@@ -298,15 +297,7 @@ static int sc18is602_probe(struct i2c_cl
 	master->min_speed_hz = hw->freq / 128;
 	master->max_speed_hz = hw->freq / 4;
 
-	error = devm_spi_register_master(dev, master);
-	if (error)
-		goto error_reg;
-
-	return 0;
-
-error_reg:
-	spi_master_put(master);
-	return error;
+	return devm_spi_register_master(dev, master);
 }
 
 static const struct i2c_device_id sc18is602_id[] = {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 655/717] spi: spi-geni-qcom: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (652 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 654/717] spi: sc18is602: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 656/717] spi: spi-qcom-qspi: " Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Rajendra Nayak,
	Girish Mahadevan, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 8f96c434dfbc85ffa755d6634c8c1cb2233fcf24 upstream.

spi_geni_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Moreover, since commit 1a9e489e6128 ("spi: spi-geni-qcom: Use OPP API to
set clk/perf state"), spi_geni_probe() leaks the spi_master allocation
if the calls to dev_pm_opp_set_clkname() or dev_pm_opp_of_add_table()
fail.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound and also
avoids the spi_master leak on probe.

Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.20+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.20+
Cc: Rajendra Nayak <rnayak@codeaurora.org>
Cc: Girish Mahadevan <girishm@codeaurora.org>
Link: https://lore.kernel.org/r/dfa1d8c41b8acdfad87ec8654cd124e6e3cb3f31.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-geni-qcom.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -603,7 +603,7 @@ static int spi_geni_probe(struct platfor
 	if (IS_ERR(clk))
 		return PTR_ERR(clk);
 
-	spi = spi_alloc_master(dev, sizeof(*mas));
+	spi = devm_spi_alloc_master(dev, sizeof(*mas));
 	if (!spi)
 		return -ENOMEM;
 
@@ -673,7 +673,6 @@ spi_geni_probe_free_irq:
 	free_irq(mas->irq, spi);
 spi_geni_probe_runtime_disable:
 	pm_runtime_disable(dev);
-	spi_master_put(spi);
 	dev_pm_opp_of_remove_table(&pdev->dev);
 put_clkname:
 	dev_pm_opp_put_clkname(mas->se.opp_table);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 656/717] spi: spi-qcom-qspi: Fix use-after-free on unbind
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (653 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 655/717] spi: spi-geni-qcom: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 657/717] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Rajendra Nayak, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 6cfd39e212dee2e77a0227ce4e0f55fa06d79f46 upstream.

qcom_qspi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: f79a158d37c2 ("spi: spi-qcom-qspi: Use OPP API to set clk/perf state")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.9+
Cc: Rajendra Nayak <rnayak@codeaurora.org>
Link: https://lore.kernel.org/r/b6d3c4dce571d78a532fd74f27def0d5dc8d8a24.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-qcom-qspi.c |   42 ++++++++++++++++--------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

--- a/drivers/spi/spi-qcom-qspi.c
+++ b/drivers/spi/spi-qcom-qspi.c
@@ -462,7 +462,7 @@ static int qcom_qspi_probe(struct platfo
 
 	dev = &pdev->dev;
 
-	master = spi_alloc_master(dev, sizeof(*ctrl));
+	master = devm_spi_alloc_master(dev, sizeof(*ctrl));
 	if (!master)
 		return -ENOMEM;
 
@@ -473,54 +473,49 @@ static int qcom_qspi_probe(struct platfo
 	spin_lock_init(&ctrl->lock);
 	ctrl->dev = dev;
 	ctrl->base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(ctrl->base)) {
-		ret = PTR_ERR(ctrl->base);
-		goto exit_probe_master_put;
-	}
+	if (IS_ERR(ctrl->base))
+		return PTR_ERR(ctrl->base);
 
 	ctrl->clks = devm_kcalloc(dev, QSPI_NUM_CLKS,
 				  sizeof(*ctrl->clks), GFP_KERNEL);
-	if (!ctrl->clks) {
-		ret = -ENOMEM;
-		goto exit_probe_master_put;
-	}
+	if (!ctrl->clks)
+		return -ENOMEM;
 
 	ctrl->clks[QSPI_CLK_CORE].id = "core";
 	ctrl->clks[QSPI_CLK_IFACE].id = "iface";
 	ret = devm_clk_bulk_get(dev, QSPI_NUM_CLKS, ctrl->clks);
 	if (ret)
-		goto exit_probe_master_put;
+		return ret;
 
 	ctrl->icc_path_cpu_to_qspi = devm_of_icc_get(dev, "qspi-config");
-	if (IS_ERR(ctrl->icc_path_cpu_to_qspi)) {
-		ret = dev_err_probe(dev, PTR_ERR(ctrl->icc_path_cpu_to_qspi),
-				    "Failed to get cpu path\n");
-		goto exit_probe_master_put;
-	}
+	if (IS_ERR(ctrl->icc_path_cpu_to_qspi))
+		return dev_err_probe(dev, PTR_ERR(ctrl->icc_path_cpu_to_qspi),
+				     "Failed to get cpu path\n");
+
 	/* Set BW vote for register access */
 	ret = icc_set_bw(ctrl->icc_path_cpu_to_qspi, Bps_to_icc(1000),
 				Bps_to_icc(1000));
 	if (ret) {
 		dev_err(ctrl->dev, "%s: ICC BW voting failed for cpu: %d\n",
 				__func__, ret);
-		goto exit_probe_master_put;
+		return ret;
 	}
 
 	ret = icc_disable(ctrl->icc_path_cpu_to_qspi);
 	if (ret) {
 		dev_err(ctrl->dev, "%s: ICC disable failed for cpu: %d\n",
 				__func__, ret);
-		goto exit_probe_master_put;
+		return ret;
 	}
 
 	ret = platform_get_irq(pdev, 0);
 	if (ret < 0)
-		goto exit_probe_master_put;
+		return ret;
 	ret = devm_request_irq(dev, ret, qcom_qspi_irq,
 			IRQF_TRIGGER_HIGH, dev_name(dev), ctrl);
 	if (ret) {
 		dev_err(dev, "Failed to request irq %d\n", ret);
-		goto exit_probe_master_put;
+		return ret;
 	}
 
 	master->max_speed_hz = 300000000;
@@ -537,10 +532,8 @@ static int qcom_qspi_probe(struct platfo
 	master->auto_runtime_pm = true;
 
 	ctrl->opp_table = dev_pm_opp_set_clkname(&pdev->dev, "core");
-	if (IS_ERR(ctrl->opp_table)) {
-		ret = PTR_ERR(ctrl->opp_table);
-		goto exit_probe_master_put;
-	}
+	if (IS_ERR(ctrl->opp_table))
+		return PTR_ERR(ctrl->opp_table);
 	/* OPP table is optional */
 	ret = dev_pm_opp_of_add_table(&pdev->dev);
 	if (ret && ret != -ENODEV) {
@@ -562,9 +555,6 @@ static int qcom_qspi_probe(struct platfo
 exit_probe_put_clkname:
 	dev_pm_opp_put_clkname(ctrl->opp_table);
 
-exit_probe_master_put:
-	spi_master_put(master);
-
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 657/717] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (654 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 656/717] spi: spi-qcom-qspi: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 658/717] spi: synquacer: Disable clock " Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Chuhong Yuan, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5ef76dac0f2c26aeae4ee79eb830280f16d5aceb upstream.

If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map()
or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the
runtime PM disable depth is incremented even though it was not
decremented before.  Fix it.

Fixes: cd050abeba2a ("spi: st-ssc4: add missed pm_runtime_disable")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.5+
Cc: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/fbe8768c30dc829e2d77eabe7be062ca22f84024.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-st-ssc4.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-st-ssc4.c
+++ b/drivers/spi/spi-st-ssc4.c
@@ -375,13 +375,14 @@ static int spi_st_probe(struct platform_
 	ret = devm_spi_register_master(&pdev->dev, master);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register master\n");
-		goto clk_disable;
+		goto rpm_disable;
 	}
 
 	return 0;
 
-clk_disable:
+rpm_disable:
 	pm_runtime_disable(&pdev->dev);
+clk_disable:
 	clk_disable_unprepare(spi_st->clk);
 put_master:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 658/717] spi: synquacer: Disable clock in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (655 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 657/717] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 659/717] spi: mt7621: " Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Masahisa Kojima, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 8853b2503014aca5c793d2c7f0aabc990b32bdad upstream.

If the calls to platform_get_irq() or devm_request_irq() fail on probe
of the SynQuacer SPI driver, the clock "sspi->clk" is erroneously not
unprepared and disabled.

If the clock rate "master->max_speed_hz" cannot be determined, the same
happens and in addition the spi_master struct is not freed.

Fix it.

Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.3+
Cc: Masahisa Kojima <masahisa.kojima@linaro.org>
Link: https://lore.kernel.org/r/232281df1ab91d8f0f553a62d5f97fc264ace4da.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-synquacer.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/spi/spi-synquacer.c
+++ b/drivers/spi/spi-synquacer.c
@@ -657,7 +657,8 @@ static int synquacer_spi_probe(struct pl
 
 	if (!master->max_speed_hz) {
 		dev_err(&pdev->dev, "missing clock source\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto disable_clk;
 	}
 	master->min_speed_hz = master->max_speed_hz / 254;
 
@@ -670,7 +671,7 @@ static int synquacer_spi_probe(struct pl
 	rx_irq = platform_get_irq(pdev, 0);
 	if (rx_irq <= 0) {
 		ret = rx_irq;
-		goto put_spi;
+		goto disable_clk;
 	}
 	snprintf(sspi->rx_irq_name, SYNQUACER_HSSPI_IRQ_NAME_MAX, "%s-rx",
 		 dev_name(&pdev->dev));
@@ -678,13 +679,13 @@ static int synquacer_spi_probe(struct pl
 				0, sspi->rx_irq_name, sspi);
 	if (ret) {
 		dev_err(&pdev->dev, "request rx_irq failed (%d)\n", ret);
-		goto put_spi;
+		goto disable_clk;
 	}
 
 	tx_irq = platform_get_irq(pdev, 1);
 	if (tx_irq <= 0) {
 		ret = tx_irq;
-		goto put_spi;
+		goto disable_clk;
 	}
 	snprintf(sspi->tx_irq_name, SYNQUACER_HSSPI_IRQ_NAME_MAX, "%s-tx",
 		 dev_name(&pdev->dev));
@@ -692,7 +693,7 @@ static int synquacer_spi_probe(struct pl
 				0, sspi->tx_irq_name, sspi);
 	if (ret) {
 		dev_err(&pdev->dev, "request tx_irq failed (%d)\n", ret);
-		goto put_spi;
+		goto disable_clk;
 	}
 
 	master->dev.of_node = np;
@@ -710,7 +711,7 @@ static int synquacer_spi_probe(struct pl
 
 	ret = synquacer_spi_enable(master);
 	if (ret)
-		goto fail_enable;
+		goto disable_clk;
 
 	pm_runtime_set_active(sspi->dev);
 	pm_runtime_enable(sspi->dev);
@@ -723,7 +724,7 @@ static int synquacer_spi_probe(struct pl
 
 disable_pm:
 	pm_runtime_disable(sspi->dev);
-fail_enable:
+disable_clk:
 	clk_disable_unprepare(sspi->clk);
 put_spi:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 659/717] spi: mt7621: Disable clock in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (656 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 658/717] spi: synquacer: Disable clock " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 660/717] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Qinglang Miao, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 24f7033405abe195224ec793dbc3d7a27dec0b98 upstream.

Commit 702b15cb9712 ("spi: mt7621: fix missing clk_disable_unprepare()
on error in mt7621_spi_probe") sought to disable the SYS clock on probe
errors, but only did so for 2 of 3 potentially failing calls:  The clock
needs to be disabled on failure of devm_spi_register_controller() as
well.

Moreover, the commit purports to fix a bug in commit cbd66c626e16 ("spi:
mt7621: Move SPI driver out of staging") but in reality the bug has
existed since the driver was first introduced.

Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.17+: 702b15cb9712: spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
Cc: <stable@vger.kernel.org> # v4.17+
Cc: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/36ad42760087952fb7c10aae7d2628547c26a7ec.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mt7621.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -382,7 +382,11 @@ static int mt7621_spi_probe(struct platf
 		return ret;
 	}
 
-	return devm_spi_register_controller(&pdev->dev, master);
+	ret = devm_spi_register_controller(&pdev->dev, master);
+	if (ret)
+		clk_disable_unprepare(clk);
+
+	return ret;
 }
 
 static int mt7621_spi_remove(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 660/717] spi: mt7621: Dont leak SPI master in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (657 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 659/717] spi: mt7621: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.10 661/717] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Stefan Roese, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 46b5c4fb87ce8211e0f9b0383dbde72c3652d2ba upstream.

If the calls to device_reset() or devm_spi_register_controller() fail on
probe of the MediaTek MT7621 SPI driver, the spi_controller struct is
erroneously not freed.  Fix by switching over to the new
devm_spi_alloc_master() helper.

Additionally, there's an ordering issue in mt7621_spi_remove() wherein
the spi_controller is unregistered after disabling the SYS clock.
The correct order is to call spi_unregister_controller() *before* this
teardown step because bus accesses may still be ongoing until that
function returns.

All of these bugs have existed since the driver was first introduced,
so it seems fair to fix them together in a single commit.

Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Stefan Roese <sr@denx.de>
Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.17+
Link: https://lore.kernel.org/r/72b680796149f5fcda0b3f530ffb7ee73b04f224.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mt7621.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -350,7 +350,7 @@ static int mt7621_spi_probe(struct platf
 	if (status)
 		return status;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rs));
 	if (!master) {
 		dev_info(&pdev->dev, "master allocation failed\n");
 		clk_disable_unprepare(clk);
@@ -382,7 +382,7 @@ static int mt7621_spi_probe(struct platf
 		return ret;
 	}
 
-	ret = devm_spi_register_controller(&pdev->dev, master);
+	ret = spi_register_controller(master);
 	if (ret)
 		clk_disable_unprepare(clk);
 
@@ -397,6 +397,7 @@ static int mt7621_spi_remove(struct plat
 	master = dev_get_drvdata(&pdev->dev);
 	rs = spi_controller_get_devdata(master);
 
+	spi_unregister_controller(master);
 	clk_disable_unprepare(rs->clk);
 
 	return 0;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 661/717] spi: atmel-quadspi: Disable clock in probe error path
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (658 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 660/717] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 662/717] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tudor Ambarus,
	Boris Brezillon, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 0e685017c7ba1a2fe9f6f1e7a9302890747d934c upstream.

If the call to of_device_get_match_data() fails on probe of the Atmel
QuadSPI driver, the clock "aq->pclk" is erroneously not unprepared and
disabled.  Fix it.

Fixes: 2e5c88887358 ("spi: atmel-quadspi: add support for sam9x60 qspi controller")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.1+
Cc: Tudor Ambarus <tudor.ambarus@microchip.com>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/8f8dc2815aa97b2378528f08f923bf81e19611f0.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -591,7 +591,7 @@ static int atmel_qspi_probe(struct platf
 	if (!aq->caps) {
 		dev_err(&pdev->dev, "Could not retrieve QSPI caps\n");
 		err = -EINVAL;
-		goto exit;
+		goto disable_pclk;
 	}
 
 	if (aq->caps->has_qspick) {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 662/717] spi: atmel-quadspi: Fix AHB memory accesses
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (659 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.10 661/717] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 663/717] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Burkart, Tudor Ambarus, Mark Brown

From: Tudor Ambarus <tudor.ambarus@microchip.com>

commit cac8c821059639b015586abf61623c62cc549a13 upstream.

Following error was seen when mounting a 16MByte ubifs:
UBIFS error (ubi0:0 pid 1893): check_lpt_type.constprop.6: invalid type (15) in LPT node type

QSPI_IFR.TFRTYP was not set correctly. When data transfer is enabled
and one wants to access the serial memory through AHB in order to:
 - read in the serial memory, but not a memory data, for example
   a JEDEC-ID, QSPI_IFR.TFRTYP must be written to '0' (both sama5d2
   and sam9x60).
 - read in the serial memory, and particularly a memory data,
   TFRTYP must be written to '1' (both sama5d2 and sam9x60).
 - write in the serial memory, but not a memory data, for example
   writing the configuration or the QSPI_SR, TFRTYP must be written
   to '2' for sama5d2 and to '0' for sam9x60.
 - write in the serial memory in particular to program a memory data,
   TFRTYP must be written to '3' for sama5d2 and to '1' for sam9x60.

Fix the setting of the QSPI_IFR.TFRTYP field.

Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
Cc: <stable@vger.kernel.org> # v5.0+
Reported-by: Tom Burkart <tom@aussec.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201207135959.154124-2-tudor.ambarus@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -365,10 +365,14 @@ static int atmel_qspi_set_cfg(struct atm
 	if (dummy_cycles)
 		ifr |= QSPI_IFR_NBDUM(dummy_cycles);
 
-	/* Set data enable */
-	if (op->data.nbytes)
+	/* Set data enable and data transfer type. */
+	if (op->data.nbytes) {
 		ifr |= QSPI_IFR_DATAEN;
 
+		if (op->addr.nbytes)
+			ifr |= QSPI_IFR_TFRTYP_MEM;
+	}
+
 	/*
 	 * If the QSPI controller is set in regular SPI mode, set it in
 	 * Serial Memory Mode (SMM).
@@ -393,7 +397,7 @@ static int atmel_qspi_set_cfg(struct atm
 			atmel_qspi_write(icr, aq, QSPI_WICR);
 		atmel_qspi_write(ifr, aq, QSPI_IFR);
 	} else {
-		if (op->data.dir == SPI_MEM_DATA_OUT)
+		if (op->data.nbytes && op->data.dir == SPI_MEM_DATA_OUT)
 			ifr |= QSPI_IFR_SAMA5D2_WRITE_TRSFR;
 
 		/* Set QSPI Instruction Frame registers */



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 663/717] soc: qcom: smp2p: Safely acquire spinlock without IRQs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (660 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 662/717] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 664/717] mtd: spinand: Fix OOB read Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Stephen Boyd, Evan Green

From: Evan Green <evgreen@chromium.org>

commit fc3e62e25c3896855b7c3d72df19ca6be3459c9f upstream.

smp2p_update_bits() should disable interrupts when it acquires its
spinlock. This is important because without the _irqsave, a priority
inversion can occur.

This function is called both with interrupts enabled in
qcom_q6v5_request_stop(), and with interrupts disabled in
ipa_smp2p_panic_notifier(). IRQ handling of spinlocks should be
consistent to avoid the panic notifier deadlocking because it's
sitting on the thread that's already got the lock via _request_stop().

Found via lockdep.

Cc: stable@vger.kernel.org
Fixes: 50e99641413e7 ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point")
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Evan Green <evgreen@chromium.org>
Link: https://lore.kernel.org/r/20200929133040.RESEND.1.Ideabf6dcdfc577cf39ce3d95b0e4aa1ac8b38f0c@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/soc/qcom/smp2p.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/soc/qcom/smp2p.c
+++ b/drivers/soc/qcom/smp2p.c
@@ -318,15 +318,16 @@ static int qcom_smp2p_inbound_entry(stru
 static int smp2p_update_bits(void *data, u32 mask, u32 value)
 {
 	struct smp2p_entry *entry = data;
+	unsigned long flags;
 	u32 orig;
 	u32 val;
 
-	spin_lock(&entry->lock);
+	spin_lock_irqsave(&entry->lock, flags);
 	val = orig = readl(entry->value);
 	val &= ~mask;
 	val |= value;
 	writel(val, entry->value);
-	spin_unlock(&entry->lock);
+	spin_unlock_irqrestore(&entry->lock, flags);
 
 	if (val != orig)
 		qcom_smp2p_kick(entry->smp2p);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 664/717] mtd: spinand: Fix OOB read
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (661 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 663/717] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 665/717] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal

From: Miquel Raynal <miquel.raynal@bootlin.com>

commit 868cbe2a6dcee451bd8f87cbbb2a73cf463b57e5 upstream.

So far OOB have never been used in SPI-NAND, add the missing memcpy to
make it work properly.

Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201001102014.20100-6-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/spi/core.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -318,6 +318,10 @@ static int spinand_write_to_cache_op(str
 		buf += ret;
 	}
 
+	if (req->ooblen)
+		memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,
+		       req->ooblen);
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 665/717] mtd: parser: cmdline: Fix parsing of part-names with colons
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (662 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 664/717] mtd: spinand: Fix OOB read Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 666/717] mtd: core: Fix refcounting for unpartitioned MTDs Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ron Minnich, Sven Eckelmann, Miquel Raynal

From: Sven Eckelmann <sven@narfation.org>

commit 639a82434f16a6df0ce0e7c8595976f1293940fd upstream.

Some devices (especially QCA ones) are already using hardcoded partition
names with colons in it. The OpenMesh A62 for example provides following
mtd relevant information via cmdline:

  root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait

The change to split only on the last colon between mtd-id and partitions
will cause newpart to see following string for the first partition:

  KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)

Such a partition list cannot be parsed and thus the device fails to boot.

Avoid this behavior by making sure that the start of the first part-name
("(") will also be the last byte the mtd-id split algorithm is using for
its colon search.

Fixes: eb13fa022741 ("mtd: parser: cmdline: Support MTD names containing one or more colons")
Cc: stable@vger.kernel.org
Cc: Ron Minnich <rminnich@google.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201124062506.185392-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/parsers/cmdlinepart.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/drivers/mtd/parsers/cmdlinepart.c
+++ b/drivers/mtd/parsers/cmdlinepart.c
@@ -226,7 +226,7 @@ static int mtdpart_setup_real(char *s)
 		struct cmdline_mtd_partition *this_mtd;
 		struct mtd_partition *parts;
 		int mtd_id_len, num_parts;
-		char *p, *mtd_id, *semicol;
+		char *p, *mtd_id, *semicol, *open_parenth;
 
 		/*
 		 * Replace the first ';' by a NULL char so strrchr can work
@@ -236,6 +236,14 @@ static int mtdpart_setup_real(char *s)
 		if (semicol)
 			*semicol = '\0';
 
+		/*
+		 * make sure that part-names with ":" will not be handled as
+		 * part of the mtd-id with an ":"
+		 */
+		open_parenth = strchr(s, '(');
+		if (open_parenth)
+			*open_parenth = '\0';
+
 		mtd_id = s;
 
 		/*
@@ -245,6 +253,10 @@ static int mtdpart_setup_real(char *s)
 		 */
 		p = strrchr(s, ':');
 
+		/* Restore the '(' now. */
+		if (open_parenth)
+			*open_parenth = '(';
+
 		/* Restore the ';' now. */
 		if (semicol)
 			*semicol = ';';



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 666/717] mtd: core: Fix refcounting for unpartitioned MTDs
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (663 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 665/717] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 667/717] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Miquel Raynal

From: Richard Weinberger <richard@nod.at>

commit 1ca71415f075353974524e96ed175306d8a937a8 upstream.

Apply changes to usecount also to the master partition.
Otherwise we have no refcounting at all if an MTD has no partitions.

Cc: stable@vger.kernel.org
Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201206202220.27290-1-richard@nod.at
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/mtdcore.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -993,6 +993,8 @@ int __get_mtd_device(struct mtd_info *mt
 		}
 	}
 
+	master->usecount++;
+
 	while (mtd->parent) {
 		mtd->usecount++;
 		mtd = mtd->parent;
@@ -1059,6 +1061,8 @@ void __put_mtd_device(struct mtd_info *m
 		mtd = mtd->parent;
 	}
 
+	master->usecount--;
+
 	if (master->_put_device)
 		master->_put_device(master);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 667/717] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (664 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 666/717] mtd: core: Fix refcounting for unpartitioned MTDs Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 668/717] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Praveenkumar I, Miquel Raynal

From: Praveenkumar I <ipkumar@codeaurora.org>

commit bc3686021122de953858a5be4cbf6e3f1d821e79 upstream.

After each codeword NAND_FLASH_STATUS is read for possible operational
failures. But there is no DMA sync for CPU operation before reading it
and this leads to incorrect or older copy of DMA buffer in reg_read_buf.

This patch adds the DMA sync on reg_read_buf for CPU before reading it.

Fixes: 5bc36b2bf6e2 ("mtd: rawnand: qcom: check for operation errors in case of raw read")
Cc: stable@vger.kernel.org
Signed-off-by: Praveenkumar I <ipkumar@codeaurora.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/1602230872-25616-1-git-send-email-ipkumar@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/raw/qcom_nandc.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -1570,6 +1570,8 @@ static int check_flash_errors(struct qco
 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 	int i;
 
+	nandc_read_buffer_sync(nandc, true);
+
 	for (i = 0; i < cw_cnt; i++) {
 		u32 flash = le32_to_cpu(nandc->reg_read_buf[i]);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 668/717] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (665 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 667/717] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 669/717] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergei Antonov, Liang Yang, Miquel Raynal

From: Sergei Antonov <saproj@gmail.com>

commit c13d845e9a69580424d40b7b101c37d4f71bcd63 upstream.

Arguments 'infolen' and 'datalen' to meson_nfc_dma_buffer_release() were mixed up.

Fixes: 8fae856c53500 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
Cc: stable@vger.kernel.org
Signed-off-by: Sergei Antonov <saproj@gmail.com>
Acked-by: Liang Yang <liang.yang@amlogic.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201028094940.11765-1-saproj@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/raw/meson_nand.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mtd/nand/raw/meson_nand.c
+++ b/drivers/mtd/nand/raw/meson_nand.c
@@ -510,7 +510,7 @@ static int meson_nfc_dma_buffer_setup(st
 }
 
 static void meson_nfc_dma_buffer_release(struct nand_chip *nand,
-					 int infolen, int datalen,
+					 int datalen, int infolen,
 					 enum dma_data_direction dir)
 {
 	struct meson_nfc *nfc = nand_get_controller_data(nand);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 669/717] scsi: qla2xxx: Fix crash during driver load on big endian machines
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (666 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 668/717] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 670/717] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Arun Easi,
	Nilesh Javali, Martin K. Petersen

From: Arun Easi <aeasi@marvell.com>

commit 8de309e7299a00b3045fb274f82b326f356404f0 upstream.

Crash stack:
	[576544.715489] Unable to handle kernel paging request for data at address 0xd00000000f970000
	[576544.715497] Faulting instruction address: 0xd00000000f880f64
	[576544.715503] Oops: Kernel access of bad area, sig: 11 [#1]
	[576544.715506] SMP NR_CPUS=2048 NUMA pSeries
	:
	[576544.715703] NIP [d00000000f880f64] .qla27xx_fwdt_template_valid+0x94/0x100 [qla2xxx]
	[576544.715722] LR [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715726] Call Trace:
	[576544.715731] [c0000004d0ffb000] [c0000006fe02c350] 0xc0000006fe02c350 (unreliable)
	[576544.715750] [c0000004d0ffb080] [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715770] [c0000004d0ffb170] [d00000000f7aa034] .qla81xx_load_risc+0x84/0x1a0 [qla2xxx]
	[576544.715789] [c0000004d0ffb210] [d00000000f79f7c8] .qla2x00_setup_chip+0xc8/0x910 [qla2xxx]
	[576544.715808] [c0000004d0ffb300] [d00000000f7a631c] .qla2x00_initialize_adapter+0x4dc/0xb00 [qla2xxx]
	[576544.715826] [c0000004d0ffb3e0] [d00000000f78ce28] .qla2x00_probe_one+0xf08/0x2200 [qla2xxx]

Link: https://lore.kernel.org/r/20201202132312.19966-8-njavali@marvell.com
Fixes: f73cb695d3ec ("[SCSI] qla2xxx: Add support for ISP2071.")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/qla2xxx/qla_tmpl.c |    9 +++++----
 drivers/scsi/qla2xxx/qla_tmpl.h |    2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -928,7 +928,8 @@ qla27xx_template_checksum(void *p, ulong
 static inline int
 qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)
 {
-	return qla27xx_template_checksum(tmp, tmp->template_size) == 0;
+	return qla27xx_template_checksum(tmp,
+		le32_to_cpu(tmp->template_size)) == 0;
 }
 
 static inline int
@@ -944,7 +945,7 @@ qla27xx_execute_fwdt_template(struct scs
 	ulong len = 0;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		tmp = memcpy(buf, tmp, len);
 		ql27xx_edit_template(vha, tmp);
 		qla27xx_walk_template(vha, tmp, buf, &len);
@@ -960,7 +961,7 @@ qla27xx_fwdt_calculate_dump_size(struct
 	ulong len = 0;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		qla27xx_walk_template(vha, tmp, NULL, &len);
 	}
 
@@ -972,7 +973,7 @@ qla27xx_fwdt_template_size(void *p)
 {
 	struct qla27xx_fwdt_template *tmp = p;
 
-	return tmp->template_size;
+	return le32_to_cpu(tmp->template_size);
 }
 
 int
--- a/drivers/scsi/qla2xxx/qla_tmpl.h
+++ b/drivers/scsi/qla2xxx/qla_tmpl.h
@@ -12,7 +12,7 @@
 struct __packed qla27xx_fwdt_template {
 	__le32 template_type;
 	__le32 entry_offset;
-	uint32_t template_size;
+	__le32 template_size;
 	uint32_t count;		/* borrow field for running/residual count */
 
 	__le32 entry_count;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 670/717] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (667 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 669/717] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 671/717] scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
	Martin K. Petersen

From: James Smart <james.smart@broadcom.com>

commit 62e3a931db60daf94fdb3159d685a5bc6ad4d0cf upstream.

The following calltrace was seen:

BUG: sleeping function called from invalid context at mm/slab.h:494
...
Call Trace:
 dump_stack+0x9a/0xf0
 ___might_sleep.cold.63+0x13d/0x178
 slab_pre_alloc_hook+0x6a/0x90
 kmem_cache_alloc_trace+0x3a/0x2d0
 lpfc_sli4_nvmet_alloc+0x4c/0x280 [lpfc]
 lpfc_post_rq_buffer+0x2e7/0xa60 [lpfc]
 lpfc_sli4_hba_setup+0x6b4c/0xa4b0 [lpfc]
 lpfc_pci_probe_one_s4.isra.15+0x14f8/0x2280 [lpfc]
 lpfc_pci_probe_one+0x260/0x2880 [lpfc]
 local_pci_probe+0xd4/0x180
 work_for_cpu_fn+0x51/0xa0
 process_one_work+0x8f0/0x17b0
 worker_thread+0x536/0xb50
 kthread+0x30c/0x3d0
 ret_from_fork+0x3a/0x50

A prior patch introduced a spin_lock_irqsave(hbalock) in the
lpfc_post_rq_buffer() routine. Call trace is seen as the hbalock is held
with interrupts disabled during a GFP_KERNEL allocation in
lpfc_sli4_nvmet_alloc().

Fix by reordering locking so that hbalock not held when calling
sli4_nvmet_alloc() (aka rqb_buf_list()).

Link: https://lore.kernel.org/r/20201020202719.54726-2-james.smart@broadcom.com
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/lpfc/lpfc_mem.c |    4 +---
 drivers/scsi/lpfc/lpfc_sli.c |   10 ++++++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -588,8 +588,6 @@ lpfc_sli4_rb_free(struct lpfc_hba *phba,
  * Description: Allocates a DMA-mapped receive buffer from the lpfc_hrb_pool PCI
  * pool along a non-DMA-mapped container for it.
  *
- * Notes: Not interrupt-safe.  Must be called with no locks held.
- *
  * Returns:
  *   pointer to HBQ on success
  *   NULL on failure
@@ -599,7 +597,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *p
 {
 	struct rqb_dmabuf *dma_buf;
 
-	dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
+	dma_buf = kzalloc(sizeof(*dma_buf), GFP_KERNEL);
 	if (!dma_buf)
 		return NULL;
 
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -7248,12 +7248,16 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
 	struct rqb_dmabuf *rqb_buffer;
 	LIST_HEAD(rqb_buf_list);
 
-	spin_lock_irqsave(&phba->hbalock, flags);
 	rqbp = hrq->rqbp;
 	for (i = 0; i < count; i++) {
+		spin_lock_irqsave(&phba->hbalock, flags);
 		/* IF RQ is already full, don't bother */
-		if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+		if (rqbp->buffer_count + i >= rqbp->entry_count - 1) {
+			spin_unlock_irqrestore(&phba->hbalock, flags);
 			break;
+		}
+		spin_unlock_irqrestore(&phba->hbalock, flags);
+
 		rqb_buffer = rqbp->rqb_alloc_buffer(phba);
 		if (!rqb_buffer)
 			break;
@@ -7262,6 +7266,8 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
 		rqb_buffer->idx = idx;
 		list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
 	}
+
+	spin_lock_irqsave(&phba->hbalock, flags);
 	while (!list_empty(&rqb_buf_list)) {
 		list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
 				 hbuf.list);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 671/717] scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (668 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 670/717] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 672/717] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
	Martin K. Petersen

From: James Smart <james.smart@broadcom.com>

commit e7dab164a9aa457f89d4528452bdfc3e15ac98b6 upstream.

The following call trace was seen during HBA reset testing:

BUG: scheduling while atomic: swapper/2/0/0x10000100
...
Call Trace:
dump_stack+0x19/0x1b
__schedule_bug+0x64/0x72
__schedule+0x782/0x840
__cond_resched+0x26/0x30
_cond_resched+0x3a/0x50
mempool_alloc+0xa0/0x170
lpfc_unreg_rpi+0x151/0x630 [lpfc]
lpfc_sli_abts_recover_port+0x171/0x190 [lpfc]
lpfc_sli4_abts_err_handler+0xb2/0x1f0 [lpfc]
lpfc_sli4_io_xri_aborted+0x256/0x300 [lpfc]
lpfc_sli4_sp_handle_abort_xri_wcqe.isra.51+0xa3/0x190 [lpfc]
lpfc_sli4_fp_handle_cqe+0x89/0x4d0 [lpfc]
__lpfc_sli4_process_cq+0xdb/0x2e0 [lpfc]
__lpfc_sli4_hba_process_cq+0x41/0x100 [lpfc]
lpfc_cq_poll_hdler+0x1a/0x30 [lpfc]
irq_poll_softirq+0xc7/0x100
__do_softirq+0xf5/0x280
call_softirq+0x1c/0x30
do_softirq+0x65/0xa0
irq_exit+0x105/0x110
do_IRQ+0x56/0xf0
common_interrupt+0x16a/0x16a

With the conversion to blk_io_poll for better interrupt latency in normal
cases, it introduced this code path, executed when I/O aborts or logouts
are seen, which attempts to allocate memory for a mailbox command to be
issued.  The allocation is GFP_KERNEL, thus it could attempt to sleep.

Fix by creating a work element that performs the event handling for the
remote port. This will have the mailbox commands and other items performed
in the work element, not the irq. A much better method as the "irq" routine
does not stall while performing all this deep handling code.

Ensure that allocation failures are handled and send LOGO on failure.

Additionally, enlarge the mailbox memory pool to reduce the possibility of
additional allocation in this path.

Link: https://lore.kernel.org/r/20201020202719.54726-3-james.smart@broadcom.com
Fixes: 317aeb83c92b ("scsi: lpfc: Add blk_io_poll support for latency improvment")
Cc: <stable@vger.kernel.org> # v5.9+
Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/lpfc/lpfc.h         |    2 -
 drivers/scsi/lpfc/lpfc_disc.h    |    2 +
 drivers/scsi/lpfc/lpfc_hbadisc.c |   35 +++++++++++++++++++++
 drivers/scsi/lpfc/lpfc_init.c    |   46 ++++++++++++++++------------
 drivers/scsi/lpfc/lpfc_mem.c     |    5 +--
 drivers/scsi/lpfc/lpfc_nvme.c    |   18 +++++++---
 drivers/scsi/lpfc/lpfc_sli.c     |   64 +++++++++++++++++++++++++++++++--------
 drivers/scsi/lpfc/lpfc_sli4.h    |    6 +--
 8 files changed, 136 insertions(+), 42 deletions(-)

--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -753,7 +753,7 @@ struct lpfc_hba {
 #define HBA_SP_QUEUE_EVT	0x8 /* Slow-path qevt posted to worker thread*/
 #define HBA_POST_RECEIVE_BUFFER 0x10 /* Rcv buffers need to be posted */
 #define HBA_PERSISTENT_TOPO	0x20 /* Persistent topology support in hba */
-#define ELS_XRI_ABORT_EVENT	0x40
+#define ELS_XRI_ABORT_EVENT	0x40 /* ELS_XRI abort event was queued */
 #define ASYNC_EVENT		0x80
 #define LINK_DISABLED		0x100 /* Link disabled by user */
 #define FCF_TS_INPROG           0x200 /* FCF table scan in progress */
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -41,6 +41,7 @@ enum lpfc_work_type {
 	LPFC_EVT_DEV_LOSS,
 	LPFC_EVT_FASTPATH_MGMT_EVT,
 	LPFC_EVT_RESET_HBA,
+	LPFC_EVT_RECOVER_PORT
 };
 
 /* structure used to queue event to the discovery tasklet */
@@ -128,6 +129,7 @@ struct lpfc_nodelist {
 	struct lpfc_vport *vport;
 	struct lpfc_work_evt els_retry_evt;
 	struct lpfc_work_evt dev_loss_evt;
+	struct lpfc_work_evt recovery_evt;
 	struct kref     kref;
 	atomic_t cmd_pending;
 	uint32_t cmd_qdepth;
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -552,6 +552,15 @@ lpfc_work_list_done(struct lpfc_hba *phb
 								    fcf_inuse,
 								    nlp_did);
 			break;
+		case LPFC_EVT_RECOVER_PORT:
+			ndlp = (struct lpfc_nodelist *)(evtp->evt_arg1);
+			lpfc_sli_abts_recover_port(ndlp->vport, ndlp);
+			free_evt = 0;
+			/* decrement the node reference count held for
+			 * this queued work
+			 */
+			lpfc_nlp_put(ndlp);
+			break;
 		case LPFC_EVT_ONLINE:
 			if (phba->link_state < LPFC_LINK_DOWN)
 				*(int *) (evtp->evt_arg1) = lpfc_online(phba);
@@ -4515,6 +4524,8 @@ lpfc_initialize_node(struct lpfc_vport *
 	INIT_LIST_HEAD(&ndlp->els_retry_evt.evt_listp);
 	INIT_LIST_HEAD(&ndlp->dev_loss_evt.evt_listp);
 	timer_setup(&ndlp->nlp_delayfunc, lpfc_els_retry_delay, 0);
+	INIT_LIST_HEAD(&ndlp->recovery_evt.evt_listp);
+
 	ndlp->nlp_DID = did;
 	ndlp->vport = vport;
 	ndlp->phba = vport->phba;
@@ -5011,6 +5022,29 @@ lpfc_unreg_rpi(struct lpfc_vport *vport,
 				mempool_free(mbox, phba->mbox_mem_pool);
 				acc_plogi = 1;
 			}
+		} else {
+			lpfc_printf_vlog(vport, KERN_INFO,
+					 LOG_NODE | LOG_DISCOVERY,
+					 "1444 Failed to allocate mempool "
+					 "unreg_rpi UNREG x%x, "
+					 "DID x%x, flag x%x, "
+					 "ndlp x%px\n",
+					 ndlp->nlp_rpi, ndlp->nlp_DID,
+					 ndlp->nlp_flag, ndlp);
+
+			/* Because mempool_alloc failed, we
+			 * will issue a LOGO here and keep the rpi alive if
+			 * not unloading.
+			 */
+			if (!(vport->load_flag & FC_UNLOADING)) {
+				ndlp->nlp_flag &= ~NLP_UNREG_INP;
+				lpfc_issue_els_logo(vport, ndlp, 0);
+				ndlp->nlp_prev_state = ndlp->nlp_state;
+				lpfc_nlp_set_state(vport, ndlp,
+						   NLP_STE_NPR_NODE);
+			}
+
+			return 1;
 		}
 		lpfc_no_rpi(phba, ndlp);
 out:
@@ -5214,6 +5248,7 @@ lpfc_cleanup_node(struct lpfc_vport *vpo
 
 	list_del_init(&ndlp->els_retry_evt.evt_listp);
 	list_del_init(&ndlp->dev_loss_evt.evt_listp);
+	list_del_init(&ndlp->recovery_evt.evt_listp);
 	lpfc_cleanup_vports_rrqs(vport, ndlp);
 	if (phba->sli_rev == LPFC_SLI_REV4)
 		ndlp->nlp_flag |= NLP_RELEASE_RPI;
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -5958,18 +5958,21 @@ lpfc_sli4_async_grp5_evt(struct lpfc_hba
 void lpfc_sli4_async_event_proc(struct lpfc_hba *phba)
 {
 	struct lpfc_cq_event *cq_event;
+	unsigned long iflags;
 
 	/* First, declare the async event has been handled */
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irqsave(&phba->hbalock, iflags);
 	phba->hba_flag &= ~ASYNC_EVENT;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irqrestore(&phba->hbalock, iflags);
+
 	/* Now, handle all the async events */
+	spin_lock_irqsave(&phba->sli4_hba.asynce_list_lock, iflags);
 	while (!list_empty(&phba->sli4_hba.sp_asynce_work_queue)) {
-		/* Get the first event from the head of the event queue */
-		spin_lock_irq(&phba->hbalock);
 		list_remove_head(&phba->sli4_hba.sp_asynce_work_queue,
 				 cq_event, struct lpfc_cq_event, list);
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irqrestore(&phba->sli4_hba.asynce_list_lock,
+				       iflags);
+
 		/* Process the asynchronous event */
 		switch (bf_get(lpfc_trailer_code, &cq_event->cqe.mcqe_cmpl)) {
 		case LPFC_TRAILER_CODE_LINK:
@@ -6001,9 +6004,12 @@ void lpfc_sli4_async_event_proc(struct l
 					&cq_event->cqe.mcqe_cmpl));
 			break;
 		}
+
 		/* Free the completion event processed to the free pool */
 		lpfc_sli4_cq_event_release(phba, cq_event);
+		spin_lock_irqsave(&phba->sli4_hba.asynce_list_lock, iflags);
 	}
+	spin_unlock_irqrestore(&phba->sli4_hba.asynce_list_lock, iflags);
 }
 
 /**
@@ -6630,6 +6636,8 @@ lpfc_sli4_driver_resource_setup(struct l
 	/* This abort list used by worker thread */
 	spin_lock_init(&phba->sli4_hba.sgl_list_lock);
 	spin_lock_init(&phba->sli4_hba.nvmet_io_wait_lock);
+	spin_lock_init(&phba->sli4_hba.asynce_list_lock);
+	spin_lock_init(&phba->sli4_hba.els_xri_abrt_list_lock);
 
 	/*
 	 * Initialize driver internal slow-path work queues
@@ -6641,8 +6649,6 @@ lpfc_sli4_driver_resource_setup(struct l
 	INIT_LIST_HEAD(&phba->sli4_hba.sp_queue_event);
 	/* Asynchronous event CQ Event work queue list */
 	INIT_LIST_HEAD(&phba->sli4_hba.sp_asynce_work_queue);
-	/* Fast-path XRI aborted CQ Event work queue list */
-	INIT_LIST_HEAD(&phba->sli4_hba.sp_fcp_xri_aborted_work_queue);
 	/* Slow-path XRI aborted CQ Event work queue list */
 	INIT_LIST_HEAD(&phba->sli4_hba.sp_els_xri_aborted_work_queue);
 	/* Receive queue CQ Event work queue list */
@@ -10174,26 +10180,28 @@ lpfc_sli4_cq_event_release(struct lpfc_h
 static void
 lpfc_sli4_cq_event_release_all(struct lpfc_hba *phba)
 {
-	LIST_HEAD(cqelist);
-	struct lpfc_cq_event *cqe;
+	LIST_HEAD(cq_event_list);
+	struct lpfc_cq_event *cq_event;
 	unsigned long iflags;
 
 	/* Retrieve all the pending WCQEs from pending WCQE lists */
-	spin_lock_irqsave(&phba->hbalock, iflags);
-	/* Pending FCP XRI abort events */
-	list_splice_init(&phba->sli4_hba.sp_fcp_xri_aborted_work_queue,
-			 &cqelist);
+
 	/* Pending ELS XRI abort events */
+	spin_lock_irqsave(&phba->sli4_hba.els_xri_abrt_list_lock, iflags);
 	list_splice_init(&phba->sli4_hba.sp_els_xri_aborted_work_queue,
-			 &cqelist);
+			 &cq_event_list);
+	spin_unlock_irqrestore(&phba->sli4_hba.els_xri_abrt_list_lock, iflags);
+
 	/* Pending asynnc events */
+	spin_lock_irqsave(&phba->sli4_hba.asynce_list_lock, iflags);
 	list_splice_init(&phba->sli4_hba.sp_asynce_work_queue,
-			 &cqelist);
-	spin_unlock_irqrestore(&phba->hbalock, iflags);
+			 &cq_event_list);
+	spin_unlock_irqrestore(&phba->sli4_hba.asynce_list_lock, iflags);
 
-	while (!list_empty(&cqelist)) {
-		list_remove_head(&cqelist, cqe, struct lpfc_cq_event, list);
-		lpfc_sli4_cq_event_release(phba, cqe);
+	while (!list_empty(&cq_event_list)) {
+		list_remove_head(&cq_event_list, cq_event,
+				 struct lpfc_cq_event, list);
+		lpfc_sli4_cq_event_release(phba, cq_event);
 	}
 }
 
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -46,6 +46,7 @@
 #define LPFC_MEM_POOL_SIZE      64      /* max elem in non-DMA safety pool */
 #define LPFC_DEVICE_DATA_POOL_SIZE 64   /* max elements in device data pool */
 #define LPFC_RRQ_POOL_SIZE	256	/* max elements in non-DMA  pool */
+#define LPFC_MBX_POOL_SIZE	256	/* max elements in MBX non-DMA pool */
 
 int
 lpfc_mem_alloc_active_rrq_pool_s4(struct lpfc_hba *phba) {
@@ -111,8 +112,8 @@ lpfc_mem_alloc(struct lpfc_hba *phba, in
 		pool->current_count++;
 	}
 
-	phba->mbox_mem_pool = mempool_create_kmalloc_pool(LPFC_MEM_POOL_SIZE,
-							 sizeof(LPFC_MBOXQ_t));
+	phba->mbox_mem_pool = mempool_create_kmalloc_pool(LPFC_MBX_POOL_SIZE,
+							  sizeof(LPFC_MBOXQ_t));
 	if (!phba->mbox_mem_pool)
 		goto fail_free_mbuf_pool;
 
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2280,6 +2280,8 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_v
 	int ret, i, pending = 0;
 	struct lpfc_sli_ring  *pring;
 	struct lpfc_hba  *phba = vport->phba;
+	struct lpfc_sli4_hdw_queue *qp;
+	int abts_scsi, abts_nvme;
 
 	/* Host transport has to clean up and confirm requiring an indefinite
 	 * wait. Print a message if a 10 second wait expires and renew the
@@ -2290,17 +2292,23 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_v
 		ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
 		if (unlikely(!ret)) {
 			pending = 0;
+			abts_scsi = 0;
+			abts_nvme = 0;
 			for (i = 0; i < phba->cfg_hdw_queue; i++) {
-				pring = phba->sli4_hba.hdwq[i].io_wq->pring;
+				qp = &phba->sli4_hba.hdwq[i];
+				pring = qp->io_wq->pring;
 				if (!pring)
 					continue;
-				if (pring->txcmplq_cnt)
-					pending += pring->txcmplq_cnt;
+				pending += pring->txcmplq_cnt;
+				abts_scsi += qp->abts_scsi_io_bufs;
+				abts_nvme += qp->abts_nvme_io_bufs;
 			}
 			lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
 					 "6176 Lport x%px Localport x%px wait "
-					 "timed out. Pending %d. Renewing.\n",
-					 lport, vport->localport, pending);
+					 "timed out. Pending %d [%d:%d]. "
+					 "Renewing.\n",
+					 lport, vport->localport, pending,
+					 abts_scsi, abts_nvme);
 			continue;
 		}
 		break;
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -10370,6 +10370,32 @@ lpfc_extra_ring_setup( struct lpfc_hba *
 	return 0;
 }
 
+static void
+lpfc_sli_post_recovery_event(struct lpfc_hba *phba,
+			     struct lpfc_nodelist *ndlp)
+{
+	unsigned long iflags;
+	struct lpfc_work_evt  *evtp = &ndlp->recovery_evt;
+
+	spin_lock_irqsave(&phba->hbalock, iflags);
+	if (!list_empty(&evtp->evt_listp)) {
+		spin_unlock_irqrestore(&phba->hbalock, iflags);
+		return;
+	}
+
+	/* Incrementing the reference count until the queued work is done. */
+	evtp->evt_arg1  = lpfc_nlp_get(ndlp);
+	if (!evtp->evt_arg1) {
+		spin_unlock_irqrestore(&phba->hbalock, iflags);
+		return;
+	}
+	evtp->evt = LPFC_EVT_RECOVER_PORT;
+	list_add_tail(&evtp->evt_listp, &phba->work_list);
+	spin_unlock_irqrestore(&phba->hbalock, iflags);
+
+	lpfc_worker_wake_up(phba);
+}
+
 /* lpfc_sli_abts_err_handler - handle a failed ABTS request from an SLI3 port.
  * @phba: Pointer to HBA context object.
  * @iocbq: Pointer to iocb object.
@@ -10460,7 +10486,7 @@ lpfc_sli4_abts_err_handler(struct lpfc_h
 	ext_status = axri->parameter & IOERR_PARAM_MASK;
 	if ((bf_get(lpfc_wcqe_xa_status, axri) == IOSTAT_LOCAL_REJECT) &&
 	    ((ext_status == IOERR_SEQUENCE_TIMEOUT) || (ext_status == 0)))
-		lpfc_sli_abts_recover_port(vport, ndlp);
+		lpfc_sli_post_recovery_event(phba, ndlp);
 }
 
 /**
@@ -13068,23 +13094,30 @@ lpfc_sli_intr_handler(int irq, void *dev
 void lpfc_sli4_els_xri_abort_event_proc(struct lpfc_hba *phba)
 {
 	struct lpfc_cq_event *cq_event;
+	unsigned long iflags;
 
 	/* First, declare the els xri abort event has been handled */
-	spin_lock_irq(&phba->hbalock);
+	spin_lock_irqsave(&phba->hbalock, iflags);
 	phba->hba_flag &= ~ELS_XRI_ABORT_EVENT;
-	spin_unlock_irq(&phba->hbalock);
+	spin_unlock_irqrestore(&phba->hbalock, iflags);
+
 	/* Now, handle all the els xri abort events */
+	spin_lock_irqsave(&phba->sli4_hba.els_xri_abrt_list_lock, iflags);
 	while (!list_empty(&phba->sli4_hba.sp_els_xri_aborted_work_queue)) {
 		/* Get the first event from the head of the event queue */
-		spin_lock_irq(&phba->hbalock);
 		list_remove_head(&phba->sli4_hba.sp_els_xri_aborted_work_queue,
 				 cq_event, struct lpfc_cq_event, list);
-		spin_unlock_irq(&phba->hbalock);
+		spin_unlock_irqrestore(&phba->sli4_hba.els_xri_abrt_list_lock,
+				       iflags);
 		/* Notify aborted XRI for ELS work queue */
 		lpfc_sli4_els_xri_aborted(phba, &cq_event->cqe.wcqe_axri);
+
 		/* Free the event processed back to the free pool */
 		lpfc_sli4_cq_event_release(phba, cq_event);
+		spin_lock_irqsave(&phba->sli4_hba.els_xri_abrt_list_lock,
+				  iflags);
 	}
+	spin_unlock_irqrestore(&phba->sli4_hba.els_xri_abrt_list_lock, iflags);
 }
 
 /**
@@ -13295,9 +13328,13 @@ lpfc_sli4_sp_handle_async_event(struct l
 	cq_event = lpfc_cq_event_setup(phba, mcqe, sizeof(struct lpfc_mcqe));
 	if (!cq_event)
 		return false;
-	spin_lock_irqsave(&phba->hbalock, iflags);
+
+	spin_lock_irqsave(&phba->sli4_hba.asynce_list_lock, iflags);
 	list_add_tail(&cq_event->list, &phba->sli4_hba.sp_asynce_work_queue);
+	spin_unlock_irqrestore(&phba->sli4_hba.asynce_list_lock, iflags);
+
 	/* Set the async event flag */
+	spin_lock_irqsave(&phba->hbalock, iflags);
 	phba->hba_flag |= ASYNC_EVENT;
 	spin_unlock_irqrestore(&phba->hbalock, iflags);
 
@@ -13572,17 +13609,20 @@ lpfc_sli4_sp_handle_abort_xri_wcqe(struc
 		break;
 	case LPFC_NVME_LS: /* NVME LS uses ELS resources */
 	case LPFC_ELS:
-		cq_event = lpfc_cq_event_setup(
-			phba, wcqe, sizeof(struct sli4_wcqe_xri_aborted));
-		if (!cq_event)
-			return false;
+		cq_event = lpfc_cq_event_setup(phba, wcqe, sizeof(*wcqe));
+		if (!cq_event) {
+			workposted = false;
+			break;
+		}
 		cq_event->hdwq = cq->hdwq;
-		spin_lock_irqsave(&phba->hbalock, iflags);
+		spin_lock_irqsave(&phba->sli4_hba.els_xri_abrt_list_lock,
+				  iflags);
 		list_add_tail(&cq_event->list,
 			      &phba->sli4_hba.sp_els_xri_aborted_work_queue);
 		/* Set the els xri abort event flag */
 		phba->hba_flag |= ELS_XRI_ABORT_EVENT;
-		spin_unlock_irqrestore(&phba->hbalock, iflags);
+		spin_unlock_irqrestore(&phba->sli4_hba.els_xri_abrt_list_lock,
+				       iflags);
 		workposted = true;
 		break;
 	default:
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -920,8 +920,9 @@ struct lpfc_sli4_hba {
 	struct list_head sp_queue_event;
 	struct list_head sp_cqe_event_pool;
 	struct list_head sp_asynce_work_queue;
-	struct list_head sp_fcp_xri_aborted_work_queue;
+	spinlock_t asynce_list_lock; /* protect sp_asynce_work_queue list */
 	struct list_head sp_els_xri_aborted_work_queue;
+	spinlock_t els_xri_abrt_list_lock; /* protect els_xri_aborted list */
 	struct list_head sp_unsol_work_queue;
 	struct lpfc_sli4_link link_state;
 	struct lpfc_sli4_lnk_info lnk_info;
@@ -1103,8 +1104,7 @@ void lpfc_sli4_async_event_proc(struct l
 void lpfc_sli4_fcf_redisc_event_proc(struct lpfc_hba *);
 int lpfc_sli4_resume_rpi(struct lpfc_nodelist *,
 			void (*)(struct lpfc_hba *, LPFC_MBOXQ_t *), void *);
-void lpfc_sli4_fcp_xri_abort_event_proc(struct lpfc_hba *);
-void lpfc_sli4_els_xri_abort_event_proc(struct lpfc_hba *);
+void lpfc_sli4_els_xri_abort_event_proc(struct lpfc_hba *phba);
 void lpfc_sli4_nvme_xri_aborted(struct lpfc_hba *phba,
 				struct sli4_wcqe_xri_aborted *axri,
 				struct lpfc_io_buf *lpfc_ncmd);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 672/717] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (669 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 671/717] scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 673/717] openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Smart, Martin K. Petersen

From: James Smart <james.smart@broadcom.com>

commit e5785d3ec32f5f44dd88cd7b398e496742630469 upstream.

Commit 9816ef6ecbc1 ("scsi: lpfc: Use after free in lpfc_rq_buf_free()")
was made to correct a use after free condition in lpfc_rq_buf_free().
Unfortunately, a subsequent patch cut on a tree without the fix
inadvertently reverted the fix.

Put the fix back: Move the freeing of the rqb_entry to after the print
function that references it.

Link: https://lore.kernel.org/r/20201020202719.54726-4-james.smart@broadcom.com
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/lpfc/lpfc_mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -721,7 +721,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
 	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
 	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
 	if (rc < 0) {
-		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"6409 Cannot post to HRQ %d: %x %x %x "
 				"DRQ %x %x\n",
@@ -731,6 +730,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
 				rqb_entry->hrq->entry_count,
 				rqb_entry->drq->host_index,
 				rqb_entry->drq->hba_index);
+		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 	} else {
 		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
 		rqbp->buffer_count++;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 673/717] openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (670 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 672/717] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 674/717] iio: buffer: Fix demux update Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aleksa Sarai, Christian Brauner

From: Aleksa Sarai <cyphar@cyphar.com>

commit 398840f8bb935d33c64df4ec4fed77a7d24c267d upstream.

This was an oversight in the original implementation, as it makes no
sense to specify both scoping flags to the same openat2(2) invocation
(before this patch, the result of such an invocation was equivalent to
RESOLVE_IN_ROOT being ignored).

This is a userspace-visible ABI change, but the only user of openat2(2)
at the moment is LXC which doesn't specify both flags and so no
userspace programs will break as a result.

Fixes: fddb5d430ad9 ("open: introduce openat2(2) syscall")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: <stable@vger.kernel.org> # v5.6+
Link: https://lore.kernel.org/r/20201027235044.5240-2-cyphar@cyphar.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/open.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/fs/open.c
+++ b/fs/open.c
@@ -1010,6 +1010,10 @@ inline int build_open_flags(const struct
 	if (how->resolve & ~VALID_RESOLVE_FLAGS)
 		return -EINVAL;
 
+	/* Scoping flags are mutually exclusive. */
+	if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
+		return -EINVAL;
+
 	/* Deal with the mode. */
 	if (WILL_CREATE(flags)) {
 		if (how->mode & ~S_IALLUGO)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 674/717] iio: buffer: Fix demux update
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (671 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 673/717] openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 675/717] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nuno Sá, Stable, Jonathan Cameron

From: Nuno Sá <nuno.sa@analog.com>

commit 19ef7b70ca9487773c29b449adf0c70f540a0aab upstream.

When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.

Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element.   Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.

Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/industrialio-buffer.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -865,12 +865,12 @@ static int iio_buffer_update_demux(struc
 				       indio_dev->masklength,
 				       in_ind + 1);
 		while (in_ind != out_ind) {
-			in_ind = find_next_bit(indio_dev->active_scan_mask,
-					       indio_dev->masklength,
-					       in_ind + 1);
 			length = iio_storage_bytes_for_si(indio_dev, in_ind);
 			/* Make sure we are aligned */
 			in_loc = roundup(in_loc, length) + length;
+			in_ind = find_next_bit(indio_dev->active_scan_mask,
+					       indio_dev->masklength,
+					       in_ind + 1);
 		}
 		length = iio_storage_bytes_for_si(indio_dev, in_ind);
 		out_loc = roundup(out_loc, length);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 675/717] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (672 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 674/717] iio: buffer: Fix demux update Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 676/717] iio: imu: st_lsm6dsx: fix edge-trigger interrupts Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Qinglang Miao, Stable,
	Jonathan Cameron

From: Qinglang Miao <miaoqinglang@huawei.com>

commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.

Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.

Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/rockchip_saradc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -462,7 +462,7 @@ static int rockchip_saradc_resume(struct
 
 	ret = clk_prepare_enable(info->clk);
 	if (ret)
-		return ret;
+		clk_disable_unprepare(info->pclk);
 
 	return ret;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 676/717] iio: imu: st_lsm6dsx: fix edge-trigger interrupts
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (673 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 675/717] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 677/717] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Stable, Jonathan Cameron

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 3f9bce7a22a3f8ac9d885c9d75bc45569f24ac8b upstream.

If we are using edge IRQs, new samples can arrive while processing
current interrupt since there are no hw guarantees the irq line
stays "low" long enough to properly detect the new interrupt.
In this case the new sample will be missed.
Polling FIFO status register in st_lsm6dsx_handler_thread routine
allow us to read new samples even if the interrupt arrives while
processing previous data and the timeslot where the line is "low"
is too short to be properly detected.

Fixes: 89ca88a7cdf2 ("iio: imu: st_lsm6dsx: support active-low interrupts")
Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/5e93cda7dc1e665f5685c53ad8e9ea71dbae782d.1605378871.git.lorenzo@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c |   26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
@@ -2255,19 +2255,35 @@ st_lsm6dsx_report_motion_event(struct st
 static irqreturn_t st_lsm6dsx_handler_thread(int irq, void *private)
 {
 	struct st_lsm6dsx_hw *hw = private;
+	int fifo_len = 0, len;
 	bool event;
-	int count;
 
 	event = st_lsm6dsx_report_motion_event(hw);
 
 	if (!hw->settings->fifo_ops.read_fifo)
 		return event ? IRQ_HANDLED : IRQ_NONE;
 
-	mutex_lock(&hw->fifo_lock);
-	count = hw->settings->fifo_ops.read_fifo(hw);
-	mutex_unlock(&hw->fifo_lock);
+	/*
+	 * If we are using edge IRQs, new samples can arrive while
+	 * processing current interrupt since there are no hw
+	 * guarantees the irq line stays "low" long enough to properly
+	 * detect the new interrupt. In this case the new sample will
+	 * be missed.
+	 * Polling FIFO status register allow us to read new
+	 * samples even if the interrupt arrives while processing
+	 * previous data and the timeslot where the line is "low" is
+	 * too short to be properly detected.
+	 */
+	do {
+		mutex_lock(&hw->fifo_lock);
+		len = hw->settings->fifo_ops.read_fifo(hw);
+		mutex_unlock(&hw->fifo_lock);
 
-	return count || event ? IRQ_HANDLED : IRQ_NONE;
+		if (len > 0)
+			fifo_len += len;
+	} while (len > 0);
+
+	return fifo_len || event ? IRQ_HANDLED : IRQ_NONE;
 }
 
 static int st_lsm6dsx_irq_setup(struct st_lsm6dsx_hw *hw)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 677/717] iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (674 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 676/717] iio: imu: st_lsm6dsx: fix edge-trigger interrupts Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 678/717] iio:light:st_uvis25: " Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Mikko Koivunen, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit a61817216bcc755eabbcb1cf281d84ccad267ed1 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart
from previous readings and in this case the status byte from the device.

The forced alignment of ts is not necessary in this case but it
potentially makes the code less fragile.

>From personal communications with Mikko:

We could probably split the reading of the int register, but it
would mean a significant performance cost of 20 i2c clock cycles.

Fixes: e12ffd241c00 ("iio: light: rpr0521 triggered buffer")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Mikko Koivunen <mikko.koivunen@fi.rohmeurope.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/rpr0521.c |   17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

--- a/drivers/iio/light/rpr0521.c
+++ b/drivers/iio/light/rpr0521.c
@@ -194,6 +194,17 @@ struct rpr0521_data {
 	bool pxs_need_dis;
 
 	struct regmap *regmap;
+
+	/*
+	 * Ensure correct naturally aligned timestamp.
+	 * Note that the read will put garbage data into
+	 * the padding but this should not be a problem
+	 */
+	struct {
+		__le16 channels[3];
+		u8 garbage;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 static IIO_CONST_ATTR(in_intensity_scale_available, RPR0521_ALS_SCALE_AVAIL);
@@ -449,8 +460,6 @@ static irqreturn_t rpr0521_trigger_consu
 	struct rpr0521_data *data = iio_priv(indio_dev);
 	int err;
 
-	u8 buffer[16]; /* 3 16-bit channels + padding + ts */
-
 	/* Use irq timestamp when reasonable. */
 	if (iio_trigger_using_own(indio_dev) && data->irq_timestamp) {
 		pf->timestamp = data->irq_timestamp;
@@ -461,11 +470,11 @@ static irqreturn_t rpr0521_trigger_consu
 		pf->timestamp = iio_get_time_ns(indio_dev);
 
 	err = regmap_bulk_read(data->regmap, RPR0521_REG_PXS_DATA,
-		&buffer,
+		data->scan.channels,
 		(3 * 2) + 1);	/* 3 * 16-bit + (discarded) int clear reg. */
 	if (!err)
 		iio_push_to_buffers_with_timestamp(indio_dev,
-						   buffer, pf->timestamp);
+						   &data->scan, pf->timestamp);
 	else
 		dev_err(&data->client->dev,
 			"Trigger consumer can't read from sensor.\n");



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 678/717] iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (675 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 677/717] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 679/717] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Lorenzo Bianconi, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit d837a996f57c29a985177bc03b0e599082047f27 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv()

This data is allocated with kzalloc() so no data can leak apart
from previous readings.

A local unsigned int variable is used for the regmap call so it
is clear there is no potential issue with writing into the padding
of the structure.

Fixes: 3025c8688c1e ("iio: light: add support for UVIS25 sensor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-3-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/st_uvis25.h      |    5 +++++
 drivers/iio/light/st_uvis25_core.c |    8 +++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/iio/light/st_uvis25.h
+++ b/drivers/iio/light/st_uvis25.h
@@ -27,6 +27,11 @@ struct st_uvis25_hw {
 	struct iio_trigger *trig;
 	bool enabled;
 	int irq;
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		u8 chan;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 extern const struct dev_pm_ops st_uvis25_pm_ops;
--- a/drivers/iio/light/st_uvis25_core.c
+++ b/drivers/iio/light/st_uvis25_core.c
@@ -232,17 +232,19 @@ static const struct iio_buffer_setup_ops
 
 static irqreturn_t st_uvis25_buffer_handler_thread(int irq, void *p)
 {
-	u8 buffer[ALIGN(sizeof(u8), sizeof(s64)) + sizeof(s64)];
 	struct iio_poll_func *pf = p;
 	struct iio_dev *iio_dev = pf->indio_dev;
 	struct st_uvis25_hw *hw = iio_priv(iio_dev);
+	unsigned int val;
 	int err;
 
-	err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, (int *)buffer);
+	err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, &val);
 	if (err < 0)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(iio_dev, buffer,
+	hw->scan.chan = val;
+
+	iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
 					   iio_get_time_ns(iio_dev));
 
 out:



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 679/717] iio:magnetometer:mag3110: Fix alignment and data leak issues.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (676 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 678/717] iio:light:st_uvis25: " Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 680/717] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 89deb1334252ea4a8491d47654811e28b0790364 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.

Fixes: 39631b5f9584 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/magnetometer/mag3110.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -56,6 +56,12 @@ struct mag3110_data {
 	int sleep_val;
 	struct regulator *vdd_reg;
 	struct regulator *vddio_reg;
+	/* Ensure natural alignment of timestamp */
+	struct {
+		__be16 channels[3];
+		u8 temperature;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 static int mag3110_request(struct mag3110_data *data)
@@ -387,10 +393,9 @@ static irqreturn_t mag3110_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mag3110_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */
 	int ret;
 
-	ret = mag3110_read(data, (__be16 *) buffer);
+	ret = mag3110_read(data, data->scan.channels);
 	if (ret < 0)
 		goto done;
 
@@ -399,10 +404,10 @@ static irqreturn_t mag3110_trigger_handl
 			MAG3110_DIE_TEMP);
 		if (ret < 0)
 			goto done;
-		buffer[6] = ret;
+		data->scan.temperature = ret;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 		iio_get_time_ns(indio_dev));
 
 done:



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 680/717] iio:pressure:mpl3115: Force alignment of buffer
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (677 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 679/717] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 681/717] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Andy Shevchenko, Alexandru Ardelean, Peter Meerwald, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 198cf32f0503d2ad60d320b95ef6fb8243db857f upstream.

Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)

This one is unusual.  We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much.  We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.

Fixes: cc26ad455f57 ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/pressure/mpl3115.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -144,7 +144,14 @@ static irqreturn_t mpl3115_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mpl3115_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 32-bit channel + 16-bit channel + padding + ts */
+	/*
+	 * 32-bit channel + 16-bit channel + padding + ts
+	 * Note that it is possible for only one of the first 2
+	 * channels to be enabled. If that happens, the first element
+	 * of the buffer may be either 16 or 32-bits.  As such we cannot
+	 * use a simple structure definition to express this data layout.
+	 */
+	u8 buffer[16] __aligned(8);
 	int ret, pos = 0;
 
 	mutex_lock(&data->lock);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 681/717] iio:imu:bmi160: Fix too large a buffer.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (678 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 680/717] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 682/717] iio:imu:bmi160: Fix alignment and data leak issues Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Daniel Baluta, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit dc7de42d6b50a07b37feeba4c6b5136290fcee81 upstream.

The comment implies this device has 3 sensor types, but it only
has an accelerometer and a gyroscope (both 3D).  As such the
buffer does not need to be as long as stated.

Note I've separated this from the following patch which fixes
the alignment for passing to iio_push_to_buffers_with_timestamp()
as they are different issues even if they affect the same line
of code.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-5-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/imu/bmi160/bmi160_core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -427,8 +427,8 @@ static irqreturn_t bmi160_trigger_handle
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct bmi160_data *data = iio_priv(indio_dev);
-	__le16 buf[16];
-	/* 3 sens x 3 axis x __le16 + 3 x __le16 pad + 4 x __le16 tstamp */
+	__le16 buf[12];
+	/* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
 	int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
 	__le16 sample;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 682/717] iio:imu:bmi160: Fix alignment and data leak issues
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (679 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 681/717] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 683/717] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Daniel Baluta, Daniel Baluta, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 7b6b51234df6cd8b04fe736b0b89c25612d896b8 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable array in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver, depending on which channels are enabled, the timestamp
can be in a number of locations.  Hence we cannot use a structure
to specify the data layout without it being misleading.

Fixes: 77c4ad2d6a9b ("iio: imu: Add initial support for Bosch BMI160")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta  <daniel.baluta@gmail.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-6-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/imu/bmi160/bmi160.h      |    7 +++++++
 drivers/iio/imu/bmi160/bmi160_core.c |    6 ++----
 2 files changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/iio/imu/bmi160/bmi160.h
+++ b/drivers/iio/imu/bmi160/bmi160.h
@@ -10,6 +10,13 @@ struct bmi160_data {
 	struct iio_trigger *trig;
 	struct regulator_bulk_data supplies[2];
 	struct iio_mount_matrix orientation;
+	/*
+	 * Ensure natural alignment for timestamp if present.
+	 * Max length needed: 2 * 3 channels + 4 bytes padding + 8 byte ts.
+	 * If fewer channels are enabled, less space may be needed, as
+	 * long as the timestamp is still aligned to 8 bytes.
+	 */
+	__le16 buf[12] __aligned(8);
 };
 
 extern const struct regmap_config bmi160_regmap_config;
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -427,8 +427,6 @@ static irqreturn_t bmi160_trigger_handle
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct bmi160_data *data = iio_priv(indio_dev);
-	__le16 buf[12];
-	/* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
 	int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
 	__le16 sample;
 
@@ -438,10 +436,10 @@ static irqreturn_t bmi160_trigger_handle
 				       &sample, sizeof(sample));
 		if (ret)
 			goto done;
-		buf[j++] = sample;
+		data->buf[j++] = sample;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp);
+	iio_push_to_buffers_with_timestamp(indio_dev, data->buf, pf->timestamp);
 done:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 683/717] iio:adc:ti-ads124s08: Fix buffer being too long.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (680 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 682/717] iio:imu:bmi160: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 684/717] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Dan Murphy, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit b0bd27f02d768e3a861c4e6c27f8e369720e6c25 upstream.

The buffer is expressed as a u32 array, yet the extra space for
the s64 timestamp was expressed as sizeof(s64)/sizeof(u16).
This will result in 2 extra u32 elements.
Fix by dividing by sizeof(u32).

Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Signed-off-by: Jonathan Cameron<Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-8-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/ti-ads124s08.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -269,7 +269,7 @@ static irqreturn_t ads124s_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ads124s_private *priv = iio_priv(indio_dev);
-	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
+	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)];
 	int scan_index, j = 0;
 	int ret;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 684/717] iio:adc:ti-ads124s08: Fix alignment and data leak issues.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (681 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 683/717] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 685/717] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Dan Murphy, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 1e405bc2512f80a903ddd6ba8740cee885238d7f upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver the timestamp can end up in various different locations
depending on what other channels are enabled.  As a result, we don't
use a structure to specify it's position as that would be misleading.

Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-9-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/ti-ads124s08.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -99,6 +99,14 @@ struct ads124s_private {
 	struct gpio_desc *reset_gpio;
 	struct spi_device *spi;
 	struct mutex lock;
+	/*
+	 * Used to correctly align data.
+	 * Ensure timestamp is naturally aligned.
+	 * Note that the full buffer length may not be needed if not
+	 * all channels are enabled, as long as the alignment of the
+	 * timestamp is maintained.
+	 */
+	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)] __aligned(8);
 	u8 data[5] ____cacheline_aligned;
 };
 
@@ -269,7 +277,6 @@ static irqreturn_t ads124s_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ads124s_private *priv = iio_priv(indio_dev);
-	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)];
 	int scan_index, j = 0;
 	int ret;
 
@@ -284,7 +291,7 @@ static irqreturn_t ads124s_trigger_handl
 		if (ret)
 			dev_err(&priv->spi->dev, "Start ADC conversions failed\n");
 
-		buffer[j] = ads124s_read(indio_dev, scan_index);
+		priv->buffer[j] = ads124s_read(indio_dev, scan_index);
 		ret = ads124s_write_cmd(indio_dev, ADS124S08_STOP_CONV);
 		if (ret)
 			dev_err(&priv->spi->dev, "Stop ADC conversions failed\n");
@@ -292,7 +299,7 @@ static irqreturn_t ads124s_trigger_handl
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, priv->buffer,
 			pf->timestamp);
 
 	iio_trigger_notify_done(indio_dev->trig);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 685/717] md/cluster: block reshape with remote resync job
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (682 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 684/717] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 686/717] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhao Heming, Song Liu

From: Zhao Heming <heming.zhao@suse.com>

commit a8da01f79c89755fad55ed0ea96e8d2103242a72 upstream.

Reshape request should be blocked with ongoing resync job. In cluster
env, a node can start resync job even if the resync cmd isn't executed
on it, e.g., user executes "mdadm --grow" on node A, sometimes node B
will start resync job. However, current update_raid_disks() only check
local recovery status, which is incomplete. As a result, we see user will
execute "mdadm --grow" successfully on local, while the remote node deny
to do reshape job when it doing resync job. The inconsistent handling
cause array enter unexpected status. If user doesn't observe this issue
and continue executing mdadm cmd, the array doesn't work at last.

Fix this issue by blocking reshape request. When node executes "--grow"
and detects ongoing resync, it should stop and report error to user.

The following script reproduces the issue with ~100% probability.
(two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB)
```
 # on node1, node2 is the remote node.
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7278,6 +7278,7 @@ static int update_raid_disks(struct mdde
 		return -EINVAL;
 	if (mddev->sync_thread ||
 	    test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+	    test_bit(MD_RESYNCING_REMOTE, &mddev->recovery) ||
 	    mddev->reshape_position != MaxSector)
 		return -EBUSY;
 
@@ -9645,8 +9646,11 @@ static void check_sb_changes(struct mdde
 		}
 	}
 
-	if (mddev->raid_disks != le32_to_cpu(sb->raid_disks))
-		update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
+	if (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) {
+		ret = update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
+		if (ret)
+			pr_warn("md: updating array disks failed. %d\n", ret);
+	}
 
 	/*
 	 * Since mddev->delta_disks has already updated in update_raid_disks,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 686/717] md/cluster: fix deadlock when node is doing resync job
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (683 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 685/717] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 687/717] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhao Heming, Xiao Ni, Song Liu

From: Zhao Heming <heming.zhao@suse.com>

commit bca5b0658020be90b6b504ca514fd80110204f71 upstream.

md-cluster uses MD_CLUSTER_SEND_LOCK to make node can exclusively send msg.
During sending msg, node can concurrently receive msg from another node.
When node does resync job, grab token_lockres:EX may trigger a deadlock:
```
nodeA                       nodeB
--------------------     --------------------
a.
send METADATA_UPDATED
held token_lockres:EX
                         b.
                         md_do_sync
                          resync_info_update
                            send RESYNCING
                             + set MD_CLUSTER_SEND_LOCK
                             + wait for holding token_lockres:EX

                         c.
                         mdadm /dev/md0 --remove /dev/sdg
                          + held reconfig_mutex
                          + send REMOVE
                             + wait_event(MD_CLUSTER_SEND_LOCK)

                         d.
                         recv_daemon //METADATA_UPDATED from A
                          process_metadata_update
                           + (mddev_trylock(mddev) ||
                              MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD)
                             //this time, both return false forever
```
Explaination:
a. A send METADATA_UPDATED
   This will block another node to send msg

b. B does sync jobs, which will send RESYNCING at intervals.
   This will be block for holding token_lockres:EX lock.

c. B do "mdadm --remove", which will send REMOVE.
   This will be blocked by step <b>: MD_CLUSTER_SEND_LOCK is 1.

d. B recv METADATA_UPDATED msg, which send from A in step <a>.
   This will be blocked by step <c>: holding mddev lock, it makes
   wait_event can't hold mddev lock. (btw,
   MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD keep ZERO in this scenario.)

There is a similar deadlock in commit 0ba959774e93
("md-cluster: use sync way to handle METADATA_UPDATED msg")
In that commit, step c is "update sb". This patch step c is
"mdadm --remove".

For fixing this issue, we can refer the solution of function:
metadata_update_start. Which does the same grab lock_token action.
lock_comm can use the same steps to avoid deadlock. By moving
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD from lock_token to lock_comm.
It enlarge a little bit window of MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
but it is safe & can break deadlock.

Repro steps (I only triggered 3 times with hundreds tests):

two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB.
```
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh \
 --bitmap-chunk=1M
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mkfs.xfs /dev/md0
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

test script will hung when executing "mdadm --remove".

```
 # dump stacks by "echo t > /proc/sysrq-trigger"
md0_cluster_rec D    0  5329      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? _cond_resched+0x2d/0x40
 ? schedule+0x4a/0xb0
 ? process_metadata_update.isra.0+0xdb/0x140 [md_cluster]
 ? wait_woken+0x80/0x80
 ? process_recvd_msg+0x113/0x1d0 [md_cluster]
 ? recv_daemon+0x9e/0x120 [md_cluster]
 ? md_thread+0x94/0x160 [md_mod]
 ? wait_woken+0x80/0x80
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40

mdadm           D    0  5423      1 0x00004004
Call Trace:
 __schedule+0x1f6/0x560
 ? __schedule+0x1fe/0x560
 ? schedule+0x4a/0xb0
 ? lock_comm.isra.0+0x7b/0xb0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? remove_disk+0x4f/0x90 [md_cluster]
 ? hot_remove_disk+0xb1/0x1b0 [md_mod]
 ? md_ioctl+0x50c/0xba0 [md_mod]
 ? wait_woken+0x80/0x80
 ? blkdev_ioctl+0xa2/0x2a0
 ? block_ioctl+0x39/0x40
 ? ksys_ioctl+0x82/0xc0
 ? __x64_sys_ioctl+0x16/0x20
 ? do_syscall_64+0x5f/0x150
 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

md0_resync      D    0  5425      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? schedule+0x4a/0xb0
 ? dlm_lock_sync+0xa1/0xd0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? lock_token+0x2d/0x90 [md_cluster]
 ? resync_info_update+0x95/0x100 [md_cluster]
 ? raid1_sync_request+0x7d3/0xa40 [raid1]
 ? md_do_sync.cold+0x737/0xc8f [md_mod]
 ? md_thread+0x94/0x160 [md_mod]
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40
```

At last, thanks for Xiao's solution.

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Suggested-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md-cluster.c |   67 +++++++++++++++++++++++++++---------------------
 drivers/md/md.c         |    6 ++--
 2 files changed, 42 insertions(+), 31 deletions(-)

--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -664,9 +664,27 @@ out:
  * Takes the lock on the TOKEN lock resource so no other
  * node can communicate while the operation is underway.
  */
-static int lock_token(struct md_cluster_info *cinfo, bool mddev_locked)
+static int lock_token(struct md_cluster_info *cinfo)
 {
-	int error, set_bit = 0;
+	int error;
+
+	error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
+	if (error) {
+		pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
+				__func__, __LINE__, error);
+	} else {
+		/* Lock the receive sequence */
+		mutex_lock(&cinfo->recv_mutex);
+	}
+	return error;
+}
+
+/* lock_comm()
+ * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
+ */
+static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
+{
+	int rv, set_bit = 0;
 	struct mddev *mddev = cinfo->mddev;
 
 	/*
@@ -677,34 +695,19 @@ static int lock_token(struct md_cluster_
 	 */
 	if (mddev_locked && !test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
 				      &cinfo->state)) {
-		error = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
+		rv = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
 					      &cinfo->state);
-		WARN_ON_ONCE(error);
+		WARN_ON_ONCE(rv);
 		md_wakeup_thread(mddev->thread);
 		set_bit = 1;
 	}
-	error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
-	if (set_bit)
-		clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
 
-	if (error)
-		pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
-				__func__, __LINE__, error);
-
-	/* Lock the receive sequence */
-	mutex_lock(&cinfo->recv_mutex);
-	return error;
-}
-
-/* lock_comm()
- * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
- */
-static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
-{
 	wait_event(cinfo->wait,
 		   !test_and_set_bit(MD_CLUSTER_SEND_LOCK, &cinfo->state));
-
-	return lock_token(cinfo, mddev_locked);
+	rv = lock_token(cinfo);
+	if (set_bit)
+		clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
+	return rv;
 }
 
 static void unlock_comm(struct md_cluster_info *cinfo)
@@ -784,9 +787,11 @@ static int sendmsg(struct md_cluster_inf
 {
 	int ret;
 
-	lock_comm(cinfo, mddev_locked);
-	ret = __sendmsg(cinfo, cmsg);
-	unlock_comm(cinfo);
+	ret = lock_comm(cinfo, mddev_locked);
+	if (!ret) {
+		ret = __sendmsg(cinfo, cmsg);
+		unlock_comm(cinfo);
+	}
 	return ret;
 }
 
@@ -1061,7 +1066,7 @@ static int metadata_update_start(struct
 		return 0;
 	}
 
-	ret = lock_token(cinfo, 1);
+	ret = lock_token(cinfo);
 	clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
 	return ret;
 }
@@ -1255,7 +1260,10 @@ static void update_size(struct mddev *md
 	int raid_slot = -1;
 
 	md_update_sb(mddev, 1);
-	lock_comm(cinfo, 1);
+	if (lock_comm(cinfo, 1)) {
+		pr_err("%s: lock_comm failed\n", __func__);
+		return;
+	}
 
 	memset(&cmsg, 0, sizeof(cmsg));
 	cmsg.type = cpu_to_le32(METADATA_UPDATED);
@@ -1407,7 +1415,8 @@ static int add_new_disk(struct mddev *md
 	cmsg.type = cpu_to_le32(NEWDISK);
 	memcpy(cmsg.uuid, uuid, 16);
 	cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
-	lock_comm(cinfo, 1);
+	if (lock_comm(cinfo, 1))
+		return -EAGAIN;
 	ret = __sendmsg(cinfo, &cmsg);
 	if (ret) {
 		unlock_comm(cinfo);
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6948,8 +6948,10 @@ static int hot_remove_disk(struct mddev
 		goto busy;
 
 kick_rdev:
-	if (mddev_is_clustered(mddev))
-		md_cluster_ops->remove_disk(mddev, rdev);
+	if (mddev_is_clustered(mddev)) {
+		if (md_cluster_ops->remove_disk(mddev, rdev))
+			goto busy;
+	}
 
 	md_kick_rdev_from_array(rdev);
 	set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 687/717] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (684 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 686/717] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 688/717] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yangtao Li, Linus Walleij

From: Yangtao Li <frank@allwinnertech.com>

commit a1158e36f876f6269978a4176e3a1d48d27fe7a1 upstream.

It is found on many allwinner soc that there is a low probability that
the interrupt status cannot be read in sunxi_pinctrl_irq_handler. This
will cause the interrupt status of a gpio bank to always be active on
gic, preventing gic from responding to other spi interrupts correctly.

So we should call the chained_irq_* each time enter sunxi_pinctrl_irq_handler().

Signed-off-by: Yangtao Li <frank@allwinnertech.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/85263ce8b058e80cea25c6ad6383eb256ce96cc8.1604988979.git.frank@allwinnertech.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/sunxi/pinctrl-sunxi.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -1142,20 +1142,22 @@ static void sunxi_pinctrl_irq_handler(st
 	if (bank == pctl->desc->irq_banks)
 		return;
 
+	chained_irq_enter(chip, desc);
+
 	reg = sunxi_irq_status_reg_from_bank(pctl->desc, bank);
 	val = readl(pctl->membase + reg);
 
 	if (val) {
 		int irqoffset;
 
-		chained_irq_enter(chip, desc);
 		for_each_set_bit(irqoffset, &val, IRQ_PER_BANK) {
 			int pin_irq = irq_find_mapping(pctl->domain,
 						       bank * IRQ_PER_BANK + irqoffset);
 			generic_handle_irq(pin_irq);
 		}
-		chained_irq_exit(chip, desc);
 	}
+
+	chained_irq_exit(chip, desc);
 }
 
 static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 688/717] clk: ingenic: Fix divider calculation with div tables
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (685 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 687/717] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 689/717] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Stephen Boyd

From: Paul Cercueil <paul@crapouillou.net>

commit 11a163f2c7d6a9f27ce144cd7e367a81c851621a upstream.

The previous code assumed that a higher hardware value always resulted
in a bigger divider, which is correct for the regular clocks, but is
an invalid assumption when a divider table is provided for the clock.

Perfect example of this is the PLL0_HALF clock, which applies a /2
divider with the hardware value 0, and a /1 divider otherwise.

Fixes: a9fa2893fcc6 ("clk: ingenic: Add support for divider tables")
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20201212135733.38050-1-paul@crapouillou.net
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/ingenic/cgu.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/drivers/clk/ingenic/cgu.c
+++ b/drivers/clk/ingenic/cgu.c
@@ -392,15 +392,21 @@ static unsigned int
 ingenic_clk_calc_hw_div(const struct ingenic_cgu_clk_info *clk_info,
 			unsigned int div)
 {
-	unsigned int i;
+	unsigned int i, best_i = 0, best = (unsigned int)-1;
 
 	for (i = 0; i < (1 << clk_info->div.bits)
 				&& clk_info->div.div_table[i]; i++) {
-		if (clk_info->div.div_table[i] >= div)
-			return i;
+		if (clk_info->div.div_table[i] >= div &&
+		    clk_info->div.div_table[i] < best) {
+			best = clk_info->div.div_table[i];
+			best_i = i;
+
+			if (div == best)
+				break;
+		}
 	}
 
-	return i - 1;
+	return best_i;
 }
 
 static unsigned



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 689/717] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (686 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 688/717] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 690/717] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Terry Zhou, Pali Rohár,
	Marek Behún, Stephen Boyd

From: Terry Zhou <bjzhou@marvell.com>

commit 6f37689cf6b38fff96de52e7f0d3e78f22803ba0 upstream.

There is an error in the current code that the XTAL MODE
pin was set to NB MPP1_31 which should be NB MPP1_9.
The latch register of NB MPP1_9 has different offset of 0x8.

Signed-off-by: Terry Zhou <bjzhou@marvell.com>
[pali: Fix pin name in commit message]
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 7ea8250406a6 ("clk: mvebu: Add the xtal clock for Armada 3700 SoC")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106100039.11385-1-pali@kernel.org
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/mvebu/armada-37xx-xtal.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/clk/mvebu/armada-37xx-xtal.c
+++ b/drivers/clk/mvebu/armada-37xx-xtal.c
@@ -13,8 +13,8 @@
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
 
-#define NB_GPIO1_LATCH	0xC
-#define XTAL_MODE	    BIT(31)
+#define NB_GPIO1_LATCH	0x8
+#define XTAL_MODE	    BIT(9)
 
 static int armada_3700_xtal_clock_probe(struct platform_device *pdev)
 {



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 690/717] clk: tegra: Do not return 0 on failure
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (687 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 689/717] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 691/717] counter: microchip-tcb-capture: Fix CMR value check Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolin Chen, Thierry Reding

From: Nicolin Chen <nicoleotsuka@gmail.com>

commit 6160aca443148416994c022a35c77daeba948ea6 upstream.

Return values from read_dt_param() will be either TRUE (1) or
FALSE (0), while dfll_fetch_pwm_params() returns 0 on success
or an ERR code on failure.

So this patch fixes the bug of returning 0 on failure.

Fixes: 36541f0499fe ("clk: tegra: dfll: support PWM regulator control")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/tegra/clk-dfll.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/clk/tegra/clk-dfll.c
+++ b/drivers/clk/tegra/clk-dfll.c
@@ -1856,13 +1856,13 @@ static int dfll_fetch_pwm_params(struct
 			    &td->reg_init_uV);
 	if (!ret) {
 		dev_err(td->dev, "couldn't get initialized voltage\n");
-		return ret;
+		return -EINVAL;
 	}
 
 	ret = read_dt_param(td, "nvidia,pwm-period-nanoseconds", &pwm_period);
 	if (!ret) {
 		dev_err(td->dev, "couldn't get PWM period\n");
-		return ret;
+		return -EINVAL;
 	}
 	td->pwm_rate = (NSEC_PER_SEC / pwm_period) * (MAX_DFLL_VOLTAGES - 1);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 691/717] counter: microchip-tcb-capture: Fix CMR value check
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (688 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 690/717] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 692/717] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, William Breathitt Gray,
	Alexandre Belloni, Kamel Bouhara, Stable, Jonathan Cameron

From: William Breathitt Gray <vilhelm.gray@gmail.com>

commit 3418bd7cfce0bd8ef1ccedc4655f9f86f6c3b0ca upstream.

The ATMEL_TC_ETRGEDG_* defines are not masks but rather possible values
for CMR. This patch fixes the action_get() callback to properly check
for these values rather than mask them.

Fixes: 106b104137fd ("counter: Add microchip TCB capture counter")
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Kamel Bouhara <kamel.bouhara@bootlin.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201114232805.253108-1-vilhelm.gray@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/counter/microchip-tcb-capture.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

--- a/drivers/counter/microchip-tcb-capture.c
+++ b/drivers/counter/microchip-tcb-capture.c
@@ -183,16 +183,20 @@ static int mchp_tc_count_action_get(stru
 
 	regmap_read(priv->regmap, ATMEL_TC_REG(priv->channel[0], CMR), &cmr);
 
-	*action = MCHP_TC_SYNAPSE_ACTION_NONE;
-
-	if (cmr & ATMEL_TC_ETRGEDG_NONE)
+	switch (cmr & ATMEL_TC_ETRGEDG) {
+	default:
 		*action = MCHP_TC_SYNAPSE_ACTION_NONE;
-	else if (cmr & ATMEL_TC_ETRGEDG_RISING)
+		break;
+	case ATMEL_TC_ETRGEDG_RISING:
 		*action = MCHP_TC_SYNAPSE_ACTION_RISING_EDGE;
-	else if (cmr & ATMEL_TC_ETRGEDG_FALLING)
+		break;
+	case ATMEL_TC_ETRGEDG_FALLING:
 		*action = MCHP_TC_SYNAPSE_ACTION_FALLING_EDGE;
-	else if (cmr & ATMEL_TC_ETRGEDG_BOTH)
+		break;
+	case ATMEL_TC_ETRGEDG_BOTH:
 		*action = MCHP_TC_SYNAPSE_ACTION_BOTH_EDGE;
+		break;
+	}
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 692/717] device-dax/core: Fix memory leak when rmmod dax.ko
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (689 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 691/717] counter: microchip-tcb-capture: Fix CMR value check Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 693/717] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Dan Williams

From: Wang Hai <wanghai38@huawei.com>

commit 1aa574312518ef1d60d2dc62d58f7021db3b163a upstream.

When I repeatedly modprobe and rmmod dax.ko, kmemleak report a
memory leak as follows:

unreferenced object 0xffff9a5588c05088 (size 8):
  comm "modprobe", pid 261, jiffies 4294693644 (age 42.063s)
...
  backtrace:
    [<00000000e007ced0>] kstrdup+0x35/0x70
    [<000000002ae73897>] kstrdup_const+0x3d/0x50
    [<000000002b00c9c3>] kvasprintf_const+0xbc/0xf0
    [<000000008023282f>] kobject_set_name_vargs+0x3b/0xd0
    [<00000000d2cbaa4e>] kobject_set_name+0x62/0x90
    [<00000000202e7a22>] bus_register+0x7f/0x2b0
    [<000000000b77792c>] 0xffffffffc02840f7
    [<000000002d5be5ac>] 0xffffffffc02840b4
    [<00000000dcafb7cd>] do_one_initcall+0x58/0x240
    [<00000000049fe480>] do_init_module+0x56/0x1e2
    [<0000000022671491>] load_module+0x2517/0x2840
    [<000000001a2201cb>] __do_sys_finit_module+0x9c/0xe0
    [<000000003eb304e7>] do_syscall_64+0x33/0x40
    [<0000000051c5fd06>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

When rmmod dax is executed, dax_bus_exit() is missing. This patch
can fix this bug.

Fixes: 9567da0b408a ("device-dax: Introduce bus + driver model")
Cc: <stable@vger.kernel.org>
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201201135929.66530-1-wanghai38@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dax/super.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -752,6 +752,7 @@ err_chrdev:
 
 static void __exit dax_core_exit(void)
 {
+	dax_bus_exit();
 	unregister_chrdev_region(dax_devt, MINORMASK+1);
 	ida_destroy(&dax_minor_ida);
 	dax_fs_exit();



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 693/717] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (690 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 692/717] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 694/717] driver: core: Fix list corruption after device_del() Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Niranjana Vishwanathapura,
	Maarten Lankhorst, Thomas Hellström

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

commit bf8975837dac156c33a4d15d46602700998cb6dd upstream.

We hardcode the maximum number of shared fences to 4, instead of
respecting num_fences. Use a minimum of 4, but more if num_fences
is higher.

This seems to have been an oversight when first implementing the
api.

Fixes: 04a5faa8cbe5 ("reservation: update api and add some helpers")
Cc: <stable@vger.kernel.org> # v3.17+
Reported-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201124115707.406917-1-maarten.lankhorst@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma-buf/dma-resv.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -200,7 +200,7 @@ int dma_resv_reserve_shared(struct dma_r
 			max = max(old->shared_count + num_fences,
 				  old->shared_max * 2);
 	} else {
-		max = 4;
+		max = max(4ul, roundup_pow_of_two(num_fences));
 	}
 
 	new = dma_resv_list_alloc(max);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 694/717] driver: core: Fix list corruption after device_del()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (691 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 693/717] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 695/717] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Takashi Iwai,
	Saravana Kannan

From: Takashi Iwai <tiwai@suse.de>

commit 66482f640755b31cb94371ff6cef17400cda6db5 upstream.

The device_links_purge() function (called from device_del()) tries to
remove the links.needs_suppliers list entry, but it's using
list_del(), hence it doesn't initialize after the removal.  This is OK
for normal cases where device_del() is called via device_destroy().
However, it's not guaranteed that the device object will be really
deleted soon after device_del().  In a minor case like HD-audio codec
reconfiguration that re-initializes the device after device_del(), it
may lead to a crash by the corrupted list entry.

As a simple fix, replace list_del() with list_del_init() in order to
make the list intact after the device_del() call.

Fixes: e2ae9bcc4aaa ("driver core: Add support for linking devices during device addition")
Cc: <stable@vger.kernel.org>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20201208190326.27531-1-tiwai@suse.de
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1386,7 +1386,7 @@ static void device_links_purge(struct de
 		return;
 
 	mutex_lock(&wfs_lock);
-	list_del(&dev->links.needs_suppliers);
+	list_del_init(&dev->links.needs_suppliers);
 	mutex_unlock(&wfs_lock);
 
 	/*



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 695/717] xen-blkback: set ring->xenblkd to NULL after kthread_stop()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (692 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 694/717] driver: core: Fix list corruption after device_del() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 696/717] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olivier Benjamin,
	Pawel Wieczorkiewicz, Julien Grall, Juergen Gross

From: Pawel Wieczorkiewicz <wipawel@amazon.de>

commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.

When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.

However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.

In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).

This is XSA-350.

Cc: <stable@vger.kernel.org> # 4.12
Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben@amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/xen-blkback/xenbus.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -274,6 +274,7 @@ static int xen_blkif_disconnect(struct x
 
 		if (ring->xenblkd) {
 			kthread_stop(ring->xenblkd);
+			ring->xenblkd = NULL;
 			wake_up(&ring->shutdown_wq);
 		}
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 696/717] xen/xenbus: Allow watches discard events before queueing
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (693 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 695/717] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 697/717] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit fed1755b118147721f2c87b37b9d66e62c39b668 upstream.

If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.

Fortunately, some watch events could be ignored, depending on its
handler callback.  For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events.  Or, some
watches could ignore events to same path.

To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'.  If
it is not NULL, it will be called for each new event just before
enqueuing it.  Then, if the callback returns false, the event will be
discarded.  No watch is using the callback for now, though.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/xen-netback/xenbus.c   |    4 ++++
 drivers/xen/xenbus/xenbus_client.c |    1 +
 drivers/xen/xenbus/xenbus_xs.c     |    5 ++++-
 include/xen/xenbus.h               |    7 +++++++
 4 files changed, 16 insertions(+), 1 deletion(-)

--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -557,12 +557,14 @@ static int xen_register_credit_watch(str
 		return -ENOMEM;
 	snprintf(node, maxlen, "%s/rate", dev->nodename);
 	vif->credit_watch.node = node;
+	vif->credit_watch.will_handle = NULL;
 	vif->credit_watch.callback = xen_net_rate_changed;
 	err = register_xenbus_watch(&vif->credit_watch);
 	if (err) {
 		pr_err("Failed to set watcher %s\n", vif->credit_watch.node);
 		kfree(node);
 		vif->credit_watch.node = NULL;
+		vif->credit_watch.will_handle = NULL;
 		vif->credit_watch.callback = NULL;
 	}
 	return err;
@@ -609,6 +611,7 @@ static int xen_register_mcast_ctrl_watch
 	snprintf(node, maxlen, "%s/request-multicast-control",
 		 dev->otherend);
 	vif->mcast_ctrl_watch.node = node;
+	vif->mcast_ctrl_watch.will_handle = NULL;
 	vif->mcast_ctrl_watch.callback = xen_mcast_ctrl_changed;
 	err = register_xenbus_watch(&vif->mcast_ctrl_watch);
 	if (err) {
@@ -616,6 +619,7 @@ static int xen_register_mcast_ctrl_watch
 		       vif->mcast_ctrl_watch.node);
 		kfree(node);
 		vif->mcast_ctrl_watch.node = NULL;
+		vif->mcast_ctrl_watch.will_handle = NULL;
 		vif->mcast_ctrl_watch.callback = NULL;
 	}
 	return err;
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -133,6 +133,7 @@ int xenbus_watch_path(struct xenbus_devi
 	int err;
 
 	watch->node = path;
+	watch->will_handle = NULL;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -705,7 +705,10 @@ int xs_watch_msg(struct xs_watch_event *
 
 	spin_lock(&watches_lock);
 	event->handle = find_watch(event->token);
-	if (event->handle != NULL) {
+	if (event->handle != NULL &&
+			(!event->handle->will_handle ||
+			 event->handle->will_handle(event->handle,
+				 event->path, event->token))) {
 		spin_lock(&watch_events_lock);
 		list_add_tail(&event->list, &watch_events);
 		wake_up(&watch_events_waitq);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -61,6 +61,13 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	/*
+	 * Called just before enqueing new event while a spinlock is held.
+	 * The event will be discarded if this callback returns false.
+	 */
+	bool (*will_handle)(struct xenbus_watch *,
+			      const char *path, const char *token);
+
 	/* Callback (executed in a process context with no locks held). */
 	void (*callback)(struct xenbus_watch *,
 			 const char *path, const char *token);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 697/717] xen/xenbus: Add will_handle callback support in xenbus_watch_path()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (694 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 696/717] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 698/717] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 2e85d32b1c865bec703ce0c962221a5e955c52c2 upstream.

Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead.  This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/xen-blkback/xenbus.c |    3 ++-
 drivers/net/xen-netback/xenbus.c   |    2 +-
 drivers/xen/xen-pciback/xenbus.c   |    2 +-
 drivers/xen/xenbus/xenbus_client.c |    9 +++++++--
 drivers/xen/xenbus/xenbus_probe.c  |    2 +-
 include/xen/xenbus.h               |    6 +++++-
 6 files changed, 17 insertions(+), 7 deletions(-)

--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -676,7 +676,8 @@ static int xen_blkbk_probe(struct xenbus
 	/* setup back pointer */
 	be->blkif->be = be;
 
-	err = xenbus_watch_pathfmt(dev, &be->backend_watch, backend_changed,
+	err = xenbus_watch_pathfmt(dev, &be->backend_watch, NULL,
+				   backend_changed,
 				   "%s/%s", dev->nodename, "physical-device");
 	if (err)
 		goto fail;
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -824,7 +824,7 @@ static void connect(struct backend_info
 	xenvif_carrier_on(be->vif);
 
 	unregister_hotplug_status_watch(be);
-	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
 				   hotplug_status_changed,
 				   "%s/%s", dev->nodename, "hotplug-status");
 	if (!err)
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -689,7 +689,7 @@ static int xen_pcibk_xenbus_probe(struct
 
 	/* watch the backend node for backend configuration information */
 	err = xenbus_watch_path(dev, dev->nodename, &pdev->be_watch,
-				xen_pcibk_be_watch);
+				NULL, xen_pcibk_be_watch);
 	if (err)
 		goto out;
 
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -127,19 +127,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);
  */
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char *, const char *),
 		      void (*callback)(struct xenbus_watch *,
 				       const char *, const char *))
 {
 	int err;
 
 	watch->node = path;
-	watch->will_handle = NULL;
+	watch->will_handle = will_handle;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
 
 	if (err) {
 		watch->node = NULL;
+		watch->will_handle = NULL;
 		watch->callback = NULL;
 		xenbus_dev_fatal(dev, err, "adding watch on %s", path);
 	}
@@ -166,6 +169,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);
  */
 int xenbus_watch_pathfmt(struct xenbus_device *dev,
 			 struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					const char *, const char *),
 			 void (*callback)(struct xenbus_watch *,
 					  const char *, const char *),
 			 const char *pathfmt, ...)
@@ -182,7 +187,7 @@ int xenbus_watch_pathfmt(struct xenbus_d
 		xenbus_dev_fatal(dev, -ENOMEM, "allocating path for watch");
 		return -ENOMEM;
 	}
-	err = xenbus_watch_path(dev, path, watch, callback);
+	err = xenbus_watch_path(dev, path, watch, will_handle, callback);
 
 	if (err)
 		kfree(path);
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,7 @@ static int watch_otherend(struct xenbus_
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    bus->otherend_changed,
+				    NULL, bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -204,10 +204,14 @@ void xenbus_probe(struct work_struct *);
 
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char *, const char *),
 		      void (*callback)(struct xenbus_watch *,
 				       const char *, const char *));
-__printf(4, 5)
+__printf(5, 6)
 int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					     const char *, const char *),
 			 void (*callback)(struct xenbus_watch *,
 					  const char *, const char *),
 			 const char *pathfmt, ...);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 698/717] xen/xenbus/xen_bus_type: Support will_handle watch callback
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (695 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 697/717] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 699/717] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit be987200fbaceaef340872841d4f7af2c5ee8dc3 upstream.

This commit adds support of the 'will_handle' watch callback for
'xen_bus_type' users.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus.h       |    2 ++
 drivers/xen/xenbus/xenbus_probe.c |    3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -44,6 +44,8 @@ struct xen_bus_type {
 	int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE], const char *nodename);
 	int (*probe)(struct xen_bus_type *bus, const char *type,
 		     const char *dir);
+	bool (*otherend_will_handle)(struct xenbus_watch *watch,
+				     const char *path, const char *token);
 	void (*otherend_changed)(struct xenbus_watch *watch, const char *path,
 				 const char *token);
 	struct bus_type bus;
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,8 @@ static int watch_otherend(struct xenbus_
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    NULL, bus->otherend_changed,
+				    bus->otherend_will_handle,
+				    bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 699/717] xen/xenbus: Count pending messages for each watch
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (696 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 698/717] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 700/717] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream.

This commit adds a counter of pending messages for each watch in the
struct.  It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus_xs.c |   29 ++++++++++++++++++-----------
 include/xen/xenbus.h           |    2 ++
 2 files changed, 20 insertions(+), 11 deletions(-)

--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -711,6 +711,7 @@ int xs_watch_msg(struct xs_watch_event *
 				 event->path, event->token))) {
 		spin_lock(&watch_events_lock);
 		list_add_tail(&event->list, &watch_events);
+		event->handle->nr_pending++;
 		wake_up(&watch_events_waitq);
 		spin_unlock(&watch_events_lock);
 	} else
@@ -768,6 +769,8 @@ int register_xenbus_watch(struct xenbus_
 
 	sprintf(token, "%lX", (long)watch);
 
+	watch->nr_pending = 0;
+
 	down_read(&xs_watch_rwsem);
 
 	spin_lock(&watches_lock);
@@ -817,11 +820,14 @@ void unregister_xenbus_watch(struct xenb
 
 	/* Cancel pending watch events. */
 	spin_lock(&watch_events_lock);
-	list_for_each_entry_safe(event, tmp, &watch_events, list) {
-		if (event->handle != watch)
-			continue;
-		list_del(&event->list);
-		kfree(event);
+	if (watch->nr_pending) {
+		list_for_each_entry_safe(event, tmp, &watch_events, list) {
+			if (event->handle != watch)
+				continue;
+			list_del(&event->list);
+			kfree(event);
+		}
+		watch->nr_pending = 0;
 	}
 	spin_unlock(&watch_events_lock);
 
@@ -868,7 +874,6 @@ void xs_suspend_cancel(void)
 
 static int xenwatch_thread(void *unused)
 {
-	struct list_head *ent;
 	struct xs_watch_event *event;
 
 	xenwatch_pid = current->pid;
@@ -883,13 +888,15 @@ static int xenwatch_thread(void *unused)
 		mutex_lock(&xenwatch_mutex);
 
 		spin_lock(&watch_events_lock);
-		ent = watch_events.next;
-		if (ent != &watch_events)
-			list_del(ent);
+		event = list_first_entry_or_null(&watch_events,
+				struct xs_watch_event, list);
+		if (event) {
+			list_del(&event->list);
+			event->handle->nr_pending--;
+		}
 		spin_unlock(&watch_events_lock);
 
-		if (ent != &watch_events) {
-			event = list_entry(ent, struct xs_watch_event, list);
+		if (event) {
 			event->handle->callback(event->handle, event->path,
 						event->token);
 			kfree(event);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -61,6 +61,8 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	unsigned int nr_pending;
+
 	/*
 	 * Called just before enqueing new event while a spinlock is held.
 	 * The event will be discarded if this callback returns false.



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 700/717] xenbus/xenbus_backend: Disallow pending watch messages
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (697 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 699/717] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 701/717] memory: jz4780_nemc: Fix an error pointer vs NULL check in probe() Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 9996bd494794a2fe393e97e7a982388c6249aa76 upstream.

'xenbus_backend' watches 'state' of devices, which is writable by
guests.  Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0.  In other words, guests
can trigger dom0 memory pressure.  This is known as XSA-349.  However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.

To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus_probe_backend.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/xen/xenbus/xenbus_probe_backend.c
+++ b/drivers/xen/xenbus/xenbus_probe_backend.c
@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct x
 	return err;
 }
 
+static bool frontend_will_handle(struct xenbus_watch *watch,
+				 const char *path, const char *token)
+{
+	return watch->nr_pending == 0;
+}
+
 static void frontend_changed(struct xenbus_watch *watch,
 			     const char *path, const char *token)
 {
@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backen
 	.levels = 3,		/* backend/type/<frontend>/<id> */
 	.get_bus_id = backend_bus_id,
 	.probe = xenbus_probe_backend,
+	.otherend_will_handle = frontend_will_handle,
 	.otherend_changed = frontend_changed,
 	.bus = {
 		.name		= "xen-backend",



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 701/717] memory: jz4780_nemc: Fix an error pointer vs NULL check in probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (698 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 700/717] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 702/717] memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe() Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Paul Cercueil,
	Krzysztof Kozlowski

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 96999c797ec1ef41259f00b4ddf9cf33b342cb78 upstream.

The devm_ioremap() function returns NULL on error, it doesn't return
error pointers.  This bug could lead to an Oops during probe.

Fixes: f046e4a3f0b9 ("memory: jz4780_nemc: Only request IO memory the driver will use")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20200803143607.GC346925@mwanda
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/memory/jz4780-nemc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/memory/jz4780-nemc.c
+++ b/drivers/memory/jz4780-nemc.c
@@ -306,9 +306,9 @@ static int jz4780_nemc_probe(struct plat
 	}
 
 	nemc->base = devm_ioremap(dev, res->start, NEMC_REG_LEN);
-	if (IS_ERR(nemc->base)) {
+	if (!nemc->base) {
 		dev_err(dev, "failed to get I/O memory\n");
-		return PTR_ERR(nemc->base);
+		return -ENOMEM;
 	}
 
 	writel(0, nemc->base + NEMC_NFCSR);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 702/717] memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (699 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 701/717] memory: jz4780_nemc: Fix an error pointer vs NULL check in probe() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 703/717] memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer() Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Machek, Lad Prabhakar,
	Sergei Shtylyov, Geert Uytterhoeven, Krzysztof Kozlowski

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

commit 4e6b86b409f9fc63fedb39d6e3a0202c4b0244ce upstream.

Release the node reference by calling of_node_put(flash) in the probe.

Fixes: ca7d8b980b67f ("memory: add Renesas RPC-IF driver")
Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/memory/renesas-rpc-if.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -560,9 +560,11 @@ static int rpcif_probe(struct platform_d
 	} else if (of_device_is_compatible(flash, "cfi-flash")) {
 		name = "rpc-if-hyperflash";
 	} else	{
+		of_node_put(flash);
 		dev_warn(&pdev->dev, "unknown flash type\n");
 		return -ENODEV;
 	}
+	of_node_put(flash);
 
 	vdev = platform_device_alloc(name, pdev->id);
 	if (!vdev)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 703/717] memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer()
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (700 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 702/717] memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 704/717] memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Machek, Lad Prabhakar,
	Sergei Shtylyov, Geert Uytterhoeven, Krzysztof Kozlowski

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

commit a0453f4ed066cae651b3119ed11f52d31dae1eca upstream.

In the error path of rpcif_manual_xfer() the value of ret is overwritten
by value returned by reset_control_reset() function and thus returning
incorrect value to the caller.

This patch makes sure the correct value is returned to the caller of
rpcif_manual_xfer() by dropping the overwrite of ret in error path.
Also now we ignore the value returned by reset_control_reset() in the
error path and instead print a error message when it fails.

Fixes: ca7d8b980b67f ("memory: add Renesas RPC-IF driver")
Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/memory/renesas-rpc-if.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -508,7 +508,8 @@ exit:
 	return ret;
 
 err_out:
-	ret = reset_control_reset(rpc->rstc);
+	if (reset_control_reset(rpc->rstc))
+		dev_err(rpc->dev, "Failed to reset HW\n");
 	rpcif_hw_init(rpc, rpc->bus_size == 2);
 	goto exit;
 }



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 704/717] memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (701 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 703/717] memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 705/717] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Lad Prabhakar,
	Sergei Shtylyov, Krzysztof Kozlowski

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

commit 61a6d854b9555b420fbfae62ef26baa8b9493b32 upstream.

rpcif_enable_rpm calls pm_runtime_enable, so rpcif_disable_rpm needs to
call pm_runtime_disable and not pm_runtime_put_sync.

Fixes: ca7d8b980b67f ("memory: add Renesas RPC-IF driver")
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/memory/renesas-rpc-if.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -212,7 +212,7 @@ EXPORT_SYMBOL(rpcif_enable_rpm);
 
 void rpcif_disable_rpm(struct rpcif *rpc)
 {
-	pm_runtime_put_sync(rpc->dev);
+	pm_runtime_disable(rpc->dev);
 }
 EXPORT_SYMBOL(rpcif_disable_rpm);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 705/717] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (702 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 704/717] memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 706/717] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vishal Verma, Dave Jiang, Ira Weiny,
	Dan Williams

From: Dan Williams <dan.j.williams@intel.com>

commit 2dd2a1740ee19cd2636d247276cf27bfa434b0e2 upstream.

A recent change to ndctl to attempt to reconfigure namespaces in place
uncovered a label accounting problem in block-window-type namespaces.
The ndctl "create.sh" test is able to trigger this signature:

 WARNING: CPU: 34 PID: 9167 at drivers/nvdimm/label.c:1100 __blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 RIP: 0010:__blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 Call Trace:
  uuid_store+0x21b/0x2f0 [libnvdimm]
  kernfs_fop_write+0xcf/0x1c0
  vfs_write+0xcc/0x380
  ksys_write+0x68/0xe0

When allocated capacity for a namespace is renamed (new UUID) the labels
with the old UUID need to be deleted. The ndctl behavior to always
destroy namespaces on reconfiguration hid this problem.

The immediate impact of this bug is limited since block-window-type
namespaces only seem to exist in the specification and not in any
shipping products. However, the label handling code is being reused for
other technologies like CXL region labels, so there is a benefit to
making sure both vertical labels sets (block-window) and horizontal
label sets (pmem) have a functional reference implementation in
libnvdimm.

Fixes: c4703ce11c23 ("libnvdimm/namespace: Fix label tracking error")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvdimm/label.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -980,6 +980,15 @@ static int __blk_label_update(struct nd_
 		}
 	}
 
+	/* release slots associated with any invalidated UUIDs */
+	mutex_lock(&nd_mapping->lock);
+	list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list)
+		if (test_and_clear_bit(ND_LABEL_REAP, &label_ent->flags)) {
+			reap_victim(nd_mapping, label_ent);
+			list_move(&label_ent->list, &list);
+		}
+	mutex_unlock(&nd_mapping->lock);
+
 	/*
 	 * Find the resource associated with the first label in the set
 	 * per the v1.2 namespace specification.



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 706/717] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (703 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 705/717] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 707/717] tracing: Disable ftrace selftests when any tracer is running Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Carlos Garnacho, Hans de Goede

From: Carlos Garnacho <carlosg@gnome.org>

commit fe6000990394639ed374cb76c313be3640714f47 upstream.

This 2-in-1 model (Product name: Switch SA5-271) features a SW_TABLET_MODE
that works as it would be expected, both when detaching the keyboard and
when folding it behind the tablet body.

It used to work until the introduction of the allow list at
commit 8169bd3e6e193 ("platform/x86: intel-vbtn: Switch to an allow-list
for SW_TABLET_MODE reporting"). Add this model to it, so that the Virtual
Buttons device announces the EV_SW features again.

Fixes: 8169bd3e6e193 ("platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Link: https://lore.kernel.org/r/20201201135727.212917-1-carlosg@gnome.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/intel-vbtn.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -216,6 +216,12 @@ static const struct dmi_system_id dmi_sw
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271"),
+		},
+	},
 	{} /* Array terminator */
 };
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 707/717] tracing: Disable ftrace selftests when any tracer is running
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (704 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 706/717] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 708/717] mt76: add back the SUPPORTS_REORDERING_BUFFER flag Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Masami Hiramatsu,
	Steven Rostedt (VMware)

From: Masami Hiramatsu <mhiramat@kernel.org>

commit 60efe21e5976d3d4170a8190ca76a271d6419754 upstream.

Disable ftrace selftests when any tracer (kernel command line options
like ftrace=, trace_events=, kprobe_events=, and boot-time tracing)
starts running because selftest can disturb it.

Currently ftrace= and trace_events= are checked, but kprobe_events
has a different flag, and boot-time tracing didn't checked. This unifies
the disabled flag and all of those boot-time tracing features sets
the flag.

This also fixes warnings on kprobe-event selftest
(CONFIG_FTRACE_STARTUP_TEST=y and CONFIG_KPROBE_EVENTS=y) with boot-time
tracing (ftrace.event.kprobes.EVENT.probes) like below;

[   59.803496] trace_kprobe: Testing kprobe tracing:
[   59.804258] ------------[ cut here ]------------
[   59.805682] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:1987 kprobe_trace_self_tests_ib
[   59.806944] Modules linked in:
[   59.807335] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.10.0-rc7+ #172
[   59.808029] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/204
[   59.808999] RIP: 0010:kprobe_trace_self_tests_init+0x5f/0x42b
[   59.809696] Code: e8 03 00 00 48 c7 c7 30 8e 07 82 e8 6d 3c 46 ff 48 c7 c6 00 b2 1a 81 48 c7 c7 7
[   59.812439] RSP: 0018:ffffc90000013e78 EFLAGS: 00010282
[   59.813038] RAX: 00000000ffffffef RBX: 0000000000000000 RCX: 0000000000049443
[   59.813780] RDX: 0000000000049403 RSI: 0000000000049403 RDI: 000000000002deb0
[   59.814589] RBP: ffffc90000013e90 R08: 0000000000000001 R09: 0000000000000001
[   59.815349] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000ffffffef
[   59.816138] R13: ffff888004613d80 R14: ffffffff82696940 R15: ffff888004429138
[   59.816877] FS:  0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000
[   59.817772] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   59.818395] CR2: 0000000001a8dd38 CR3: 0000000002222000 CR4: 00000000000006a0
[   59.819144] Call Trace:
[   59.819469]  ? init_kprobe_trace+0x6b/0x6b
[   59.819948]  do_one_initcall+0x5f/0x300
[   59.820392]  ? rcu_read_lock_sched_held+0x4f/0x80
[   59.820916]  kernel_init_freeable+0x22a/0x271
[   59.821416]  ? rest_init+0x241/0x241
[   59.821841]  kernel_init+0xe/0x10f
[   59.822251]  ret_from_fork+0x22/0x30
[   59.822683] irq event stamp: 16403349
[   59.823121] hardirqs last  enabled at (16403359): [<ffffffff810db81e>] console_unlock+0x48e/0x580
[   59.824074] hardirqs last disabled at (16403368): [<ffffffff810db786>] console_unlock+0x3f6/0x580
[   59.825036] softirqs last  enabled at (16403200): [<ffffffff81c0033a>] __do_softirq+0x33a/0x484
[   59.825982] softirqs last disabled at (16403087): [<ffffffff81a00f02>] asm_call_irq_on_stack+0x10
[   59.827034] ---[ end trace 200c544775cdfeb3 ]---
[   59.827635] trace_kprobe: error on probing function entry.

Link: https://lkml.kernel.org/r/160741764955.3448999.3347769358299456915.stgit@devnote2

Fixes: 4d655281eb1b ("tracing/boot Add kprobe event support")
Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace.c          |   19 +++++++++++++------
 kernel/trace/trace.h          |    5 +++++
 kernel/trace/trace_boot.c     |    2 ++
 kernel/trace/trace_events.c   |    2 +-
 kernel/trace/trace_kprobe.c   |    9 +++------
 kernel/trace/trace_selftest.c |    2 +-
 6 files changed, 25 insertions(+), 14 deletions(-)

--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -68,10 +68,21 @@ bool ring_buffer_expanded;
 static bool __read_mostly tracing_selftest_running;
 
 /*
- * If a tracer is running, we do not want to run SELFTEST.
+ * If boot-time tracing including tracers/events via kernel cmdline
+ * is running, we do not want to run SELFTEST.
  */
 bool __read_mostly tracing_selftest_disabled;
 
+#ifdef CONFIG_FTRACE_STARTUP_TEST
+void __init disable_tracing_selftest(const char *reason)
+{
+	if (!tracing_selftest_disabled) {
+		tracing_selftest_disabled = true;
+		pr_info("Ftrace startup test is disabled due to %s\n", reason);
+	}
+}
+#endif
+
 /* Pipe tracepoints to printk */
 struct trace_iterator *tracepoint_print_iter;
 int tracepoint_printk;
@@ -2113,11 +2124,7 @@ int __init register_tracer(struct tracer
 	apply_trace_boot_options();
 
 	/* disable other selftests, since this will break it. */
-	tracing_selftest_disabled = true;
-#ifdef CONFIG_FTRACE_STARTUP_TEST
-	printk(KERN_INFO "Disabling FTRACE selftests due to running tracer '%s'\n",
-	       type->name);
-#endif
+	disable_tracing_selftest("running a tracer");
 
  out_unlock:
 	return ret;
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -896,6 +896,8 @@ extern bool ring_buffer_expanded;
 extern bool tracing_selftest_disabled;
 
 #ifdef CONFIG_FTRACE_STARTUP_TEST
+extern void __init disable_tracing_selftest(const char *reason);
+
 extern int trace_selftest_startup_function(struct tracer *trace,
 					   struct trace_array *tr);
 extern int trace_selftest_startup_function_graph(struct tracer *trace,
@@ -919,6 +921,9 @@ extern int trace_selftest_startup_branch
  */
 #define __tracer_data		__refdata
 #else
+static inline void __init disable_tracing_selftest(const char *reason)
+{
+}
 /* Tracers are seldom changed. Optimize when selftests are disabled. */
 #define __tracer_data		__read_mostly
 #endif /* CONFIG_FTRACE_STARTUP_TEST */
--- a/kernel/trace/trace_boot.c
+++ b/kernel/trace/trace_boot.c
@@ -344,6 +344,8 @@ static int __init trace_boot_init(void)
 	trace_boot_init_one_instance(tr, trace_node);
 	trace_boot_init_instances(trace_node);
 
+	disable_tracing_selftest("running boot-time tracing");
+
 	return 0;
 }
 /*
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3201,7 +3201,7 @@ static __init int setup_trace_event(char
 {
 	strlcpy(bootup_event_buf, str, COMMAND_LINE_SIZE);
 	ring_buffer_expanded = true;
-	tracing_selftest_disabled = true;
+	disable_tracing_selftest("running event tracing");
 
 	return 1;
 }
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -25,11 +25,12 @@
 
 /* Kprobe early definition from command line */
 static char kprobe_boot_events_buf[COMMAND_LINE_SIZE] __initdata;
-static bool kprobe_boot_events_enabled __initdata;
 
 static int __init set_kprobe_boot_events(char *str)
 {
 	strlcpy(kprobe_boot_events_buf, str, COMMAND_LINE_SIZE);
+	disable_tracing_selftest("running kprobe events");
+
 	return 0;
 }
 __setup("kprobe_event=", set_kprobe_boot_events);
@@ -1887,8 +1888,6 @@ static __init void setup_boot_kprobe_eve
 		ret = trace_run_command(cmd, create_or_delete_trace_kprobe);
 		if (ret)
 			pr_warn("Failed to add event(%d): %s\n", ret, cmd);
-		else
-			kprobe_boot_events_enabled = true;
 
 		cmd = p;
 	}
@@ -1973,10 +1972,8 @@ static __init int kprobe_trace_self_test
 	if (tracing_is_disabled())
 		return -ENODEV;
 
-	if (kprobe_boot_events_enabled) {
-		pr_info("Skipping kprobe tests due to kprobe_event on cmdline\n");
+	if (tracing_selftest_disabled)
 		return 0;
-	}
 
 	target = kprobe_trace_selftest_target;
 
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -787,7 +787,7 @@ trace_selftest_startup_function_graph(st
 
 	/* Have we just recovered from a hang? */
 	if (graph_hang_thresh > GRAPH_MAX_FUNC_TEST) {
-		tracing_selftest_disabled = true;
+		disable_tracing_selftest("recovering from a hang");
 		ret = -1;
 		goto out;
 	}



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 708/717] mt76: add back the SUPPORTS_REORDERING_BUFFER flag
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (705 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 707/717] tracing: Disable ftrace selftests when any tracer is running Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 709/717] of: fix linker-section match-table corruption Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau

From: Felix Fietkau <nbd@nbd.name>

commit ed89b89330b521f20682ead6bf93e1014b21a200 upstream.

It was accidentally dropped while adding multiple wiphy support
Fixes fast-rx support and avoids handling reordering in both mac80211
and the driver

Cc: stable@vger.kernel.org
Fixes: c89d36254155 ("mt76: add function for allocating an extra wiphy")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt76/mac80211.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -305,6 +305,7 @@ mt76_phy_init(struct mt76_dev *dev, stru
 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
 	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
+	ieee80211_hw_set(hw, SUPPORTS_REORDERING_BUFFER);
 
 	if (!(dev->drv->drv_flags & MT_DRV_AMSDU_OFFLOAD)) {
 		ieee80211_hw_set(hw, TX_AMSDU);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 709/717] of: fix linker-section match-table corruption
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (706 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 708/717] mt76: add back the SUPPORTS_REORDERING_BUFFER flag Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 710/717] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 5812b32e01c6d86ba7a84110702b46d8a8531fe9 upstream.

Specify type alignment when declaring linker-section match-table entries
to prevent gcc from increasing alignment and corrupting the various
tables with padding (e.g. timers, irqchips, clocks, reserved memory).

This is specifically needed on x86 where gcc (typically) aligns larger
objects like struct of_device_id with static extent on 32-byte
boundaries which at best prevents matching on anything but the first
entry. Specifying alignment when declaring variables suppresses this
optimisation.

Here's a 64-bit example where all entries are corrupt as 16 bytes of
padding has been inserted before the first entry:

	ffffffff8266b4b0 D __clk_of_table
	ffffffff8266b4c0 d __of_table_fixed_factor_clk
	ffffffff8266b5a0 d __of_table_fixed_clk
	ffffffff8266b680 d __clk_of_table_sentinel

And here's a 32-bit example where the 8-byte-aligned table happens to be
placed on a 32-byte boundary so that all but the first entry are corrupt
due to the 28 bytes of padding inserted between entries:

	812b3ec0 D __irqchip_of_table
	812b3ec0 d __of_table_irqchip1
	812b3fa0 d __of_table_irqchip2
	812b4080 d __of_table_irqchip3
	812b4160 d irqchip_of_match_end

Verified on x86 using gcc-9.3 and gcc-4.9 (which uses 64-byte
alignment), and on arm using gcc-7.2.

Note that there are no in-tree users of these tables on x86 currently
(even if they are included in the image).

Fixes: 54196ccbe0ba ("of: consolidate linker section OF match table declarations")
Fixes: f6e916b82022 ("irqchip: add basic infrastructure")
Cc: stable <stable@vger.kernel.org>     # 3.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20201123102319.8090-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/of.h |    1 +
 1 file changed, 1 insertion(+)

--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -1300,6 +1300,7 @@ static inline int of_get_available_child
 #define _OF_DECLARE(table, name, compat, fn, fn_type)			\
 	static const struct of_device_id __of_table_##name		\
 		__used __section("__" #table "_of_table")		\
+		__aligned(__alignof__(struct of_device_id))		\
 		 = { .compatible = compat,				\
 		     .data = (fn == (fn_type)NULL) ? fn : fn  }
 #else



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 710/717] PCI: Fix pci_slot_release() NULL pointer dereference
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (707 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 709/717] of: fix linker-section match-table corruption Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 711/717] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jubin Zhong, Bjorn Helgaas

From: Jubin Zhong <zhongjubin@huawei.com>

commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream.

If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots.  But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:

  Unable to handle kernel NULL pointer dereference at virtual address
00000000
  ...
  CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
  task: ffffeb398a45ef10 task.stack: ffffeb398a470000
  PC is at __list_del_entry_valid+0x5c/0xb0
  LR is at pci_slot_release+0x84/0xe4
  ...
  __list_del_entry_valid+0x5c/0xb0
  pci_slot_release+0x84/0xe4
  kobject_put+0x184/0x1c4
  pci_create_slot+0x17c/0x1b4
  __pci_hp_initialize+0x68/0xa4
  pciehp_probe+0x1a4/0x2fc
  pcie_port_probe_service+0x58/0x84
  driver_probe_device+0x320/0x470

Initialize slot->list before calling kobject_init_and_add() to avoid this.

Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/slot.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -272,6 +272,9 @@ placeholder:
 		goto err;
 	}
 
+	INIT_LIST_HEAD(&slot->list);
+	list_add(&slot->list, &parent->slots);
+
 	err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
 				   "%s", slot_name);
 	if (err) {
@@ -279,9 +282,6 @@ placeholder:
 		goto err;
 	}
 
-	INIT_LIST_HEAD(&slot->list);
-	list_add(&slot->list, &parent->slots);
-
 	down_read(&pci_bus_sem);
 	list_for_each_entry(dev, &parent->devices, bus_list)
 		if (PCI_SLOT(dev->devfn) == slot_nr)



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 711/717] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (708 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 710/717] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 712/717] remoteproc: sysmon: Ensure remote notification ordering Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, DingHua Ma, Chen-Yu Tsai, Mark Brown

From: DingHua Ma <dinghua.ma.sz@gmail.com>

commit 291de1d102fafef0798cdad9666cd4f8da7da7cc upstream.

When I use the axp20x chip to power my SDIO device on the 5.4 kernel,
the output voltage of DLDO2 is wrong. After comparing the register
manual and source code of the chip, I found that the mask bit of the
driver register of the port was wrong. I fixed this error by modifying
the mask register of the source code. This error seems to be a copy
error of the macro when writing the code. Now the voltage output of
the DLDO2 port of axp20x is correct. My development environment is
Allwinner A40I of arm architecture, and the kernel version is 5.4.

Signed-off-by: DingHua Ma <dinghua.ma.sz@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Cc: <stable@vger.kernel.org>
Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks")
Link: https://lore.kernel.org/r/20201201001000.22302-1-dinghua.ma.sz@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/axp20x-regulator.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -594,7 +594,7 @@ static const struct regulator_desc axp22
 		 AXP22X_DLDO1_V_OUT, AXP22X_DLDO1_V_OUT_MASK,
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_DLDO1_MASK),
 	AXP_DESC(AXP22X, DLDO2, "dldo2", "dldoin", 700, 3300, 100,
-		 AXP22X_DLDO2_V_OUT, AXP22X_PWR_OUT_DLDO2_MASK,
+		 AXP22X_DLDO2_V_OUT, AXP22X_DLDO2_V_OUT_MASK,
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_DLDO2_MASK),
 	AXP_DESC(AXP22X, DLDO3, "dldo3", "dldoin", 700, 3300, 100,
 		 AXP22X_DLDO3_V_OUT, AXP22X_DLDO3_V_OUT_MASK,



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 712/717] remoteproc: sysmon: Ensure remote notification ordering
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (709 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 711/717] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 713/717] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rishabh Bhatnagar, Bjorn Andersson

From: Bjorn Andersson <bjorn.andersson@linaro.org>

commit 138a6428ba9023ae29e103e87a223575fbc3d2b7 upstream.

The reliance on the remoteproc's state for determining when to send
sysmon notifications to a remote processor is racy with regard to
concurrent remoteproc operations.

Further more the advertisement of the state of other remote processor to
a newly started remote processor might not only send the wrong state,
but might result in a stream of state changes that are out of order.

Address this by introducing state tracking within the sysmon instances
themselves and extend the locking to ensure that the notifications are
consistent with this state.

Fixes: 1f36ab3f6e3b ("remoteproc: sysmon: Inform current rproc about all active rprocs")
Fixes: 1877f54f75ad ("remoteproc: sysmon: Add notifications for events")
Fixes: 1fb82ee806d1 ("remoteproc: qcom: Introduce sysmon")
Cc: stable@vger.kernel.org
Reviewed-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
Link: https://lore.kernel.org/r/20201122054135.802935-2-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/remoteproc/qcom_sysmon.c |   25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

--- a/drivers/remoteproc/qcom_sysmon.c
+++ b/drivers/remoteproc/qcom_sysmon.c
@@ -22,6 +22,9 @@ struct qcom_sysmon {
 	struct rproc_subdev subdev;
 	struct rproc *rproc;
 
+	int state;
+	struct mutex state_lock;
+
 	struct list_head node;
 
 	const char *name;
@@ -448,7 +451,10 @@ static int sysmon_prepare(struct rproc_s
 		.ssr_event = SSCTL_SSR_EVENT_BEFORE_POWERUP
 	};
 
+	mutex_lock(&sysmon->state_lock);
+	sysmon->state = SSCTL_SSR_EVENT_BEFORE_POWERUP;
 	blocking_notifier_call_chain(&sysmon_notifiers, 0, (void *)&event);
+	mutex_unlock(&sysmon->state_lock);
 
 	return 0;
 }
@@ -472,20 +478,25 @@ static int sysmon_start(struct rproc_sub
 		.ssr_event = SSCTL_SSR_EVENT_AFTER_POWERUP
 	};
 
+	mutex_lock(&sysmon->state_lock);
+	sysmon->state = SSCTL_SSR_EVENT_AFTER_POWERUP;
 	blocking_notifier_call_chain(&sysmon_notifiers, 0, (void *)&event);
+	mutex_unlock(&sysmon->state_lock);
 
 	mutex_lock(&sysmon_lock);
 	list_for_each_entry(target, &sysmon_list, node) {
-		if (target == sysmon ||
-		    target->rproc->state != RPROC_RUNNING)
+		if (target == sysmon)
 			continue;
 
+		mutex_lock(&target->state_lock);
 		event.subsys_name = target->name;
+		event.ssr_event = target->state;
 
 		if (sysmon->ssctl_version == 2)
 			ssctl_send_event(sysmon, &event);
 		else if (sysmon->ept)
 			sysmon_send_event(sysmon, &event);
+		mutex_unlock(&target->state_lock);
 	}
 	mutex_unlock(&sysmon_lock);
 
@@ -500,7 +511,10 @@ static void sysmon_stop(struct rproc_sub
 		.ssr_event = SSCTL_SSR_EVENT_BEFORE_SHUTDOWN
 	};
 
+	mutex_lock(&sysmon->state_lock);
+	sysmon->state = SSCTL_SSR_EVENT_BEFORE_SHUTDOWN;
 	blocking_notifier_call_chain(&sysmon_notifiers, 0, (void *)&event);
+	mutex_unlock(&sysmon->state_lock);
 
 	/* Don't request graceful shutdown if we've crashed */
 	if (crashed)
@@ -521,7 +535,10 @@ static void sysmon_unprepare(struct rpro
 		.ssr_event = SSCTL_SSR_EVENT_AFTER_SHUTDOWN
 	};
 
+	mutex_lock(&sysmon->state_lock);
+	sysmon->state = SSCTL_SSR_EVENT_AFTER_SHUTDOWN;
 	blocking_notifier_call_chain(&sysmon_notifiers, 0, (void *)&event);
+	mutex_unlock(&sysmon->state_lock);
 }
 
 /**
@@ -534,11 +551,10 @@ static int sysmon_notify(struct notifier
 			 void *data)
 {
 	struct qcom_sysmon *sysmon = container_of(nb, struct qcom_sysmon, nb);
-	struct rproc *rproc = sysmon->rproc;
 	struct sysmon_event *sysmon_event = data;
 
 	/* Skip non-running rprocs and the originating instance */
-	if (rproc->state != RPROC_RUNNING ||
+	if (sysmon->state != SSCTL_SSR_EVENT_AFTER_POWERUP ||
 	    !strcmp(sysmon_event->subsys_name, sysmon->name)) {
 		dev_dbg(sysmon->dev, "not notifying %s\n", sysmon->name);
 		return NOTIFY_DONE;
@@ -591,6 +607,7 @@ struct qcom_sysmon *qcom_add_sysmon_subd
 	init_completion(&sysmon->ind_comp);
 	init_completion(&sysmon->shutdown_comp);
 	mutex_init(&sysmon->lock);
+	mutex_init(&sysmon->state_lock);
 
 	sysmon->shutdown_irq = of_irq_get_byname(sysmon->dev->of_node,
 						 "shutdown-ack");



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 713/717] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (710 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 712/717] remoteproc: sysmon: Ensure remote notification ordering Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 714/717] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhuguangqing, Viresh Kumar, Daniel Lezcano

From: Zhuguangqing <zhuguangqing@xiaomi.com>

commit 236761f19a4f373354f1dcf399b57753f1f4b871 upstream.

If state has not changed successfully and we updated cpufreq_state,
next time when the new state is equal to cpufreq_state (not changed
successfully last time), we will return directly and miss a
freq_qos_update_request() that should have been.

Fixes: 5130802ddbb1 ("thermal: cpu_cooling: Switch to QoS requests for freq limits")
Cc: v5.4+ <stable@vger.kernel.org> # v5.4+
Signed-off-by: Zhuguangqing <zhuguangqing@xiaomi.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201106092243.15574-1-zhuguangqing83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/thermal/cpufreq_cooling.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/thermal/cpufreq_cooling.c
+++ b/drivers/thermal/cpufreq_cooling.c
@@ -438,13 +438,11 @@ static int cpufreq_set_cur_state(struct
 	if (cpufreq_cdev->cpufreq_state == state)
 		return 0;
 
-	cpufreq_cdev->cpufreq_state = state;
-
 	frequency = get_state_freq(cpufreq_cdev, state);
 
 	ret = freq_qos_update_request(&cpufreq_cdev->qos_req, frequency);
-
 	if (ret > 0) {
+		cpufreq_cdev->cpufreq_state = state;
 		cpus = cpufreq_cdev->policy->cpus;
 		max_capacity = arch_scale_cpu_capacity(cpumask_first(cpus));
 		capacity = frequency * max_capacity;



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 714/717] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (711 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 713/717] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 715/717] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikita Shubin, Alexandre Belloni

From: Nikita Shubin <nikita.shubin@maquefel.me>

commit 00c33482bb6110bce8110daa351f9b3baf4df7dc upstream.

Mismatch in probe platform_set_drvdata set's and method's that call
dev_get_platdata will result in "Unable to handle kernel NULL pointer
dereference", let's use according method for getting driver data after
platform_set_drvdata.

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = (ptrval)
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.9.10-00003-g723e101e0037-dirty #4
Hardware name: Technologic Systems TS-72xx SBC
PC is at ep93xx_rtc_read_time+0xc/0x2c
LR is at __rtc_read_time+0x4c/0x8c
[...]
[<c02b01c8>] (ep93xx_rtc_read_time) from [<c02ac38c>] (__rtc_read_time+0x4c/0x8c)
[<c02ac38c>] (__rtc_read_time) from [<c02ac3f8>] (rtc_read_time+0x2c/0x4c)
[<c02ac3f8>] (rtc_read_time) from [<c02acc54>] (__rtc_read_alarm+0x28/0x358)
[<c02acc54>] (__rtc_read_alarm) from [<c02abd80>] (__rtc_register_device+0x124/0x2ec)
[<c02abd80>] (__rtc_register_device) from [<c02b028c>] (ep93xx_rtc_probe+0xa4/0xac)
[<c02b028c>] (ep93xx_rtc_probe) from [<c026424c>] (platform_drv_probe+0x24/0x5c)
[<c026424c>] (platform_drv_probe) from [<c0262918>] (really_probe+0x218/0x374)
[<c0262918>] (really_probe) from [<c0262da0>] (device_driver_attach+0x44/0x60)
[<c0262da0>] (device_driver_attach) from [<c0262e70>] (__driver_attach+0xb4/0xc0)
[<c0262e70>] (__driver_attach) from [<c0260d44>] (bus_for_each_dev+0x68/0xac)
[<c0260d44>] (bus_for_each_dev) from [<c026223c>] (driver_attach+0x18/0x24)
[<c026223c>] (driver_attach) from [<c0261dd8>] (bus_add_driver+0x150/0x1b4)
[<c0261dd8>] (bus_add_driver) from [<c026342c>] (driver_register+0xb0/0xf4)
[<c026342c>] (driver_register) from [<c0264210>] (__platform_driver_register+0x30/0x48)
[<c0264210>] (__platform_driver_register) from [<c04cb9ac>] (ep93xx_rtc_driver_init+0x10/0x1c)
[<c04cb9ac>] (ep93xx_rtc_driver_init) from [<c000973c>] (do_one_initcall+0x7c/0x1c0)
[<c000973c>] (do_one_initcall) from [<c04b9ecc>] (kernel_init_freeable+0x168/0x1ac)
[<c04b9ecc>] (kernel_init_freeable) from [<c03b2228>] (kernel_init+0x8/0xf4)
[<c03b2228>] (kernel_init) from [<c00082c0>] (ret_from_fork+0x14/0x34)
Exception stack(0xc441dfb0 to 0xc441dff8)
dfa0:                                     00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
Code: e12fff1e e92d4010 e590303c e1a02001 (e5933000)
---[ end trace c914d6030eaa95c8 ]---

Fixes: b809d192eb98 ("rtc: ep93xx: stop setting platform_data")
Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201201095507.10317-1-nikita.shubin@maquefel.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-ep93xx.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/rtc/rtc-ep93xx.c
+++ b/drivers/rtc/rtc-ep93xx.c
@@ -33,7 +33,7 @@ struct ep93xx_rtc {
 static int ep93xx_rtc_get_swcomp(struct device *dev, unsigned short *preload,
 				 unsigned short *delete)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long comp;
 
 	comp = readl(ep93xx_rtc->mmio_base + EP93XX_RTC_SWCOMP);
@@ -51,7 +51,7 @@ static int ep93xx_rtc_get_swcomp(struct
 
 static int ep93xx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long time;
 
 	time = readl(ep93xx_rtc->mmio_base + EP93XX_RTC_DATA);
@@ -62,7 +62,7 @@ static int ep93xx_rtc_read_time(struct d
 
 static int ep93xx_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long secs = rtc_tm_to_time64(tm);
 
 	writel(secs + 1, ep93xx_rtc->mmio_base + EP93XX_RTC_LOAD);



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 715/717] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (712 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 714/717] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 716/717] null_blk: Fix zone size initialization Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Pugachev, Steven Rostedt (VMware)

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit adab66b71abfe206a020f11e561f4df41f0b2aba upstream.

It was believed that metag was the only architecture that required the ring
buffer to keep 8 byte words aligned on 8 byte architectures, and with its
removal, it was assumed that the ring buffer code did not need to handle
this case. It appears that sparc64 also requires this.

The following was reported on a sparc64 boot up:

   kernel: futex hash table entries: 65536 (order: 9, 4194304 bytes, linear)
   kernel: Running postponed tracer tests:
   kernel: Testing tracer function:
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: PASSED

Need to put back the 64BIT aligned code for the ring buffer.

Link: https://lore.kernel.org/r/CADxRZqzXQRYgKc=y-KV=S_yHL+Y8Ay2mh5ezeZUnpRvg+syWKw@mail.gmail.com

Cc: stable@vger.kernel.org
Fixes: 86b3de60a0b6 ("ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS")
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/Kconfig               |   16 ++++++++++++++++
 kernel/trace/ring_buffer.c |   17 +++++++++++++----
 2 files changed, 29 insertions(+), 4 deletions(-)

--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -143,6 +143,22 @@ config UPROBES
 	    managed by the kernel and kept transparent to the probed
 	    application. )
 
+config HAVE_64BIT_ALIGNED_ACCESS
+	def_bool 64BIT && !HAVE_EFFICIENT_UNALIGNED_ACCESS
+	help
+	  Some architectures require 64 bit accesses to be 64 bit
+	  aligned, which also requires structs containing 64 bit values
+	  to be 64 bit aligned too. This includes some 32 bit
+	  architectures which can do 64 bit accesses, as well as 64 bit
+	  architectures without unaligned access.
+
+	  This symbol should be selected by an architecture if 64 bit
+	  accesses are required to be 64 bit aligned in this way even
+	  though it is not a 64 bit architecture.
+
+	  See Documentation/unaligned-memory-access.txt for more
+	  information on the topic of unaligned memory accesses.
+
 config HAVE_EFFICIENT_UNALIGNED_ACCESS
 	bool
 	help
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -129,7 +129,16 @@ int ring_buffer_print_entry_header(struc
 #define RB_ALIGNMENT		4U
 #define RB_MAX_SMALL_DATA	(RB_ALIGNMENT * RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
 #define RB_EVNT_MIN_SIZE	8U	/* two 32bit words */
-#define RB_ALIGN_DATA		__aligned(RB_ALIGNMENT)
+
+#ifndef CONFIG_HAVE_64BIT_ALIGNED_ACCESS
+# define RB_FORCE_8BYTE_ALIGNMENT	0
+# define RB_ARCH_ALIGNMENT		RB_ALIGNMENT
+#else
+# define RB_FORCE_8BYTE_ALIGNMENT	1
+# define RB_ARCH_ALIGNMENT		8U
+#endif
+
+#define RB_ALIGN_DATA		__aligned(RB_ARCH_ALIGNMENT)
 
 /* define RINGBUF_TYPE_DATA for 'case RINGBUF_TYPE_DATA:' */
 #define RINGBUF_TYPE_DATA 0 ... RINGBUF_TYPE_DATA_TYPE_LEN_MAX
@@ -2719,7 +2728,7 @@ rb_update_event(struct ring_buffer_per_c
 
 	event->time_delta = delta;
 	length -= RB_EVNT_HDR_SIZE;
-	if (length > RB_MAX_SMALL_DATA) {
+	if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT) {
 		event->type_len = 0;
 		event->array[0] = length;
 	} else
@@ -2734,11 +2743,11 @@ static unsigned rb_calculate_event_lengt
 	if (!length)
 		length++;
 
-	if (length > RB_MAX_SMALL_DATA)
+	if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
 		length += sizeof(event.array[0]);
 
 	length += RB_EVNT_HDR_SIZE;
-	length = ALIGN(length, RB_ALIGNMENT);
+	length = ALIGN(length, RB_ARCH_ALIGNMENT);
 
 	/*
 	 * In case the time delta is larger than the 27 bits for it



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 716/717] null_blk: Fix zone size initialization
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (713 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 715/717] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.10 717/717] null_blk: Fail zone append to conventional zones Greg Kroah-Hartman
                   ` (3 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naohiro Aota, Damien Le Moal,
	Christoph Hellwig, Johannes Thumshirn, Jens Axboe

From: Damien Le Moal <damien.lemoal@wdc.com>

commit 0ebcdd702f49aeb0ad2e2d894f8c124a0acc6e23 upstream.

For a null_blk device with zoned mode enabled is currently initialized
with a number of zones equal to the device capacity divided by the zone
size, without considering if the device capacity is a multiple of the
zone size. If the zone size is not a divisor of the capacity, the zones
end up not covering the entire capacity, potentially resulting is out
of bounds accesses to the zone array.

Fix this by adding one last smaller zone with a size equal to the
remainder of the disk capacity divided by the zone size if the capacity
is not a multiple of the zone size. For such smaller last zone, the zone
capacity is also checked so that it does not exceed the smaller zone
size.

Reported-by: Naohiro Aota <naohiro.aota@wdc.com>
Fixes: ca4b2a011948 ("null_blk: add zone support")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/null_blk_zoned.c |   23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

--- a/drivers/block/null_blk_zoned.c
+++ b/drivers/block/null_blk_zoned.c
@@ -6,8 +6,7 @@
 #define CREATE_TRACE_POINTS
 #include "null_blk_trace.h"
 
-/* zone_size in MBs to sectors. */
-#define ZONE_SIZE_SHIFT		11
+#define MB_TO_SECTS(mb) (((sector_t)mb * SZ_1M) >> SECTOR_SHIFT)
 
 static inline unsigned int null_zone_no(struct nullb_device *dev, sector_t sect)
 {
@@ -16,7 +15,7 @@ static inline unsigned int null_zone_no(
 
 int null_init_zoned_dev(struct nullb_device *dev, struct request_queue *q)
 {
-	sector_t dev_size = (sector_t)dev->size * 1024 * 1024;
+	sector_t dev_capacity_sects, zone_capacity_sects;
 	sector_t sector = 0;
 	unsigned int i;
 
@@ -38,9 +37,13 @@ int null_init_zoned_dev(struct nullb_dev
 		return -EINVAL;
 	}
 
-	dev->zone_size_sects = dev->zone_size << ZONE_SIZE_SHIFT;
-	dev->nr_zones = dev_size >>
-				(SECTOR_SHIFT + ilog2(dev->zone_size_sects));
+	zone_capacity_sects = MB_TO_SECTS(dev->zone_capacity);
+	dev_capacity_sects = MB_TO_SECTS(dev->size);
+	dev->zone_size_sects = MB_TO_SECTS(dev->zone_size);
+	dev->nr_zones = dev_capacity_sects >> ilog2(dev->zone_size_sects);
+	if (dev_capacity_sects & (dev->zone_size_sects - 1))
+		dev->nr_zones++;
+
 	dev->zones = kvmalloc_array(dev->nr_zones, sizeof(struct blk_zone),
 			GFP_KERNEL | __GFP_ZERO);
 	if (!dev->zones)
@@ -101,8 +104,12 @@ int null_init_zoned_dev(struct nullb_dev
 		struct blk_zone *zone = &dev->zones[i];
 
 		zone->start = zone->wp = sector;
-		zone->len = dev->zone_size_sects;
-		zone->capacity = dev->zone_capacity << ZONE_SIZE_SHIFT;
+		if (zone->start + dev->zone_size_sects > dev_capacity_sects)
+			zone->len = dev_capacity_sects - zone->start;
+		else
+			zone->len = dev->zone_size_sects;
+		zone->capacity =
+			min_t(sector_t, zone->len, zone_capacity_sects);
 		zone->type = BLK_ZONE_TYPE_SEQWRITE_REQ;
 		zone->cond = BLK_ZONE_COND_EMPTY;
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* [PATCH 5.10 717/717] null_blk: Fail zone append to conventional zones
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (714 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 716/717] null_blk: Fix zone size initialization Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 20:18 ` [PATCH 5.10 000/717] 5.10.4-rc1 review Jon Hunter
                   ` (2 subsequent siblings)
  718 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naohiro Aota, Damien Le Moal,
	Christoph Hellwig, Johannes Thumshirn, Jens Axboe

From: Damien Le Moal <damien.lemoal@wdc.com>

commit 2e896d89510f23927ec393bee1e0570db3d5a6c6 upstream.

Conventional zones do not have a write pointer and so cannot accept zone
append writes. Make sure to fail any zone append write command issued to
a conventional zone.

Reported-by: Naohiro Aota <naohiro.aota@wdc.com>
Fixes: e0489ed5daeb ("null_blk: Support REQ_OP_ZONE_APPEND")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/null_blk_zoned.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/block/null_blk_zoned.c
+++ b/drivers/block/null_blk_zoned.c
@@ -339,8 +339,11 @@ static blk_status_t null_zone_write(stru
 
 	trace_nullb_zone_op(cmd, zno, zone->cond);
 
-	if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL)
+	if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL) {
+		if (append)
+			return BLK_STS_IOERR;
 		return null_process_cmd(cmd, REQ_OP_WRITE, sector, nr_sectors);
+	}
 
 	null_lock_zone(dev, zno);
 



^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes()
  2020-12-28 12:41 ` [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes() Greg Kroah-Hartman
@ 2020-12-28 14:09   ` Ilia Mirkin
  2020-12-28 14:21     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 750+ messages in thread
From: Ilia Mirkin @ 2020-12-28 14:09 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: LKML, # 3.9+, Lyude Paul, Sasha Levin

Hi Greg,

Linus had to apply a fixup for this patch. Please ensure that it's in
your patch list:

commit d652d5f1eeeb06046009f4fcb9b4542249526916
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Dec 17 09:27:57 2020 -0800

    drm/edid: fix objtool warning in drm_cvt_modes()

It does not appear to have a Fixes tag, so may not have been picked up
by your automated tooling.

Cheers,

  -ilia

On Mon, Dec 28, 2020 at 9:01 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Lyude Paul <lyude@redhat.com>
>
> [ Upstream commit 991fcb77f490390bcad89fa67d95763c58cdc04c ]
>
> Noticed this when trying to compile with -Wall on a kernel fork. We
> potentially don't set width here, which causes the compiler to complain
> about width potentially being uninitialized in drm_cvt_modes(). So, let's
> fix that.
>
> Changes since v1:
> * Don't emit an error as this code isn't reachable, just mark it as such
> Changes since v2:
> * Remove now unused variable
>
> Fixes: 3f649ab728cd ("treewide: Remove uninitialized_var() usage")
> Signed-off-by: Lyude Paul <lyude@redhat.com>
> Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
> Link: https://patchwork.freedesktop.org/patch/msgid/20201105235703.1328115-1-lyude@redhat.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/gpu/drm/drm_edid.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> index 631125b46e04c..b84efd538a702 100644
> --- a/drivers/gpu/drm/drm_edid.c
> +++ b/drivers/gpu/drm/drm_edid.c
> @@ -3114,6 +3114,8 @@ static int drm_cvt_modes(struct drm_connector *connector,
>                 case 0x0c:
>                         width = height * 15 / 9;
>                         break;
> +               default:
> +                       unreachable();
>                 }
>
>                 for (j = 1; j < 5; j++) {
> --
> 2.27.0
>
>
>

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes()
  2020-12-28 14:09   ` Ilia Mirkin
@ 2020-12-28 14:21     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 14:21 UTC (permalink / raw)
  To: Ilia Mirkin; +Cc: LKML, # 3.9+, Lyude Paul, Sasha Levin

On Mon, Dec 28, 2020 at 09:09:59AM -0500, Ilia Mirkin wrote:
> Hi Greg,
> 
> Linus had to apply a fixup for this patch. Please ensure that it's in
> your patch list:
> 
> commit d652d5f1eeeb06046009f4fcb9b4542249526916
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Thu Dec 17 09:27:57 2020 -0800
> 
>     drm/edid: fix objtool warning in drm_cvt_modes()
> 
> It does not appear to have a Fixes tag, so may not have been picked up
> by your automated tooling.

It was not, thanks, now queued up!

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
  2020-12-28 12:41 ` [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
@ 2020-12-28 18:50   ` Jakub Kicinski
  2020-12-28 23:24     ` Sasha Levin
  0 siblings, 1 reply; 750+ messages in thread
From: Jakub Kicinski @ 2020-12-28 18:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Vincent Bernat, Sasha Levin

On Mon, 28 Dec 2020 13:41:36 +0100 Greg Kroah-Hartman wrote:
> From: Vincent Bernat <vincent@bernat.ch>
> 
> [ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
> 
> Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
> ignores a route whose interface is down. It is provided as a
> per-interface sysctl. However, while a "all" variant is exposed, it
> was a noop since it was never evaluated. We use the usual "or" logic
> for this kind of sysctls.

I'd recommend to drop 98 and 99, at least for now.

The kernel always behaved this way, and it remains to be seen if anyone
depended on that (mis) behavior.

This needs to hit a real release.

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 12:47 ` [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor Greg Kroah-Hartman
@ 2020-12-28 18:54   ` Jakub Kicinski
  2020-12-28 22:29     ` Sasha Levin
  0 siblings, 1 reply; 750+ messages in thread
From: Jakub Kicinski @ 2020-12-28 18:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Björn Töpel, Sasha Levin

On Mon, 28 Dec 2020 13:47:40 +0100 Greg Kroah-Hartman wrote:
> From: Björn Töpel <bjorn.topel@intel.com>
> 
> [ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
> 
> On the Rx side, the next_to_use index points to the next item in the
> HW ring to be refilled/allocated, and next_to_clean points to the next
> item to potentially be processed.
> 
> When the HW Rx ring is fully refilled, i.e. no packets has been
> processed, the next_to_use will be next_to_clean - 1. When the ring is
> fully processed next_to_clean will be equal to next_to_use. The latter
> case is where a bug is triggered.
> 
> If the next_to_use bits are not cleared, and the "fully processed"
> state is entered, a stale descriptor can be processed.
> 
> The skb-path correctly clear the status bit for the next_to_use
> descriptor, but the AF_XDP zero-copy path did not do that.
> 
> This change adds the status bits clearing of the next_to_use
> descriptor.
> 
> Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Oh wow, so much for Sasha waiting longer for code to get tested before
auto-pulling things into stable :/

I have this change and other changes here queued, but haven't sent the
submission yet.

How long is the auto-backporting delay in terms of calendar days?

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 000/717] 5.10.4-rc1 review
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (715 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.10 717/717] null_blk: Fail zone append to conventional zones Greg Kroah-Hartman
@ 2020-12-28 20:18 ` Jon Hunter
  2020-12-28 20:27 ` Guenter Roeck
  2020-12-29  8:41 ` Naresh Kamboju
  718 siblings, 0 replies; 750+ messages in thread
From: Jon Hunter @ 2020-12-28 20:18 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable, linux-tegra

On Mon, 28 Dec 2020 13:39:58 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.4 release.
> There are 717 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.4-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests passing for Tegra ...

Test results for stable-v5.10:
    12 builds:	12 pass, 0 fail
    26 boots:	26 pass, 0 fail
    64 tests:	64 pass, 0 fail

Linux version:	5.10.4-rc1-g404b2e8f23fd
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Tested-by: Jon Hunter <jonathanh@nvidia.com>

Jon

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 000/717] 5.10.4-rc1 review
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (716 preceding siblings ...)
  2020-12-28 20:18 ` [PATCH 5.10 000/717] 5.10.4-rc1 review Jon Hunter
@ 2020-12-28 20:27 ` Guenter Roeck
  2020-12-29  8:41 ` Naresh Kamboju
  718 siblings, 0 replies; 750+ messages in thread
From: Guenter Roeck @ 2020-12-28 20:27 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable

On Mon, Dec 28, 2020 at 01:39:58PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.4 release.
> There are 717 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
> 

Build results:
	total: 154 pass: 154 fail: 0
Qemu test results:
	total: 427 pass: 427 fail: 0

Tested-by: Guenter Roeck <linux@roeck-us.net>

Guenter

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 18:54   ` Jakub Kicinski
@ 2020-12-28 22:29     ` Sasha Levin
  2020-12-28 22:51       ` Jakub Kicinski
  0 siblings, 1 reply; 750+ messages in thread
From: Sasha Levin @ 2020-12-28 22:29 UTC (permalink / raw)
  To: Jakub Kicinski
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Björn Töpel

On Mon, Dec 28, 2020 at 10:54:23AM -0800, Jakub Kicinski wrote:
>On Mon, 28 Dec 2020 13:47:40 +0100 Greg Kroah-Hartman wrote:
>> From: Björn Töpel <bjorn.topel@intel.com>
>>
>> [ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
>>
>> On the Rx side, the next_to_use index points to the next item in the
>> HW ring to be refilled/allocated, and next_to_clean points to the next
>> item to potentially be processed.
>>
>> When the HW Rx ring is fully refilled, i.e. no packets has been
>> processed, the next_to_use will be next_to_clean - 1. When the ring is
>> fully processed next_to_clean will be equal to next_to_use. The latter
>> case is where a bug is triggered.
>>
>> If the next_to_use bits are not cleared, and the "fully processed"
>> state is entered, a stale descriptor can be processed.
>>
>> The skb-path correctly clear the status bit for the next_to_use
>> descriptor, but the AF_XDP zero-copy path did not do that.
>>
>> This change adds the status bits clearing of the next_to_use
>> descriptor.
>>
>> Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
>> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>
>Oh wow, so much for Sasha waiting longer for code to get tested before
>auto-pulling things into stable :/

The timeline is usually for a commit to appear in a release, and it did.
Was it too early?

>I have this change and other changes here queued, but haven't sent the
>submission yet.

What do you mean with "queued"? Its in Linus's tree for about two weeks
now.

>How long is the auto-backporting delay in terms of calendar days?

The autosel stuff is about 2-3(-4) weeks at this point, stuff with a
fixes tag gets picked up in about 2 weeks.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 22:29     ` Sasha Levin
@ 2020-12-28 22:51       ` Jakub Kicinski
  2020-12-28 23:43         ` Sasha Levin
  0 siblings, 1 reply; 750+ messages in thread
From: Jakub Kicinski @ 2020-12-28 22:51 UTC (permalink / raw)
  To: Sasha Levin
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Björn Töpel

On Mon, 28 Dec 2020 17:29:07 -0500 Sasha Levin wrote:
> On Mon, Dec 28, 2020 at 10:54:23AM -0800, Jakub Kicinski wrote:
> >On Mon, 28 Dec 2020 13:47:40 +0100 Greg Kroah-Hartman wrote:  
> >> From: Björn Töpel <bjorn.topel@intel.com>
> >>
> >> [ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
> >>
> >> On the Rx side, the next_to_use index points to the next item in the
> >> HW ring to be refilled/allocated, and next_to_clean points to the next
> >> item to potentially be processed.
> >>
> >> When the HW Rx ring is fully refilled, i.e. no packets has been
> >> processed, the next_to_use will be next_to_clean - 1. When the ring is
> >> fully processed next_to_clean will be equal to next_to_use. The latter
> >> case is where a bug is triggered.
> >>
> >> If the next_to_use bits are not cleared, and the "fully processed"
> >> state is entered, a stale descriptor can be processed.
> >>
> >> The skb-path correctly clear the status bit for the next_to_use
> >> descriptor, but the AF_XDP zero-copy path did not do that.
> >>
> >> This change adds the status bits clearing of the next_to_use
> >> descriptor.
> >>
> >> Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
> >> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> >> Signed-off-by: Sasha Levin <sashal@kernel.org>  
> >
> >Oh wow, so much for Sasha waiting longer for code to get tested before
> >auto-pulling things into stable :/  
> 
> The timeline is usually for a commit to appear in a release, and it did.
> Was it too early?

Hm, I'm not sure of exact semantics but I meant a final release, 
not an -rc. 

Plus I thought the point of things being part of a release is that
people actually get a chance to test that release. -rc1 was cut 24
hours ago. I guess a "release" is used as a yardstick here, to 
measure time, not for practical reasons?

> >I have this change and other changes here queued, but haven't sent the
> >submission yet.  
> 
> What do you mean with "queued"? Its in Linus's tree for about two weeks
> now.

Networking maintainers have their own queue for patches that will go to
stable:

https://patchwork.kernel.org/bundle/netdev/stable/?state=*

> >How long is the auto-backporting delay in terms of calendar days?  
> 
> The autosel stuff is about 2-3(-4) weeks at this point, stuff with a
> fixes tag gets picked up in about 2 weeks.

$ git show 8d14768a7972b92c73259f0c9c45b969d85e3a60 --format='%cD' --no-patch
Wed, 16 Dec 2020 10:51:07 -0800
$ git show 8d14768a7972b92c73259f0c9c45b969d85e3a60 --format='%aD' --no-patch
Fri, 11 Dec 2020 15:57:11 +0100

Two weeks from author date. That's a little short because.. I also
delay things by up to two weeks :) so you'll grab patches which are
sitting in networking stable queue.

And all networking fixes should have a Fixes tag, so that's no
discriminator to be honest.

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
  2020-12-28 18:50   ` Jakub Kicinski
@ 2020-12-28 23:24     ` Sasha Levin
  0 siblings, 0 replies; 750+ messages in thread
From: Sasha Levin @ 2020-12-28 23:24 UTC (permalink / raw)
  To: Jakub Kicinski; +Cc: Greg Kroah-Hartman, linux-kernel, stable, Vincent Bernat

On Mon, Dec 28, 2020 at 10:50:58AM -0800, Jakub Kicinski wrote:
>On Mon, 28 Dec 2020 13:41:36 +0100 Greg Kroah-Hartman wrote:
>> From: Vincent Bernat <vincent@bernat.ch>
>>
>> [ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
>>
>> Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
>> ignores a route whose interface is down. It is provided as a
>> per-interface sysctl. However, while a "all" variant is exposed, it
>> was a noop since it was never evaluated. We use the usual "or" logic
>> for this kind of sysctls.
>
>I'd recommend to drop 98 and 99, at least for now.
>
>The kernel always behaved this way, and it remains to be seen if anyone
>depended on that (mis) behavior.
>
>This needs to hit a real release.

I'll drop it.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 22:51       ` Jakub Kicinski
@ 2020-12-28 23:43         ` Sasha Levin
  2020-12-29  0:28           ` Jakub Kicinski
  0 siblings, 1 reply; 750+ messages in thread
From: Sasha Levin @ 2020-12-28 23:43 UTC (permalink / raw)
  To: Jakub Kicinski
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Björn Töpel

On Mon, Dec 28, 2020 at 02:51:05PM -0800, Jakub Kicinski wrote:
>On Mon, 28 Dec 2020 17:29:07 -0500 Sasha Levin wrote:
>> On Mon, Dec 28, 2020 at 10:54:23AM -0800, Jakub Kicinski wrote:
>> >On Mon, 28 Dec 2020 13:47:40 +0100 Greg Kroah-Hartman wrote:
>> >> From: Björn Töpel <bjorn.topel@intel.com>
>> >>
>> >> [ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
>> >>
>> >> On the Rx side, the next_to_use index points to the next item in the
>> >> HW ring to be refilled/allocated, and next_to_clean points to the next
>> >> item to potentially be processed.
>> >>
>> >> When the HW Rx ring is fully refilled, i.e. no packets has been
>> >> processed, the next_to_use will be next_to_clean - 1. When the ring is
>> >> fully processed next_to_clean will be equal to next_to_use. The latter
>> >> case is where a bug is triggered.
>> >>
>> >> If the next_to_use bits are not cleared, and the "fully processed"
>> >> state is entered, a stale descriptor can be processed.
>> >>
>> >> The skb-path correctly clear the status bit for the next_to_use
>> >> descriptor, but the AF_XDP zero-copy path did not do that.
>> >>
>> >> This change adds the status bits clearing of the next_to_use
>> >> descriptor.
>> >>
>> >> Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
>> >> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
>> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>> >> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> >
>> >Oh wow, so much for Sasha waiting longer for code to get tested before
>> >auto-pulling things into stable :/
>>
>> The timeline is usually for a commit to appear in a release, and it did.
>> Was it too early?
>
>Hm, I'm not sure of exact semantics but I meant a final release,
>not an -rc.
>
>Plus I thought the point of things being part of a release is that
>people actually get a chance to test that release. -rc1 was cut 24
>hours ago. I guess a "release" is used as a yardstick here, to
>measure time, not for practical reasons?

Note that it wasn't actually released yet, at this point folks are
supposed to be testing 5.10.4-rc1 to make sure that those patches are
okay.

I still think that there are no significant users of Linus's tree, so
the idea of having a patch "in a release" doesn't mean as much as folks
think it does. Sure, we have a lot of folks who test -rc releases, but
are you aware of anyone who runs -rc on real world workloads to test it?

>> >I have this change and other changes here queued, but haven't sent the
>> >submission yet.
>>
>> What do you mean with "queued"? Its in Linus's tree for about two weeks
>> now.
>
>Networking maintainers have their own queue for patches that will go to
>stable:
>
>https://patchwork.kernel.org/bundle/netdev/stable/?state=*

This part has always been tricky to me: some parts of net/ and
drivers/net/ don't go through netdev, and some do. I have a filter to
ignore net/ completely, but I found that quite a lot of drivers/net/
wasn't covered by this process.

How could I blacklist/ignore the parts of the tree you're looking at?

Also, is drivers/net/ stuff covered as well as net/? I found in the past
that it's not the case when I was looking at missing patches for the
hyper-v driver.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor
  2020-12-28 23:43         ` Sasha Levin
@ 2020-12-29  0:28           ` Jakub Kicinski
  0 siblings, 0 replies; 750+ messages in thread
From: Jakub Kicinski @ 2020-12-29  0:28 UTC (permalink / raw)
  To: Sasha Levin
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Björn Töpel

On Mon, 28 Dec 2020 18:43:36 -0500 Sasha Levin wrote:
> On Mon, Dec 28, 2020 at 02:51:05PM -0800, Jakub Kicinski wrote:
> >On Mon, 28 Dec 2020 17:29:07 -0500 Sasha Levin wrote:  
> >> On Mon, Dec 28, 2020 at 10:54:23AM -0800, Jakub Kicinski wrote:  
> >> >On Mon, 28 Dec 2020 13:47:40 +0100 Greg Kroah-Hartman wrote:  
> >> >> From: Björn Töpel <bjorn.topel@intel.com>
> >> >>
> >> >> [ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
> >> >>
> >> >> On the Rx side, the next_to_use index points to the next item in the
> >> >> HW ring to be refilled/allocated, and next_to_clean points to the next
> >> >> item to potentially be processed.
> >> >>
> >> >> When the HW Rx ring is fully refilled, i.e. no packets has been
> >> >> processed, the next_to_use will be next_to_clean - 1. When the ring is
> >> >> fully processed next_to_clean will be equal to next_to_use. The latter
> >> >> case is where a bug is triggered.
> >> >>
> >> >> If the next_to_use bits are not cleared, and the "fully processed"
> >> >> state is entered, a stale descriptor can be processed.
> >> >>
> >> >> The skb-path correctly clear the status bit for the next_to_use
> >> >> descriptor, but the AF_XDP zero-copy path did not do that.
> >> >>
> >> >> This change adds the status bits clearing of the next_to_use
> >> >> descriptor.
> >> >>
> >> >> Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
> >> >> Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
> >> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> >> >> Signed-off-by: Sasha Levin <sashal@kernel.org>  
> >> >
> >> >Oh wow, so much for Sasha waiting longer for code to get tested before
> >> >auto-pulling things into stable :/  
> >>
> >> The timeline is usually for a commit to appear in a release, and it did.
> >> Was it too early?  
> >
> >Hm, I'm not sure of exact semantics but I meant a final release,
> >not an -rc.
> >
> >Plus I thought the point of things being part of a release is that
> >people actually get a chance to test that release. -rc1 was cut 24
> >hours ago. I guess a "release" is used as a yardstick here, to
> >measure time, not for practical reasons?  
> 
> Note that it wasn't actually released yet, at this point folks are
> supposed to be testing 5.10.4-rc1 to make sure that those patches are
> okay.
> 
> I still think that there are no significant users of Linus's tree, so
> the idea of having a patch "in a release" doesn't mean as much as folks
> think it does. Sure, we have a lot of folks who test -rc releases, but
> are you aware of anyone who runs -rc on real world workloads to test it?

Ack, I'm not disagreeing. From my limited information/experience testing
seems to happen mostly in the -next trees (be it linux-next or more
likely net-next for networking) and in production releases (either final
produced by Linus or when patch hits some stable tree).

I'd actually be on board of removing this "must be in Linus's tag"
requirement. I don't see why anyone would test rcX instead of just
pulling latest linux/master.

> >> >I have this change and other changes here queued, but haven't sent the
> >> >submission yet.  
> >>
> >> What do you mean with "queued"? Its in Linus's tree for about two weeks
> >> now.  
> >
> >Networking maintainers have their own queue for patches that will go to
> >stable:
> >
> >https://patchwork.kernel.org/bundle/netdev/stable/?state=*  
> 
> This part has always been tricky to me: some parts of net/ and
> drivers/net/ don't go through netdev, and some do. I have a filter to
> ignore net/ completely, but I found that quite a lot of drivers/net/
> wasn't covered by this process.
> 
> How could I blacklist/ignore the parts of the tree you're looking at?
> 
> Also, is drivers/net/ stuff covered as well as net/? I found in the past
> that it's not the case when I was looking at missing patches for the
> hyper-v driver.

Yeah, it's tricky, I've produced some criteria for build testing things
which hit the mailing list:

https://github.com/kuba-moo/nipa/blob/master/netdev/tree_match.py#L47

But it's far from 100% accurate. I think your best shot would be to
filter by committer? :S The special rules only apply to patches which
went directly into net or net-next so committed by DaveM (or myself).

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 000/717] 5.10.4-rc1 review
  2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
                   ` (717 preceding siblings ...)
  2020-12-28 20:27 ` Guenter Roeck
@ 2020-12-29  8:41 ` Naresh Kamboju
  718 siblings, 0 replies; 750+ messages in thread
From: Naresh Kamboju @ 2020-12-29  8:41 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, lkft-triage, pavel, linux-stable

On Mon, 28 Dec 2020 at 19:31, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.10.4 release.
> There are 717 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.4-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>

Summary
------------------------------------------------------------------------

kernel: 5.10.4-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.10.y
git commit: 404b2e8f23fd9530a213b3eb2b10868346c18c1f
git describe: v5.10.3-718-g404b2e8f23fd
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.3-718-g404b2e8f23fd

No regressions (compared to build v5.10.3)

No fixes (compared to build v5.10.3)

Ran 52627 total tests in the following environments and test suites.

Environments
--------------
- arc
- arm
- arm64
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- juno-r2-compat
- juno-r2-kasan
- mips
- parisc
- powerpc
- qemu-arm-clang
- qemu-arm64-clang
- qemu-arm64-kasan
- qemu-i386-clang
- qemu-x86_64-clang
- qemu-x86_64-kasan
- qemu-x86_64-kcsan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- riscv
- s390
- sh
- sparc
- x15
- x86
- x86-kasan

Test Suites
-----------
* build
* linux-log-parser
* install-android-platform-tools-r2600
* ltp-commands-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* fwts
* kselftest
* kvm-unit-tests
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-fs-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-sched-tests
* network-basic-tests
* ltp-controllers-tests
* ltp-open-posix-tests
* perf
* v4l2-compliance
* kunit
* rcutorture
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  2020-12-28 12:43 ` [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
@ 2020-12-29 19:01   ` Nathan Chancellor
  2020-12-30  9:29     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 750+ messages in thread
From: Nathan Chancellor @ 2020-12-29 19:01 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

On Mon, Dec 28, 2020 at 01:43:30PM +0100, Greg Kroah-Hartman wrote:
> From: Vadim Pasternak <vadimp@nvidia.com>
> 
> [ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]
> 
> Remove PSU EEPROM configuration for systems class equipped with
> Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
> all the systems from this class used few types of power units, all
> equipped with EEPROM device with address space two bytes. Thus, all
> these devices have been handled by EEPROM driver "24c02".
> 
> There is a new requirement is to support power unit replacement by "off
> the shelf" device, matching electrical required parameters. Such device
> can be equipped with different EEPROM type, which could be one byte
> address space addressing or even could be not equipped with EEPROM.
> In such case "24c02" will not work.
> 
> Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
> Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
> Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/platform/x86/mlx-platform.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
> index 623e7f737d4ab..598f445587649 100644
> --- a/drivers/platform/x86/mlx-platform.c
> +++ b/drivers/platform/x86/mlx-platform.c
> @@ -601,15 +601,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
>  		.label = "psu1",
>  		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
>  		.mask = BIT(0),
> -		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
> -		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
> +		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
>  	},
>  	{
>  		.label = "psu2",
>  		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
>  		.mask = BIT(1),
> -		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
> -		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
> +		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
>  	},
>  };
>  
> -- 
> 2.27.0
> 
> 
> 

Please pick up eca6ba20f38c ("platform/x86: mlx-platform: remove an
unused variable") everywhere that this patch was applied to avoid
introducing a new clang warning.

Cheers,
Nathan

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0.
  2020-12-28 12:50 ` [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
@ 2020-12-29 19:42   ` Bas Nieuwenhuizen
  2020-12-30  9:24     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 750+ messages in thread
From: Bas Nieuwenhuizen @ 2020-12-29 19:42 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: LKML, stable, Alex Deucher, Nicholas Kazlauskas

Hi Greg,

Someone bisected a non-booting computer with 5.10.4-rc1 to this
commit. Would it be possible to back out of backporting this commit
(was backported to 5.4 and 5.10)? I suspect we may need
53f4cb8b5580a20d01449a7d8e1cbfdaed9ff6b6 to be picked too to avoid
regressing, but I'm not sure about process (e.g. timeline to confirm
things) here and a not booting computer is really bad.

Thanks,
Bas

On Mon, Dec 28, 2020 at 3:28 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
>
> commit be7b9b327e79cd2db07b659af599867b629b2f66 upstream.
>
> With modifiers I'd like to support non-dedicated buffers for
> images.
>
> Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
> Cc: stable@vger.kernel.org # 5.1.0
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
>  drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
>
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -3746,6 +3746,7 @@ fill_plane_dcc_attributes(struct amdgpu_
>         struct dc *dc = adev->dm.dc;
>         struct dc_dcc_surface_param input;
>         struct dc_surface_dcc_cap output;
> +       uint64_t plane_address = afb->address + afb->base.offsets[0];
>         uint32_t offset = AMDGPU_TILING_GET(info, DCC_OFFSET_256B);
>         uint32_t i64b = AMDGPU_TILING_GET(info, DCC_INDEPENDENT_64B) != 0;
>         uint64_t dcc_address;
> @@ -3789,7 +3790,7 @@ fill_plane_dcc_attributes(struct amdgpu_
>                 AMDGPU_TILING_GET(info, DCC_PITCH_MAX) + 1;
>         dcc->independent_64b_blks = i64b;
>
> -       dcc_address = get_dcc_address(afb->address, info);
> +       dcc_address = get_dcc_address(plane_address, info);
>         address->grph.meta_addr.low_part = lower_32_bits(dcc_address);
>         address->grph.meta_addr.high_part = upper_32_bits(dcc_address);
>
> @@ -3820,6 +3821,8 @@ fill_plane_buffer_attributes(struct amdg
>         address->tmz_surface = tmz_surface;
>
>         if (format < SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) {
> +               uint64_t addr = afb->address + fb->offsets[0];
> +
>                 plane_size->surface_size.x = 0;
>                 plane_size->surface_size.y = 0;
>                 plane_size->surface_size.width = fb->width;
> @@ -3828,9 +3831,10 @@ fill_plane_buffer_attributes(struct amdg
>                         fb->pitches[0] / fb->format->cpp[0];
>
>                 address->type = PLN_ADDR_TYPE_GRAPHICS;
> -               address->grph.addr.low_part = lower_32_bits(afb->address);
> -               address->grph.addr.high_part = upper_32_bits(afb->address);
> +               address->grph.addr.low_part = lower_32_bits(addr);
> +               address->grph.addr.high_part = upper_32_bits(addr);
>         } else if (format < SURFACE_PIXEL_FORMAT_INVALID) {
> +               uint64_t luma_addr = afb->address + fb->offsets[0];
>                 uint64_t chroma_addr = afb->address + fb->offsets[1];
>
>                 plane_size->surface_size.x = 0;
> @@ -3851,9 +3855,9 @@ fill_plane_buffer_attributes(struct amdg
>
>                 address->type = PLN_ADDR_TYPE_VIDEO_PROGRESSIVE;
>                 address->video_progressive.luma_addr.low_part =
> -                       lower_32_bits(afb->address);
> +                       lower_32_bits(luma_addr);
>                 address->video_progressive.luma_addr.high_part =
> -                       upper_32_bits(afb->address);
> +                       upper_32_bits(luma_addr);
>                 address->video_progressive.chroma_addr.low_part =
>                         lower_32_bits(chroma_addr);
>                 address->video_progressive.chroma_addr.high_part =
>
>

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check
  2020-12-28 12:43 ` [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
@ 2020-12-29 22:42   ` Pavel Machek
  0 siblings, 0 replies; 750+ messages in thread
From: Pavel Machek @ 2020-12-29 22:42 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Hulk Robot, Qinglang Miao, Ulf Hansson,
	Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 916 bytes --]

Hi!

> From: Qinglang Miao <miaoqinglang@huawei.com>
> 
> [ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]
> 
> kfree(host->card) has been called in put_device so that
> another kfree would raise cause a double-free bug.

> +++ b/drivers/memstick/core/memstick.c
> @@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
>  			host->card = card;
>  			if (device_register(&card->dev)) {
>  				put_device(&card->dev);
> -				kfree(host->card);
>  				host->card = NULL;
>  			}

Does the host->card = NULL need to be removed, too (and following code
refactored)? put_device() needs that pointer to be able to free it and
it can do so asynchronously.

This will cause crashes; they should be easy to reproduce with
CONFIG_DEBUG_KOBJECT_RELEASE due to delay in kobject_release() AFAICT.

Best regards,								Pavel

-- 
http://www.livejournal.com/~pavelmachek

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0.
  2020-12-29 19:42   ` Bas Nieuwenhuizen
@ 2020-12-30  9:24     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-30  9:24 UTC (permalink / raw)
  To: Bas Nieuwenhuizen; +Cc: LKML, stable, Alex Deucher, Nicholas Kazlauskas

On Tue, Dec 29, 2020 at 08:42:50PM +0100, Bas Nieuwenhuizen wrote:
> Hi Greg,
> 
> Someone bisected a non-booting computer with 5.10.4-rc1 to this
> commit. Would it be possible to back out of backporting this commit
> (was backported to 5.4 and 5.10)? I suspect we may need
> 53f4cb8b5580a20d01449a7d8e1cbfdaed9ff6b6 to be picked too to avoid
> regressing, but I'm not sure about process (e.g. timeline to confirm
> things) here and a not booting computer is really bad.

Thanks for the report, now dropped from both queues.  If this needs to
be added, after testing, please let stable@vger.kernel.org know and we
will be glad to add it back.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  2020-12-29 19:01   ` Nathan Chancellor
@ 2020-12-30  9:29     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-30  9:29 UTC (permalink / raw)
  To: Nathan Chancellor
  Cc: linux-kernel, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

On Tue, Dec 29, 2020 at 12:01:44PM -0700, Nathan Chancellor wrote:
> On Mon, Dec 28, 2020 at 01:43:30PM +0100, Greg Kroah-Hartman wrote:
> > From: Vadim Pasternak <vadimp@nvidia.com>
> > 
> > [ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]
> > 
> > Remove PSU EEPROM configuration for systems class equipped with
> > Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
> > all the systems from this class used few types of power units, all
> > equipped with EEPROM device with address space two bytes. Thus, all
> > these devices have been handled by EEPROM driver "24c02".
> > 
> > There is a new requirement is to support power unit replacement by "off
> > the shelf" device, matching electrical required parameters. Such device
> > can be equipped with different EEPROM type, which could be one byte
> > address space addressing or even could be not equipped with EEPROM.
> > In such case "24c02" will not work.
> > 
> > Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
> > Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
> > Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
> > Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  drivers/platform/x86/mlx-platform.c | 6 ++----
> >  1 file changed, 2 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
> > index 623e7f737d4ab..598f445587649 100644
> > --- a/drivers/platform/x86/mlx-platform.c
> > +++ b/drivers/platform/x86/mlx-platform.c
> > @@ -601,15 +601,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
> >  		.label = "psu1",
> >  		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
> >  		.mask = BIT(0),
> > -		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
> > -		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
> > +		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
> >  	},
> >  	{
> >  		.label = "psu2",
> >  		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
> >  		.mask = BIT(1),
> > -		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
> > -		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
> > +		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
> >  	},
> >  };
> >  
> > -- 
> > 2.27.0
> > 
> > 
> > 
> 
> Please pick up eca6ba20f38c ("platform/x86: mlx-platform: remove an
> unused variable") everywhere that this patch was applied to avoid
> introducing a new clang warning.

Now queued up, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-28 12:48 ` [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
@ 2020-12-30 12:25   ` Pavel Machek
  2020-12-30 12:32     ` Andy Shevchenko
  0 siblings, 1 reply; 750+ messages in thread
From: Pavel Machek @ 2020-12-30 12:25 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Sakari Ailus, Andy Shevchenko,
	Laurent Pinchart, Mauro Carvalho Chehab

[-- Attachment #1: Type: text/plain, Size: 778 bytes --]

Hi!

> commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.
> 
> Validate media bus code, width and height when setting the subdev format.
> 
> This effectively reworks how setting subdev format is implemented in the
> driver.

Something is wrong here:

> +	fmt->format.code = formats[0].mbus_code;
> +	for (i = 0; i < ARRAY_SIZE(formats); i++) {
> +		if (formats[i].mbus_code == fmt->format.code) {
> +			fmt->format.code = mbus_code;
> +			break;
> +		}

This does not make sense. Loop will always exit during the first
iteration, making the whole loop crazy/redundant.

Best regards,
								Pavel

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-30 12:25   ` Pavel Machek
@ 2020-12-30 12:32     ` Andy Shevchenko
  2020-12-30 12:44       ` Laurent Pinchart
  0 siblings, 1 reply; 750+ messages in thread
From: Andy Shevchenko @ 2020-12-30 12:32 UTC (permalink / raw)
  To: Pavel Machek
  Cc: Greg Kroah-Hartman, Linux Kernel Mailing List, Stable,
	Sakari Ailus, Laurent Pinchart, Mauro Carvalho Chehab

On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek <pavel@denx.de> wrote:

> > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.
> >
> > Validate media bus code, width and height when setting the subdev format.
> >
> > This effectively reworks how setting subdev format is implemented in the
> > driver.
>
> Something is wrong here:
>
> > +     fmt->format.code = formats[0].mbus_code;
> > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {

Looks like 'i = 1' should be...

> > +             if (formats[i].mbus_code == fmt->format.code) {
> > +                     fmt->format.code = mbus_code;
> > +                     break;
> > +             }
>
> This does not make sense. Loop will always exit during the first
> iteration, making the whole loop crazy/redundant.



-- 
With Best Regards,
Andy Shevchenko

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-30 12:32     ` Andy Shevchenko
@ 2020-12-30 12:44       ` Laurent Pinchart
  2020-12-30 12:56         ` Pavel Machek
  0 siblings, 1 reply; 750+ messages in thread
From: Laurent Pinchart @ 2020-12-30 12:44 UTC (permalink / raw)
  To: Andy Shevchenko
  Cc: Pavel Machek, Greg Kroah-Hartman, Linux Kernel Mailing List,
	Stable, Sakari Ailus, Mauro Carvalho Chehab

On Wed, Dec 30, 2020 at 02:32:46PM +0200, Andy Shevchenko wrote:
> On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek wrote:
> 
> > > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.
> > >
> > > Validate media bus code, width and height when setting the subdev format.
> > >
> > > This effectively reworks how setting subdev format is implemented in the
> > > driver.
> >
> > Something is wrong here:
> >
> > > +     fmt->format.code = formats[0].mbus_code;
> > > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {
> 
> Looks like 'i = 1' should be...
> 
> > > +             if (formats[i].mbus_code == fmt->format.code) {

More likely

			if (formats[i].mbus_code == mbus_code) {

I think.

Pavel, would you like to submit a patch ?

> > > +                     fmt->format.code = mbus_code;
> > > +                     break;
> > > +             }
> >
> > This does not make sense. Loop will always exit during the first
> > iteration, making the whole loop crazy/redundant.

-- 
Regards,

Laurent Pinchart

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-30 12:44       ` Laurent Pinchart
@ 2020-12-30 12:56         ` Pavel Machek
  0 siblings, 0 replies; 750+ messages in thread
From: Pavel Machek @ 2020-12-30 12:56 UTC (permalink / raw)
  To: Laurent Pinchart
  Cc: Andy Shevchenko, Pavel Machek, Greg Kroah-Hartman,
	Linux Kernel Mailing List, Stable, Sakari Ailus,
	Mauro Carvalho Chehab

[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]

On Wed 2020-12-30 14:44:41, Laurent Pinchart wrote:
> On Wed, Dec 30, 2020 at 02:32:46PM +0200, Andy Shevchenko wrote:
> > On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek wrote:
> > 
> > > > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.
> > > >
> > > > Validate media bus code, width and height when setting the subdev format.
> > > >
> > > > This effectively reworks how setting subdev format is implemented in the
> > > > driver.
> > >
> > > Something is wrong here:
> > >
> > > > +     fmt->format.code = formats[0].mbus_code;
> > > > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {
> > 
> > Looks like 'i = 1' should be...
> > 
> > > > +             if (formats[i].mbus_code == fmt->format.code) {
> 
> More likely
> 
> 			if (formats[i].mbus_code == mbus_code) {
> 
> I think.

That looks reasonable, but I don't have hardware to test.

> Pavel, would you like to submit a patch ?

Done, should be in your inbox.

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER
  2020-12-28 12:42 ` [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER Greg Kroah-Hartman
@ 2020-12-31  8:49   ` Serge Semin
  2020-12-31  8:51     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 750+ messages in thread
From: Serge Semin @ 2020-12-31  8:49 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, kernel test robot, Randy Dunlap,
	Ramil Zaripov, Mark Brown, linux-spi, Sasha Levin

Hello Greg,
The next patch has been created to supersede the one you've applied:
https://lore.kernel.org/linux-spi/20201127144612.4204-1-Sergey.Semin@baikalelectronics.ru/
Mark has already merged it in his repo.

-Sergey

On Mon, Dec 28, 2020 at 01:42:12PM +0100, Greg Kroah-Hartman wrote:
> From: Randy Dunlap <rdunlap@infradead.org>
> 
> [ Upstream commit 1241f0787578136ab58f49adc52f2dcd2bbc4bf2 ]
> 
> Fix build error for spi-dw-bt1.o by selecting MULTIPLEXER.
> 
> hppa-linux-ld: drivers/spi/spi-dw-bt1.o: in function `dw_spi_bt1_sys_init':
> (.text+0x1ac): undefined reference to `devm_mux_control_get'
> 
> Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
> Cc: Serge Semin <Sergey.Semin@baikalelectronics.ru>
> Cc: Ramil Zaripov <Ramil.Zaripov@baikalelectronics.ru>
> Cc: Mark Brown <broonie@kernel.org>
> Cc: linux-spi@vger.kernel.org
> Acked-by: Serge Semin <fancer.lancer@gmail.com>
> Link: https://lore.kernel.org/r/20201116040721.8001-1-rdunlap@infradead.org
> Signed-off-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/spi/Kconfig | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
> index 5cff60de8e834..3fd16b7f61507 100644
> --- a/drivers/spi/Kconfig
> +++ b/drivers/spi/Kconfig
> @@ -255,6 +255,7 @@ config SPI_DW_MMIO
>  config SPI_DW_BT1
>  	tristate "Baikal-T1 SPI driver for DW SPI core"
>  	depends on MIPS_BAIKAL_T1 || COMPILE_TEST
> +	select MULTIPLEXER
>  	help
>  	  Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI
>  	  controllers. Two of them are pretty much normal: with IRQ, DMA,
> -- 
> 2.27.0
> 
> 
> 

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER
  2020-12-31  8:49   ` Serge Semin
@ 2020-12-31  8:51     ` Greg Kroah-Hartman
  2020-12-31  9:10       ` Serge Semin
  0 siblings, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-31  8:51 UTC (permalink / raw)
  To: Serge Semin
  Cc: linux-kernel, stable, kernel test robot, Randy Dunlap,
	Ramil Zaripov, Mark Brown, linux-spi, Sasha Levin

On Thu, Dec 31, 2020 at 11:49:56AM +0300, Serge Semin wrote:
> Hello Greg,
> The next patch has been created to supersede the one you've applied:
> https://lore.kernel.org/linux-spi/20201127144612.4204-1-Sergey.Semin@baikalelectronics.ru/
> Mark has already merged it in his repo.

Ok, so should that one be queued up as well?  Let us know the git commit
id of it when it reaches Linus's kernel and we will be glad to take it.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER
  2020-12-31  8:51     ` Greg Kroah-Hartman
@ 2020-12-31  9:10       ` Serge Semin
  2020-12-31  9:25         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 750+ messages in thread
From: Serge Semin @ 2020-12-31  9:10 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Serge Semin, linux-kernel, stable, kernel test robot,
	Randy Dunlap, Ramil Zaripov, Mark Brown, linux-spi, Sasha Levin

On Thu, Dec 31, 2020 at 09:51:21AM +0100, Greg Kroah-Hartman wrote:
> On Thu, Dec 31, 2020 at 11:49:56AM +0300, Serge Semin wrote:
> > Hello Greg,
> > The next patch has been created to supersede the one you've applied:
> > https://lore.kernel.org/linux-spi/20201127144612.4204-1-Sergey.Semin@baikalelectronics.ru/
> > Mark has already merged it in his repo.
> 

> Ok, so should that one be queued up as well?  Let us know the git commit
> id of it when it reaches Linus's kernel and we will be glad to take it.

I believe it is already there:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7218838109fef61cdec988ff728e902d434c9cc5
Yeah, it's better to queue that patch up too, otherwise the build
error will be indeed fixed by the commit you've merged in, but the
probe procedure will still always fail.

-Sergey

> 
> thanks,
> 
> greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER
  2020-12-31  9:10       ` Serge Semin
@ 2020-12-31  9:25         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 750+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-31  9:25 UTC (permalink / raw)
  To: Serge Semin
  Cc: Serge Semin, linux-kernel, stable, kernel test robot,
	Randy Dunlap, Ramil Zaripov, Mark Brown, linux-spi, Sasha Levin

On Thu, Dec 31, 2020 at 12:10:34PM +0300, Serge Semin wrote:
> On Thu, Dec 31, 2020 at 09:51:21AM +0100, Greg Kroah-Hartman wrote:
> > On Thu, Dec 31, 2020 at 11:49:56AM +0300, Serge Semin wrote:
> > > Hello Greg,
> > > The next patch has been created to supersede the one you've applied:
> > > https://lore.kernel.org/linux-spi/20201127144612.4204-1-Sergey.Semin@baikalelectronics.ru/
> > > Mark has already merged it in his repo.
> > 
> 
> > Ok, so should that one be queued up as well?  Let us know the git commit
> > id of it when it reaches Linus's kernel and we will be glad to take it.
> 
> I believe it is already there:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7218838109fef61cdec988ff728e902d434c9cc5
> Yeah, it's better to queue that patch up too, otherwise the build
> error will be indeed fixed by the commit you've merged in, but the
> probe procedure will still always fail.

Ok, now queued up, thanks for letting us know.

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2020-12-28 12:50 ` [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
@ 2021-01-04 19:04   ` Andre Tomt
  2021-01-04 20:10     ` Oleksandr Natalenko
  2021-01-05  6:54     ` Greg Kroah-Hartman
  0 siblings, 2 replies; 750+ messages in thread
From: Andre Tomt @ 2021-01-04 19:04 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: stable, Harry Wentland, Alex Deucher, Nicholas Kazlauskas, Stylon Wang

On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
> From: Stylon Wang <stylon.wang@amd.com>
> 
> commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
> 
> EDID parsing in S3 resume pushes new display modes
> to probed_modes list but doesn't consolidate to actual
> mode list. This creates a race condition when
> amdgpu_dm_connector_ddc_get_modes() re-initializes the
> list head without walking the list and results in  memory leak.

This commit is causing me problems on 5.10.4: when I turn off the 
display (a LG TV in this case), and turn it back on again later there is 
no video output and I get the following in the kernel log:

[ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]] *ERROR* 
Restoring old state failed with -12

I've found another report on this commit as well:
https://bugzilla.kernel.org/show_bug.cgi?id=211033

And I suspect this is the same:
https://bugs.archlinux.org/task/69202

Reverting it from 5.10.4 makes things behave again.

Have not tested 5.4.86 or 5.11-rc.

I'm using a RX570 Polaris based card.

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2021-01-04 19:04   ` Andre Tomt
@ 2021-01-04 20:10     ` Oleksandr Natalenko
  2021-01-04 20:40       ` Oleksandr Natalenko
  2021-01-05  6:54     ` Greg Kroah-Hartman
  1 sibling, 1 reply; 750+ messages in thread
From: Oleksandr Natalenko @ 2021-01-04 20:10 UTC (permalink / raw)
  To: Andre Tomt
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Harry Wentland,
	Alex Deucher, Nicholas Kazlauskas, Stylon Wang

On Mon, Jan 04, 2021 at 08:04:08PM +0100, Andre Tomt wrote:
> On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
> > From: Stylon Wang <stylon.wang@amd.com>
> > 
> > commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
> > 
> > EDID parsing in S3 resume pushes new display modes
> > to probed_modes list but doesn't consolidate to actual
> > mode list. This creates a race condition when
> > amdgpu_dm_connector_ddc_get_modes() re-initializes the
> > list head without walking the list and results in  memory leak.
> 
> This commit is causing me problems on 5.10.4: when I turn off the display (a
> LG TV in this case), and turn it back on again later there is no video
> output and I get the following in the kernel log:
> 
> [ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]] *ERROR*
> Restoring old state failed with -12

Uh, it seems you've just saved me a ton of gray hair. I have the very
same issue and I'm going to revert this patch now in order to check
whether it makes any difference.

Thanks!

> 
> I've found another report on this commit as well:
> https://bugzilla.kernel.org/show_bug.cgi?id=211033
> 
> And I suspect this is the same:
> https://bugs.archlinux.org/task/69202
> 
> Reverting it from 5.10.4 makes things behave again.
> 
> Have not tested 5.4.86 or 5.11-rc.
> 
> I'm using a RX570 Polaris based card.

-- 
  Oleksandr Natalenko (post-factum)

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2021-01-04 20:10     ` Oleksandr Natalenko
@ 2021-01-04 20:40       ` Oleksandr Natalenko
  0 siblings, 0 replies; 750+ messages in thread
From: Oleksandr Natalenko @ 2021-01-04 20:40 UTC (permalink / raw)
  To: Andre Tomt
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Harry Wentland,
	Alex Deucher, Nicholas Kazlauskas, Stylon Wang

On Mon, Jan 04, 2021 at 09:10:17PM +0100, Oleksandr Natalenko wrote:
> On Mon, Jan 04, 2021 at 08:04:08PM +0100, Andre Tomt wrote:
> > On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
> > > From: Stylon Wang <stylon.wang@amd.com>
> > > 
> > > commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
> > > 
> > > EDID parsing in S3 resume pushes new display modes
> > > to probed_modes list but doesn't consolidate to actual
> > > mode list. This creates a race condition when
> > > amdgpu_dm_connector_ddc_get_modes() re-initializes the
> > > list head without walking the list and results in  memory leak.
> > 
> > This commit is causing me problems on 5.10.4: when I turn off the display (a
> > LG TV in this case), and turn it back on again later there is no video
> > output and I get the following in the kernel log:
> > 
> > [ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]] *ERROR*
> > Restoring old state failed with -12
> 
> Uh, it seems you've just saved me a ton of gray hair. I have the very
> same issue and I'm going to revert this patch now in order to check
> whether it makes any difference.

Confirmed, reverting this patch makes my monitor light back after
turning off/on.

Also, during testing, I've noticed that with the stock v5.10.4 kernel
once reboot sequence is initiated and xorg gets killed, the monitor also
lights back and shows the console.

My HW:

0a:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Lexa PRO [Radeon 540/540X/550/550X / RX 540X/550/550X] (rev c7)

> 
> Thanks!
> 
> > 
> > I've found another report on this commit as well:
> > https://bugzilla.kernel.org/show_bug.cgi?id=211033
> > 
> > And I suspect this is the same:
> > https://bugs.archlinux.org/task/69202
> > 
> > Reverting it from 5.10.4 makes things behave again.
> > 
> > Have not tested 5.4.86 or 5.11-rc.
> > 
> > I'm using a RX570 Polaris based card.

-- 
  Oleksandr Natalenko (post-factum)

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2021-01-04 19:04   ` Andre Tomt
  2021-01-04 20:10     ` Oleksandr Natalenko
@ 2021-01-05  6:54     ` Greg Kroah-Hartman
  2021-01-05 16:32       ` Andre Tomt
  1 sibling, 1 reply; 750+ messages in thread
From: Greg Kroah-Hartman @ 2021-01-05  6:54 UTC (permalink / raw)
  To: Andre Tomt
  Cc: linux-kernel, stable, Harry Wentland, Alex Deucher,
	Nicholas Kazlauskas, Stylon Wang

On Mon, Jan 04, 2021 at 08:04:08PM +0100, Andre Tomt wrote:
> On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
> > From: Stylon Wang <stylon.wang@amd.com>
> > 
> > commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
> > 
> > EDID parsing in S3 resume pushes new display modes
> > to probed_modes list but doesn't consolidate to actual
> > mode list. This creates a race condition when
> > amdgpu_dm_connector_ddc_get_modes() re-initializes the
> > list head without walking the list and results in  memory leak.
> 
> This commit is causing me problems on 5.10.4: when I turn off the display (a
> LG TV in this case), and turn it back on again later there is no video
> output and I get the following in the kernel log:
> 
> [ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]] *ERROR*
> Restoring old state failed with -12
> 
> I've found another report on this commit as well:
> https://bugzilla.kernel.org/show_bug.cgi?id=211033
> 
> And I suspect this is the same:
> https://bugs.archlinux.org/task/69202
> 
> Reverting it from 5.10.4 makes things behave again.
> 
> Have not tested 5.4.86 or 5.11-rc.
> 
> I'm using a RX570 Polaris based card.

Can you test 5.11-rc to see if this issue is there as well?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 750+ messages in thread

* Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2021-01-05  6:54     ` Greg Kroah-Hartman
@ 2021-01-05 16:32       ` Andre Tomt
  2021-01-05 16:41         ` Deucher, Alexander
  0 siblings, 1 reply; 750+ messages in thread
From: Andre Tomt @ 2021-01-05 16:32 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Harry Wentland, Alex Deucher,
	Nicholas Kazlauskas, Stylon Wang

On 05.01.2021 07:54, Greg Kroah-Hartman wrote:
> On Mon, Jan 04, 2021 at 08:04:08PM +0100, Andre Tomt wrote:
>> On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
>>> From: Stylon Wang <stylon.wang@amd.com>
>>>
>>> commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
>>>
>>> EDID parsing in S3 resume pushes new display modes
>>> to probed_modes list but doesn't consolidate to actual
>>> mode list. This creates a race condition when
>>> amdgpu_dm_connector_ddc_get_modes() re-initializes the
>>> list head without walking the list and results in  memory leak.
>>
>> This commit is causing me problems on 5.10.4: when I turn off the display (a
>> LG TV in this case), and turn it back on again later there is no video
>> output and I get the following in the kernel log:
>>
>> [ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]] *ERROR*
>> Restoring old state failed with -12
>>
>> I've found another report on this commit as well:
>> https://bugzilla.kernel.org/show_bug.cgi?id=211033
>>
>> And I suspect this is the same:
>> https://bugs.archlinux.org/task/69202
>>
>> Reverting it from 5.10.4 makes things behave again.
>>
>> Have not tested 5.4.86 or 5.11-rc.
>>
>> I'm using a RX570 Polaris based card.
> 
> Can you test 5.11-rc to see if this issue is there as well?

Just did, and have the same issue on 5.11-rc2. Reverting it also solves 
the problem on 5.11-rc2, as it does on 5.10.4

FWIW one easy way to reproduce seems to be unplugging and re-plugging 
the HDMI.

^ permalink raw reply	[flat|nested] 750+ messages in thread

* RE: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume
  2021-01-05 16:32       ` Andre Tomt
@ 2021-01-05 16:41         ` Deucher, Alexander
  0 siblings, 0 replies; 750+ messages in thread
From: Deucher, Alexander @ 2021-01-05 16:41 UTC (permalink / raw)
  To: Andre Tomt, Greg Kroah-Hartman
  Cc: linux-kernel, stable, Wentland, Harry, Kazlauskas, Nicholas,
	Wang, Chao-kai (Stylon)

[AMD Public Use]

> -----Original Message-----
> From: Andre Tomt <andre@tomt.net>
> Sent: Tuesday, January 5, 2021 11:32 AM
> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: linux-kernel@vger.kernel.org; stable@vger.kernel.org; Wentland, Harry
> <Harry.Wentland@amd.com>; Deucher, Alexander
> <Alexander.Deucher@amd.com>; Kazlauskas, Nicholas
> <Nicholas.Kazlauskas@amd.com>; Wang, Chao-kai (Stylon)
> <Stylon.Wang@amd.com>
> Subject: Re: [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3
> resume
> 
> On 05.01.2021 07:54, Greg Kroah-Hartman wrote:
> > On Mon, Jan 04, 2021 at 08:04:08PM +0100, Andre Tomt wrote:
> >> On 28.12.2020 13:50, Greg Kroah-Hartman wrote:
> >>> From: Stylon Wang <stylon.wang@amd.com>
> >>>
> >>> commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.
> >>>
> >>> EDID parsing in S3 resume pushes new display modes to probed_modes
> >>> list but doesn't consolidate to actual mode list. This creates a
> >>> race condition when
> >>> amdgpu_dm_connector_ddc_get_modes() re-initializes the list head
> >>> without walking the list and results in  memory leak.
> >>
> >> This commit is causing me problems on 5.10.4: when I turn off the
> >> display (a LG TV in this case), and turn it back on again later there
> >> is no video output and I get the following in the kernel log:
> >>
> >> [ 8245.259628] [drm:dm_restore_drm_connector_state [amdgpu]]
> *ERROR*
> >> Restoring old state failed with -12
> >>
> >> I've found another report on this commit as well:
> >>
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbug
> >>
> zilla.kernel.org%2Fshow_bug.cgi%3Fid%3D211033&amp;data=04%7C01%7Cal
> ex
> >>
> ander.deucher%40amd.com%7Cad673e351bab4f6af94508d8b1977ed8%7C3d
> d8961f
> >>
> e4884e608e11a82d994e183d%7C0%7C0%7C637454612140560971%7CUnknow
> n%7CTWF
> >>
> pbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXV
> CI6
> >>
> Mn0%3D%7C3000&amp;sdata=8Rsnbfh4P5GmFUlybb31mT7C0Ee4vDInxJ1gt
> C3jrVI%3
> >> D&amp;reserved=0
> >>
> >> And I suspect this is the same:
> >>
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbug
> >>
> s.archlinux.org%2Ftask%2F69202&amp;data=04%7C01%7Calexander.deuche
> r%4
> >>
> 0amd.com%7Cad673e351bab4f6af94508d8b1977ed8%7C3dd8961fe4884e608
> e11a82
> >>
> d994e183d%7C0%7C0%7C637454612140560971%7CUnknown%7CTWFpbGZsb
> 3d8eyJWIj
> >>
> oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3
> 000&a
> >>
> mp;sdata=1149tCcm3rcaj1MkVPbWqWhWFIPgkeBoYxo0oVv%2FzNI%3D&a
> mp;reserve
> >> d=0
> >>
> >> Reverting it from 5.10.4 makes things behave again.
> >>
> >> Have not tested 5.4.86 or 5.11-rc.
> >>
> >> I'm using a RX570 Polaris based card.
> >
> > Can you test 5.11-rc to see if this issue is there as well?
> 
> Just did, and have the same issue on 5.11-rc2. Reverting it also solves the
> problem on 5.11-rc2, as it does on 5.10.4
> 
> FWIW one easy way to reproduce seems to be unplugging and re-plugging
> the HDMI.

We are looking into the root cause, but I'll send out the revert for now.

Thanks,

Alex

^ permalink raw reply	[flat|nested] 750+ messages in thread

end of thread, other threads:[~2021-01-05 16:42 UTC | newest]

Thread overview: 750+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-28 12:39 [PATCH 5.10 000/717] 5.10.4-rc1 review Greg Kroah-Hartman
2020-12-28 12:39 ` [PATCH 5.10 001/717] hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 002/717] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 003/717] iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 004/717] drm/aspeed: Fix Kconfig warning & subsequent build errors Greg Kroah-Hartman
2020-12-28 12:40   ` Greg Kroah-Hartman
2020-12-28 12:40   ` Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 005/717] drm/mcde: Fix handling of platform_get_irq() error Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 006/717] drm/tve200: " Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 007/717] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 008/717] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 009/717] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 010/717] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 011/717] arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 012/717] arm64: dts: ipq6018: update the reserved-memory node Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 013/717] arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 014/717] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 015/717] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 016/717] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 017/717] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 018/717] RDMA/bnxt_re: Fix entry size during SRQ create Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 019/717] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 020/717] ARM: dts: aspeed-g6: Fix the GPIO memory size Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 021/717] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 022/717] RDMA/core: Fix error return in _ib_modify_qp() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 023/717] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 024/717] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 025/717] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 026/717] RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 027/717] RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 028/717] RDMA/rtrs-srv: Dont guard the whole __alloc_srv with srv_mutex Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 029/717] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 030/717] ASoC: qcom: fix unsigned int bitwidth compared to less than zero Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 031/717] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 032/717] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 033/717] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 034/717] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 035/717] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 036/717] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 037/717] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 038/717] drm/msm: Add missing stub definition Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 039/717] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 040/717] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 041/717] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 042/717] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 043/717] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 044/717] RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 045/717] perf test: Use generic event for expand_libpfm_events() Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 046/717] drm/msm/dp: DisplayPort PHY compliance tests fixup Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 047/717] drm/msm/dsi_pll_7nm: restore VCO rate during restore_state Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 048/717] drm/msm/dsi_pll_10nm: " Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 049/717] drm/msm/dpu: fix clock scaling on non-sc7180 board Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 050/717] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 051/717] scsi: aacraid: Improve compat_ioctl handlers Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 052/717] pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 053/717] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 054/717] drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 055/717] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 056/717] crypto: arm64/poly1305-neon - reorder PAC authentication with SP update Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 057/717] crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 058/717] crypto: caam - fix printing on xts fallback allocation error path Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 059/717] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 060/717] nl80211/cfg80211: fix potential infinite loop Greg Kroah-Hartman
2020-12-28 12:40 ` [PATCH 5.10 061/717] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 062/717] bpf: Fix tests for local_storage Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 063/717] x86/mce: Correct the detection of invalid notifier priorities Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 064/717] drm/edid: Fix uninitialized variable in drm_cvt_modes() Greg Kroah-Hartman
2020-12-28 14:09   ` Ilia Mirkin
2020-12-28 14:21     ` Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 065/717] ath11k: Initialize complete alpha2 for regulatory change Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 066/717] ath11k: Fix number of rules in filtered ETSI regdomain Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 067/717] ath11k: fix wmi init configuration Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 068/717] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 069/717] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 070/717] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 071/717] drm/panel: simple: Add flags to boe_nv133fhm_n61 Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 072/717] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 073/717] Bluetooth: Fix: LL PRivacy BLE device fails to connect Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 074/717] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 075/717] spi: stm32-qspi: fix reference leak in stm32 qspi operations Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 076/717] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 077/717] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 078/717] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 079/717] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 080/717] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 081/717] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 082/717] spi: imx: fix reference leak in two imx operations Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 083/717] ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 084/717] ath11k: Handle errors if peer creation fails Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 085/717] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 086/717] drm/msm/a6xx: Clear shadow on suspend Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 087/717] drm/msm/a5xx: " Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 088/717] firmware: tegra: fix strncpy()/strncat() confusion Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 089/717] drm/msm/dp: return correct connection status after suspend Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 090/717] drm/msm/dp: skip checking LINK_STATUS_UPDATED bit Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 091/717] drm/msm/dp: do not notify audio subsystem if sink doesnt support audio Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 092/717] selftests/run_kselftest.sh: fix dry-run typo Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 093/717] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 094/717] ASoC: wm8994: Fix PM disable depth imbalance on error Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 095/717] ASoC: wm8998: " Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 096/717] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 097/717] virtiofs fix leak in setup Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 098/717] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
2020-12-28 18:50   ` Jakub Kicinski
2020-12-28 23:24     ` Sasha Levin
2020-12-28 12:41 ` [PATCH 5.10 099/717] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 100/717] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 101/717] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 102/717] ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 103/717] arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 104/717] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 105/717] drm/amdgpu: fix compute queue priority if num_kcq is less than 4 Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 106/717] soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 107/717] crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 108/717] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 109/717] firmware: arm_scmi: Fix missing destroy_workqueue() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 110/717] drm/udl: Fix missing error code in udl_handle_damage() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 111/717] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 112/717] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 113/717] scripts: kernel-doc: Restore anonymous enum parsing Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 114/717] drm/amdkfd: Put ACPI table after using it Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 115/717] ionic: use mc sync for multicast filters Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 116/717] ionic: flatten calls to ionic_lif_rx_mode Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 117/717] ionic: change set_rx_mode from_ndo to can_sleep Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 118/717] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 119/717] media: platform: add missing put_device() call in mtk_jpeg_clk_init() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 120/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
2020-12-28 12:41 ` [PATCH 5.10 121/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 122/717] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 123/717] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 124/717] media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 125/717] media: ov5640: fix support of BT656 bus mode Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 126/717] media: staging: rkisp1: cap: fix runtime PM imbalance on error Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 127/717] media: cedrus: fix reference leak in cedrus_start_streaming Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 128/717] media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 129/717] media: venus: core: change clk enable and disable order in resume and suspend Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 130/717] media: venus: core: vote for video-mem path Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 131/717] media: venus: core: vote with average bandwidth and peak bandwidth as zero Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 132/717] RDMA/cma: Add missing error handling of listen_id Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 133/717] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 134/717] spi: dw: fix build error by selecting MULTIPLEXER Greg Kroah-Hartman
2020-12-31  8:49   ` Serge Semin
2020-12-31  8:51     ` Greg Kroah-Hartman
2020-12-31  9:10       ` Serge Semin
2020-12-31  9:25         ` Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 135/717] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 136/717] media: venus: put dummy vote on video-mem path after last session release Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 137/717] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 138/717] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 139/717] mmc: sdhci: tegra: fix wrong unit with busy_timeout Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 140/717] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 141/717] drm/meson: Free RDMA resources after tearing down DRM Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 142/717] drm/meson: Unbind all connectors on module removal Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 143/717] drm/meson: dw-hdmi: Register a callback to disable the regulator Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 144/717] drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 145/717] ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 146/717] iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 147/717] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 148/717] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 149/717] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 150/717] bus: mhi: core: Remove double locking from mhi_driver_remove() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 151/717] bus: mhi: core: Fix null pointer access when parsing MHI configuration Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 152/717] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 153/717] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 154/717] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 155/717] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 156/717] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 157/717] ARM: dts: tacoma: Fix node vs reg mismatch for flash memory Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 158/717] Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path" Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 159/717] powerpc/powernv/sriov: fix unsigned int win compared to less than zero Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 160/717] mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 161/717] mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 162/717] mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init() Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 163/717] mfd: cpcap: Fix interrupt regression with regmap clear_ack Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 164/717] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 165/717] scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 166/717] scsi: ufs: Fix clkgating on/off Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 167/717] rcu: Allow rcu_irq_enter_check_tick() from NMI Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 168/717] rcu,ftrace: Fix ftrace recursion Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 169/717] rcu/tree: Defer kvfree_rcu() allocation to a clean context Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 170/717] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 171/717] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 173/717] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 174/717] drm/meson: dw-hdmi: Disable clocks on driver teardown Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 175/717] drm/meson: dw-hdmi: Enable the iahb clock early enough Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 176/717] PCI: Disable MSI for Pericom PCIe-USB adapter Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 177/717] PCI: brcmstb: Initialize "tmp" before use Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 178/717] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 179/717] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 180/717] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
2020-12-28 12:42 ` [PATCH 5.10 181/717] soc: qcom: initialize local variable Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 182/717] arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 183/717] arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 184/717] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 185/717] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 186/717] staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 187/717] ath11k: Fix the rx_filter flag setting for peer rssi stats Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 188/717] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 189/717] soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 190/717] pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 191/717] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
2020-12-29 22:42   ` Pavel Machek
2020-12-28 12:43 ` [PATCH 5.10 192/717] ARM: dts: at91: sam9x60: add pincontrol for USB Host Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 193/717] ARM: dts: at91: sama5d4_xplained: " Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 194/717] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 195/717] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 196/717] brcmfmac: fix error return code in brcmf_cfg80211_connect() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 197/717] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 198/717] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 199/717] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 200/717] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 201/717] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 202/717] arm64: dts: qcom: sdm845: Limit ipa iommu streams Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 203/717] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 204/717] leds: lp50xx: Fix an error handling path in lp50xx_probe_dt() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 205/717] leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 206/717] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 207/717] RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 208/717] soundwire: qcom: Fix build failure when slimbus is module Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 209/717] drm/imx/dcss: fix rotations for Vivante tiled formats Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 210/717] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 211/717] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 212/717] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
2020-12-29 19:01   ` Nathan Chancellor
2020-12-30  9:29     ` Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 213/717] arm64: dts: qcom: sc7180: limit IPA iommu streams Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 214/717] RDMA/hns: Only record vlan info for HIP08 Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 215/717] RDMA/hns: Fix missing fields in address vector Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 216/717] RDMA/hns: Avoid setting loopback indicator when smac is same as dmac Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 217/717] serial: 8250-mtk: Fix reference leak in mtk8250_probe Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 218/717] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 219/717] media: imx214: Fix stop streaming Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 220/717] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 221/717] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 222/717] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 223/717] RDMA/core: Track device memory MRs Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 224/717] drm/mediatek: Use correct aliases name for ovl Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 225/717] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 226/717] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 227/717] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 228/717] power: supply: bq25890: Use the correct range for IILIM register Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 229/717] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 230/717] power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 231/717] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 232/717] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 233/717] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 234/717] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 235/717] arm64: dts: ls1028a: fix FlexSPI " Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 236/717] arm64: dts: freescale: sl28: combine SPI MTD partitions Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 237/717] phy: tegra: xusb: Fix usb_phy device driver field Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 238/717] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 239/717] arm64: dts: qcom: c630: Fix pinctrl pins properties Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 240/717] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.10 241/717] PCI: Fix overflow in " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 242/717] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 243/717] PCI: iproc: Invalidate correct PAXB inbound windows Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 244/717] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 245/717] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 246/717] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 247/717] scsi: hisi_sas: Fix up probe error handling for v3 hw Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 248/717] scsi: pm80xx: Do not sleep in atomic context Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 249/717] spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 250/717] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 251/717] RDMA/hns: Fix 0-length sge calculation error Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 252/717] RDMA/hns: Bugfix for calculation of extended sge Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 253/717] mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 254/717] soundwire: master: use pm_runtime_set_active() on add Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 255/717] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 256/717] ASoC: Intel: Boards: tgl_max98373: update TDM slot_width Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 257/717] media: max9271: Fix GPIO enable/disable Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 258/717] media: rdacm20: Enable GPIO1 explicitly Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 259/717] media: i2c: imx219: Selection compliance fixes Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 260/717] ath11k: Dont cast ath11k_skb_cb to ieee80211_tx_info.control Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 261/717] ath11k: Reset ath11k_skb_cb before setting new flags Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 262/717] ath11k: Fix an error handling path Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 263/717] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 264/717] ath10k: Fix an error handling path Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 265/717] ath10k: Release some resources in " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 266/717] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 267/717] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 268/717] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 269/717] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 270/717] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 271/717] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 272/717] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 273/717] selftests/seccomp: Update kernel config Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 274/717] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 275/717] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 276/717] f2fs: fix double free of unicode map Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 277/717] media: tvp5150: Fix wrong return value of tvp5150_parse_dt() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 278/717] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 279/717] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 280/717] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 281/717] powerpc/xmon: Fix build failure for 8xx Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 282/717] powerpc/perf: Fix to update radix_scope_qual in power10 Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 283/717] powerpc/perf: Update the PMU group constraints for l2l3 events " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 284/717] powerpc/perf: Fix the PMU group constraints for threshold " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 285/717] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 286/717] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 287/717] clocksource/drivers/ingenic: Fix section mismatch Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 288/717] clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 289/717] arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 290/717] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 291/717] libbpf: Sanitise map names before pinning Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 292/717] ARM: dts: at91: sam9x60ek: remove bypass property Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 293/717] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 294/717] scripts: kernel-doc: fix parsing function-like typedefs Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 295/717] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 296/717] selftests/bpf: Fix invalid use of strncat in test_sockmap Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 297/717] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 298/717] soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 299/717] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 300/717] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.10 301/717] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 302/717] mt76: mt7663s: fix a possible ple quota underflow Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 303/717] mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 304/717] mt76: set fops_tx_stats.owner " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 305/717] mt76: dma: fix possible deadlock running mt76_dma_cleanup Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 306/717] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 307/717] mt76: fix memory leak if device probing fails Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 308/717] mt76: fix tkip configuration for mt7615/7663 devices Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 309/717] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 310/717] ASoC: q6afe-clocks: Add missing parent clock rate Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 311/717] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 312/717] ASoC: cros_ec_codec: fix uninitialized memory read Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 313/717] ASoC: atmel: mchp-spdifrx needs COMMON_CLK Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 314/717] ASoC: qcom: fix QDSP6 dependencies, attempt #3 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 315/717] phy: mediatek: allow compile-testing the hdmi phy Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 316/717] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 317/717] memory: ti-emif-sram: only build for ARMv7 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 318/717] memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 319/717] drm/msm: a5xx: Make preemption reset case reentrant Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 320/717] drm/msm: add IOMMU_SUPPORT dependency Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 321/717] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 322/717] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 323/717] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 324/717] cpufreq: highbank: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 325/717] cpufreq: mediatek: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 326/717] cpufreq: qcom: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 327/717] cpufreq: st: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 328/717] cpufreq: sun50i: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 329/717] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 330/717] cpufreq: scpi: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 331/717] cpufreq: vexpress-spc: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 332/717] cpufreq: imx: fix NVMEM_IMX_OCOTP dependency Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 333/717] macintosh/adb-iop: Always wait for reply message from IOP Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 334/717] macintosh/adb-iop: Send correct poll command Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 335/717] staging: bcm2835: fix vchiq_mmal dependencies Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 336/717] staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 337/717] spi: dw: Fix error return code in dw_spi_bt1_probe() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 338/717] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 339/717] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 340/717] Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 341/717] block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 342/717] block/rnbd: fix a null pointer dereference on dev->blk_symlink_name Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 343/717] Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 344/717] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 345/717] adm8211: fix error return code in adm8211_probe() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 346/717] mtd: spi-nor: sst: fix BPn bits for the SST25VF064C Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 347/717] mtd: spi-nor: ignore errors in spi_nor_unlock_all() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 348/717] mtd: spi-nor: atmel: remove global protection flag Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 349/717] mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 350/717] arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 351/717] arm64: dts: meson: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 352/717] ARM: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 353/717] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 354/717] arm64: dts: meson: g12b: w400: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 355/717] clk: fsl-sai: fix memory leak Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 356/717] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 357/717] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 358/717] scsi: iscsi: Fix inappropriate use of put_device() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 359/717] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 360/717] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.10 361/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 362/717] platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 363/717] ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 364/717] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 365/717] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 366/717] powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 367/717] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 368/717] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 369/717] coresight: remove broken __exit annotations Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 370/717] ASoC: max98390: Fix error codes in max98390_dsm_init() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 371/717] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 372/717] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 373/717] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 374/717] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 375/717] nfsd: Fix message level for normal termination Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 376/717] NFSD: Fix 5 seconds delay when doing inter server copy Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 377/717] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 378/717] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 379/717] scsi: qla2xxx: Fix FW initialization error on big endian machines Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 380/717] scsi: qla2xxx: Fix N2N and NVMe connect retry failure Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 381/717] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 382/717] misc: pci_endpoint_test: fix return value of error branch Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 383/717] bus: fsl-mc: add back accidentally dropped error check Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 384/717] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 385/717] fsi: Aspeed: Add mutex to protect HW access Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 386/717] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 387/717] iwlwifi: dbg-tlv: fix old length in is_trig_data_contained() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 388/717] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 389/717] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 390/717] clk: renesas: r8a779a0: Fix R and OSC clocks Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 391/717] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 392/717] powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 393/717] powerpc/sstep: Cover new VSX instructions under CONFIG_VSX Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 394/717] slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 395/717] ALSA: hda/hdmi: fix silent stream for first playback to DP Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 396/717] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 397/717] RDMA/uverbs: Fix incorrect variable type Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 398/717] remoteproc/mediatek: change MT8192 CFG register base Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 399/717] remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 400/717] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 401/717] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 402/717] remoteproc: qcom: pas: fix error handling in adsp_pds_enable Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 403/717] remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 404/717] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 405/717] remoteproc/mediatek: unprepare clk if scp_before_load fails Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 406/717] clk: qcom: gcc-sc7180: Use floor ops for sdcc clks Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 407/717] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 408/717] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 409/717] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 410/717] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 411/717] samples/bpf: Fix possible hang in xdpsock with multiple threads Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 412/717] fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 413/717] extcon: max77693: Fix modalias string Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 414/717] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 415/717] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 416/717] mac80211: fix a mistake check for rx_stats update Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 417/717] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 418/717] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 419/717] irqchip/ti-sci-inta: Fix printing of inta id on probe success Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 420/717] irqchip/ti-sci-intr: Fix freeing of irqs Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.10 421/717] dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0 Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 422/717] RDMA/hns: Limit the length of data copied between kernel and userspace Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 423/717] RDMA/hns: Normalization the judgment of some features Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 424/717] RDMA/hns: Do shift on traffic class when using RoCEv2 Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 425/717] gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 426/717] ath11k: Fix incorrect tlvs in scan start command Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 427/717] irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 428/717] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 429/717] watchdog: sirfsoc: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 430/717] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 431/717] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 432/717] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 433/717] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 434/717] um: Monitor error events in IRQ controller Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 435/717] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 436/717] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 437/717] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 438/717] RDMA/mlx5: Fix MR cache memory leak Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 439/717] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 440/717] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 441/717] drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 442/717] powerpc/perf: Fix Threshold Event Counter Multiplier width for P10 Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 443/717] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 444/717] perf test: Fix metric parsing test Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 445/717] drm/amdgpu: fix regression in vbios reservation handling on headless Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 446/717] mm/gup: reorganize internal_get_user_pages_fast() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 447/717] mm/gup: prevent gup_fast from racing with COW during fork Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 448/717] mm/gup: combine put_compound_head() and unpin_user_page() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 449/717] mm: memcg/slab: fix return of child memcg objcg for root memcg Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 450/717] mm: memcg/slab: fix use after free in obj_cgroup_charge Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 451/717] mm/rmap: always do TTU_IGNORE_ACCESS Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 452/717] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 453/717] mm/vmalloc: Fix unlock order in s_stop() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 454/717] mm/vmalloc.c: fix kasan shadow poisoning size Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 455/717] mm,memory_failure: always pin the page in madvise_inject_error Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 456/717] hugetlb: fix an error code in hugetlb_reserve_pages() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 457/717] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 458/717] proc: fix lookup in /proc/net subdirectories after setns(2) Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 459/717] checkpatch: fix unescaped left brace Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 460/717] s390/test_unwind: fix CALL_ON_STACK tests Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 461/717] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 462/717] ice, xsk: clear the status bits for the next_to_use descriptor Greg Kroah-Hartman
2020-12-28 18:54   ` Jakub Kicinski
2020-12-28 22:29     ` Sasha Levin
2020-12-28 22:51       ` Jakub Kicinski
2020-12-28 23:43         ` Sasha Levin
2020-12-29  0:28           ` Jakub Kicinski
2020-12-28 12:47 ` [PATCH 5.10 463/717] i40e, " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 464/717] net: dsa: qca: ar9331: fix sleeping function called from invalid context bug Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 465/717] dpaa2-eth: fix the size of the mapped SGT buffer Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 466/717] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 467/717] net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 468/717] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 469/717] block/rnbd-clt: Get rid of warning regarding size argument in strlcpy Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 470/717] block/rnbd-clt: Fix possible memleak Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 471/717] NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 472/717] net: korina: fix return value Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 473/717] devlink: use _BITUL() macro instead of BIT() in the UAPI header Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 474/717] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 475/717] powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 476/717] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 477/717] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 478/717] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 479/717] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.10 481/717] pwm: imx27: Fix overflow for bigger periods Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 482/717] pwm: sun4i: Remove erroneous else branch Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 483/717] io_uring: cancel only requests of current task Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 484/717] tools build: Add missing libcap to test-all.bin target Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 485/717] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 486/717] qlcnic: Fix error code in probe Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 487/717] nfp: move indirect block cleanup to flower app stop callback Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 488/717] vdpa/mlx5: Use write memory barrier after updating CQ index Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 489/717] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 490/717] virtio_net: Fix error code in probe() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 491/717] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 492/717] vhost scsi: fix error return code in vhost_scsi_set_endpoint() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 493/717] epoll: check for events when removing a timed out thread from the wait queue Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 494/717] clk: bcm: dvp: Add MODULE_DEVICE_TABLE() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 495/717] clk: at91: sama7g5: fix compilation error Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 496/717] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 497/717] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 498/717] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 499/717] clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts" Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 500/717] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 501/717] powerpc/boot: Fix build of dts/fsl Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 502/717] powerpc/smp: Add __init to init_big_cores() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 503/717] ARM: 9044/1: vfp: use undef hook for VFP support detection Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 504/717] ARM: 9036/1: uncompress: Fix dbgadtb size parameter name Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 505/717] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 506/717] io_uring: fix racy IOPOLL flush overflow Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 507/717] io_uring: cancel reqs shouldnt kill overflow list Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 508/717] Smack: Handle io_uring kernel thread privileges Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 509/717] proc mountinfo: make splice available again Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 510/717] io_uring: fix io_cqring_events()s noflush Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 511/717] io_uring: fix racy IOPOLL completions Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 512/717] io_uring: always let io_iopoll_complete() complete polled io Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 513/717] vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 514/717] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 515/717] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 516/717] io_uring: fix io_wqe->work_list corruption Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 517/717] io_uring: fix 0-iov read buffer select Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 518/717] io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 519/717] io_uring: fix ignoring xa_store errors Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 520/717] io_uring: fix double io_uring free Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 521/717] io_uring: make ctx cancel on exit targeted to actual ctx Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 522/717] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 523/717] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 524/717] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 525/717] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 526/717] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 527/717] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
2020-12-30 12:25   ` Pavel Machek
2020-12-30 12:32     ` Andy Shevchenko
2020-12-30 12:44       ` Laurent Pinchart
2020-12-30 12:56         ` Pavel Machek
2020-12-28 12:48 ` [PATCH 5.10 528/717] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 529/717] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 530/717] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 531/717] ACPI: NFIT: Fix input validation of bus-family Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 532/717] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 533/717] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 534/717] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 535/717] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 536/717] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 537/717] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 538/717] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 539/717] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 540/717] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.10 541/717] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 542/717] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 543/717] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 544/717] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 545/717] ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 546/717] ALSA: hda/realtek - Supported Dell fixed type headset Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 547/717] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 548/717] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 549/717] ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 550/717] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 551/717] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 552/717] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 553/717] s390/idle: add missing mt_cycles calculation Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 554/717] s390/idle: fix accounting with machine checks Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 555/717] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 556/717] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 557/717] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 558/717] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 559/717] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 560/717] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 561/717] ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS) Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 562/717] ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision) Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 563/717] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 564/717] z3fold: simplify freeing slots Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 565/717] z3fold: stricter locking and more careful reclaim Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 566/717] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 567/717] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 568/717] perf/x86/intel/lbr: Fix the return type of get_lbr_cycles() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 569/717] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 570/717] cpufreq: intel_pstate: Use most recent guaranteed performance values Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 571/717] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 572/717] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 573/717] m68k: Fix WARNING splat in pmac_zilog driver Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 574/717] Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 575/717] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 576/717] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 577/717] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 578/717] dyndbg: fix use before null check Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 579/717] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 580/717] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 581/717] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 582/717] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 583/717] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 584/717] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 585/717] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 586/717] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 587/717] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 588/717] btrfs: update last_byte_to_unpin in switch_commit_roots Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 589/717] btrfs: fix race when defragmenting leads to unnecessary IO Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 590/717] ext4: fix an IS_ERR() vs NULL check Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 591/717] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 592/717] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 593/717] ext4: dont remount read-only with errors=continue on reboot Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 594/717] RISC-V: Fix usage of memblock_enforce_memory_limit Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 595/717] arm64: dts: ti: k3-am65: mark dss as dma-coherent Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 596/717] arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 597/717] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 598/717] KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 599/717] KVM: SVM: Remove the call to sev_platform_status() during setup Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 600/717] iommu/arm-smmu: Allow implementation specific write_s2cr Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.10 601/717] iommu/arm-smmu-qcom: Read back stream mappings Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 602/717] iommu/arm-smmu-qcom: Implement S2CR quirk Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 603/717] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 604/717] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 605/717] ARM: tegra: Populate OPP table for Tegra20 Ventana Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 606/717] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 607/717] powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 608/717] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 609/717] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 610/717] powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 611/717] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 612/717] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 613/717] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 614/717] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 615/717] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 616/717] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 617/717] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 618/717] ovl: make ioctl() safe Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 619/717] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 620/717] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 621/717] um: Fix time-travel mode Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 622/717] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 623/717] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 624/717] SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 625/717] SMB3.1.1: do not log warning message if server doesnt populate salt Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 626/717] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 627/717] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 628/717] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 629/717] fsnotify: generalize handle_inode_event() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 630/717] inotify: convert to handle_inode_event() interface Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 631/717] fsnotify: fix events reported to watching parent and child Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 632/717] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 633/717] drm/panfrost: Fix job timeout handling Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 634/717] drm/panfrost: Move the GPU reset bits outside the timeout handler Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 635/717] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
2020-12-29 19:42   ` Bas Nieuwenhuizen
2020-12-30  9:24     ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 636/717] drm/amdgpu: only set DP subconnector type on DP and eDP connectors Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 637/717] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
2021-01-04 19:04   ` Andre Tomt
2021-01-04 20:10     ` Oleksandr Natalenko
2021-01-04 20:40       ` Oleksandr Natalenko
2021-01-05  6:54     ` Greg Kroah-Hartman
2021-01-05 16:32       ` Andre Tomt
2021-01-05 16:41         ` Deucher, Alexander
2020-12-28 12:50 ` [PATCH 5.10 638/717] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 639/717] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 640/717] iio: ad_sigma_delta: Dont put SPI transfer buffer on the stack Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 641/717] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 642/717] spi: spi-sh: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 643/717] spi: atmel-quadspi: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 644/717] spi: spi-mtk-nor: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 645/717] spi: ar934x: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 646/717] spi: davinci: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 647/717] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 648/717] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 649/717] spi: mxic: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 650/717] spi: npcm-fiu: Disable clock " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 651/717] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 652/717] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 653/717] spi: rpc-if: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 654/717] spi: sc18is602: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 655/717] spi: spi-geni-qcom: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 656/717] spi: spi-qcom-qspi: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 657/717] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 658/717] spi: synquacer: Disable clock " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 659/717] spi: mt7621: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 660/717] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.10 661/717] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 662/717] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 663/717] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 664/717] mtd: spinand: Fix OOB read Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 665/717] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 666/717] mtd: core: Fix refcounting for unpartitioned MTDs Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 667/717] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 668/717] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 669/717] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 670/717] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 671/717] scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 672/717] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 673/717] openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 674/717] iio: buffer: Fix demux update Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 675/717] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 676/717] iio: imu: st_lsm6dsx: fix edge-trigger interrupts Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 677/717] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 678/717] iio:light:st_uvis25: " Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 679/717] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 680/717] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 681/717] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 682/717] iio:imu:bmi160: Fix alignment and data leak issues Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 683/717] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 684/717] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 685/717] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 686/717] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 687/717] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 688/717] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 689/717] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 690/717] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 691/717] counter: microchip-tcb-capture: Fix CMR value check Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 692/717] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 693/717] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 694/717] driver: core: Fix list corruption after device_del() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 695/717] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 696/717] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 697/717] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 698/717] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 699/717] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 700/717] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 701/717] memory: jz4780_nemc: Fix an error pointer vs NULL check in probe() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 702/717] memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 703/717] memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 704/717] memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 705/717] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 706/717] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 707/717] tracing: Disable ftrace selftests when any tracer is running Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 708/717] mt76: add back the SUPPORTS_REORDERING_BUFFER flag Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 709/717] of: fix linker-section match-table corruption Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 710/717] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 711/717] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 712/717] remoteproc: sysmon: Ensure remote notification ordering Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 713/717] thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 714/717] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 715/717] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 716/717] null_blk: Fix zone size initialization Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.10 717/717] null_blk: Fail zone append to conventional zones Greg Kroah-Hartman
2020-12-28 20:18 ` [PATCH 5.10 000/717] 5.10.4-rc1 review Jon Hunter
2020-12-28 20:27 ` Guenter Roeck
2020-12-29  8:41 ` Naresh Kamboju

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.