]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.4
authorSasha Levin <sashal@kernel.org>
Sun, 14 Feb 2021 16:44:57 +0000 (11:44 -0500)
committerSasha Levin <sashal@kernel.org>
Sun, 14 Feb 2021 16:44:57 +0000 (11:44 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
18 files changed:
queue-5.4/arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch [new file with mode: 0644]
queue-5.4/arm-ensure-the-signal-page-contains-defined-contents.patch [new file with mode: 0644]
queue-5.4/arm-kexec-fix-oops-after-tlb-are-invalidated.patch [new file with mode: 0644]
queue-5.4/arm-omap2-fix-suspcious-rcu-usage-splats-for-omap_en.patch [new file with mode: 0644]
queue-5.4/arm64-dts-qcom-sdm845-reserve-lpass-clocks-in-gcc.patch [new file with mode: 0644]
queue-5.4/arm64-dts-rockchip-fix-pcie-dt-properties-on-rk3399.patch [new file with mode: 0644]
queue-5.4/bfq-iosched-revert-bfq-fix-computation-of-shallow-de.patch [new file with mode: 0644]
queue-5.4/cap-fix-conversions-on-getxattr.patch [new file with mode: 0644]
queue-5.4/drm-amd-display-add-more-clock-sources-to-dcn2.1.patch [new file with mode: 0644]
queue-5.4/drm-amd-display-decrement-refcount-of-dc_sink-before.patch [new file with mode: 0644]
queue-5.4/drm-amd-display-fix-dc_sink-kref-count-in-emulated_l.patch [new file with mode: 0644]
queue-5.4/drm-amd-display-free-atomic-state-after-drm_atomic_c.patch [new file with mode: 0644]
queue-5.4/nvme-pci-ignore-the-subsysem-nqn-on-phison-e16.patch [new file with mode: 0644]
queue-5.4/ovl-perform-vfs_getxattr-with-mounter-creds.patch [new file with mode: 0644]
queue-5.4/ovl-skip-getxattr-of-security-labels.patch [new file with mode: 0644]
queue-5.4/platform-x86-hp-wmi-disable-tablet-mode-reporting-by.patch [new file with mode: 0644]
queue-5.4/riscv-virt_addr_valid-must-check-the-address-belongs.patch [new file with mode: 0644]
queue-5.4/series

diff --git a/queue-5.4/arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch b/queue-5.4/arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch
new file mode 100644 (file)
index 0000000..aae6a32
--- /dev/null
@@ -0,0 +1,47 @@
+From 9826449999c24463a629a39a49c987e9c9bf712a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 10:03:20 +0100
+Subject: ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 5638159f6d93b99ec9743ac7f65563fca3cf413d ]
+
+This reverts commit c17e9377aa81664d94b4f2102559fcf2a01ec8e7.
+
+The lpc32xx clock driver is not able to actually change the PLL rate as
+this would require reparenting ARM_CLK, DDRAM_CLK, PERIPH_CLK to SYSCLK,
+then stop the PLL, update the register, restart the PLL and wait for the
+PLL to lock and finally reparent ARM_CLK, DDRAM_CLK, PERIPH_CLK to HCLK
+PLL.
+
+Currently, the HCLK driver simply updates the registers but this has no
+real effect and all the clock rate calculation end up being wrong. This is
+especially annoying for the peripheral (e.g. UARTs, I2C, SPI).
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Link: https://lore.kernel.org/r/20210203090320.GA3760268@piout.net'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 7b7ec7b1217b8..824393e1bcfb7 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -329,9 +329,6 @@
+                                       clocks = <&xtal_32k>, <&xtal>;
+                                       clock-names = "xtal_32k", "xtal";
+-
+-                                      assigned-clocks = <&clk LPC32XX_CLK_HCLK_PLL>;
+-                                      assigned-clock-rates = <208000000>;
+                               };
+                       };
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-ensure-the-signal-page-contains-defined-contents.patch b/queue-5.4/arm-ensure-the-signal-page-contains-defined-contents.patch
new file mode 100644 (file)
index 0000000..d3468e6
--- /dev/null
@@ -0,0 +1,54 @@
+From 6d4917d9133bd704aad5554ea28745b8f3a6222f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 10:19:07 +0000
+Subject: ARM: ensure the signal page contains defined contents
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 9c698bff66ab4914bb3d71da7dc6112519bde23e ]
+
+Ensure that the signal page contains our poison instruction to increase
+the protection against ROP attacks and also contains well defined
+contents.
+
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/signal.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index ab2568996ddb0..c01f76cd02422 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -694,18 +694,20 @@ struct page *get_signal_page(void)
+       addr = page_address(page);
++      /* Poison the entire page */
++      memset32(addr, __opcode_to_mem_arm(0xe7fddef1),
++               PAGE_SIZE / sizeof(u32));
++
+       /* Give the signal return code some randomness */
+       offset = 0x200 + (get_random_int() & 0x7fc);
+       signal_return_offset = offset;
+-      /*
+-       * Copy signal return handlers into the vector page, and
+-       * set sigreturn to be a pointer to these.
+-       */
++      /* Copy signal return handlers into the page */
+       memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+-      ptr = (unsigned long)addr + offset;
+-      flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
++      /* Flush out all instructions in this page */
++      ptr = (unsigned long)addr;
++      flush_icache_range(ptr, ptr + PAGE_SIZE);
+       return page;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-kexec-fix-oops-after-tlb-are-invalidated.patch b/queue-5.4/arm-kexec-fix-oops-after-tlb-are-invalidated.patch
new file mode 100644 (file)
index 0000000..71f151c
--- /dev/null
@@ -0,0 +1,204 @@
+From fb55291abf9561cb40136bf681ceccc9e573db58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 19:40:01 +0000
+Subject: ARM: kexec: fix oops after TLB are invalidated
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4d62e81b60d4025e2dfcd5ea531cc1394ce9226f ]
+
+Giancarlo Ferrari reports the following oops while trying to use kexec:
+
+ Unable to handle kernel paging request at virtual address 80112f38
+ pgd = fd7ef03e
+ [80112f38] *pgd=0001141e(bad)
+ Internal error: Oops: 80d [#1] PREEMPT SMP ARM
+ ...
+
+This is caused by machine_kexec() trying to set the kernel text to be
+read/write, so it can poke values into the relocation code before
+copying it - and an interrupt occuring which changes the page tables.
+The subsequent writes then hit read-only sections that trigger a
+data abort resulting in the above oops.
+
+Fix this by copying the relocation code, and then writing the variables
+into the destination, thereby avoiding the need to make the kernel text
+read/write.
+
+Reported-by: Giancarlo Ferrari <giancarlo.ferrari89@gmail.com>
+Tested-by: Giancarlo Ferrari <giancarlo.ferrari89@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/kexec-internal.h | 12 +++++++++
+ arch/arm/kernel/asm-offsets.c         |  5 ++++
+ arch/arm/kernel/machine_kexec.c       | 20 ++++++--------
+ arch/arm/kernel/relocate_kernel.S     | 38 ++++++++-------------------
+ 4 files changed, 36 insertions(+), 39 deletions(-)
+ create mode 100644 arch/arm/include/asm/kexec-internal.h
+
+diff --git a/arch/arm/include/asm/kexec-internal.h b/arch/arm/include/asm/kexec-internal.h
+new file mode 100644
+index 0000000000000..ecc2322db7aa1
+--- /dev/null
++++ b/arch/arm/include/asm/kexec-internal.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ARM_KEXEC_INTERNAL_H
++#define _ARM_KEXEC_INTERNAL_H
++
++struct kexec_relocate_data {
++      unsigned long kexec_start_address;
++      unsigned long kexec_indirection_page;
++      unsigned long kexec_mach_type;
++      unsigned long kexec_r2;
++};
++
++#endif
+diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
+index c773b829ee8ee..bfb05c93494db 100644
+--- a/arch/arm/kernel/asm-offsets.c
++++ b/arch/arm/kernel/asm-offsets.c
+@@ -15,6 +15,7 @@
+ #include <linux/kvm_host.h>
+ #endif
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/glue-df.h>
+ #include <asm/glue-pf.h>
+ #include <asm/mach/arch.h>
+@@ -190,5 +191,9 @@ int main(void)
+   DEFINE(MPU_RGN_PRBAR,       offsetof(struct mpu_rgn, prbar));
+   DEFINE(MPU_RGN_PRLAR,       offsetof(struct mpu_rgn, prlar));
+ #endif
++  DEFINE(KEXEC_START_ADDR,    offsetof(struct kexec_relocate_data, kexec_start_address));
++  DEFINE(KEXEC_INDIR_PAGE,    offsetof(struct kexec_relocate_data, kexec_indirection_page));
++  DEFINE(KEXEC_MACH_TYPE,     offsetof(struct kexec_relocate_data, kexec_mach_type));
++  DEFINE(KEXEC_R2,            offsetof(struct kexec_relocate_data, kexec_r2));
+   return 0; 
+ }
+diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
+index 76300f3813e89..734adeb42df87 100644
+--- a/arch/arm/kernel/machine_kexec.c
++++ b/arch/arm/kernel/machine_kexec.c
+@@ -15,6 +15,7 @@
+ #include <asm/pgalloc.h>
+ #include <asm/mmu_context.h>
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/fncpy.h>
+ #include <asm/mach-types.h>
+ #include <asm/smp_plat.h>
+@@ -24,11 +25,6 @@
+ extern void relocate_new_kernel(void);
+ extern const unsigned int relocate_new_kernel_size;
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
+-extern unsigned long kexec_mach_type;
+-extern unsigned long kexec_boot_atags;
+-
+ static atomic_t waiting_for_crash_ipi;
+ /*
+@@ -161,6 +157,7 @@ void (*kexec_reinit)(void);
+ void machine_kexec(struct kimage *image)
+ {
+       unsigned long page_list, reboot_entry_phys;
++      struct kexec_relocate_data *data;
+       void (*reboot_entry)(void);
+       void *reboot_code_buffer;
+@@ -176,18 +173,17 @@ void machine_kexec(struct kimage *image)
+       reboot_code_buffer = page_address(image->control_code_page);
+-      /* Prepare parameters for reboot_code_buffer*/
+-      set_kernel_text_rw();
+-      kexec_start_address = image->start;
+-      kexec_indirection_page = page_list;
+-      kexec_mach_type = machine_arch_type;
+-      kexec_boot_atags = image->arch.kernel_r2;
+-
+       /* copy our kernel relocation code to the control code page */
+       reboot_entry = fncpy(reboot_code_buffer,
+                            &relocate_new_kernel,
+                            relocate_new_kernel_size);
++      data = reboot_code_buffer + relocate_new_kernel_size;
++      data->kexec_start_address = image->start;
++      data->kexec_indirection_page = page_list;
++      data->kexec_mach_type = machine_arch_type;
++      data->kexec_r2 = image->arch.kernel_r2;
++
+       /* get the identity mapping physical address for the reboot code */
+       reboot_entry_phys = virt_to_idmap(reboot_entry);
+diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
+index 7eaa2ae7aff58..5e15b5912cb05 100644
+--- a/arch/arm/kernel/relocate_kernel.S
++++ b/arch/arm/kernel/relocate_kernel.S
+@@ -5,14 +5,16 @@
+ #include <linux/linkage.h>
+ #include <asm/assembler.h>
++#include <asm/asm-offsets.h>
+ #include <asm/kexec.h>
+       .align  3       /* not needed for this code, but keeps fncpy() happy */
+ ENTRY(relocate_new_kernel)
+-      ldr     r0,kexec_indirection_page
+-      ldr     r1,kexec_start_address
++      adr     r7, relocate_new_kernel_end
++      ldr     r0, [r7, #KEXEC_INDIR_PAGE]
++      ldr     r1, [r7, #KEXEC_START_ADDR]
+       /*
+        * If there is no indirection page (we are doing crashdumps)
+@@ -57,34 +59,16 @@ ENTRY(relocate_new_kernel)
+ 2:
+       /* Jump to relocated kernel */
+-      mov lr,r1
+-      mov r0,#0
+-      ldr r1,kexec_mach_type
+-      ldr r2,kexec_boot_atags
+- ARM( ret lr  )
+- THUMB(       bx lr           )
+-
+-      .align
+-
+-      .globl kexec_start_address
+-kexec_start_address:
+-      .long   0x0
+-
+-      .globl kexec_indirection_page
+-kexec_indirection_page:
+-      .long   0x0
+-
+-      .globl kexec_mach_type
+-kexec_mach_type:
+-      .long   0x0
+-
+-      /* phy addr of the atags for the new kernel */
+-      .globl kexec_boot_atags
+-kexec_boot_atags:
+-      .long   0x0
++      mov     lr, r1
++      mov     r0, #0
++      ldr     r1, [r7, #KEXEC_MACH_TYPE]
++      ldr     r2, [r7, #KEXEC_R2]
++ ARM( ret     lr      )
++ THUMB(       bx      lr      )
+ ENDPROC(relocate_new_kernel)
++      .align  3
+ relocate_new_kernel_end:
+       .globl relocate_new_kernel_size
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-omap2-fix-suspcious-rcu-usage-splats-for-omap_en.patch b/queue-5.4/arm-omap2-fix-suspcious-rcu-usage-splats-for-omap_en.patch
new file mode 100644 (file)
index 0000000..5c1cda3
--- /dev/null
@@ -0,0 +1,106 @@
+From fc22069b1a19016784590b1156d39a78f3bdd2ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 21:09:11 +0200
+Subject: ARM: OMAP2+: Fix suspcious RCU usage splats for
+ omap_enter_idle_coupled
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 06862d789ddde8a99c1e579e934ca17c15a84755 ]
+
+We get suspcious RCU usage splats with cpuidle in several places in
+omap_enter_idle_coupled() with the kernel debug options enabled:
+
+RCU used illegally from extended quiescent state!
+...
+(_raw_spin_lock_irqsave)
+(omap_enter_idle_coupled+0x17c/0x2d8)
+(omap_enter_idle_coupled)
+(cpuidle_enter_state)
+(cpuidle_enter_state_coupled)
+(cpuidle_enter)
+
+Let's use RCU_NONIDLE to suppress these splats. Things got changed around
+with commit 1098582a0f6c ("sched,idle,rcu: Push rcu_idle deeper into the
+idle path") that started triggering these warnings.
+
+For the tick_broadcast related calls, ideally we'd just switch over to
+using CPUIDLE_FLAG_TIMER_STOP for omap_enter_idle_coupled() to have the
+generic cpuidle code handle the tick_broadcast related calls for us and
+then just drop the tick_broadcast calls here.
+
+But we're currently missing the call in the common cpuidle code for
+tick_broadcast_enable() that CPU1 hotplug needs as described in earlier
+commit 50d6b3cf9403 ("ARM: OMAP2+: fix lack of timer interrupts on CPU1
+after hotplug").
+
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Russell King <rmk+kernel@armlinux.org.uk>
+Acked-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/cpuidle44xx.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
+index c8d317fafe2ea..de37027ad7587 100644
+--- a/arch/arm/mach-omap2/cpuidle44xx.c
++++ b/arch/arm/mach-omap2/cpuidle44xx.c
+@@ -151,10 +151,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+                                (cx->mpu_logic_state == PWRDM_POWER_OFF);
+       /* Enter broadcast mode for periodic timers */
+-      tick_broadcast_enable();
++      RCU_NONIDLE(tick_broadcast_enable());
+       /* Enter broadcast mode for one-shot timers */
+-      tick_broadcast_enter();
++      RCU_NONIDLE(tick_broadcast_enter());
+       /*
+        * Call idle CPU PM enter notifier chain so that
+@@ -166,7 +166,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+       if (dev->cpu == 0) {
+               pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state);
+-              omap_set_pwrdm_state(mpu_pd, cx->mpu_state);
++              RCU_NONIDLE(omap_set_pwrdm_state(mpu_pd, cx->mpu_state));
+               /*
+                * Call idle CPU cluster PM enter notifier chain
+@@ -178,7 +178,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+                               index = 0;
+                               cx = state_ptr + index;
+                               pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state);
+-                              omap_set_pwrdm_state(mpu_pd, cx->mpu_state);
++                              RCU_NONIDLE(omap_set_pwrdm_state(mpu_pd, cx->mpu_state));
+                               mpuss_can_lose_context = 0;
+                       }
+               }
+@@ -194,9 +194,9 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+                   mpuss_can_lose_context)
+                       gic_dist_disable();
+-              clkdm_deny_idle(cpu_clkdm[1]);
+-              omap_set_pwrdm_state(cpu_pd[1], PWRDM_POWER_ON);
+-              clkdm_allow_idle(cpu_clkdm[1]);
++              RCU_NONIDLE(clkdm_deny_idle(cpu_clkdm[1]));
++              RCU_NONIDLE(omap_set_pwrdm_state(cpu_pd[1], PWRDM_POWER_ON));
++              RCU_NONIDLE(clkdm_allow_idle(cpu_clkdm[1]));
+               if (IS_PM44XX_ERRATUM(PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD) &&
+                   mpuss_can_lose_context) {
+@@ -222,7 +222,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+       cpu_pm_exit();
+ cpu_pm_out:
+-      tick_broadcast_exit();
++      RCU_NONIDLE(tick_broadcast_exit());
+ fail:
+       cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-qcom-sdm845-reserve-lpass-clocks-in-gcc.patch b/queue-5.4/arm64-dts-qcom-sdm845-reserve-lpass-clocks-in-gcc.patch
new file mode 100644 (file)
index 0000000..5ea7784
--- /dev/null
@@ -0,0 +1,61 @@
+From f8f1165dda9be1b14eb7e408ad41bc053afa0ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 16:11:03 -0800
+Subject: arm64: dts: qcom: sdm845: Reserve LPASS clocks in gcc
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 93f2a11580a9732c1d90f9e01a7e9facc825658f ]
+
+The GCC_LPASS_Q6_AXI_CLK and GCC_LPASS_SWAY_CLK clocks may not be
+touched on a typical UEFI based SDM845 device, but when the kernel is
+built with CONFIG_SDM_LPASSCC_845 this happens, unless they are marked
+as protected-clocks in the DT.
+
+This was done for the MTP and the Pocophone, but not for DB845c and the
+Lenovo Yoga C630 - causing these to fail to boot if the LPASS clock
+controller is enabled (which it typically isn't).
+
+Tested-by: Vinod Koul <vkoul@kernel.org> #on db845c
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20201222001103.3112306-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts           | 4 +++-
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index 751651a6cd819..bf4fde88011c8 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -337,7 +337,9 @@
+ &gcc {
+       protected-clocks = <GCC_QSPI_CORE_CLK>,
+                          <GCC_QSPI_CORE_CLK_SRC>,
+-                         <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
++                         <GCC_QSPI_CNOC_PERIPH_AHB_CLK>,
++                         <GCC_LPASS_Q6_AXI_CLK>,
++                         <GCC_LPASS_SWAY_CLK>;
+ };
+ &pm8998_gpio {
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index e638f216dbfb3..840d6b9bbb598 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -232,7 +232,9 @@
+ &gcc {
+       protected-clocks = <GCC_QSPI_CORE_CLK>,
+                          <GCC_QSPI_CORE_CLK_SRC>,
+-                         <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
++                         <GCC_QSPI_CNOC_PERIPH_AHB_CLK>,
++                         <GCC_LPASS_Q6_AXI_CLK>,
++                         <GCC_LPASS_SWAY_CLK>;
+ };
+ &i2c1 {
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-rockchip-fix-pcie-dt-properties-on-rk3399.patch b/queue-5.4/arm64-dts-rockchip-fix-pcie-dt-properties-on-rk3399.patch
new file mode 100644 (file)
index 0000000..19ce51a
--- /dev/null
@@ -0,0 +1,50 @@
+From dee602ea7a40b4c2000a84507b1cba4cdaed2ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Aug 2020 13:51:12 +0100
+Subject: arm64: dts: rockchip: Fix PCIe DT properties on rk3399
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 43f20b1c6140896916f4e91aacc166830a7ba849 ]
+
+It recently became apparent that the lack of a 'device_type = "pci"'
+in the PCIe root complex node for rk3399 is a violation of the PCI
+binding, as documented in IEEE Std 1275-1994. Changes to the kernel's
+parsing of the DT made such violation fatal, as drivers cannot
+probe the controller anymore.
+
+Add the missing property makes the PCIe node compliant. While we
+are at it, drop the pointless linux,pci-domain property, which only
+makes sense when there are multiple host bridges.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200815125112.462652-3-maz@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index bb7d0aac6b9db..9d6ed8cda2c86 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -232,6 +232,7 @@
+               reg = <0x0 0xf8000000 0x0 0x2000000>,
+                     <0x0 0xfd000000 0x0 0x1000000>;
+               reg-names = "axi-base", "apb-base";
++              device_type = "pci";
+               #address-cells = <3>;
+               #size-cells = <2>;
+               #interrupt-cells = <1>;
+@@ -250,7 +251,6 @@
+                               <0 0 0 2 &pcie0_intc 1>,
+                               <0 0 0 3 &pcie0_intc 2>,
+                               <0 0 0 4 &pcie0_intc 3>;
+-              linux,pci-domain = <0>;
+               max-link-speed = <1>;
+               msi-map = <0x0 &its 0x0 0x1000>;
+               phys = <&pcie_phy 0>, <&pcie_phy 1>,
+-- 
+2.27.0
+
diff --git a/queue-5.4/bfq-iosched-revert-bfq-fix-computation-of-shallow-de.patch b/queue-5.4/bfq-iosched-revert-bfq-fix-computation-of-shallow-de.patch
new file mode 100644 (file)
index 0000000..7e9a8da
--- /dev/null
@@ -0,0 +1,68 @@
+From c4b9283315133ba2b40cbdeb7c96d435bb501b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 07:18:23 -0700
+Subject: bfq-iosched: Revert "bfq: Fix computation of shallow depth"
+
+From: Lin Feng <linf@wangsu.com>
+
+[ Upstream commit 388c705b95f23f317fa43e6abf9ff07b583b721a ]
+
+This reverts commit 6d4d273588378c65915acaf7b2ee74e9dd9c130a.
+
+bfq.limit_depth passes word_depths[] as shallow_depth down to sbitmap core
+sbitmap_get_shallow, which uses just the number to limit the scan depth of
+each bitmap word, formula:
+scan_percentage_for_each_word = shallow_depth / (1 << sbimap->shift) * 100%
+
+That means the comments's percentiles 50%, 75%, 18%, 37% of bfq are correct.
+But after commit patch 'bfq: Fix computation of shallow depth', we use
+sbitmap.depth instead, as a example in following case:
+
+sbitmap.depth = 256, map_nr = 4, shift = 6; sbitmap_word.depth = 64.
+The resulsts of computed bfqd->word_depths[] are {128, 192, 48, 96}, and
+three of the numbers exceed core dirver's 'sbitmap_word.depth=64' limit
+nothing.
+
+Signed-off-by: Lin Feng <linf@wangsu.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 7d19aae015aeb..ba32adaeefdd0 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6320,13 +6320,13 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+        * limit 'something'.
+        */
+       /* no more than 50% of tags for async I/O */
+-      bfqd->word_depths[0][0] = max(bt->sb.depth >> 1, 1U);
++      bfqd->word_depths[0][0] = max((1U << bt->sb.shift) >> 1, 1U);
+       /*
+        * no more than 75% of tags for sync writes (25% extra tags
+        * w.r.t. async I/O, to prevent async I/O from starving sync
+        * writes)
+        */
+-      bfqd->word_depths[0][1] = max((bt->sb.depth * 3) >> 2, 1U);
++      bfqd->word_depths[0][1] = max(((1U << bt->sb.shift) * 3) >> 2, 1U);
+       /*
+        * In-word depths in case some bfq_queue is being weight-
+@@ -6336,9 +6336,9 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+        * shortage.
+        */
+       /* no more than ~18% of tags for async I/O */
+-      bfqd->word_depths[1][0] = max((bt->sb.depth * 3) >> 4, 1U);
++      bfqd->word_depths[1][0] = max(((1U << bt->sb.shift) * 3) >> 4, 1U);
+       /* no more than ~37% of tags for sync writes (~20% extra tags) */
+-      bfqd->word_depths[1][1] = max((bt->sb.depth * 6) >> 4, 1U);
++      bfqd->word_depths[1][1] = max(((1U << bt->sb.shift) * 6) >> 4, 1U);
+       for (i = 0; i < 2; i++)
+               for (j = 0; j < 2; j++)
+-- 
+2.27.0
+
diff --git a/queue-5.4/cap-fix-conversions-on-getxattr.patch b/queue-5.4/cap-fix-conversions-on-getxattr.patch
new file mode 100644 (file)
index 0000000..de18600
--- /dev/null
@@ -0,0 +1,145 @@
+From 447f9a823415bb38ed9f88280c7c4f2b4a121ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 10:22:48 +0100
+Subject: cap: fix conversions on getxattr
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit f2b00be488730522d0fb7a8a5de663febdcefe0a ]
+
+If a capability is stored on disk in v2 format cap_inode_getsecurity() will
+currently return in v2 format unconditionally.
+
+This is wrong: v2 cap should be equivalent to a v3 cap with zero rootid,
+and so the same conversions performed on it.
+
+If the rootid cannot be mapped, v3 is returned unconverted.  Fix this so
+that both v2 and v3 return -EOVERFLOW if the rootid (or the owner of the fs
+user namespace in case of v2) cannot be mapped into the current user
+namespace.
+
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 67 ++++++++++++++++++++++++++++----------------
+ 1 file changed, 43 insertions(+), 24 deletions(-)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 0ca31c8bc0b13..28a6939bcc4e5 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -371,10 +371,11 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ {
+       int size, ret;
+       kuid_t kroot;
++      u32 nsmagic, magic;
+       uid_t root, mappedroot;
+       char *tmpbuf = NULL;
+       struct vfs_cap_data *cap;
+-      struct vfs_ns_cap_data *nscap;
++      struct vfs_ns_cap_data *nscap = NULL;
+       struct dentry *dentry;
+       struct user_namespace *fs_ns;
+@@ -396,46 +397,61 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+       fs_ns = inode->i_sb->s_user_ns;
+       cap = (struct vfs_cap_data *) tmpbuf;
+       if (is_v2header((size_t) ret, cap)) {
+-              /* If this is sizeof(vfs_cap_data) then we're ok with the
+-               * on-disk value, so return that.  */
+-              if (alloc)
+-                      *buffer = tmpbuf;
+-              else
+-                      kfree(tmpbuf);
+-              return ret;
+-      } else if (!is_v3header((size_t) ret, cap)) {
+-              kfree(tmpbuf);
+-              return -EINVAL;
++              root = 0;
++      } else if (is_v3header((size_t) ret, cap)) {
++              nscap = (struct vfs_ns_cap_data *) tmpbuf;
++              root = le32_to_cpu(nscap->rootid);
++      } else {
++              size = -EINVAL;
++              goto out_free;
+       }
+-      nscap = (struct vfs_ns_cap_data *) tmpbuf;
+-      root = le32_to_cpu(nscap->rootid);
+       kroot = make_kuid(fs_ns, root);
+       /* If the root kuid maps to a valid uid in current ns, then return
+        * this as a nscap. */
+       mappedroot = from_kuid(current_user_ns(), kroot);
+       if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
++              size = sizeof(struct vfs_ns_cap_data);
+               if (alloc) {
+-                      *buffer = tmpbuf;
++                      if (!nscap) {
++                              /* v2 -> v3 conversion */
++                              nscap = kzalloc(size, GFP_ATOMIC);
++                              if (!nscap) {
++                                      size = -ENOMEM;
++                                      goto out_free;
++                              }
++                              nsmagic = VFS_CAP_REVISION_3;
++                              magic = le32_to_cpu(cap->magic_etc);
++                              if (magic & VFS_CAP_FLAGS_EFFECTIVE)
++                                      nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
++                              memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
++                              nscap->magic_etc = cpu_to_le32(nsmagic);
++                      } else {
++                              /* use allocated v3 buffer */
++                              tmpbuf = NULL;
++                      }
+                       nscap->rootid = cpu_to_le32(mappedroot);
+-              } else
+-                      kfree(tmpbuf);
+-              return size;
++                      *buffer = nscap;
++              }
++              goto out_free;
+       }
+       if (!rootid_owns_currentns(kroot)) {
+-              kfree(tmpbuf);
+-              return -EOPNOTSUPP;
++              size = -EOVERFLOW;
++              goto out_free;
+       }
+       /* This comes from a parent namespace.  Return as a v2 capability */
+       size = sizeof(struct vfs_cap_data);
+       if (alloc) {
+-              *buffer = kmalloc(size, GFP_ATOMIC);
+-              if (*buffer) {
+-                      struct vfs_cap_data *cap = *buffer;
+-                      __le32 nsmagic, magic;
++              if (nscap) {
++                      /* v3 -> v2 conversion */
++                      cap = kzalloc(size, GFP_ATOMIC);
++                      if (!cap) {
++                              size = -ENOMEM;
++                              goto out_free;
++                      }
+                       magic = VFS_CAP_REVISION_2;
+                       nsmagic = le32_to_cpu(nscap->magic_etc);
+                       if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
+@@ -443,9 +459,12 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+                       memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+                       cap->magic_etc = cpu_to_le32(magic);
+               } else {
+-                      size = -ENOMEM;
++                      /* use unconverted v2 */
++                      tmpbuf = NULL;
+               }
++              *buffer = cap;
+       }
++out_free:
+       kfree(tmpbuf);
+       return size;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-add-more-clock-sources-to-dcn2.1.patch b/queue-5.4/drm-amd-display-add-more-clock-sources-to-dcn2.1.patch
new file mode 100644 (file)
index 0000000..81023d8
--- /dev/null
@@ -0,0 +1,57 @@
+From 81aa77c9c4bdcf029b73be3cb90ec9540998215d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:53:15 -0500
+Subject: drm/amd/display: Add more Clock Sources to DCN2.1
+
+From: Sung Lee <sung.lee@amd.com>
+
+[ Upstream commit 1622711beebe887e4f0f8237fea1f09bb48e9a51 ]
+
+[WHY]
+When enabling HDMI on ComboPHY, there are not
+enough clock sources to complete display detection.
+
+[HOW]
+Initialize more clock sources.
+
+Signed-off-by: Sung Lee <sung.lee@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index a6d5beada6634..f63cbbee7b337 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -826,6 +826,8 @@ enum dcn20_clk_src_array_id {
+       DCN20_CLK_SRC_PLL0,
+       DCN20_CLK_SRC_PLL1,
+       DCN20_CLK_SRC_PLL2,
++      DCN20_CLK_SRC_PLL3,
++      DCN20_CLK_SRC_PLL4,
+       DCN20_CLK_SRC_TOTAL_DCN21
+ };
+@@ -1498,6 +1500,14 @@ static bool construct(
+                       dcn21_clock_source_create(ctx, ctx->dc_bios,
+                               CLOCK_SOURCE_COMBO_PHY_PLL2,
+                               &clk_src_regs[2], false);
++      pool->base.clock_sources[DCN20_CLK_SRC_PLL3] =
++                      dcn21_clock_source_create(ctx, ctx->dc_bios,
++                              CLOCK_SOURCE_COMBO_PHY_PLL3,
++                              &clk_src_regs[3], false);
++      pool->base.clock_sources[DCN20_CLK_SRC_PLL4] =
++                      dcn21_clock_source_create(ctx, ctx->dc_bios,
++                              CLOCK_SOURCE_COMBO_PHY_PLL4,
++                              &clk_src_regs[4], false);
+       pool->base.clk_src_count = DCN20_CLK_SRC_TOTAL_DCN21;
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-decrement-refcount-of-dc_sink-before.patch b/queue-5.4/drm-amd-display-decrement-refcount-of-dc_sink-before.patch
new file mode 100644 (file)
index 0000000..8240b65
--- /dev/null
@@ -0,0 +1,46 @@
+From 9fe2d98b5d6f1155b5bfb3ced85d23e8e30e0584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:02:48 -0500
+Subject: drm/amd/display: Decrement refcount of dc_sink before reassignment
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 8e92bb0fa75bca9a57e4aba2e36f67d8016a3053 ]
+
+[why]
+An old dc_sink state is causing a memory leak because it is missing a
+dc_sink_release before a new dc_sink is assigned back to
+aconnector->dc_sink.
+
+[how]
+Decrement the dc_sink refcount before reassigning it to a new dc_sink.
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b4da8d1e4fb87..fbbe611d4873f 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1417,8 +1417,10 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
+                * TODO: check if we still need the S3 mode update workaround.
+                * If yes, put it here.
+                */
+-              if (aconnector->dc_sink)
++              if (aconnector->dc_sink) {
+                       amdgpu_dm_update_freesync_caps(connector, NULL);
++                      dc_sink_release(aconnector->dc_sink);
++              }
+               aconnector->dc_sink = sink;
+               dc_sink_retain(aconnector->dc_sink);
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-fix-dc_sink-kref-count-in-emulated_l.patch b/queue-5.4/drm-amd-display-fix-dc_sink-kref-count-in-emulated_l.patch
new file mode 100644 (file)
index 0000000..106abcf
--- /dev/null
@@ -0,0 +1,44 @@
+From 29a5fab9f7189187dbfae86eb947474a0b34db14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 22:24:14 -0500
+Subject: drm/amd/display: Fix dc_sink kref count in emulated_link_detect
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 3ddc818d9bb877c64f5c649beab97af86c403702 ]
+
+[why]
+prev_sink is not used anywhere else in the function and the reference to
+it from dc_link is replaced with a new dc_sink.
+
+[how]
+Change dc_sink_retain(prev_sink) to dc_sink_release(prev_sink).
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index de06ee7d2ad46..3671b3e8f69d8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1093,8 +1093,8 @@ static void emulated_link_detect(struct dc_link *link)
+       link->type = dc_connection_none;
+       prev_sink = link->local_sink;
+-      if (prev_sink != NULL)
+-              dc_sink_retain(prev_sink);
++      if (prev_sink)
++              dc_sink_release(prev_sink);
+       switch (link->connector_signal) {
+       case SIGNAL_TYPE_HDMI_TYPE_A: {
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-free-atomic-state-after-drm_atomic_c.patch b/queue-5.4/drm-amd-display-free-atomic-state-after-drm_atomic_c.patch
new file mode 100644 (file)
index 0000000..c7d4a7c
--- /dev/null
@@ -0,0 +1,73 @@
+From aa3dcc178256ffc7d0ef67d2147daf44cd5772d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 16:27:07 -0500
+Subject: drm/amd/display: Free atomic state after drm_atomic_commit
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 2abaa323d744011982b20b8f3886184d56d23946 ]
+
+[why]
+drm_atomic_commit was changed so that the caller must free their
+drm_atomic_state reference on successes.
+
+[how]
+Add drm_atomic_commit_put after drm_atomic_commit call in
+dm_force_atomic_commit.
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 3671b3e8f69d8..b4da8d1e4fb87 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6463,14 +6463,14 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+       ret = PTR_ERR_OR_ZERO(conn_state);
+       if (ret)
+-              goto err;
++              goto out;
+       /* Attach crtc to drm_atomic_state*/
+       crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base);
+       ret = PTR_ERR_OR_ZERO(crtc_state);
+       if (ret)
+-              goto err;
++              goto out;
+       /* force a restore */
+       crtc_state->mode_changed = true;
+@@ -6480,17 +6480,15 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+       ret = PTR_ERR_OR_ZERO(plane_state);
+       if (ret)
+-              goto err;
+-
++              goto out;
+       /* Call commit internally with the state we just constructed */
+       ret = drm_atomic_commit(state);
+-      if (!ret)
+-              return 0;
+-err:
+-      DRM_ERROR("Restoring old state failed with %i\n", ret);
++out:
+       drm_atomic_state_put(state);
++      if (ret)
++              DRM_ERROR("Restoring old state failed with %i\n", ret);
+       return ret;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/nvme-pci-ignore-the-subsysem-nqn-on-phison-e16.patch b/queue-5.4/nvme-pci-ignore-the-subsysem-nqn-on-phison-e16.patch
new file mode 100644 (file)
index 0000000..a3c2d2c
--- /dev/null
@@ -0,0 +1,37 @@
+From 8f478c9c9ed7ba3468ac91dbd58daa2acfb5979e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 22:08:22 +0100
+Subject: nvme-pci: ignore the subsysem NQN on Phison E16
+
+From: Claus Stovgaard <claus.stovgaard@gmail.com>
+
+[ Upstream commit c9e95c39280530200cdd0bbd2670e6334a81970b ]
+
+Tested both with Corsairs firmware 11.3 and 13.0 for the Corsairs MP600
+and both have the issue as reported by the kernel.
+
+nvme nvme0: missing or invalid SUBNQN field.
+
+Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 434d3f21f0e13..19e375b59f407 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3147,6 +3147,8 @@ static const struct pci_device_id nvme_id_table[] = {
+       { PCI_DEVICE(0x144d, 0xa822),   /* Samsung PM1725a */
+               .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
+                               NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++      { PCI_DEVICE(0x1987, 0x5016),   /* Phison E16 */
++              .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+       { PCI_DEVICE(0x1d1d, 0x1f1f),   /* LighNVM qemu device */
+               .driver_data = NVME_QUIRK_LIGHTNVM, },
+       { PCI_DEVICE(0x1d1d, 0x2807),   /* CNEX WL */
+-- 
+2.27.0
+
diff --git a/queue-5.4/ovl-perform-vfs_getxattr-with-mounter-creds.patch b/queue-5.4/ovl-perform-vfs_getxattr-with-mounter-creds.patch
new file mode 100644 (file)
index 0000000..34244e1
--- /dev/null
@@ -0,0 +1,40 @@
+From 383c271f0eef6933e27f75869a6ee8fecc1efeda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 10:22:48 +0100
+Subject: ovl: perform vfs_getxattr() with mounter creds
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 554677b97257b0b69378bd74e521edb7e94769ff ]
+
+The vfs_getxattr() in ovl_xattr_set() is used to check whether an xattr
+exist on a lower layer file that is to be removed.  If the xattr does not
+exist, then no need to copy up the file.
+
+This call of vfs_getxattr() wasn't wrapped in credential override, and this
+is probably okay.  But for consitency wrap this instance as well.
+
+Reported-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index bb980721502dd..56b55397a7a00 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -337,7 +337,9 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
+               goto out;
+       if (!value && !upperdentry) {
++              old_cred = ovl_override_creds(dentry->d_sb);
+               err = vfs_getxattr(realdentry, name, NULL, 0);
++              revert_creds(old_cred);
+               if (err < 0)
+                       goto out_drop_write;
+       }
+-- 
+2.27.0
+
diff --git a/queue-5.4/ovl-skip-getxattr-of-security-labels.patch b/queue-5.4/ovl-skip-getxattr-of-security-labels.patch
new file mode 100644 (file)
index 0000000..fe9b300
--- /dev/null
@@ -0,0 +1,74 @@
+From deab0e2e55a942134759fac3efb3e03800a424fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Dec 2020 12:16:08 +0200
+Subject: ovl: skip getxattr of security labels
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 03fedf93593c82538b18476d8c4f0e8f8435ea70 ]
+
+When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr
+calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will
+intercept in inode_getxattr hooks.
+
+When selinux LSM is installed but not initialized, it will list the
+security.selinux xattr in inode_listsecurity, but will not intercept it
+in inode_getxattr.  This results in -ENODATA for a getxattr call for an
+xattr returned by listxattr.
+
+This situation was manifested as overlayfs failure to copy up lower
+files from squashfs when selinux is built-in but not initialized,
+because ovl_copy_xattr() iterates the lower inode xattrs by
+vfs_listxattr() and vfs_getxattr().
+
+ovl_copy_xattr() skips copy up of security labels that are indentified by
+inode_copy_up_xattr LSM hooks, but it does that after vfs_getxattr().
+Since we are not going to copy them, skip vfs_getxattr() of the security
+labels.
+
+Reported-by: Michael Labriola <michael.d.labriola@gmail.com>
+Tested-by: Michael Labriola <michael.d.labriola@gmail.com>
+Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/copy_up.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index ec5eca5a96f41..7b758d623b5bd 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -76,6 +76,14 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+               if (ovl_is_private_xattr(name))
+                       continue;
++
++              error = security_inode_copy_up_xattr(name);
++              if (error < 0 && error != -EOPNOTSUPP)
++                      break;
++              if (error == 1) {
++                      error = 0;
++                      continue; /* Discard */
++              }
+ retry:
+               size = vfs_getxattr(old, name, value, value_size);
+               if (size == -ERANGE)
+@@ -99,13 +107,6 @@ retry:
+                       goto retry;
+               }
+-              error = security_inode_copy_up_xattr(name);
+-              if (error < 0 && error != -EOPNOTSUPP)
+-                      break;
+-              if (error == 1) {
+-                      error = 0;
+-                      continue; /* Discard */
+-              }
+               error = vfs_setxattr(new, name, value, size, 0);
+               if (error)
+                       break;
+-- 
+2.27.0
+
diff --git a/queue-5.4/platform-x86-hp-wmi-disable-tablet-mode-reporting-by.patch b/queue-5.4/platform-x86-hp-wmi-disable-tablet-mode-reporting-by.patch
new file mode 100644 (file)
index 0000000..6e3cd32
--- /dev/null
@@ -0,0 +1,102 @@
+From ab54c7f8458fc89809c1114fbb999df269b0a10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 13:49:41 +0100
+Subject: platform/x86: hp-wmi: Disable tablet-mode reporting by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 67fbe02a5cebc3c653610f12e3c0424e58450153 ]
+
+Recently userspace has started making more use of SW_TABLET_MODE
+(when an input-dev reports this).
+
+Specifically recent GNOME3 versions will:
+
+1.  When SW_TABLET_MODE is reported and is reporting 0:
+1.1 Disable accelerometer-based screen auto-rotation
+1.2 Disable automatically showing the on-screen keyboard when a
+    text-input field is focussed
+
+2.  When SW_TABLET_MODE is reported and is reporting 1:
+2.1 Ignore input-events from the builtin keyboard and touchpad
+    (this is for 360° hinges style 2-in-1s where the keyboard and
+     touchpads are accessible on the back of the tablet when folded
+     into tablet-mode)
+
+This means that claiming to support SW_TABLET_MODE when it does not
+actually work / reports correct values has bad side-effects.
+
+The check in the hp-wmi code which is used to decide if the input-dev
+should claim SW_TABLET_MODE support, only checks if the
+HPWMI_HARDWARE_QUERY is supported. It does *not* check if the hardware
+actually is capable of reporting SW_TABLET_MODE.
+
+This leads to the hp-wmi input-dev claiming SW_TABLET_MODE support,
+while in reality it will always report 0 as SW_TABLET_MODE value.
+This has been seen on a "HP ENVY x360 Convertible 15-cp0xxx" and
+this likely is the case on a whole lot of other HP models.
+
+This problem causes both auto-rotation and on-screen keyboard
+support to not work on affected x360 models.
+
+There is no easy fix for this, but since userspace expects
+SW_TABLET_MODE reporting to be reliable when advertised it is
+better to not claim/report SW_TABLET_MODE support at all, then
+to claim to support it while it does not work.
+
+To avoid the mentioned problems, add a new enable_tablet_mode_sw
+module-parameter which defaults to false.
+
+Note I've made this an int using the standard -1=auto, 0=off, 1=on
+triplett, with the hope that in the future we can come up with a
+better way to detect SW_TABLET_MODE support. ATM the default
+auto option just does the same as off.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1918255
+Cc: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mark Gross <mgross@linux.intel.com>
+Link: https://lore.kernel.org/r/20210120124941.73409-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp-wmi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index a44a2ec332872..63a530a3d9feb 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -32,6 +32,10 @@ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("wmi:95F24279-4D7B-4334-9387-ACCDC67EF61C");
+ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
++static int enable_tablet_mode_sw = -1;
++module_param(enable_tablet_mode_sw, int, 0444);
++MODULE_PARM_DESC(enable_tablet_mode_sw, "Enable SW_TABLET_MODE reporting (-1=auto, 0=no, 1=yes)");
++
+ #define HPWMI_EVENT_GUID "95F24279-4D7B-4334-9387-ACCDC67EF61C"
+ #define HPWMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4"
+@@ -654,10 +658,12 @@ static int __init hp_wmi_input_setup(void)
+       }
+       /* Tablet mode */
+-      val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
+-      if (!(val < 0)) {
+-              __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+-              input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++      if (enable_tablet_mode_sw > 0) {
++              val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
++              if (val >= 0) {
++                      __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
++                      input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++              }
+       }
+       err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
+-- 
+2.27.0
+
diff --git a/queue-5.4/riscv-virt_addr_valid-must-check-the-address-belongs.patch b/queue-5.4/riscv-virt_addr_valid-must-check-the-address-belongs.patch
new file mode 100644 (file)
index 0000000..75fbf8b
--- /dev/null
@@ -0,0 +1,46 @@
+From 643393054c0c360f8e6750f56c64549fcfc225e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 12:31:05 -0500
+Subject: riscv: virt_addr_valid must check the address belongs to linear
+ mapping
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit 2ab543823322b564f205cb15d0f0302803c87d11 ]
+
+virt_addr_valid macro checks that a virtual address is valid, ie that
+the address belongs to the linear mapping and that the corresponding
+ physical page exists.
+
+Add the missing check that ensures the virtual address belongs to the
+linear mapping, otherwise __virt_to_phys, when compiled with
+CONFIG_DEBUG_VIRTUAL enabled, raises a WARN that is interpreted as a
+kernel bug by syzbot.
+
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Reviewed-by: Atish Patra <atish.patra@wdc.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/page.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
+index 3db261c4810fc..6a30794aa1eea 100644
+--- a/arch/riscv/include/asm/page.h
++++ b/arch/riscv/include/asm/page.h
+@@ -119,7 +119,10 @@ extern unsigned long min_low_pfn;
+ #endif /* __ASSEMBLY__ */
+-#define virt_addr_valid(vaddr)        (pfn_valid(virt_to_pfn(vaddr)))
++#define virt_addr_valid(vaddr)        ({                                              \
++      unsigned long _addr = (unsigned long)vaddr;                             \
++      (unsigned long)(_addr) >= PAGE_OFFSET && pfn_valid(virt_to_pfn(_addr)); \
++})
+ #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | \
+                                VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+-- 
+2.27.0
+
index 1359bcb67142f2eeff282e52fc55cdce413e0fda..bf85d039e7d26cdca4b99247b6c93064a12db903 100644 (file)
@@ -4,3 +4,20 @@ tracing-do-not-count-ftrace-events-in-top-level-enable-output.patch
 tracing-check-length-before-giving-out-the-filter-buffer.patch
 arm-xen-don-t-probe-xenbus-as-part-of-an-early-initcall.patch
 cgroup-fix-psi-monitor-for-root-cgroup.patch
+arm64-dts-rockchip-fix-pcie-dt-properties-on-rk3399.patch
+arm64-dts-qcom-sdm845-reserve-lpass-clocks-in-gcc.patch
+arm-omap2-fix-suspcious-rcu-usage-splats-for-omap_en.patch
+platform-x86-hp-wmi-disable-tablet-mode-reporting-by.patch
+ovl-perform-vfs_getxattr-with-mounter-creds.patch
+cap-fix-conversions-on-getxattr.patch
+ovl-skip-getxattr-of-security-labels.patch
+nvme-pci-ignore-the-subsysem-nqn-on-phison-e16.patch
+drm-amd-display-add-more-clock-sources-to-dcn2.1.patch
+drm-amd-display-fix-dc_sink-kref-count-in-emulated_l.patch
+drm-amd-display-free-atomic-state-after-drm_atomic_c.patch
+drm-amd-display-decrement-refcount-of-dc_sink-before.patch
+riscv-virt_addr_valid-must-check-the-address-belongs.patch
+bfq-iosched-revert-bfq-fix-computation-of-shallow-de.patch
+arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch
+arm-ensure-the-signal-page-contains-defined-contents.patch
+arm-kexec-fix-oops-after-tlb-are-invalidated.patch