5.4-stable patches

added patches:
	riscv-define-illegal_pointer_value-for-64bit.patch

diff --git a/queue-5.4/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch b/queue-5.4/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch
deleted file mode 100644 (file)
index 865d05d..0000000
--- a/queue-5.4/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 6b44aa559d6c7f4ea591ef9d2352a7250138d62a Mon Sep 17 00:00:00 2001
-From: Val Packett <val@packett.cool>
-Date: Mon, 24 Jun 2024 17:40:48 -0300
-Subject: drm/rockchip: vop: clear DMA stop bit on RK3066
-
-From: Val Packett <val@packett.cool>
-
-commit 6b44aa559d6c7f4ea591ef9d2352a7250138d62a upstream.
-
-The RK3066 VOP sets a dma_stop bit when it's done scanning out a frame
-and needs the driver to acknowledge that by clearing the bit.
-
-Unless we clear it "between" frames, the RGB output only shows noise
-instead of the picture. atomic_flush is the place for it that least
-affects other code (doing it on vblank would require converting all
-other usages of the reg_lock to spin_(un)lock_irq, which would affect
-performance for everyone).
-
-This seems to be a redundant synchronization mechanism that was removed
-in later iterations of the VOP hardware block.
-
-Fixes: f4a6de855eae ("drm: rockchip: vop: add rk3066 vop definitions")
-Cc: stable@vger.kernel.org
-Signed-off-by: Val Packett <val@packett.cool>
-Signed-off-by: Heiko Stuebner <heiko@sntech.de>
-Link: https://patchwork.freedesktop.org/patch/msgid/20240624204054.5524-2-val@packett.cool
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/gpu/drm/rockchip/rockchip_drm_vop.c |    4 ++++
- drivers/gpu/drm/rockchip/rockchip_drm_vop.h |    1 +
- drivers/gpu/drm/rockchip/rockchip_vop_reg.c |    1 +
- 3 files changed, 6 insertions(+)
-
---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-@@ -1246,6 +1246,10 @@ static void vop_crtc_atomic_flush(struct
- 
-       vop_cfg_done(vop);
- 
-+      /* Ack the DMA transfer of the previous frame (RK3066). */
-+      if (VOP_HAS_REG(vop, common, dma_stop))
-+              VOP_REG_SET(vop, common, dma_stop, 0);
-+
-       spin_unlock(&vop->reg_lock);
- 
-       /*
---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
-@@ -69,6 +69,7 @@ struct vop_common {
-       struct vop_reg dither_up;
-       struct vop_reg gate_en;
-       struct vop_reg mmu_en;
-+      struct vop_reg dma_stop;
-       struct vop_reg out_mode;
-       struct vop_reg standby;
- };
---- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
-@@ -365,6 +365,7 @@ static const struct vop_output rk3066_ou
- };
- 
- static const struct vop_common rk3066_common = {
-+      .dma_stop = VOP_REG(RK3066_SYS_CTRL0, 0x1, 0),
-       .standby = VOP_REG(RK3066_SYS_CTRL0, 0x1, 1),
-       .out_mode = VOP_REG(RK3066_DSP_CTRL0, 0xf, 0),
-       .cfg_done = VOP_REG(RK3066_REG_CFG_DONE, 0x1, 0),

diff --git a/queue-5.4/riscv-define-illegal_pointer_value-for-64bit.patch b/queue-5.4/riscv-define-illegal_pointer_value-for-64bit.patch
new file mode 100644 (file)
index 0000000..b527098
--- /dev/null
+++ b/queue-5.4/riscv-define-illegal_pointer_value-for-64bit.patch
@@ -0,0 +1,38 @@
+From 5c178472af247c7b50f962495bb7462ba453b9fb Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@kernel.org>
+Date: Sat, 6 Jul 2024 01:02:10 +0800
+Subject: riscv: define ILLEGAL_POINTER_VALUE for 64bit
+
+From: Jisheng Zhang <jszhang@kernel.org>
+
+commit 5c178472af247c7b50f962495bb7462ba453b9fb upstream.
+
+This is used in poison.h for poison pointer offset. Based on current
+SV39, SV48 and SV57 vm layout, 0xdead000000000000 is a proper value
+that is not mappable, this can avoid potentially turning an oops to
+an expolit.
+
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Fixes: fbe934d69eb7 ("RISC-V: Build Infrastructure")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240705170210.3236-1-jszhang@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/Kconfig |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -139,6 +139,11 @@ config GENERIC_HWEIGHT
+ config FIX_EARLYCON_MEM
+       def_bool y
+ 
++config ILLEGAL_POINTER_VALUE
++      hex
++      default 0 if 32BIT
++      default 0xdead000000000000 if 64BIT
++
+ config PGTABLE_LEVELS
+       int
+       default 3 if 64BIT

diff --git a/queue-5.4/series b/queue-5.4/series
index 1267224d819c33b7a7cf6568bb9a8b83ca2fd0a8..f4ea03b15a8c7c418a2f577950bc14295c1ca422 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -257,7 +257,6 @@ ext4-fix-double-brelse-the-buffer-of-the-extents-path.patch
 ext4-fix-incorrect-tid-assumption-in-ext4_wait_for_tail_page_commit.patch
 parisc-fix-64-bit-userspace-syscall-path.patch
 parisc-fix-stack-start-for-addr_no_randomize-personality.patch
-drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch
 of-irq-support-msi-cells-0-in-of_msi_get_domain.patch
 drm-omapdrm-add-missing-check-for-alloc_ordered_workqueue.patch
 jbd2-stop-waiting-for-space-when-jbd2_cleanup_journal_tail-returns-error.patch
@@ -269,3 +268,4 @@ ocfs2-cancel-dqi_sync_work-before-freeing-oinfo.patch
 ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch
 ocfs2-fix-null-ptr-deref-when-journal-load-failed.patch
 ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch
+riscv-define-illegal_pointer_value-for-64bit.patch