From 99840878ef8b8dd73670c90a0c879e54a5f3a61a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 17 Jan 2021 15:33:38 +0100 Subject: [PATCH] 5.10-stable patches added patches: acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch alsa-doc-fix-reference-to-mixart.rst.patch alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch asoc-dapm-remove-widget-from-dirty-list-on-free.patch btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch cifs-check-pointer-before-freeing.patch cifs-fix-interrupted-close-commands.patch compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch dm-integrity-fix-flush-with-external-metadata-device.patch dm-integrity-fix-the-maximum-number-of-arguments.patch dm-raid-fix-discard-limits-for-raid1.patch dm-snapshot-flush-merged-data-before-committing-metadata.patch drm-amdgpu-add-green_sardine-device-id-v2.patch drm-amdgpu-add-new-device-id-for-renior.patch drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch drm-bridge-sii902x-refactor-init-code-into-separate-function.patch drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch drm-i915-gt-limit-vfe-threads-based-on-gt.patch dt-bindings-display-sii902x-add-supply-bindings.patch ext4-fix-bug-for-rename-with-rename_whiteout.patch ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch mips-fix-section-mismatch-in-reference.patch mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch mm-hugetlb-fix-potential-missing-huge-page-size-info.patch mm-process_vm_access.c-include-compat.h.patch mm-vmalloc.c-fix-potential-memory-leak.patch r8152-add-lenovo-powered-usb-c-travel-hub.patch rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch riscv-drop-a-duplicated-page_kernel_exec.patch riscv-fix-kasan-memory-mapping.patch riscv-fixup-config_generic_time_vsyscall.patch riscv-return-enosys-for-syscall-1.patch stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch xen-privcmd-allow-fetching-resource-sizes.patch --- ...vice_add-against-device-id-overflows.patch | 109 ++++++ ...alsa-doc-fix-reference-to-mixart.rst.patch | 35 ++ ...nd-mute-micmute-leds-for-hp-machines.patch | 40 +++ ...d-dmi-entry-for-lenovo-thinkpad-x395.patch | 42 +++ ...emove-widget-from-dirty-list-on-free.patch | 45 +++ ...-dereference-in-extent_io_tree_panic.patch | 41 +++ ...ent-type-check-to-avoid-false-enoent.patch | 104 ++++++ .../cifs-check-pointer-before-freeing.patch | 46 +++ .../cifs-fix-interrupted-close-commands.patch | 36 ++ ...imum-version-of-gcc-to-5.1-for-arm64.patch | 55 +++ ...-to-a-tasklet-if-interrupts-disabled.patch | 86 +++++ ...-bio_endio-from-the-dm-crypt-tasklet.patch | 73 ++++ ...crypto-request-completion-in-softirq.patch | 233 +++++++++++++ ...ocating-crypto-requests-from-softirq.patch | 149 ++++++++ ...-flush-with-external-metadata-device.patch | 179 ++++++++++ ...-fix-the-maximum-number-of-arguments.patch | 45 +++ ...dm-raid-fix-discard-limits-for-raid1.patch | 47 +++ ...rged-data-before-committing-metadata.patch | 96 ++++++ ...mdgpu-add-green_sardine-device-id-v2.patch | 34 ++ ...-amdgpu-add-new-device-id-for-renior.patch | 44 +++ ...lay-core-is-not-supported-bug-210921.patch | 33 ++ ...i-o-and-core-vcc-supplies-if-present.patch | 90 +++++ ...tor-init-code-into-separate-function.patch | 139 ++++++++ ...min-to-override-security-mitigations.patch | 233 +++++++++++++ ...x-cpu-mode-backlight-takeover-on-lpt.patch | 76 ++++ ...915-gt-limit-vfe-threads-based-on-gt.patch | 326 ++++++++++++++++++ ...-display-sii902x-add-supply-bindings.patch | 43 +++ ...-bug-for-rename-with-rename_whiteout.patch | 101 ++++++ ...wrong-list_splice-in-ext4_fc_cleanup.patch | 36 ++ ..._null-and-set-inode-null-when-is_err.patch | 131 +++++++ ...ss-with-config_mips_raw_appended_dtb.patch | 51 +++ ...le-and-nt_siginfo-in-32bit-coredumps.patch | 61 ++++ ...ps-fix-section-mismatch-in-reference.patch | 61 ++++ ...ix-non-standard-usage-of-variable-sp.patch | 61 ++++ ...sible-boot-hangup-with-kaslr-enabled.patch | 51 +++ ...otential-missing-huge-page-size-info.patch | 36 ++ ...process_vm_access.c-include-compat.h.patch | 38 ++ ...-vmalloc.c-fix-potential-memory-leak.patch | 41 +++ ...-add-lenovo-powered-usb-c-travel-hub.patch | 55 +++ ...r-free-in-ocrdma_dealloc_ucontext_pd.patch | 41 +++ ...termittent-blue-screen-on-oled-panel.patch | 57 +++ ...v-drop-a-duplicated-page_kernel_exec.patch | 34 ++ .../riscv-fix-kasan-memory-mapping.patch | 36 ++ ...v-fixup-config_generic_time_vsyscall.patch | 49 +++ .../riscv-return-enosys-for-syscall-1.patch | 41 +++ queue-5.10/series | 48 +++ ...-all-ehl-tgl-to-auto-detect-phy-addr.patch | 72 ++++ ...tracing_on-support-to-helper-scripts.patch | 52 +++ ...ions-check-without-kprobes-on-ftrace.patch | 58 ++++ ...sk-after-interrupt-has-been-disabled.patch | 51 +++ ...rivcmd-allow-fetching-resource-sizes.patch | 87 +++++ 51 files changed, 3828 insertions(+) create mode 100644 queue-5.10/acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch create mode 100644 queue-5.10/alsa-doc-fix-reference-to-mixart.rst.patch create mode 100644 queue-5.10/alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch create mode 100644 queue-5.10/asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch create mode 100644 queue-5.10/asoc-dapm-remove-widget-from-dirty-list-on-free.patch create mode 100644 queue-5.10/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch create mode 100644 queue-5.10/btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch create mode 100644 queue-5.10/cifs-check-pointer-before-freeing.patch create mode 100644 queue-5.10/cifs-fix-interrupted-close-commands.patch create mode 100644 queue-5.10/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch create mode 100644 queue-5.10/dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch create mode 100644 queue-5.10/dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch create mode 100644 queue-5.10/dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch create mode 100644 queue-5.10/dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch create mode 100644 queue-5.10/dm-integrity-fix-flush-with-external-metadata-device.patch create mode 100644 queue-5.10/dm-integrity-fix-the-maximum-number-of-arguments.patch create mode 100644 queue-5.10/dm-raid-fix-discard-limits-for-raid1.patch create mode 100644 queue-5.10/dm-snapshot-flush-merged-data-before-committing-metadata.patch create mode 100644 queue-5.10/drm-amdgpu-add-green_sardine-device-id-v2.patch create mode 100644 queue-5.10/drm-amdgpu-add-new-device-id-for-renior.patch create mode 100644 queue-5.10/drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch create mode 100644 queue-5.10/drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch create mode 100644 queue-5.10/drm-bridge-sii902x-refactor-init-code-into-separate-function.patch create mode 100644 queue-5.10/drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch create mode 100644 queue-5.10/drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch create mode 100644 queue-5.10/drm-i915-gt-limit-vfe-threads-based-on-gt.patch create mode 100644 queue-5.10/dt-bindings-display-sii902x-add-supply-bindings.patch create mode 100644 queue-5.10/ext4-fix-bug-for-rename-with-rename_whiteout.patch create mode 100644 queue-5.10/ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch create mode 100644 queue-5.10/ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch create mode 100644 queue-5.10/mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch create mode 100644 queue-5.10/mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch create mode 100644 queue-5.10/mips-fix-section-mismatch-in-reference.patch create mode 100644 queue-5.10/mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch create mode 100644 queue-5.10/mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch create mode 100644 queue-5.10/mm-hugetlb-fix-potential-missing-huge-page-size-info.patch create mode 100644 queue-5.10/mm-process_vm_access.c-include-compat.h.patch create mode 100644 queue-5.10/mm-vmalloc.c-fix-potential-memory-leak.patch create mode 100644 queue-5.10/r8152-add-lenovo-powered-usb-c-travel-hub.patch create mode 100644 queue-5.10/rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch create mode 100644 queue-5.10/revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch create mode 100644 queue-5.10/riscv-drop-a-duplicated-page_kernel_exec.patch create mode 100644 queue-5.10/riscv-fix-kasan-memory-mapping.patch create mode 100644 queue-5.10/riscv-fixup-config_generic_time_vsyscall.patch create mode 100644 queue-5.10/riscv-return-enosys-for-syscall-1.patch create mode 100644 queue-5.10/stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch create mode 100644 queue-5.10/tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch create mode 100644 queue-5.10/tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch create mode 100644 queue-5.10/x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch create mode 100644 queue-5.10/xen-privcmd-allow-fetching-resource-sizes.patch diff --git a/queue-5.10/acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch b/queue-5.10/acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch new file mode 100644 index 00000000000..7d8ec6c0d80 --- /dev/null +++ b/queue-5.10/acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch @@ -0,0 +1,109 @@ +From a58015d638cd4e4555297b04bec9b49028369075 Mon Sep 17 00:00:00 2001 +From: Dexuan Cui +Date: Thu, 7 Jan 2021 23:23:48 -0800 +Subject: ACPI: scan: Harden acpi_device_add() against device ID overflows + +From: Dexuan Cui + +commit a58015d638cd4e4555297b04bec9b49028369075 upstream. + +Linux VM on Hyper-V crashes with the latest mainline: + +[ 4.069624] detected buffer overflow in strcpy +[ 4.077733] kernel BUG at lib/string.c:1149! +.. +[ 4.085819] RIP: 0010:fortify_panic+0xf/0x11 +... +[ 4.085819] Call Trace: +[ 4.085819] acpi_device_add.cold.15+0xf2/0xfb +[ 4.085819] acpi_add_single_object+0x2a6/0x690 +[ 4.085819] acpi_bus_check_add+0xc6/0x280 +[ 4.085819] acpi_ns_walk_namespace+0xda/0x1aa +[ 4.085819] acpi_walk_namespace+0x9a/0xc2 +[ 4.085819] acpi_bus_scan+0x78/0x90 +[ 4.085819] acpi_scan_init+0xfa/0x248 +[ 4.085819] acpi_init+0x2c1/0x321 +[ 4.085819] do_one_initcall+0x44/0x1d0 +[ 4.085819] kernel_init_freeable+0x1ab/0x1f4 + +This is because of the recent buffer overflow detection in the +commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in +fortified string functions") + +Here acpi_device_bus_id->bus_id can only hold 14 characters, while the +the acpi_device_hid(device) returns a 22-char string +"HYPER_V_GEN_COUNTER_V1". + +Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a +string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8 +chars. + +The field bus_id in struct acpi_device_bus_id was originally defined as +char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the +commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI +devices") + +Fix the issue by changing the field bus_id to const char *, and use +kstrdup_const() to initialize it. + +Signed-off-by: Dexuan Cui +Tested-By: Jethro Beekman +[ rjw: Subject change, whitespace adjustment ] +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/internal.h | 2 +- + drivers/acpi/scan.c | 15 ++++++++++++++- + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -97,7 +97,7 @@ void acpi_scan_table_handler(u32 event, + extern struct list_head acpi_bus_id_list; + + struct acpi_device_bus_id { +- char bus_id[15]; ++ const char *bus_id; + unsigned int instance_no; + struct list_head node; + }; +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -486,6 +486,7 @@ static void acpi_device_del(struct acpi_ + acpi_device_bus_id->instance_no--; + else { + list_del(&acpi_device_bus_id->node); ++ kfree_const(acpi_device_bus_id->bus_id); + kfree(acpi_device_bus_id); + } + break; +@@ -674,7 +675,14 @@ int acpi_device_add(struct acpi_device * + } + if (!found) { + acpi_device_bus_id = new_bus_id; +- strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); ++ acpi_device_bus_id->bus_id = ++ kstrdup_const(acpi_device_hid(device), GFP_KERNEL); ++ if (!acpi_device_bus_id->bus_id) { ++ pr_err(PREFIX "Memory allocation error for bus id\n"); ++ result = -ENOMEM; ++ goto err_free_new_bus_id; ++ } ++ + acpi_device_bus_id->instance_no = 0; + list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); + } +@@ -709,6 +717,11 @@ int acpi_device_add(struct acpi_device * + if (device->parent) + list_del(&device->node); + list_del(&device->wakeup_list); ++ ++ err_free_new_bus_id: ++ if (!found) ++ kfree(new_bus_id); ++ + mutex_unlock(&acpi_device_lock); + + err_detach: diff --git a/queue-5.10/alsa-doc-fix-reference-to-mixart.rst.patch b/queue-5.10/alsa-doc-fix-reference-to-mixart.rst.patch new file mode 100644 index 00000000000..9d7b29a7e96 --- /dev/null +++ b/queue-5.10/alsa-doc-fix-reference-to-mixart.rst.patch @@ -0,0 +1,35 @@ +From 3e096a2112b7b407549020cf095e2a425f00fabb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= +Date: Fri, 1 Jan 2021 23:19:42 +0100 +Subject: ALSA: doc: Fix reference to mixart.rst +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +commit 3e096a2112b7b407549020cf095e2a425f00fabb upstream. + +MIXART.txt has been converted to ReST and renamed. Fix the reference +in alsa-configuration.rst. + +Fixes: 3d8e81862ce4 ("ALSA: doc: ReSTize MIXART.txt") +Signed-off-by: Jonathan Neuschäfer +Cc: +Link: https://lore.kernel.org/r/20210101221942.1068388-1-j.neuschaefer@gmx.net +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst +index fe52c314b763..b36af65a08ed 100644 +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -1501,7 +1501,7 @@ Module for Digigram miXart8 sound cards. + + This module supports multiple cards. + Note: One miXart8 board will be represented as 4 alsa cards. +-See MIXART.txt for details. ++See Documentation/sound/cards/mixart.rst for details. + + When the driver is compiled as a module and the hotplug firmware + is supported, the firmware data is loaded via hotplug automatically. diff --git a/queue-5.10/alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch b/queue-5.10/alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch new file mode 100644 index 00000000000..e6bee0f3f96 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch @@ -0,0 +1,40 @@ +From 91bc156817a3c2007332b64b4f85c32aafbbbea6 Mon Sep 17 00:00:00 2001 +From: Jeremy Szu +Date: Wed, 6 Jan 2021 21:05:46 +0800 +Subject: ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines + +From: Jeremy Szu + +commit 91bc156817a3c2007332b64b4f85c32aafbbbea6 upstream. + + * The HP ZBook Fury 15/17 G7 Mobile Workstation are using ALC285 codec + which is using 0x04 to control mute LED and 0x01 to control micmute LED. + + * The right channel speaker is no sound and it needs to expose GPIO1 for + initialing AMP. + +Add quirks to support them. + +Signed-off-by: Jeremy Szu +Cc: +Link: https://lore.kernel.org/r/20210106130549.100532-1-jeremy.szu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7970,6 +7970,10 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), ++ SND_PCI_QUIRK(0x103c, 0x8780, "HP ZBook Fury 17 G7 Mobile Workstation", ++ ALC285_FIXUP_HP_GPIO_AMP_INIT), ++ SND_PCI_QUIRK(0x103c, 0x8783, "HP ZBook Fury 15 G7 Mobile Workstation", ++ ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED), diff --git a/queue-5.10/asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch b/queue-5.10/asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch new file mode 100644 index 00000000000..1c073ce542d --- /dev/null +++ b/queue-5.10/asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch @@ -0,0 +1,42 @@ +From 1f092d1c8819679d78a7d9c62a46d4939d217a9d Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Sun, 27 Dec 2020 17:41:09 +0100 +Subject: ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395 + +From: Jaroslav Kysela + +commit 1f092d1c8819679d78a7d9c62a46d4939d217a9d upstream. + +The ThinkPad X395 latop does not have the internal digital +microphone connected to the AMD's ACP bridge, but it's advertised +via BIOS. The internal microphone is connected to the HDA codec. + +Use DMI to block the microphone PCM device for this platform. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1892115 +Cc: +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20201227164109.269973-1-perex@perex.cz +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/amd/renoir/rn-pci-acp3x.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/amd/renoir/rn-pci-acp3x.c ++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c +@@ -171,6 +171,13 @@ static const struct dmi_system_id rn_acp + DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"), + } + }, ++ { ++ /* Lenovo ThinkPad X395 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "20NLCTO1WW"), ++ } ++ }, + {} + }; + diff --git a/queue-5.10/asoc-dapm-remove-widget-from-dirty-list-on-free.patch b/queue-5.10/asoc-dapm-remove-widget-from-dirty-list-on-free.patch new file mode 100644 index 00000000000..f68a390f857 --- /dev/null +++ b/queue-5.10/asoc-dapm-remove-widget-from-dirty-list-on-free.patch @@ -0,0 +1,45 @@ +From 5c6679b5cb120f07652418524ab186ac47680b49 Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Sat, 12 Dec 2020 17:20:12 -0800 +Subject: ASoC: dapm: remove widget from dirty list on free + +From: Thomas Hebb + +commit 5c6679b5cb120f07652418524ab186ac47680b49 upstream. + +A widget's "dirty" list_head, much like its "list" list_head, eventually +chains back to a list_head on the snd_soc_card itself. This means that +the list can stick around even after the widget (or all widgets) have +been freed. Currently, however, widgets that are in the dirty list when +freed remain there, corrupting the entire list and leading to memory +errors and undefined behavior when the list is next accessed or +modified. + +I encountered this issue when a component failed to probe relatively +late in snd_soc_bind_card(), causing it to bail out and call +soc_cleanup_card_resources(), which eventually called +snd_soc_dapm_free() with widgets that were still dirty from when they'd +been added. + +Fixes: db432b414e20 ("ASoC: Do DAPM power checks only for widgets changed since last run") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Hebb +Reviewed-by: Charles Keepax +Link: https://lore.kernel.org/r/f8b5f031d50122bf1a9bfc9cae046badf4a7a31a.1607822410.git.tommyhebb@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2486,6 +2486,7 @@ void snd_soc_dapm_free_widget(struct snd + enum snd_soc_dapm_direction dir; + + list_del(&w->list); ++ list_del(&w->dirty); + /* + * remove source and sink paths associated to this widget. + * While removing the path, remove reference to it from both diff --git a/queue-5.10/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch b/queue-5.10/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch new file mode 100644 index 00000000000..17dc5c69bd1 --- /dev/null +++ b/queue-5.10/btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch @@ -0,0 +1,41 @@ +From 29b665cc51e8b602bf2a275734349494776e3dbc Mon Sep 17 00:00:00 2001 +From: Su Yue +Date: Sun, 3 Jan 2021 17:28:03 +0800 +Subject: btrfs: prevent NULL pointer dereference in extent_io_tree_panic + +From: Su Yue + +commit 29b665cc51e8b602bf2a275734349494776e3dbc upstream. + +Some extent io trees are initialized with NULL private member (e.g. +btrfs_device::alloc_state and btrfs_fs_info::excluded_extents). +Dereference of a NULL tree->private as inode pointer will cause panic. + +Pass tree->fs_info as it's known to be valid in all cases. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929 +Fixes: 05912a3c04eb ("btrfs: drop extent_io_ops::tree_fs_info callback") +CC: stable@vger.kernel.org # 4.19+ +Reviewed-by: Anand Jain +Signed-off-by: Su Yue +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent_io.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -676,9 +676,7 @@ alloc_extent_state_atomic(struct extent_ + + static void extent_io_tree_panic(struct extent_io_tree *tree, int err) + { +- struct inode *inode = tree->private_data; +- +- btrfs_panic(btrfs_sb(inode->i_sb), err, ++ btrfs_panic(tree->fs_info, err, + "locking error: extent tree was modified by another thread while locked"); + } + diff --git a/queue-5.10/btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch b/queue-5.10/btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch new file mode 100644 index 00000000000..44d7e174d2d --- /dev/null +++ b/queue-5.10/btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch @@ -0,0 +1,104 @@ +From 50e31ef486afe60f128d42fb9620e2a63172c15c Mon Sep 17 00:00:00 2001 +From: Qu Wenruo +Date: Tue, 29 Dec 2020 21:29:34 +0800 +Subject: btrfs: reloc: fix wrong file extent type check to avoid false ENOENT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qu Wenruo + +commit 50e31ef486afe60f128d42fb9620e2a63172c15c upstream. + +[BUG] +There are several bug reports about recent kernel unable to relocate +certain data block groups. + +Sometimes the error just goes away, but there is one reporter who can +reproduce it reliably. + +The dmesg would look like: + + [438.260483] BTRFS info (device dm-10): balance: start -dvrange=34625344765952..34625344765953 + [438.269018] BTRFS info (device dm-10): relocating block group 34625344765952 flags data|raid1 + [450.439609] BTRFS info (device dm-10): found 167 extents, stage: move data extents + [463.501781] BTRFS info (device dm-10): balance: ended with status: -2 + +[CAUSE] +The ENOENT error is returned from the following call chain: + + add_data_references() + |- delete_v1_space_cache(); + |- if (!found) + return -ENOENT; + +The variable @found is set to true if we find a data extent whose +disk bytenr matches parameter @data_bytes. + +With extra debugging, the offending tree block looks like this: + + leaf bytenr = 42676709441536, data_bytenr = 34626327621632 + + ctime 1567904822.739884119 (2019-09-08 03:07:02) + mtime 0.0 (1970-01-01 01:00:00) + otime 0.0 (1970-01-01 01:00:00) + item 27 key (51933 EXTENT_DATA 0) itemoff 9854 itemsize 53 + generation 1517381 type 2 (prealloc) + prealloc data disk byte 34626327621632 nr 262144 <<< + prealloc data offset 0 nr 262144 + item 28 key (52262 ROOT_ITEM 0) itemoff 9415 itemsize 439 + generation 2618893 root_dirid 256 bytenr 42677048360960 level 3 refs 1 + lastsnap 2618893 byte_limit 0 bytes_used 5557338112 flags 0x0(none) + uuid d0d4361f-d231-6d40-8901-fe506e4b2b53 + +Although item 27 has disk bytenr 34626327621632, which matches the +data_bytenr, its type is prealloc, not reg. +This makes the existing code skip that item, and return ENOENT. + +[FIX] +The code is modified in commit 19b546d7a1b2 ("btrfs: relocation: Use +btrfs_find_all_leafs to locate data extent parent tree leaves"), before +that commit, we use something like + + "if (type == BTRFS_FILE_EXTENT_INLINE) continue;" + +But in that offending commit, we use (type == BTRFS_FILE_EXTENT_REG), +ignoring BTRFS_FILE_EXTENT_PREALLOC. + +Fix it by also checking BTRFS_FILE_EXTENT_PREALLOC. + +Reported-by: Stéphane Lesimple +Link: https://lore.kernel.org/linux-btrfs/505cabfa88575ed6dbe7cb922d8914fb@lesimple.fr +Fixes: 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves") +CC: stable@vger.kernel.org # 5.6+ +Tested-By: Stéphane Lesimple +Reviewed-by: Su Yue +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/relocation.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -3027,11 +3027,16 @@ static int delete_v1_space_cache(struct + return 0; + + for (i = 0; i < btrfs_header_nritems(leaf); i++) { ++ u8 type; ++ + btrfs_item_key_to_cpu(leaf, &key, i); + if (key.type != BTRFS_EXTENT_DATA_KEY) + continue; + ei = btrfs_item_ptr(leaf, i, struct btrfs_file_extent_item); +- if (btrfs_file_extent_type(leaf, ei) == BTRFS_FILE_EXTENT_REG && ++ type = btrfs_file_extent_type(leaf, ei); ++ ++ if ((type == BTRFS_FILE_EXTENT_REG || ++ type == BTRFS_FILE_EXTENT_PREALLOC) && + btrfs_file_extent_disk_bytenr(leaf, ei) == data_bytenr) { + found = true; + space_cache_ino = key.objectid; diff --git a/queue-5.10/cifs-check-pointer-before-freeing.patch b/queue-5.10/cifs-check-pointer-before-freeing.patch new file mode 100644 index 00000000000..b883b5a7ce6 --- /dev/null +++ b/queue-5.10/cifs-check-pointer-before-freeing.patch @@ -0,0 +1,46 @@ +From 77b6ec01c29aade01701aa30bf1469acc7f2be76 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Tue, 5 Jan 2021 12:21:26 -0800 +Subject: cifs: check pointer before freeing + +From: Tom Rix + +commit 77b6ec01c29aade01701aa30bf1469acc7f2be76 upstream. + +clang static analysis reports this problem + +dfs_cache.c:591:2: warning: Argument to kfree() is a constant address + (18446744073709551614), which is not memory allocated by malloc() + kfree(vi); + ^~~~~~~~~ + +In dfs_cache_del_vol() the volume info pointer 'vi' being freed +is the return of a call to find_vol(). The large constant address +is find_vol() returning an error. + +Add an error check to dfs_cache_del_vol() similar to the one done +in dfs_cache_update_vol(). + +Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines") +Signed-off-by: Tom Rix +Reviewed-by: Nathan Chancellor +CC: # v5.0+ +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/dfs_cache.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -1317,7 +1317,8 @@ void dfs_cache_del_vol(const char *fullp + vi = find_vol(fullpath); + spin_unlock(&vol_list_lock); + +- kref_put(&vi->refcnt, vol_release); ++ if (!IS_ERR(vi)) ++ kref_put(&vi->refcnt, vol_release); + } + + /** diff --git a/queue-5.10/cifs-fix-interrupted-close-commands.patch b/queue-5.10/cifs-fix-interrupted-close-commands.patch new file mode 100644 index 00000000000..e270c7fcceb --- /dev/null +++ b/queue-5.10/cifs-fix-interrupted-close-commands.patch @@ -0,0 +1,36 @@ +From 2659d3bff3e1b000f49907d0839178b101a89887 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Wed, 13 Jan 2021 14:16:16 -0300 +Subject: cifs: fix interrupted close commands + +From: Paulo Alcantara + +commit 2659d3bff3e1b000f49907d0839178b101a89887 upstream. + +Retry close command if it gets interrupted to not leak open handles on +the server. + +Signed-off-by: Paulo Alcantara (SUSE) +Reported-by: Duncan Findlay +Suggested-by: Pavel Shilovsky +Fixes: 6988a619f5b7 ("cifs: allow syscalls to be restarted in __smb_send_rqst()") +Cc: stable@vger.kernel.org +Reviewd-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3248,7 +3248,7 @@ close_exit: + free_rsp_buf(resp_buftype, rsp); + + /* retry close in a worker thread if this one is interrupted */ +- if (rc == -EINTR) { ++ if (is_interrupt_error(rc)) { + int tmp_rc; + + tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid, diff --git a/queue-5.10/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch b/queue-5.10/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch new file mode 100644 index 00000000000..4932f1ea510 --- /dev/null +++ b/queue-5.10/compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch @@ -0,0 +1,55 @@ +From dca5244d2f5b94f1809f0c02a549edf41ccd5493 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 12 Jan 2021 22:48:32 +0000 +Subject: compiler.h: Raise minimum version of GCC to 5.1 for arm64 + +From: Will Deacon + +commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream. + +GCC versions >= 4.9 and < 5.1 have been shown to emit memory references +beyond the stack pointer, resulting in memory corruption if an interrupt +is taken after the stack pointer has been adjusted but before the +reference has been executed. This leads to subtle, infrequent data +corruption such as the EXT4 problems reported by Russell King at the +link below. + +Life is too short for buggy compilers, so raise the minimum GCC version +required by arm64 to 5.1. + +Reported-by: Russell King +Suggested-by: Arnd Bergmann +Signed-off-by: Will Deacon +Tested-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Reviewed-by: Nathan Chancellor +Acked-by: Linus Torvalds +Cc: +Cc: Theodore Ts'o +Cc: Florian Weimer +Cc: Peter Zijlstra +Cc: Nick Desaulniers +Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk +Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/compiler-gcc.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -13,6 +13,12 @@ + /* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 */ + #if GCC_VERSION < 40900 + # error Sorry, your version of GCC is too old - please use 4.9 or newer. ++#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100 ++/* ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293 ++ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk ++ */ ++# error Sorry, your version of GCC is too old - please use 5.1 or newer. + #endif + + /* diff --git a/queue-5.10/dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch b/queue-5.10/dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch new file mode 100644 index 00000000000..f775a4ec5e4 --- /dev/null +++ b/queue-5.10/dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch @@ -0,0 +1,86 @@ +From c87a95dc28b1431c7e77e2c0c983cf37698089d2 Mon Sep 17 00:00:00 2001 +From: Ignat Korchagin +Date: Wed, 13 Jan 2021 19:17:17 +0000 +Subject: dm crypt: defer decryption to a tasklet if interrupts disabled + +From: Ignat Korchagin + +commit c87a95dc28b1431c7e77e2c0c983cf37698089d2 upstream. + +On some specific hardware on early boot we occasionally get: + +[ 1193.920255][ T0] BUG: sleeping function called from invalid context at mm/mempool.c:381 +[ 1193.936616][ T0] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/69 +[ 1193.953233][ T0] no locks held by swapper/69/0. +[ 1193.965871][ T0] irq event stamp: 575062 +[ 1193.977724][ T0] hardirqs last enabled at (575061): [] tick_nohz_idle_exit+0xe2/0x3e0 +[ 1194.002762][ T0] hardirqs last disabled at (575062): [] flush_smp_call_function_from_idle+0x4f/0x80 +[ 1194.029035][ T0] softirqs last enabled at (575050): [] asm_call_irq_on_stack+0x12/0x20 +[ 1194.054227][ T0] softirqs last disabled at (575043): [] asm_call_irq_on_stack+0x12/0x20 +[ 1194.079389][ T0] CPU: 69 PID: 0 Comm: swapper/69 Not tainted 5.10.6-cloudflare-kasan-2021.1.4-dev #1 +[ 1194.104103][ T0] Hardware name: NULL R162-Z12-CD/MZ12-HD4-CD, BIOS R10 06/04/2020 +[ 1194.119591][ T0] Call Trace: +[ 1194.130233][ T0] dump_stack+0x9a/0xcc +[ 1194.141617][ T0] ___might_sleep.cold+0x180/0x1b0 +[ 1194.153825][ T0] mempool_alloc+0x16b/0x300 +[ 1194.165313][ T0] ? remove_element+0x160/0x160 +[ 1194.176961][ T0] ? blk_mq_end_request+0x4b/0x490 +[ 1194.188778][ T0] crypt_convert+0x27f6/0x45f0 [dm_crypt] +[ 1194.201024][ T0] ? rcu_read_lock_sched_held+0x3f/0x70 +[ 1194.212906][ T0] ? module_assert_mutex_or_preempt+0x3e/0x70 +[ 1194.225318][ T0] ? __module_address.part.0+0x1b/0x3a0 +[ 1194.237212][ T0] ? is_kernel_percpu_address+0x5b/0x190 +[ 1194.249238][ T0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0 [dm_crypt] +[ 1194.261593][ T0] ? is_module_address+0x25/0x40 +[ 1194.272905][ T0] ? static_obj+0x8a/0xc0 +[ 1194.283582][ T0] ? lockdep_init_map_waits+0x26a/0x700 +[ 1194.295570][ T0] ? __raw_spin_lock_init+0x39/0x110 +[ 1194.307330][ T0] kcryptd_crypt_read_convert+0x31c/0x560 [dm_crypt] +[ 1194.320496][ T0] ? kcryptd_queue_crypt+0x1be/0x380 [dm_crypt] +[ 1194.333203][ T0] blk_update_request+0x6d7/0x1500 +[ 1194.344841][ T0] ? blk_mq_trigger_softirq+0x190/0x190 +[ 1194.356831][ T0] blk_mq_end_request+0x4b/0x490 +[ 1194.367994][ T0] ? blk_mq_trigger_softirq+0x190/0x190 +[ 1194.379693][ T0] flush_smp_call_function_queue+0x24b/0x560 +[ 1194.391847][ T0] flush_smp_call_function_from_idle+0x59/0x80 +[ 1194.403969][ T0] do_idle+0x287/0x450 +[ 1194.413891][ T0] ? arch_cpu_idle_exit+0x40/0x40 +[ 1194.424716][ T0] ? lockdep_hardirqs_on_prepare+0x286/0x3f0 +[ 1194.436399][ T0] ? _raw_spin_unlock_irqrestore+0x39/0x40 +[ 1194.447759][ T0] cpu_startup_entry+0x19/0x20 +[ 1194.458038][ T0] secondary_startup_64_no_verify+0xb0/0xbb + +IO completion can be queued to a different CPU by the block subsystem as a "call +single function/data". The CPU may run these routines from the idle task, but it +does so with interrupts disabled. + +It is not a good idea to do decryption with irqs disabled even in an idle task +context, so just defer it to a tasklet (as is done with requests from hard irqs). + +Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues") +Cc: stable@vger.kernel.org # v5.9+ +Signed-off-by: Ignat Korchagin +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2221,8 +2221,12 @@ static void kcryptd_queue_crypt(struct d + + if ((bio_data_dir(io->base_bio) == READ && test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags)) || + (bio_data_dir(io->base_bio) == WRITE && test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags))) { +- if (in_irq()) { +- /* Crypto API's "skcipher_walk_first() refuses to work in hard IRQ context */ ++ /* ++ * in_irq(): Crypto API's skcipher_walk_first() refuses to work in hard IRQ context. ++ * irqs_disabled(): the kernel may run some IO completion from the idle thread, but ++ * it is being executed with irqs disabled. ++ */ ++ if (in_irq() || irqs_disabled()) { + tasklet_init(&io->tasklet, kcryptd_crypt_tasklet, (unsigned long)&io->work); + tasklet_schedule(&io->tasklet); + return; diff --git a/queue-5.10/dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch b/queue-5.10/dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch new file mode 100644 index 00000000000..cec55b64d56 --- /dev/null +++ b/queue-5.10/dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch @@ -0,0 +1,73 @@ +From 8e14f610159d524cd7aac37982826d3ef75c09e8 Mon Sep 17 00:00:00 2001 +From: Ignat Korchagin +Date: Sat, 9 Jan 2021 15:17:06 +0000 +Subject: dm crypt: do not call bio_endio() from the dm-crypt tasklet + +From: Ignat Korchagin + +commit 8e14f610159d524cd7aac37982826d3ef75c09e8 upstream. + +Sometimes, when dm-crypt executes decryption in a tasklet, we may get +"BUG: KASAN: use-after-free in tasklet_action_common.constprop..." +with a kasan-enabled kernel. + +When the decryption fully completes in the tasklet, dm-crypt will call +bio_endio(), which in turn will call clone_endio() from dm.c core code. That +function frees the resources associated with the bio, including per bio private +structures. For dm-crypt it will free the current struct dm_crypt_io, which +contains our tasklet object, causing use-after-free, when the tasklet is being +dequeued by the kernel. + +To avoid this, do not call bio_endio() from the current tasklet context, but +delay its execution to the dm-crypt IO workqueue. + +Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues") +Cc: # v5.9+ +Signed-off-by: Ignat Korchagin +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1730,6 +1730,12 @@ static void crypt_inc_pending(struct dm_ + atomic_inc(&io->io_pending); + } + ++static void kcryptd_io_bio_endio(struct work_struct *work) ++{ ++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work); ++ bio_endio(io->base_bio); ++} ++ + /* + * One of the bios was finished. Check for completion of + * the whole request and correctly clean up the buffer. +@@ -1752,7 +1758,23 @@ static void crypt_dec_pending(struct dm_ + kfree(io->integrity_metadata); + + base_bio->bi_status = error; +- bio_endio(base_bio); ++ ++ /* ++ * If we are running this function from our tasklet, ++ * we can't call bio_endio() here, because it will call ++ * clone_endio() from dm.c, which in turn will ++ * free the current struct dm_crypt_io structure with ++ * our tasklet. In this case we need to delay bio_endio() ++ * execution to after the tasklet is done and dequeued. ++ */ ++ if (tasklet_trylock(&io->tasklet)) { ++ tasklet_unlock(&io->tasklet); ++ bio_endio(base_bio); ++ return; ++ } ++ ++ INIT_WORK(&io->work, kcryptd_io_bio_endio); ++ queue_work(cc->io_queue, &io->work); + } + + /* diff --git a/queue-5.10/dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch b/queue-5.10/dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch new file mode 100644 index 00000000000..d207cebf7a4 --- /dev/null +++ b/queue-5.10/dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch @@ -0,0 +1,233 @@ +From 8abec36d1274bbd5ae8f36f3658b9abb3db56c31 Mon Sep 17 00:00:00 2001 +From: Ignat Korchagin +Date: Mon, 4 Jan 2021 14:59:47 +0000 +Subject: dm crypt: do not wait for backlogged crypto request completion in softirq + +From: Ignat Korchagin + +commit 8abec36d1274bbd5ae8f36f3658b9abb3db56c31 upstream. + +Commit 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd +workqueues") made it possible for some code paths in dm-crypt to be +executed in softirq context, when the underlying driver processes IO +requests in interrupt/softirq context. + +When Crypto API backlogs a crypto request, dm-crypt uses +wait_for_completion to avoid sending further requests to an already +overloaded crypto driver. However, if the code is executing in softirq +context, we might get the following stacktrace: + +[ 210.235213][ C0] BUG: scheduling while atomic: fio/2602/0x00000102 +[ 210.236701][ C0] Modules linked in: +[ 210.237566][ C0] CPU: 0 PID: 2602 Comm: fio Tainted: G W 5.10.0+ #50 +[ 210.239292][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 +[ 210.241233][ C0] Call Trace: +[ 210.241946][ C0] +[ 210.242561][ C0] dump_stack+0x7d/0xa3 +[ 210.243466][ C0] __schedule_bug.cold+0xb3/0xc2 +[ 210.244539][ C0] __schedule+0x156f/0x20d0 +[ 210.245518][ C0] ? io_schedule_timeout+0x140/0x140 +[ 210.246660][ C0] schedule+0xd0/0x270 +[ 210.247541][ C0] schedule_timeout+0x1fb/0x280 +[ 210.248586][ C0] ? usleep_range+0x150/0x150 +[ 210.249624][ C0] ? unpoison_range+0x3a/0x60 +[ 210.250632][ C0] ? ____kasan_kmalloc.constprop.0+0x82/0xa0 +[ 210.251949][ C0] ? unpoison_range+0x3a/0x60 +[ 210.252958][ C0] ? __prepare_to_swait+0xa7/0x190 +[ 210.254067][ C0] do_wait_for_common+0x2ab/0x370 +[ 210.255158][ C0] ? usleep_range+0x150/0x150 +[ 210.256192][ C0] ? bit_wait_io_timeout+0x160/0x160 +[ 210.257358][ C0] ? blk_update_request+0x757/0x1150 +[ 210.258582][ C0] ? _raw_spin_lock_irq+0x82/0xd0 +[ 210.259674][ C0] ? _raw_read_unlock_irqrestore+0x30/0x30 +[ 210.260917][ C0] wait_for_completion+0x4c/0x90 +[ 210.261971][ C0] crypt_convert+0x19a6/0x4c00 +[ 210.263033][ C0] ? _raw_spin_lock_irqsave+0x87/0xe0 +[ 210.264193][ C0] ? kasan_set_track+0x1c/0x30 +[ 210.265191][ C0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0 +[ 210.266283][ C0] ? kmem_cache_free+0x104/0x470 +[ 210.267363][ C0] ? crypt_endio+0x91/0x180 +[ 210.268327][ C0] kcryptd_crypt_read_convert+0x30e/0x420 +[ 210.269565][ C0] blk_update_request+0x757/0x1150 +[ 210.270563][ C0] blk_mq_end_request+0x4b/0x480 +[ 210.271680][ C0] blk_done_softirq+0x21d/0x340 +[ 210.272775][ C0] ? _raw_spin_lock+0x81/0xd0 +[ 210.273847][ C0] ? blk_mq_stop_hw_queue+0x30/0x30 +[ 210.275031][ C0] ? _raw_read_lock_irq+0x40/0x40 +[ 210.276182][ C0] __do_softirq+0x190/0x611 +[ 210.277203][ C0] ? handle_edge_irq+0x221/0xb60 +[ 210.278340][ C0] asm_call_irq_on_stack+0x12/0x20 +[ 210.279514][ C0] +[ 210.280164][ C0] do_softirq_own_stack+0x37/0x40 +[ 210.281281][ C0] irq_exit_rcu+0x110/0x1b0 +[ 210.282286][ C0] common_interrupt+0x74/0x120 +[ 210.283376][ C0] asm_common_interrupt+0x1e/0x40 +[ 210.284496][ C0] RIP: 0010:_aesni_enc1+0x65/0xb0 + +Fix this by making crypt_convert function reentrant from the point of +a single bio and make dm-crypt defer further bio processing to a +workqueue, if Crypto API backlogs a request in interrupt context. + +Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues") +Cc: stable@vger.kernel.org # v5.9+ +Signed-off-by: Ignat Korchagin +Acked-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 98 insertions(+), 5 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1539,13 +1539,19 @@ static void crypt_free_req(struct crypt_ + * Encrypt / decrypt data from one bio to another one (can be the same one) + */ + static blk_status_t crypt_convert(struct crypt_config *cc, +- struct convert_context *ctx, bool atomic) ++ struct convert_context *ctx, bool atomic, bool reset_pending) + { + unsigned int tag_offset = 0; + unsigned int sector_step = cc->sector_size >> SECTOR_SHIFT; + int r; + +- atomic_set(&ctx->cc_pending, 1); ++ /* ++ * if reset_pending is set we are dealing with the bio for the first time, ++ * else we're continuing to work on the previous bio, so don't mess with ++ * the cc_pending counter ++ */ ++ if (reset_pending) ++ atomic_set(&ctx->cc_pending, 1); + + while (ctx->iter_in.bi_size && ctx->iter_out.bi_size) { + +@@ -1568,7 +1574,25 @@ static blk_status_t crypt_convert(struct + * but the driver request queue is full, let's wait. + */ + case -EBUSY: +- wait_for_completion(&ctx->restart); ++ if (in_interrupt()) { ++ if (try_wait_for_completion(&ctx->restart)) { ++ /* ++ * we don't have to block to wait for completion, ++ * so proceed ++ */ ++ } else { ++ /* ++ * we can't wait for completion without blocking ++ * exit and continue processing in a workqueue ++ */ ++ ctx->r.req = NULL; ++ ctx->cc_sector += sector_step; ++ tag_offset++; ++ return BLK_STS_DEV_RESOURCE; ++ } ++ } else { ++ wait_for_completion(&ctx->restart); ++ } + reinit_completion(&ctx->restart); + fallthrough; + /* +@@ -1960,6 +1984,37 @@ static bool kcryptd_crypt_write_inline(s + } + } + ++static void kcryptd_crypt_write_continue(struct work_struct *work) ++{ ++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work); ++ struct crypt_config *cc = io->cc; ++ struct convert_context *ctx = &io->ctx; ++ int crypt_finished; ++ sector_t sector = io->sector; ++ blk_status_t r; ++ ++ wait_for_completion(&ctx->restart); ++ reinit_completion(&ctx->restart); ++ ++ r = crypt_convert(cc, &io->ctx, true, false); ++ if (r) ++ io->error = r; ++ crypt_finished = atomic_dec_and_test(&ctx->cc_pending); ++ if (!crypt_finished && kcryptd_crypt_write_inline(cc, ctx)) { ++ /* Wait for completion signaled by kcryptd_async_done() */ ++ wait_for_completion(&ctx->restart); ++ crypt_finished = 1; ++ } ++ ++ /* Encryption was already finished, submit io now */ ++ if (crypt_finished) { ++ kcryptd_crypt_write_io_submit(io, 0); ++ io->sector = sector; ++ } ++ ++ crypt_dec_pending(io); ++} ++ + static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) + { + struct crypt_config *cc = io->cc; +@@ -1988,7 +2043,17 @@ static void kcryptd_crypt_write_convert( + + crypt_inc_pending(io); + r = crypt_convert(cc, ctx, +- test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags)); ++ test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags), true); ++ /* ++ * Crypto API backlogged the request, because its queue was full ++ * and we're in softirq context, so continue from a workqueue ++ * (TODO: is it actually possible to be in softirq in the write path?) ++ */ ++ if (r == BLK_STS_DEV_RESOURCE) { ++ INIT_WORK(&io->work, kcryptd_crypt_write_continue); ++ queue_work(cc->crypt_queue, &io->work); ++ return; ++ } + if (r) + io->error = r; + crypt_finished = atomic_dec_and_test(&ctx->cc_pending); +@@ -2013,6 +2078,25 @@ static void kcryptd_crypt_read_done(stru + crypt_dec_pending(io); + } + ++static void kcryptd_crypt_read_continue(struct work_struct *work) ++{ ++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work); ++ struct crypt_config *cc = io->cc; ++ blk_status_t r; ++ ++ wait_for_completion(&io->ctx.restart); ++ reinit_completion(&io->ctx.restart); ++ ++ r = crypt_convert(cc, &io->ctx, true, false); ++ if (r) ++ io->error = r; ++ ++ if (atomic_dec_and_test(&io->ctx.cc_pending)) ++ kcryptd_crypt_read_done(io); ++ ++ crypt_dec_pending(io); ++} ++ + static void kcryptd_crypt_read_convert(struct dm_crypt_io *io) + { + struct crypt_config *cc = io->cc; +@@ -2024,7 +2108,16 @@ static void kcryptd_crypt_read_convert(s + io->sector); + + r = crypt_convert(cc, &io->ctx, +- test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags)); ++ test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags), true); ++ /* ++ * Crypto API backlogged the request, because its queue was full ++ * and we're in softirq context, so continue from a workqueue ++ */ ++ if (r == BLK_STS_DEV_RESOURCE) { ++ INIT_WORK(&io->work, kcryptd_crypt_read_continue); ++ queue_work(cc->crypt_queue, &io->work); ++ return; ++ } + if (r) + io->error = r; + diff --git a/queue-5.10/dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch b/queue-5.10/dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch new file mode 100644 index 00000000000..394e643f15d --- /dev/null +++ b/queue-5.10/dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch @@ -0,0 +1,149 @@ +From d68b29584c25dbacd01ed44a3e45abb35353f1de Mon Sep 17 00:00:00 2001 +From: Ignat Korchagin +Date: Mon, 4 Jan 2021 14:59:48 +0000 +Subject: dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq + +From: Ignat Korchagin + +commit d68b29584c25dbacd01ed44a3e45abb35353f1de upstream. + +Commit 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd +workqueues") made it possible for some code paths in dm-crypt to be +executed in softirq context, when the underlying driver processes IO +requests in interrupt/softirq context. + +In this case sometimes when allocating a new crypto request we may get +a stacktrace like below: + +[ 210.103008][ C0] BUG: sleeping function called from invalid context at mm/mempool.c:381 +[ 210.104746][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2602, name: fio +[ 210.106599][ C0] CPU: 0 PID: 2602 Comm: fio Tainted: G W 5.10.0+ #50 +[ 210.108331][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 +[ 210.110212][ C0] Call Trace: +[ 210.110921][ C0] +[ 210.111527][ C0] dump_stack+0x7d/0xa3 +[ 210.112411][ C0] ___might_sleep.cold+0x122/0x151 +[ 210.113527][ C0] mempool_alloc+0x16b/0x2f0 +[ 210.114524][ C0] ? __queue_work+0x515/0xde0 +[ 210.115553][ C0] ? mempool_resize+0x700/0x700 +[ 210.116586][ C0] ? crypt_endio+0x91/0x180 +[ 210.117479][ C0] ? blk_update_request+0x757/0x1150 +[ 210.118513][ C0] ? blk_mq_end_request+0x4b/0x480 +[ 210.119572][ C0] ? blk_done_softirq+0x21d/0x340 +[ 210.120628][ C0] ? __do_softirq+0x190/0x611 +[ 210.121626][ C0] crypt_convert+0x29f9/0x4c00 +[ 210.122668][ C0] ? _raw_spin_lock_irqsave+0x87/0xe0 +[ 210.123824][ C0] ? kasan_set_track+0x1c/0x30 +[ 210.124858][ C0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0 +[ 210.125930][ C0] ? kmem_cache_free+0x104/0x470 +[ 210.126973][ C0] ? crypt_endio+0x91/0x180 +[ 210.127947][ C0] kcryptd_crypt_read_convert+0x30e/0x420 +[ 210.129165][ C0] blk_update_request+0x757/0x1150 +[ 210.130231][ C0] blk_mq_end_request+0x4b/0x480 +[ 210.131294][ C0] blk_done_softirq+0x21d/0x340 +[ 210.132332][ C0] ? _raw_spin_lock+0x81/0xd0 +[ 210.133289][ C0] ? blk_mq_stop_hw_queue+0x30/0x30 +[ 210.134399][ C0] ? _raw_read_lock_irq+0x40/0x40 +[ 210.135458][ C0] __do_softirq+0x190/0x611 +[ 210.136409][ C0] ? handle_edge_irq+0x221/0xb60 +[ 210.137447][ C0] asm_call_irq_on_stack+0x12/0x20 +[ 210.138507][ C0] +[ 210.139118][ C0] do_softirq_own_stack+0x37/0x40 +[ 210.140191][ C0] irq_exit_rcu+0x110/0x1b0 +[ 210.141151][ C0] common_interrupt+0x74/0x120 +[ 210.142171][ C0] asm_common_interrupt+0x1e/0x40 + +Fix this by allocating crypto requests with GFP_ATOMIC mask in +interrupt context. + +Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues") +Cc: stable@vger.kernel.org # v5.9+ +Reported-by: Maciej S. Szmigiero +Signed-off-by: Ignat Korchagin +Acked-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 35 +++++++++++++++++++++++++---------- + 1 file changed, 25 insertions(+), 10 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1454,13 +1454,16 @@ static int crypt_convert_block_skcipher( + static void kcryptd_async_done(struct crypto_async_request *async_req, + int error); + +-static void crypt_alloc_req_skcipher(struct crypt_config *cc, ++static int crypt_alloc_req_skcipher(struct crypt_config *cc, + struct convert_context *ctx) + { + unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1); + +- if (!ctx->r.req) +- ctx->r.req = mempool_alloc(&cc->req_pool, GFP_NOIO); ++ if (!ctx->r.req) { ++ ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO); ++ if (!ctx->r.req) ++ return -ENOMEM; ++ } + + skcipher_request_set_tfm(ctx->r.req, cc->cipher_tfm.tfms[key_index]); + +@@ -1471,13 +1474,18 @@ static void crypt_alloc_req_skcipher(str + skcipher_request_set_callback(ctx->r.req, + CRYPTO_TFM_REQ_MAY_BACKLOG, + kcryptd_async_done, dmreq_of_req(cc, ctx->r.req)); ++ ++ return 0; + } + +-static void crypt_alloc_req_aead(struct crypt_config *cc, ++static int crypt_alloc_req_aead(struct crypt_config *cc, + struct convert_context *ctx) + { +- if (!ctx->r.req_aead) +- ctx->r.req_aead = mempool_alloc(&cc->req_pool, GFP_NOIO); ++ if (!ctx->r.req) { ++ ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO); ++ if (!ctx->r.req) ++ return -ENOMEM; ++ } + + aead_request_set_tfm(ctx->r.req_aead, cc->cipher_tfm.tfms_aead[0]); + +@@ -1488,15 +1496,17 @@ static void crypt_alloc_req_aead(struct + aead_request_set_callback(ctx->r.req_aead, + CRYPTO_TFM_REQ_MAY_BACKLOG, + kcryptd_async_done, dmreq_of_req(cc, ctx->r.req_aead)); ++ ++ return 0; + } + +-static void crypt_alloc_req(struct crypt_config *cc, ++static int crypt_alloc_req(struct crypt_config *cc, + struct convert_context *ctx) + { + if (crypt_integrity_aead(cc)) +- crypt_alloc_req_aead(cc, ctx); ++ return crypt_alloc_req_aead(cc, ctx); + else +- crypt_alloc_req_skcipher(cc, ctx); ++ return crypt_alloc_req_skcipher(cc, ctx); + } + + static void crypt_free_req_skcipher(struct crypt_config *cc, +@@ -1539,7 +1549,12 @@ static blk_status_t crypt_convert(struct + + while (ctx->iter_in.bi_size && ctx->iter_out.bi_size) { + +- crypt_alloc_req(cc, ctx); ++ r = crypt_alloc_req(cc, ctx); ++ if (r) { ++ complete(&ctx->restart); ++ return BLK_STS_DEV_RESOURCE; ++ } ++ + atomic_inc(&ctx->cc_pending); + + if (crypt_integrity_aead(cc)) diff --git a/queue-5.10/dm-integrity-fix-flush-with-external-metadata-device.patch b/queue-5.10/dm-integrity-fix-flush-with-external-metadata-device.patch new file mode 100644 index 00000000000..407644ddb19 --- /dev/null +++ b/queue-5.10/dm-integrity-fix-flush-with-external-metadata-device.patch @@ -0,0 +1,179 @@ +From 9b5948267adc9e689da609eb61cf7ed49cae5fa8 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 8 Jan 2021 11:15:56 -0500 +Subject: dm integrity: fix flush with external metadata device + +From: Mikulas Patocka + +commit 9b5948267adc9e689da609eb61cf7ed49cae5fa8 upstream. + +With external metadata device, flush requests are not passed down to the +data device. + +Fix this by submitting the flush request in dm_integrity_flush_buffers. In +order to not degrade performance, we overlap the data device flush with +the metadata device flush. + +Reported-by: Lukas Straub +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-bufio.c | 6 ++++ + drivers/md/dm-integrity.c | 60 +++++++++++++++++++++++++++++++++++++--------- + include/linux/dm-bufio.h | 1 + 3 files changed, 56 insertions(+), 11 deletions(-) + +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1534,6 +1534,12 @@ sector_t dm_bufio_get_device_size(struct + } + EXPORT_SYMBOL_GPL(dm_bufio_get_device_size); + ++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c) ++{ ++ return c->dm_io; ++} ++EXPORT_SYMBOL_GPL(dm_bufio_get_dm_io_client); ++ + sector_t dm_bufio_get_block_number(struct dm_buffer *b) + { + return b->block; +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -1379,12 +1379,52 @@ thorough_test: + #undef MAY_BE_HASH + } + +-static void dm_integrity_flush_buffers(struct dm_integrity_c *ic) ++struct flush_request { ++ struct dm_io_request io_req; ++ struct dm_io_region io_reg; ++ struct dm_integrity_c *ic; ++ struct completion comp; ++}; ++ ++static void flush_notify(unsigned long error, void *fr_) ++{ ++ struct flush_request *fr = fr_; ++ if (unlikely(error != 0)) ++ dm_integrity_io_error(fr->ic, "flusing disk cache", -EIO); ++ complete(&fr->comp); ++} ++ ++static void dm_integrity_flush_buffers(struct dm_integrity_c *ic, bool flush_data) + { + int r; ++ ++ struct flush_request fr; ++ ++ if (!ic->meta_dev) ++ flush_data = false; ++ if (flush_data) { ++ fr.io_req.bi_op = REQ_OP_WRITE, ++ fr.io_req.bi_op_flags = REQ_PREFLUSH | REQ_SYNC, ++ fr.io_req.mem.type = DM_IO_KMEM, ++ fr.io_req.mem.ptr.addr = NULL, ++ fr.io_req.notify.fn = flush_notify, ++ fr.io_req.notify.context = &fr; ++ fr.io_req.client = dm_bufio_get_dm_io_client(ic->bufio), ++ fr.io_reg.bdev = ic->dev->bdev, ++ fr.io_reg.sector = 0, ++ fr.io_reg.count = 0, ++ fr.ic = ic; ++ init_completion(&fr.comp); ++ r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL); ++ BUG_ON(r); ++ } ++ + r = dm_bufio_write_dirty_buffers(ic->bufio); + if (unlikely(r)) + dm_integrity_io_error(ic, "writing tags", r); ++ ++ if (flush_data) ++ wait_for_completion(&fr.comp); + } + + static void sleep_on_endio_wait(struct dm_integrity_c *ic) +@@ -2110,7 +2150,7 @@ offload_to_thread: + + if (unlikely(dio->op == REQ_OP_DISCARD) && likely(ic->mode != 'D')) { + integrity_metadata(&dio->work); +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, false); + + dio->in_flight = (atomic_t)ATOMIC_INIT(1); + dio->completion = NULL; +@@ -2195,7 +2235,7 @@ static void integrity_commit(struct work + flushes = bio_list_get(&ic->flush_bio_list); + if (unlikely(ic->mode != 'J')) { + spin_unlock_irq(&ic->endio_wait.lock); +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, true); + goto release_flush_bios; + } + +@@ -2409,7 +2449,7 @@ skip_io: + complete_journal_op(&comp); + wait_for_completion_io(&comp.comp); + +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, true); + } + + static void integrity_writer(struct work_struct *w) +@@ -2451,7 +2491,7 @@ static void recalc_write_super(struct dm + { + int r; + +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, false); + if (dm_integrity_failed(ic)) + return; + +@@ -2654,7 +2694,7 @@ static void bitmap_flush_work(struct wor + unsigned long limit; + struct bio *bio; + +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, false); + + range.logical_sector = 0; + range.n_sectors = ic->provided_data_sectors; +@@ -2663,9 +2703,7 @@ static void bitmap_flush_work(struct wor + add_new_range_and_wait(ic, &range); + spin_unlock_irq(&ic->endio_wait.lock); + +- dm_integrity_flush_buffers(ic); +- if (ic->meta_dev) +- blkdev_issue_flush(ic->dev->bdev, GFP_NOIO); ++ dm_integrity_flush_buffers(ic, true); + + limit = ic->provided_data_sectors; + if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) { +@@ -2934,11 +2972,11 @@ static void dm_integrity_postsuspend(str + if (ic->meta_dev) + queue_work(ic->writer_wq, &ic->writer_work); + drain_workqueue(ic->writer_wq); +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, true); + } + + if (ic->mode == 'B') { +- dm_integrity_flush_buffers(ic); ++ dm_integrity_flush_buffers(ic, true); + #if 1 + /* set to 0 to test bitmap replay code */ + init_journal(ic, 0, ic->journal_sections, 0); +--- a/include/linux/dm-bufio.h ++++ b/include/linux/dm-bufio.h +@@ -150,6 +150,7 @@ void dm_bufio_set_minimum_buffers(struct + + unsigned dm_bufio_get_block_size(struct dm_bufio_client *c); + sector_t dm_bufio_get_device_size(struct dm_bufio_client *c); ++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c); + sector_t dm_bufio_get_block_number(struct dm_buffer *b); + void *dm_bufio_get_block_data(struct dm_buffer *b); + void *dm_bufio_get_aux_data(struct dm_buffer *b); diff --git a/queue-5.10/dm-integrity-fix-the-maximum-number-of-arguments.patch b/queue-5.10/dm-integrity-fix-the-maximum-number-of-arguments.patch new file mode 100644 index 00000000000..ba1e15f001b --- /dev/null +++ b/queue-5.10/dm-integrity-fix-the-maximum-number-of-arguments.patch @@ -0,0 +1,45 @@ +From 17ffc193cdc6dc7a613d00d8ad47fc1f801b9bf0 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Tue, 12 Jan 2021 14:54:47 -0500 +Subject: dm integrity: fix the maximum number of arguments + +From: Mikulas Patocka + +commit 17ffc193cdc6dc7a613d00d8ad47fc1f801b9bf0 upstream. + +Advance the maximum number of arguments from 9 to 15 to account for +all potential feature flags that may be supplied. + +Linux 4.19 added "meta_device" +(356d9d52e1221ba0c9f10b8b38652f78a5298329) and "recalculate" +(a3fcf7253139609bf9ff901fbf955fba047e75dd) flags. + +Commit 468dfca38b1a6fbdccd195d875599cb7c8875cd9 added +"sectors_per_bit" and "bitmap_flush_interval". + +Commit 84597a44a9d86ac949900441cea7da0af0f2f473 added +"allow_discards". + +And the commit d537858ac8aaf4311b51240893add2fc62003b97 added +"fix_padding". + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -3792,7 +3792,7 @@ static int dm_integrity_ctr(struct dm_ta + unsigned extra_args; + struct dm_arg_set as; + static const struct dm_arg _args[] = { +- {0, 9, "Invalid number of feature args"}, ++ {0, 15, "Invalid number of feature args"}, + }; + unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec; + bool should_write_sb; diff --git a/queue-5.10/dm-raid-fix-discard-limits-for-raid1.patch b/queue-5.10/dm-raid-fix-discard-limits-for-raid1.patch new file mode 100644 index 00000000000..f996b218c05 --- /dev/null +++ b/queue-5.10/dm-raid-fix-discard-limits-for-raid1.patch @@ -0,0 +1,47 @@ +From cc07d72bf350b77faeffee1c37bc52197171473f Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Thu, 24 Sep 2020 13:14:52 -0400 +Subject: dm raid: fix discard limits for raid1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mike Snitzer + +commit cc07d72bf350b77faeffee1c37bc52197171473f upstream. + +Block core warned that discard_granularity was 0 for dm-raid with +personality of raid1. Reason is that raid_io_hints() was incorrectly +special-casing raid1 rather than raid0. + +Fix raid_io_hints() by removing discard limits settings for +raid1. Check for raid0 instead. + +Fixes: 61697a6abd24a ("dm: eliminate 'split_discard_bios' flag from DM target interface") +Cc: stable@vger.kernel.org +Reported-by: Zdenek Kabelac +Reported-by: Mikulas Patocka +Reported-by: Stephan Bärwolf +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-raid.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3730,10 +3730,10 @@ static void raid_io_hints(struct dm_targ + blk_limits_io_opt(limits, chunk_size_bytes * mddev_data_stripes(rs)); + + /* +- * RAID1 and RAID10 personalities require bio splitting, +- * RAID0/4/5/6 don't and process large discard bios properly. ++ * RAID0 and RAID10 personalities require bio splitting, ++ * RAID1/4/5/6 don't and process large discard bios properly. + */ +- if (rs_is_raid1(rs) || rs_is_raid10(rs)) { ++ if (rs_is_raid0(rs) || rs_is_raid10(rs)) { + limits->discard_granularity = chunk_size_bytes; + limits->max_discard_sectors = rs->md.chunk_sectors; + } diff --git a/queue-5.10/dm-snapshot-flush-merged-data-before-committing-metadata.patch b/queue-5.10/dm-snapshot-flush-merged-data-before-committing-metadata.patch new file mode 100644 index 00000000000..49840677124 --- /dev/null +++ b/queue-5.10/dm-snapshot-flush-merged-data-before-committing-metadata.patch @@ -0,0 +1,96 @@ +From fcc42338375a1e67b8568dbb558f8b784d0f3b01 Mon Sep 17 00:00:00 2001 +From: Akilesh Kailash +Date: Mon, 28 Dec 2020 07:14:07 +0000 +Subject: dm snapshot: flush merged data before committing metadata + +From: Akilesh Kailash + +commit fcc42338375a1e67b8568dbb558f8b784d0f3b01 upstream. + +If the origin device has a volatile write-back cache and the following +events occur: + +1: After finishing merge operation of one set of exceptions, + merge_callback() is invoked. +2: Update the metadata in COW device tracking the merge completion. + This update to COW device is flushed cleanly. +3: System crashes and the origin device's cache where the recent + merge was completed has not been flushed. + +During the next cycle when we read the metadata from the COW device, +we will skip reading those metadata whose merge was completed in +step (1). This will lead to data loss/corruption. + +To address this, flush the origin device post merge IO before +updating the metadata. + +Cc: stable@vger.kernel.org +Signed-off-by: Akilesh Kailash +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -141,6 +141,11 @@ struct dm_snapshot { + * for them to be committed. + */ + struct bio_list bios_queued_during_merge; ++ ++ /* ++ * Flush data after merge. ++ */ ++ struct bio flush_bio; + }; + + /* +@@ -1121,6 +1126,17 @@ shut: + + static void error_bios(struct bio *bio); + ++static int flush_data(struct dm_snapshot *s) ++{ ++ struct bio *flush_bio = &s->flush_bio; ++ ++ bio_reset(flush_bio); ++ bio_set_dev(flush_bio, s->origin->bdev); ++ flush_bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; ++ ++ return submit_bio_wait(flush_bio); ++} ++ + static void merge_callback(int read_err, unsigned long write_err, void *context) + { + struct dm_snapshot *s = context; +@@ -1134,6 +1150,11 @@ static void merge_callback(int read_err, + goto shut; + } + ++ if (flush_data(s) < 0) { ++ DMERR("Flush after merge failed: shutting down merge"); ++ goto shut; ++ } ++ + if (s->store->type->commit_merge(s->store, + s->num_merging_chunks) < 0) { + DMERR("Write error in exception store: shutting down merge"); +@@ -1318,6 +1339,7 @@ static int snapshot_ctr(struct dm_target + s->first_merging_chunk = 0; + s->num_merging_chunks = 0; + bio_list_init(&s->bios_queued_during_merge); ++ bio_init(&s->flush_bio, NULL, 0); + + /* Allocate hash table for COW data */ + if (init_hash_tables(s)) { +@@ -1504,6 +1526,8 @@ static void snapshot_dtr(struct dm_targe + + dm_exception_store_destroy(s->store); + ++ bio_uninit(&s->flush_bio); ++ + dm_put_device(ti, s->cow); + + dm_put_device(ti, s->origin); diff --git a/queue-5.10/drm-amdgpu-add-green_sardine-device-id-v2.patch b/queue-5.10/drm-amdgpu-add-green_sardine-device-id-v2.patch new file mode 100644 index 00000000000..caa54310527 --- /dev/null +++ b/queue-5.10/drm-amdgpu-add-green_sardine-device-id-v2.patch @@ -0,0 +1,34 @@ +From 21702c8cae51535e09b91341a069503c6ef3d2a3 Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Fri, 2 Oct 2020 10:58:55 -0400 +Subject: drm/amdgpu: add green_sardine device id (v2) + +From: Prike Liang + +commit 21702c8cae51535e09b91341a069503c6ef3d2a3 upstream. + +Add green_sardine PCI id support and map it to renoir asic type. + +v2: add apu flag + +Signed-off-by: Prike Liang +Reviewed-by: Alex Deucher +Reviewed-by: Huang Rui +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.10.x +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1076,6 +1076,7 @@ static const struct pci_device_id pciidl + + /* Renoir */ + {0x1002, 0x1636, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU}, ++ {0x1002, 0x1638, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU}, + + /* Navi12 */ + {0x1002, 0x7360, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI12}, diff --git a/queue-5.10/drm-amdgpu-add-new-device-id-for-renior.patch b/queue-5.10/drm-amdgpu-add-new-device-id-for-renior.patch new file mode 100644 index 00000000000..d474924df78 --- /dev/null +++ b/queue-5.10/drm-amdgpu-add-new-device-id-for-renior.patch @@ -0,0 +1,44 @@ +From 53f1e7f6a1720f8299b5283857eedc8f07d29533 Mon Sep 17 00:00:00 2001 +From: mengwang +Date: Wed, 12 Aug 2020 11:49:29 +0800 +Subject: drm/amdgpu: add new device id for Renior + +From: mengwang + +commit 53f1e7f6a1720f8299b5283857eedc8f07d29533 upstream. + +add DID 0x164C into pciidlist under CHIP_RENOIR family. + +Signed-off-by: mengwang +Reviewed-by: Huang Rui +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.10.x +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + + drivers/gpu/drm/amd/amdgpu/soc15.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1077,6 +1077,7 @@ static const struct pci_device_id pciidl + /* Renoir */ + {0x1002, 0x1636, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU}, + {0x1002, 0x1638, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU}, ++ {0x1002, 0x164C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU}, + + /* Navi12 */ + {0x1002, 0x7360, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI12}, +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1242,7 +1242,8 @@ static int soc15_common_early_init(void + break; + case CHIP_RENOIR: + adev->asic_funcs = &soc15_asic_funcs; +- if (adev->pdev->device == 0x1636) ++ if ((adev->pdev->device == 0x1636) || ++ (adev->pdev->device == 0x164c)) + adev->apu_flags |= AMD_APU_IS_RENOIR; + else + adev->apu_flags |= AMD_APU_IS_GREEN_SARDINE; diff --git a/queue-5.10/drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch b/queue-5.10/drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch new file mode 100644 index 00000000000..83c582bfc54 --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch @@ -0,0 +1,33 @@ +From ff9346dbabbb6595c5c20d90d88ae4a2247487a9 Mon Sep 17 00:00:00 2001 +From: Alexandre Demers +Date: Thu, 7 Jan 2021 18:53:03 -0500 +Subject: drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921) + +From: Alexandre Demers + +commit ff9346dbabbb6595c5c20d90d88ae4a2247487a9 upstream. + +This fix bug 210921 where DRM_INFO floods log when hitting an unsupported ASIC in +amdgpu_device_asic_has_dc_support(). This info should be only called once. + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=210921 +Signed-off-by: Alexandre Demers +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3008,7 +3008,7 @@ bool amdgpu_device_asic_has_dc_support(e + #endif + default: + if (amdgpu_dc > 0) +- DRM_INFO("Display Core has been requested via kernel parameter " ++ DRM_INFO_ONCE("Display Core has been requested via kernel parameter " + "but isn't supported by ASIC, ignoring\n"); + return false; + } diff --git a/queue-5.10/drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch b/queue-5.10/drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch new file mode 100644 index 00000000000..5b5e025b441 --- /dev/null +++ b/queue-5.10/drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch @@ -0,0 +1,90 @@ +From cc5f7e2fcbe396f2f461cd67c872af771a334bca Mon Sep 17 00:00:00 2001 +From: Alexandru Gagniuc +Date: Tue, 20 Oct 2020 17:14:58 -0500 +Subject: drm/bridge: sii902x: Enable I/O and core VCC supplies if present + +From: Alexandru Gagniuc + +commit cc5f7e2fcbe396f2f461cd67c872af771a334bca upstream. + +On the SII9022, the IOVCC and CVCC12 supplies must reach the correct +voltage before the reset sequence is initiated. On most boards, this +assumption is true at boot-up, so initialization succeeds. + +However, when we try to initialize the chip with incorrect supply +voltages, it will not respond to I2C requests. sii902x_probe() fails +with -ENXIO. + +To resolve this, look for the "iovcc" and "cvcc12" regulators, and +make sure they are enabled before starting the reset sequence. If +these supplies are not available in devicetree, then they will default +to dummy-regulator. In that case everything will work like before. + +This was observed on a STM32MP157C-DK2 booting in u-boot falcon mode. +On this board, the supplies would be set by the second stage +bootloader, which does not run in falcon mode. + +Signed-off-by: Alexandru Gagniuc +Signed-off-by: Sam Ravnborg +[Fix checkpatch warnings] +Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-2-mr.nuke.me@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/bridge/sii902x.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/drivers/gpu/drm/bridge/sii902x.c ++++ b/drivers/gpu/drm/bridge/sii902x.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -168,6 +169,7 @@ struct sii902x { + struct drm_connector connector; + struct gpio_desc *reset_gpio; + struct i2c_mux_core *i2cmux; ++ struct regulator_bulk_data supplies[2]; + /* + * Mutex protects audio and video functions from interfering + * each other, by keeping their i2c command sequences atomic. +@@ -1049,7 +1051,26 @@ static int sii902x_probe(struct i2c_clie + + mutex_init(&sii902x->mutex); + ++ sii902x->supplies[0].supply = "iovcc"; ++ sii902x->supplies[1].supply = "cvcc12"; ++ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(sii902x->supplies), ++ sii902x->supplies); ++ if (ret < 0) ++ return ret; ++ ++ ret = regulator_bulk_enable(ARRAY_SIZE(sii902x->supplies), ++ sii902x->supplies); ++ if (ret < 0) { ++ dev_err_probe(dev, ret, "Failed to enable supplies"); ++ return ret; ++ } ++ + ret = sii902x_init(sii902x); ++ if (ret < 0) { ++ regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies), ++ sii902x->supplies); ++ } ++ + return ret; + } + +@@ -1060,6 +1081,8 @@ static int sii902x_remove(struct i2c_cli + + i2c_mux_del_adapters(sii902x->i2cmux); + drm_bridge_remove(&sii902x->bridge); ++ regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies), ++ sii902x->supplies); + + return 0; + } diff --git a/queue-5.10/drm-bridge-sii902x-refactor-init-code-into-separate-function.patch b/queue-5.10/drm-bridge-sii902x-refactor-init-code-into-separate-function.patch new file mode 100644 index 00000000000..77683aac96e --- /dev/null +++ b/queue-5.10/drm-bridge-sii902x-refactor-init-code-into-separate-function.patch @@ -0,0 +1,139 @@ +From 91b5e26731c5d409d6134603afc061617639933e Mon Sep 17 00:00:00 2001 +From: Alexandru Gagniuc +Date: Tue, 20 Oct 2020 17:14:57 -0500 +Subject: drm/bridge: sii902x: Refactor init code into separate function + +From: Alexandru Gagniuc + +commit 91b5e26731c5d409d6134603afc061617639933e upstream. + +Separate the hardware initialization code from setting up the data +structures and parsing the device tree. The purpose of this change is +to provide a single exit point and avoid a waterfall of 'goto's in +the subsequent patch. + +Signed-off-by: Alexandru Gagniuc +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-1-mr.nuke.me@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/bridge/sii902x.c | 77 +++++++++++++++++++++------------------ + 1 file changed, 43 insertions(+), 34 deletions(-) + +--- a/drivers/gpu/drm/bridge/sii902x.c ++++ b/drivers/gpu/drm/bridge/sii902x.c +@@ -954,41 +954,13 @@ static const struct drm_bridge_timings d + | DRM_BUS_FLAG_DE_HIGH, + }; + +-static int sii902x_probe(struct i2c_client *client, +- const struct i2c_device_id *id) ++static int sii902x_init(struct sii902x *sii902x) + { +- struct device *dev = &client->dev; ++ struct device *dev = &sii902x->i2c->dev; + unsigned int status = 0; +- struct sii902x *sii902x; + u8 chipid[4]; + int ret; + +- ret = i2c_check_functionality(client->adapter, +- I2C_FUNC_SMBUS_BYTE_DATA); +- if (!ret) { +- dev_err(dev, "I2C adapter not suitable\n"); +- return -EIO; +- } +- +- sii902x = devm_kzalloc(dev, sizeof(*sii902x), GFP_KERNEL); +- if (!sii902x) +- return -ENOMEM; +- +- sii902x->i2c = client; +- sii902x->regmap = devm_regmap_init_i2c(client, &sii902x_regmap_config); +- if (IS_ERR(sii902x->regmap)) +- return PTR_ERR(sii902x->regmap); +- +- sii902x->reset_gpio = devm_gpiod_get_optional(dev, "reset", +- GPIOD_OUT_LOW); +- if (IS_ERR(sii902x->reset_gpio)) { +- dev_err(dev, "Failed to retrieve/request reset gpio: %ld\n", +- PTR_ERR(sii902x->reset_gpio)); +- return PTR_ERR(sii902x->reset_gpio); +- } +- +- mutex_init(&sii902x->mutex); +- + sii902x_reset(sii902x); + + ret = regmap_write(sii902x->regmap, SII902X_REG_TPI_RQB, 0x0); +@@ -1012,11 +984,11 @@ static int sii902x_probe(struct i2c_clie + regmap_read(sii902x->regmap, SII902X_INT_STATUS, &status); + regmap_write(sii902x->regmap, SII902X_INT_STATUS, status); + +- if (client->irq > 0) { ++ if (sii902x->i2c->irq > 0) { + regmap_write(sii902x->regmap, SII902X_INT_ENABLE, + SII902X_HOTPLUG_EVENT); + +- ret = devm_request_threaded_irq(dev, client->irq, NULL, ++ ret = devm_request_threaded_irq(dev, sii902x->i2c->irq, NULL, + sii902x_interrupt, + IRQF_ONESHOT, dev_name(dev), + sii902x); +@@ -1031,9 +1003,9 @@ static int sii902x_probe(struct i2c_clie + + sii902x_audio_codec_init(sii902x, dev); + +- i2c_set_clientdata(client, sii902x); ++ i2c_set_clientdata(sii902x->i2c, sii902x); + +- sii902x->i2cmux = i2c_mux_alloc(client->adapter, dev, ++ sii902x->i2cmux = i2c_mux_alloc(sii902x->i2c->adapter, dev, + 1, 0, I2C_MUX_GATE, + sii902x_i2c_bypass_select, + sii902x_i2c_bypass_deselect); +@@ -1044,6 +1016,43 @@ static int sii902x_probe(struct i2c_clie + return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0); + } + ++static int sii902x_probe(struct i2c_client *client, ++ const struct i2c_device_id *id) ++{ ++ struct device *dev = &client->dev; ++ struct sii902x *sii902x; ++ int ret; ++ ++ ret = i2c_check_functionality(client->adapter, ++ I2C_FUNC_SMBUS_BYTE_DATA); ++ if (!ret) { ++ dev_err(dev, "I2C adapter not suitable\n"); ++ return -EIO; ++ } ++ ++ sii902x = devm_kzalloc(dev, sizeof(*sii902x), GFP_KERNEL); ++ if (!sii902x) ++ return -ENOMEM; ++ ++ sii902x->i2c = client; ++ sii902x->regmap = devm_regmap_init_i2c(client, &sii902x_regmap_config); ++ if (IS_ERR(sii902x->regmap)) ++ return PTR_ERR(sii902x->regmap); ++ ++ sii902x->reset_gpio = devm_gpiod_get_optional(dev, "reset", ++ GPIOD_OUT_LOW); ++ if (IS_ERR(sii902x->reset_gpio)) { ++ dev_err(dev, "Failed to retrieve/request reset gpio: %ld\n", ++ PTR_ERR(sii902x->reset_gpio)); ++ return PTR_ERR(sii902x->reset_gpio); ++ } ++ ++ mutex_init(&sii902x->mutex); ++ ++ ret = sii902x_init(sii902x); ++ return ret; ++} ++ + static int sii902x_remove(struct i2c_client *client) + + { diff --git a/queue-5.10/drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch b/queue-5.10/drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch new file mode 100644 index 00000000000..8568bd3d073 --- /dev/null +++ b/queue-5.10/drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch @@ -0,0 +1,233 @@ +From 984cadea032b103c5824a5f29d0a36b3e9df6333 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 11 Jan 2021 22:52:20 +0000 +Subject: drm/i915: Allow the sysadmin to override security mitigations + +From: Chris Wilson + +commit 984cadea032b103c5824a5f29d0a36b3e9df6333 upstream. + +The clear-residuals mitigation is a relatively heavy hammer and under some +circumstances the user may wish to forgo the context isolation in order +to meet some performance requirement. Introduce a generic module +parameter to allow selectively enabling/disabling different mitigations. + +To disable just the clear-residuals mitigation (on Ivybridge, Baytrail, +or Haswell) use the module parameter: i915.mitigations=auto,!residuals + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1858 +Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts") +Signed-off-by: Chris Wilson +Cc: Joonas Lahtinen +Cc: Jon Bloomfield +Cc: Rodrigo Vivi +Cc: stable@vger.kernel.org # v5.7 +Reviewed-by: Jon Bloomfield +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20210111225220.3483-3-chris@chris-wilson.co.uk +(cherry picked from commit f7452c7cbd5b5dfb9a6c84cb20bea04c89be50cd) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/Makefile | 1 + drivers/gpu/drm/i915/gt/intel_ring_submission.c | 4 + drivers/gpu/drm/i915/i915_mitigations.c | 146 ++++++++++++++++++++++++ + drivers/gpu/drm/i915/i915_mitigations.h | 13 ++ + 4 files changed, 163 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/Makefile ++++ b/drivers/gpu/drm/i915/Makefile +@@ -38,6 +38,7 @@ i915-y += i915_drv.o \ + i915_config.o \ + i915_irq.o \ + i915_getparam.o \ ++ i915_mitigations.o \ + i915_params.o \ + i915_pci.o \ + i915_scatterlist.o \ +--- a/drivers/gpu/drm/i915/gt/intel_ring_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_ring_submission.c +@@ -32,6 +32,7 @@ + #include "gen6_ppgtt.h" + #include "gen7_renderclear.h" + #include "i915_drv.h" ++#include "i915_mitigations.h" + #include "intel_breadcrumbs.h" + #include "intel_context.h" + #include "intel_gt.h" +@@ -885,7 +886,8 @@ static int switch_context(struct i915_re + GEM_BUG_ON(HAS_EXECLISTS(engine->i915)); + + if (engine->wa_ctx.vma && ce != engine->kernel_context) { +- if (engine->wa_ctx.vma->private != ce) { ++ if (engine->wa_ctx.vma->private != ce && ++ i915_mitigate_clear_residuals()) { + ret = clear_residuals(rq); + if (ret) + return ret; +--- /dev/null ++++ b/drivers/gpu/drm/i915/i915_mitigations.c +@@ -0,0 +1,146 @@ ++// SPDX-License-Identifier: MIT ++/* ++ * Copyright © 2021 Intel Corporation ++ */ ++ ++#include ++#include ++#include ++#include ++ ++#include "i915_drv.h" ++#include "i915_mitigations.h" ++ ++static unsigned long mitigations __read_mostly = ~0UL; ++ ++enum { ++ CLEAR_RESIDUALS = 0, ++}; ++ ++static const char * const names[] = { ++ [CLEAR_RESIDUALS] = "residuals", ++}; ++ ++bool i915_mitigate_clear_residuals(void) ++{ ++ return READ_ONCE(mitigations) & BIT(CLEAR_RESIDUALS); ++} ++ ++static int mitigations_set(const char *val, const struct kernel_param *kp) ++{ ++ unsigned long new = ~0UL; ++ char *str, *sep, *tok; ++ bool first = true; ++ int err = 0; ++ ++ BUILD_BUG_ON(ARRAY_SIZE(names) >= BITS_PER_TYPE(mitigations)); ++ ++ str = kstrdup(val, GFP_KERNEL); ++ if (!str) ++ return -ENOMEM; ++ ++ for (sep = str; (tok = strsep(&sep, ","));) { ++ bool enable = true; ++ int i; ++ ++ /* Be tolerant of leading/trailing whitespace */ ++ tok = strim(tok); ++ ++ if (first) { ++ first = false; ++ ++ if (!strcmp(tok, "auto")) ++ continue; ++ ++ new = 0; ++ if (!strcmp(tok, "off")) ++ continue; ++ } ++ ++ if (*tok == '!') { ++ enable = !enable; ++ tok++; ++ } ++ ++ if (!strncmp(tok, "no", 2)) { ++ enable = !enable; ++ tok += 2; ++ } ++ ++ if (*tok == '\0') ++ continue; ++ ++ for (i = 0; i < ARRAY_SIZE(names); i++) { ++ if (!strcmp(tok, names[i])) { ++ if (enable) ++ new |= BIT(i); ++ else ++ new &= ~BIT(i); ++ break; ++ } ++ } ++ if (i == ARRAY_SIZE(names)) { ++ pr_err("Bad \"%s.mitigations=%s\", '%s' is unknown\n", ++ DRIVER_NAME, val, tok); ++ err = -EINVAL; ++ break; ++ } ++ } ++ kfree(str); ++ if (err) ++ return err; ++ ++ WRITE_ONCE(mitigations, new); ++ return 0; ++} ++ ++static int mitigations_get(char *buffer, const struct kernel_param *kp) ++{ ++ unsigned long local = READ_ONCE(mitigations); ++ int count, i; ++ bool enable; ++ ++ if (!local) ++ return scnprintf(buffer, PAGE_SIZE, "%s\n", "off"); ++ ++ if (local & BIT(BITS_PER_LONG - 1)) { ++ count = scnprintf(buffer, PAGE_SIZE, "%s,", "auto"); ++ enable = false; ++ } else { ++ enable = true; ++ count = 0; ++ } ++ ++ for (i = 0; i < ARRAY_SIZE(names); i++) { ++ if ((local & BIT(i)) != enable) ++ continue; ++ ++ count += scnprintf(buffer + count, PAGE_SIZE - count, ++ "%s%s,", enable ? "" : "!", names[i]); ++ } ++ ++ buffer[count - 1] = '\n'; ++ return count; ++} ++ ++static const struct kernel_param_ops ops = { ++ .set = mitigations_set, ++ .get = mitigations_get, ++}; ++ ++module_param_cb_unsafe(mitigations, &ops, NULL, 0600); ++MODULE_PARM_DESC(mitigations, ++"Selectively enable security mitigations for all Intel® GPUs in the system.\n" ++"\n" ++" auto -- enables all mitigations required for the platform [default]\n" ++" off -- disables all mitigations\n" ++"\n" ++"Individual mitigations can be enabled by passing a comma-separated string,\n" ++"e.g. mitigations=residuals to enable only clearing residuals or\n" ++"mitigations=auto,noresiduals to disable only the clear residual mitigation.\n" ++"Either '!' or 'no' may be used to switch from enabling the mitigation to\n" ++"disabling it.\n" ++"\n" ++"Active mitigations for Ivybridge, Baytrail, Haswell:\n" ++" residuals -- clear all thread-local registers between contexts" ++); +--- /dev/null ++++ b/drivers/gpu/drm/i915/i915_mitigations.h +@@ -0,0 +1,13 @@ ++/* SPDX-License-Identifier: MIT */ ++/* ++ * Copyright © 2021 Intel Corporation ++ */ ++ ++#ifndef __I915_MITIGATIONS_H__ ++#define __I915_MITIGATIONS_H__ ++ ++#include ++ ++bool i915_mitigate_clear_residuals(void); ++ ++#endif /* __I915_MITIGATIONS_H__ */ diff --git a/queue-5.10/drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch b/queue-5.10/drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch new file mode 100644 index 00000000000..b10a5a78e67 --- /dev/null +++ b/queue-5.10/drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch @@ -0,0 +1,76 @@ +From bb83d5fb550bb7db75b29e6342417fda2bbb691c Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Fri, 8 Jan 2021 17:28:41 +0200 +Subject: drm/i915/backlight: fix CPU mode backlight takeover on LPT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit bb83d5fb550bb7db75b29e6342417fda2bbb691c upstream. + +The pch_get_backlight(), lpt_get_backlight(), and lpt_set_backlight() +functions operate directly on the hardware registers. If inverting the +value is needed, using intel_panel_compute_brightness(), it should only +be done in the interface between hardware registers and +panel->backlight.level. + +The CPU mode takeover code added in commit 5b1ec9ac7ab5 +("drm/i915/backlight: Fix backlight takeover on LPT, v3.") reads the +hardware register and converts to panel->backlight.level correctly, +however the value written back should remain in the hardware register +"domain". + +This hasn't been an issue, because GM45 machines are the only known +users of i915.invert_brightness and the brightness invert quirk, and +without one of them no conversion is made. It's likely nobody's ever hit +the problem. + +Fixes: 5b1ec9ac7ab5 ("drm/i915/backlight: Fix backlight takeover on LPT, v3.") +Cc: Maarten Lankhorst +Cc: Ville Syrjälä +Cc: Lyude Paul +Cc: # v5.1+ +Reviewed-by: Lyude Paul +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20210108152841.6944-1-jani.nikula@intel.com +(cherry picked from commit 0d4ced1c5bfe649196877d90442d4fd618e19153) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/display/intel_panel.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_panel.c ++++ b/drivers/gpu/drm/i915/display/intel_panel.c +@@ -1650,16 +1650,13 @@ static int lpt_setup_backlight(struct in + val = pch_get_backlight(connector); + else + val = lpt_get_backlight(connector); +- val = intel_panel_compute_brightness(connector, val); +- panel->backlight.level = clamp(val, panel->backlight.min, +- panel->backlight.max); + + if (cpu_mode) { + drm_dbg_kms(&dev_priv->drm, + "CPU backlight register was enabled, switching to PCH override\n"); + + /* Write converted CPU PWM value to PCH override register */ +- lpt_set_backlight(connector->base.state, panel->backlight.level); ++ lpt_set_backlight(connector->base.state, val); + intel_de_write(dev_priv, BLC_PWM_PCH_CTL1, + pch_ctl1 | BLM_PCH_OVERRIDE_ENABLE); + +@@ -1667,6 +1664,10 @@ static int lpt_setup_backlight(struct in + cpu_ctl2 & ~BLM_PWM_ENABLE); + } + ++ val = intel_panel_compute_brightness(connector, val); ++ panel->backlight.level = clamp(val, panel->backlight.min, ++ panel->backlight.max); ++ + return 0; + } + diff --git a/queue-5.10/drm-i915-gt-limit-vfe-threads-based-on-gt.patch b/queue-5.10/drm-i915-gt-limit-vfe-threads-based-on-gt.patch new file mode 100644 index 00000000000..9053f2a1894 --- /dev/null +++ b/queue-5.10/drm-i915-gt-limit-vfe-threads-based-on-gt.patch @@ -0,0 +1,326 @@ +From ffaf97899c4a58b9fefb11534f730785443611a8 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 11 Jan 2021 22:52:18 +0000 +Subject: drm/i915/gt: Limit VFE threads based on GT + +From: Chris Wilson + +commit ffaf97899c4a58b9fefb11534f730785443611a8 upstream. + +MEDIA_STATE_VFE only accepts the 'maximum number of threads' in the +range [0, n-1] where n is #EU * (#threads/EU) with the number of threads +based on plaform and the number of EU based on the number of slices and +subslices. This is a fixed number per platform/gt, so appropriately +limit the number of threads we spawn to match the device. + +v2: Oversaturate the system with tasks to force execution on every HW +thread; if the thread idles it is returned to the pool and may be reused +again before an unused thread. + +v3: Fix more state commands, which was causing Baytrail to barf. +v4: STATE_CACHE_INVALIDATE requires a stall on Ivybridge + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2024 +Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts") +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Prathap Kumar Valsan +Cc: Akeem G Abodunrin +Cc: Jon Bloomfield +Cc: Rodrigo Vivi +Cc: Randy Wright +Cc: stable@vger.kernel.org # v5.7+ +Reviewed-by: Akeem G Abodunrin +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20210111225220.3483-1-chris@chris-wilson.co.uk +(cherry picked from commit eebfb32e26851662d24ea86dd381fd0f83cd4b47) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gt/gen7_renderclear.c | 157 +++++++++++++++++------------ + 1 file changed, 94 insertions(+), 63 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c ++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +@@ -7,8 +7,6 @@ + #include "i915_drv.h" + #include "intel_gpu_commands.h" + +-#define MAX_URB_ENTRIES 64 +-#define STATE_SIZE (4 * 1024) + #define GT3_INLINE_DATA_DELAYS 0x1E00 + #define batch_advance(Y, CS) GEM_BUG_ON((Y)->end != (CS)) + +@@ -34,38 +32,59 @@ struct batch_chunk { + }; + + struct batch_vals { +- u32 max_primitives; +- u32 max_urb_entries; +- u32 cmd_size; +- u32 state_size; ++ u32 max_threads; + u32 state_start; +- u32 batch_size; ++ u32 surface_start; + u32 surface_height; + u32 surface_width; +- u32 scratch_size; +- u32 max_size; ++ u32 size; + }; + ++static inline int num_primitives(const struct batch_vals *bv) ++{ ++ /* ++ * We need to saturate the GPU with work in order to dispatch ++ * a shader on every HW thread, and clear the thread-local registers. ++ * In short, we have to dispatch work faster than the shaders can ++ * run in order to fill the EU and occupy each HW thread. ++ */ ++ return bv->max_threads; ++} ++ + static void + batch_get_defaults(struct drm_i915_private *i915, struct batch_vals *bv) + { + if (IS_HASWELL(i915)) { +- bv->max_primitives = 280; +- bv->max_urb_entries = MAX_URB_ENTRIES; ++ switch (INTEL_INFO(i915)->gt) { ++ default: ++ case 1: ++ bv->max_threads = 70; ++ break; ++ case 2: ++ bv->max_threads = 140; ++ break; ++ case 3: ++ bv->max_threads = 280; ++ break; ++ } + bv->surface_height = 16 * 16; + bv->surface_width = 32 * 2 * 16; + } else { +- bv->max_primitives = 128; +- bv->max_urb_entries = MAX_URB_ENTRIES / 2; ++ switch (INTEL_INFO(i915)->gt) { ++ default: ++ case 1: /* including vlv */ ++ bv->max_threads = 36; ++ break; ++ case 2: ++ bv->max_threads = 128; ++ break; ++ } + bv->surface_height = 16 * 8; + bv->surface_width = 32 * 16; + } +- bv->cmd_size = bv->max_primitives * 4096; +- bv->state_size = STATE_SIZE; +- bv->state_start = bv->cmd_size; +- bv->batch_size = bv->cmd_size + bv->state_size; +- bv->scratch_size = bv->surface_height * bv->surface_width; +- bv->max_size = bv->batch_size + bv->scratch_size; ++ bv->state_start = round_up(SZ_1K + num_primitives(bv) * 64, SZ_4K); ++ bv->surface_start = bv->state_start + SZ_4K; ++ bv->size = bv->surface_start + bv->surface_height * bv->surface_width; + } + + static void batch_init(struct batch_chunk *bc, +@@ -155,7 +174,8 @@ static u32 + gen7_fill_binding_table(struct batch_chunk *state, + const struct batch_vals *bv) + { +- u32 surface_start = gen7_fill_surface_state(state, bv->batch_size, bv); ++ u32 surface_start = ++ gen7_fill_surface_state(state, bv->surface_start, bv); + u32 *cs = batch_alloc_items(state, 32, 8); + u32 offset = batch_offset(state, cs); + +@@ -214,9 +234,9 @@ static void + gen7_emit_state_base_address(struct batch_chunk *batch, + u32 surface_state_base) + { +- u32 *cs = batch_alloc_items(batch, 0, 12); ++ u32 *cs = batch_alloc_items(batch, 0, 10); + +- *cs++ = STATE_BASE_ADDRESS | (12 - 2); ++ *cs++ = STATE_BASE_ADDRESS | (10 - 2); + /* general */ + *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY; + /* surface */ +@@ -233,8 +253,6 @@ gen7_emit_state_base_address(struct batc + *cs++ = BASE_ADDRESS_MODIFY; + *cs++ = 0; + *cs++ = BASE_ADDRESS_MODIFY; +- *cs++ = 0; +- *cs++ = 0; + batch_advance(batch, cs); + } + +@@ -244,8 +262,7 @@ gen7_emit_vfe_state(struct batch_chunk * + u32 urb_size, u32 curbe_size, + u32 mode) + { +- u32 urb_entries = bv->max_urb_entries; +- u32 threads = bv->max_primitives - 1; ++ u32 threads = bv->max_threads - 1; + u32 *cs = batch_alloc_items(batch, 32, 8); + + *cs++ = MEDIA_VFE_STATE | (8 - 2); +@@ -254,7 +271,7 @@ gen7_emit_vfe_state(struct batch_chunk * + *cs++ = 0; + + /* number of threads & urb entries for GPGPU vs Media Mode */ +- *cs++ = threads << 16 | urb_entries << 8 | mode << 2; ++ *cs++ = threads << 16 | 1 << 8 | mode << 2; + + *cs++ = 0; + +@@ -293,17 +310,12 @@ gen7_emit_media_object(struct batch_chun + { + unsigned int x_offset = (media_object_index % 16) * 64; + unsigned int y_offset = (media_object_index / 16) * 16; +- unsigned int inline_data_size; +- unsigned int media_batch_size; +- unsigned int i; ++ unsigned int pkt = 6 + 3; + u32 *cs; + +- inline_data_size = 112 * 8; +- media_batch_size = inline_data_size + 6; +- +- cs = batch_alloc_items(batch, 8, media_batch_size); ++ cs = batch_alloc_items(batch, 8, pkt); + +- *cs++ = MEDIA_OBJECT | (media_batch_size - 2); ++ *cs++ = MEDIA_OBJECT | (pkt - 2); + + /* interface descriptor offset */ + *cs++ = 0; +@@ -317,25 +329,44 @@ gen7_emit_media_object(struct batch_chun + *cs++ = 0; + + /* inline */ +- *cs++ = (y_offset << 16) | (x_offset); ++ *cs++ = y_offset << 16 | x_offset; + *cs++ = 0; + *cs++ = GT3_INLINE_DATA_DELAYS; +- for (i = 3; i < inline_data_size; i++) +- *cs++ = 0; + + batch_advance(batch, cs); + } + + static void gen7_emit_pipeline_flush(struct batch_chunk *batch) + { +- u32 *cs = batch_alloc_items(batch, 0, 5); ++ u32 *cs = batch_alloc_items(batch, 0, 4); + +- *cs++ = GFX_OP_PIPE_CONTROL(5); +- *cs++ = PIPE_CONTROL_STATE_CACHE_INVALIDATE | +- PIPE_CONTROL_GLOBAL_GTT_IVB; ++ *cs++ = GFX_OP_PIPE_CONTROL(4); ++ *cs++ = PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH | ++ PIPE_CONTROL_DEPTH_CACHE_FLUSH | ++ PIPE_CONTROL_DC_FLUSH_ENABLE | ++ PIPE_CONTROL_CS_STALL; + *cs++ = 0; + *cs++ = 0; ++ ++ batch_advance(batch, cs); ++} ++ ++static void gen7_emit_pipeline_invalidate(struct batch_chunk *batch) ++{ ++ u32 *cs = batch_alloc_items(batch, 0, 8); ++ ++ /* ivb: Stall before STATE_CACHE_INVALIDATE */ ++ *cs++ = GFX_OP_PIPE_CONTROL(4); ++ *cs++ = PIPE_CONTROL_STALL_AT_SCOREBOARD | ++ PIPE_CONTROL_CS_STALL; ++ *cs++ = 0; ++ *cs++ = 0; ++ ++ *cs++ = GFX_OP_PIPE_CONTROL(4); ++ *cs++ = PIPE_CONTROL_STATE_CACHE_INVALIDATE; + *cs++ = 0; ++ *cs++ = 0; ++ + batch_advance(batch, cs); + } + +@@ -344,34 +375,34 @@ static void emit_batch(struct i915_vma * + const struct batch_vals *bv) + { + struct drm_i915_private *i915 = vma->vm->i915; +- unsigned int desc_count = 64; +- const u32 urb_size = 112; ++ const unsigned int desc_count = 1; ++ const unsigned int urb_size = 1; + struct batch_chunk cmds, state; +- u32 interface_descriptor; ++ u32 descriptors; + unsigned int i; + +- batch_init(&cmds, vma, start, 0, bv->cmd_size); +- batch_init(&state, vma, start, bv->state_start, bv->state_size); ++ batch_init(&cmds, vma, start, 0, bv->state_start); ++ batch_init(&state, vma, start, bv->state_start, SZ_4K); + +- interface_descriptor = +- gen7_fill_interface_descriptor(&state, bv, +- IS_HASWELL(i915) ? +- &cb_kernel_hsw : +- &cb_kernel_ivb, +- desc_count); +- gen7_emit_pipeline_flush(&cmds); ++ descriptors = gen7_fill_interface_descriptor(&state, bv, ++ IS_HASWELL(i915) ? ++ &cb_kernel_hsw : ++ &cb_kernel_ivb, ++ desc_count); ++ ++ gen7_emit_pipeline_invalidate(&cmds); + batch_add(&cmds, PIPELINE_SELECT | PIPELINE_SELECT_MEDIA); + batch_add(&cmds, MI_NOOP); +- gen7_emit_state_base_address(&cmds, interface_descriptor); ++ gen7_emit_pipeline_invalidate(&cmds); ++ + gen7_emit_pipeline_flush(&cmds); ++ gen7_emit_state_base_address(&cmds, descriptors); ++ gen7_emit_pipeline_invalidate(&cmds); + + gen7_emit_vfe_state(&cmds, bv, urb_size - 1, 0, 0); ++ gen7_emit_interface_descriptor_load(&cmds, descriptors, desc_count); + +- gen7_emit_interface_descriptor_load(&cmds, +- interface_descriptor, +- desc_count); +- +- for (i = 0; i < bv->max_primitives; i++) ++ for (i = 0; i < num_primitives(bv); i++) + gen7_emit_media_object(&cmds, i); + + batch_add(&cmds, MI_BATCH_BUFFER_END); +@@ -385,15 +416,15 @@ int gen7_setup_clear_gpr_bb(struct intel + + batch_get_defaults(engine->i915, &bv); + if (!vma) +- return bv.max_size; ++ return bv.size; + +- GEM_BUG_ON(vma->obj->base.size < bv.max_size); ++ GEM_BUG_ON(vma->obj->base.size < bv.size); + + batch = i915_gem_object_pin_map(vma->obj, I915_MAP_WC); + if (IS_ERR(batch)) + return PTR_ERR(batch); + +- emit_batch(vma, memset(batch, 0, bv.max_size), &bv); ++ emit_batch(vma, memset(batch, 0, bv.size), &bv); + + i915_gem_object_flush_map(vma->obj); + __i915_gem_object_release_map(vma->obj); diff --git a/queue-5.10/dt-bindings-display-sii902x-add-supply-bindings.patch b/queue-5.10/dt-bindings-display-sii902x-add-supply-bindings.patch new file mode 100644 index 00000000000..11bf08ee2fe --- /dev/null +++ b/queue-5.10/dt-bindings-display-sii902x-add-supply-bindings.patch @@ -0,0 +1,43 @@ +From 4c1e054322da99cbfd293a5fddf283f2fdb3e2d0 Mon Sep 17 00:00:00 2001 +From: Alexandru Gagniuc +Date: Tue, 20 Oct 2020 17:14:59 -0500 +Subject: dt-bindings: display: sii902x: Add supply bindings + +From: Alexandru Gagniuc + +commit 4c1e054322da99cbfd293a5fddf283f2fdb3e2d0 upstream. + +The sii902x chip family requires IO and core voltages to reach the +correct voltage before chip initialization. Add binding for describing +the two supplies. + +Signed-off-by: Alexandru Gagniuc +Acked-by: Rob Herring +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-3-mr.nuke.me@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/display/bridge/sii902x.txt | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/Documentation/devicetree/bindings/display/bridge/sii902x.txt ++++ b/Documentation/devicetree/bindings/display/bridge/sii902x.txt +@@ -8,6 +8,8 @@ Optional properties: + - interrupts: describe the interrupt line used to inform the host + about hotplug events. + - reset-gpios: OF device-tree gpio specification for RST_N pin. ++ - iovcc-supply: I/O Supply Voltage (1.8V or 3.3V) ++ - cvcc12-supply: Digital Core Supply Voltage (1.2V) + + HDMI audio properties: + - #sound-dai-cells: <0> or <1>. <0> if only i2s or spdif pin +@@ -54,6 +56,8 @@ Example: + compatible = "sil,sii9022"; + reg = <0x39>; + reset-gpios = <&pioA 1 0>; ++ iovcc-supply = <&v3v3_hdmi>; ++ cvcc12-supply = <&v1v2_hdmi>; + + #sound-dai-cells = <0>; + sil,i2s-data-lanes = < 0 1 2 >; diff --git a/queue-5.10/ext4-fix-bug-for-rename-with-rename_whiteout.patch b/queue-5.10/ext4-fix-bug-for-rename-with-rename_whiteout.patch new file mode 100644 index 00000000000..296f07e3bfc --- /dev/null +++ b/queue-5.10/ext4-fix-bug-for-rename-with-rename_whiteout.patch @@ -0,0 +1,101 @@ +From 6b4b8e6b4ad8553660421d6360678b3811d5deb9 Mon Sep 17 00:00:00 2001 +From: yangerkun +Date: Tue, 5 Jan 2021 14:28:57 +0800 +Subject: ext4: fix bug for rename with RENAME_WHITEOUT + +From: yangerkun + +commit 6b4b8e6b4ad8553660421d6360678b3811d5deb9 upstream. + +We got a "deleted inode referenced" warning cross our fsstress test. The +bug can be reproduced easily with following steps: + + cd /dev/shm + mkdir test/ + fallocate -l 128M img + mkfs.ext4 -b 1024 img + mount img test/ + dd if=/dev/zero of=test/foo bs=1M count=128 + mkdir test/dir/ && cd test/dir/ + for ((i=0;i<1000;i++)); do touch file$i; done # consume all block + cd ~ && renameat2(AT_FDCWD, /dev/shm/test/dir/file1, AT_FDCWD, + /dev/shm/test/dir/dst_file, RENAME_WHITEOUT) # ext4_add_entry in + ext4_rename will return ENOSPC!! + cd /dev/shm/ && umount test/ && mount img test/ && ls -li test/dir/file1 + We will get the output: + "ls: cannot access 'test/dir/file1': Structure needs cleaning" + and the dmesg show: + "EXT4-fs error (device loop0): ext4_lookup:1626: inode #2049: comm ls: + deleted inode referenced: 139" + +ext4_rename will create a special inode for whiteout and use this 'ino' +to replace the source file's dir entry 'ino'. Once error happens +latter(the error above was the ENOSPC return from ext4_add_entry in +ext4_rename since all space has been consumed), the cleanup do drop the +nlink for whiteout, but forget to restore 'ino' with source file. This +will trigger the bug describle as above. + +Signed-off-by: yangerkun +Reviewed-by: Jan Kara +Cc: stable@vger.kernel.org +Fixes: cd808deced43 ("ext4: support RENAME_WHITEOUT") +Link: https://lore.kernel.org/r/20210105062857.3566-1-yangerkun@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/namei.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3602,9 +3602,6 @@ static int ext4_setent(handle_t *handle, + return retval2; + } + } +- brelse(ent->bh); +- ent->bh = NULL; +- + return retval; + } + +@@ -3803,6 +3800,7 @@ static int ext4_rename(struct inode *old + } + } + ++ old_file_type = old.de->file_type; + if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir)) + ext4_handle_sync(handle); + +@@ -3830,7 +3828,6 @@ static int ext4_rename(struct inode *old + force_reread = (new.dir->i_ino == old.dir->i_ino && + ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA)); + +- old_file_type = old.de->file_type; + if (whiteout) { + /* + * Do this before adding a new entry, so the old entry is sure +@@ -3928,15 +3925,19 @@ static int ext4_rename(struct inode *old + retval = 0; + + end_rename: +- brelse(old.dir_bh); +- brelse(old.bh); +- brelse(new.bh); + if (whiteout) { +- if (retval) ++ if (retval) { ++ ext4_setent(handle, &old, ++ old.inode->i_ino, old_file_type); + drop_nlink(whiteout); ++ } + unlock_new_inode(whiteout); + iput(whiteout); ++ + } ++ brelse(old.dir_bh); ++ brelse(old.bh); ++ brelse(new.bh); + if (handle) + ext4_journal_stop(handle); + return retval; diff --git a/queue-5.10/ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch b/queue-5.10/ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch new file mode 100644 index 00000000000..ea8f047fd74 --- /dev/null +++ b/queue-5.10/ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch @@ -0,0 +1,36 @@ +From 31e203e09f036f48e7c567c2d32df0196bbd303f Mon Sep 17 00:00:00 2001 +From: Daejun Park +Date: Wed, 30 Dec 2020 18:48:51 +0900 +Subject: ext4: fix wrong list_splice in ext4_fc_cleanup + +From: Daejun Park + +commit 31e203e09f036f48e7c567c2d32df0196bbd303f upstream. + +After full/fast commit, entries in staging queue are promoted to main +queue. In ext4_fs_cleanup function, it splice to staging queue to +staging queue. + +Fixes: aa75f4d3daaeb ("ext4: main fast-commit commit path") +Signed-off-by: Daejun Park +Reviewed-by: Harshad Shirwadkar +Link: https://lore.kernel.org/r/20201230094851epcms2p6eeead8cc984379b37b2efd21af90fd1a@epcms2p6 +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/fast_commit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -1207,7 +1207,7 @@ static void ext4_fc_cleanup(journal_t *j + list_splice_init(&sbi->s_fc_dentry_q[FC_Q_STAGING], + &sbi->s_fc_dentry_q[FC_Q_MAIN]); + list_splice_init(&sbi->s_fc_q[FC_Q_STAGING], +- &sbi->s_fc_q[FC_Q_STAGING]); ++ &sbi->s_fc_q[FC_Q_MAIN]); + + ext4_clear_mount_flag(sb, EXT4_MF_FC_COMMITTING); + ext4_clear_mount_flag(sb, EXT4_MF_FC_INELIGIBLE); diff --git a/queue-5.10/ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch b/queue-5.10/ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch new file mode 100644 index 00000000000..42c643e9fdd --- /dev/null +++ b/queue-5.10/ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch @@ -0,0 +1,131 @@ +From 23dd561ad9eae02b4d51bb502fe4e1a0666e9567 Mon Sep 17 00:00:00 2001 +From: Yi Li +Date: Wed, 30 Dec 2020 11:38:27 +0800 +Subject: ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR + +From: Yi Li + +commit 23dd561ad9eae02b4d51bb502fe4e1a0666e9567 upstream. + +1: ext4_iget/ext4_find_extent never returns NULL, use IS_ERR +instead of IS_ERR_OR_NULL to fix this. + +2: ext4_fc_replay_inode should set the inode to NULL when IS_ERR. +and go to call iput properly. + +Fixes: 8016e29f4362 ("ext4: fast commit recovery path") +Signed-off-by: Yi Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20201230033827.3996064-1-yili@winhong.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/fast_commit.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -1269,14 +1269,14 @@ static int ext4_fc_replay_unlink(struct + entry.len = darg.dname_len; + inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL); + +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode %d not found", darg.ino); + return 0; + } + + old_parent = ext4_iget(sb, darg.parent_ino, + EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(old_parent)) { ++ if (IS_ERR(old_parent)) { + jbd_debug(1, "Dir with inode %d not found", darg.parent_ino); + iput(inode); + return 0; +@@ -1361,7 +1361,7 @@ static int ext4_fc_replay_link(struct su + darg.parent_ino, darg.dname_len); + + inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode not found."); + return 0; + } +@@ -1417,10 +1417,11 @@ static int ext4_fc_replay_inode(struct s + trace_ext4_fc_replay(sb, tag, ino, 0, 0); + + inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL); +- if (!IS_ERR_OR_NULL(inode)) { ++ if (!IS_ERR(inode)) { + ext4_ext_clear_bb(inode); + iput(inode); + } ++ inode = NULL; + + ext4_fc_record_modified_inode(sb, ino); + +@@ -1463,7 +1464,7 @@ static int ext4_fc_replay_inode(struct s + + /* Given that we just wrote the inode on disk, this SHOULD succeed. */ + inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode not found."); + return -EFSCORRUPTED; + } +@@ -1515,7 +1516,7 @@ static int ext4_fc_replay_create(struct + goto out; + + inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "inode %d not found.", darg.ino); + inode = NULL; + ret = -EINVAL; +@@ -1528,7 +1529,7 @@ static int ext4_fc_replay_create(struct + * dot and dot dot dirents are setup properly. + */ + dir = ext4_iget(sb, darg.parent_ino, EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(dir)) { ++ if (IS_ERR(dir)) { + jbd_debug(1, "Dir %d not found.", darg.ino); + goto out; + } +@@ -1604,7 +1605,7 @@ static int ext4_fc_replay_add_range(stru + + inode = ext4_iget(sb, le32_to_cpu(fc_add_ex->fc_ino), + EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode not found."); + return 0; + } +@@ -1728,7 +1729,7 @@ ext4_fc_replay_del_range(struct super_bl + le32_to_cpu(lrange->fc_ino), cur, remaining); + + inode = ext4_iget(sb, le32_to_cpu(lrange->fc_ino), EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode %d not found", le32_to_cpu(lrange->fc_ino)); + return 0; + } +@@ -1809,7 +1810,7 @@ static void ext4_fc_set_bitmaps_and_coun + for (i = 0; i < state->fc_modified_inodes_used; i++) { + inode = ext4_iget(sb, state->fc_modified_inodes[i], + EXT4_IGET_NORMAL); +- if (IS_ERR_OR_NULL(inode)) { ++ if (IS_ERR(inode)) { + jbd_debug(1, "Inode %d not found.", + state->fc_modified_inodes[i]); + continue; +@@ -1826,7 +1827,7 @@ static void ext4_fc_set_bitmaps_and_coun + + if (ret > 0) { + path = ext4_find_extent(inode, map.m_lblk, NULL, 0); +- if (!IS_ERR_OR_NULL(path)) { ++ if (!IS_ERR(path)) { + for (j = 0; j < path->p_depth; j++) + ext4_mb_mark_bb(inode->i_sb, + path[j].p_block, 1, 1); diff --git a/queue-5.10/mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch b/queue-5.10/mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch new file mode 100644 index 00000000000..1db2686d701 --- /dev/null +++ b/queue-5.10/mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch @@ -0,0 +1,51 @@ +From 4d4f9c1a17a3480f8fe523673f7232b254d724b7 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Wed, 16 Dec 2020 23:39:56 +0000 +Subject: MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Cercueil + +commit 4d4f9c1a17a3480f8fe523673f7232b254d724b7 upstream. + +The compressed payload is not necesarily 4-byte aligned, at least when +compiling with Clang. In that case, the 4-byte value appended to the +compressed payload that corresponds to the uncompressed kernel image +size must be read using get_unaligned_le32(). + +This fixes Clang-built kernels not booting on MIPS (tested on a Ingenic +JZ4770 board). + +Fixes: b8f54f2cde78 ("MIPS: ZBOOT: copy appended dtb to the end of the kernel") +Cc: # v4.7 +Signed-off-by: Paul Cercueil +Reviewed-by: Nick Desaulniers +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/boot/compressed/decompress.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -13,6 +13,7 @@ + #include + + #include ++#include + + /* + * These two variables specify the free mem region +@@ -117,7 +118,7 @@ void decompress_kernel(unsigned long boo + dtb_size = fdt_totalsize((void *)&__appended_dtb); + + /* last four bytes is always image size in little endian */ +- image_size = le32_to_cpup((void *)&__image_end - 4); ++ image_size = get_unaligned_le32((void *)&__image_end - 4); + + /* copy dtb to where the booted kernel will expect it */ + memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size, diff --git a/queue-5.10/mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch b/queue-5.10/mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch new file mode 100644 index 00000000000..5ce391a331f --- /dev/null +++ b/queue-5.10/mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch @@ -0,0 +1,61 @@ +From 698222457465ce343443be81c5512edda86e5914 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Thu, 24 Dec 2020 19:44:38 +0000 +Subject: MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps + +From: Al Viro + +commit 698222457465ce343443be81c5512edda86e5914 upstream. + +Patches that introduced NT_FILE and NT_SIGINFO notes back in 2012 +had taken care of native (fs/binfmt_elf.c) and compat (fs/compat_binfmt_elf.c) +coredumps; unfortunately, compat on mips (which does not go through the +usual compat_binfmt_elf.c) had not been noticed. + +As the result, both N32 and O32 coredumps on 64bit mips kernels +have those sections malformed enough to confuse the living hell out of +all gdb and readelf versions (up to and including the tip of binutils-gdb.git). + +Longer term solution is to make both O32 and N32 compat use the +regular compat_binfmt_elf.c, but that's too much for backports. The minimal +solution is to do in arch/mips/kernel/binfmt_elf[on]32.c the same thing +those patches have done in fs/compat_binfmt_elf.c + +Cc: stable@kernel.org # v3.7+ +Signed-off-by: Al Viro +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/binfmt_elfn32.c | 7 +++++++ + arch/mips/kernel/binfmt_elfo32.c | 7 +++++++ + 2 files changed, 14 insertions(+) + +--- a/arch/mips/kernel/binfmt_elfn32.c ++++ b/arch/mips/kernel/binfmt_elfn32.c +@@ -103,4 +103,11 @@ jiffies_to_old_timeval32(unsigned long j + #undef ns_to_kernel_old_timeval + #define ns_to_kernel_old_timeval ns_to_old_timeval32 + ++/* ++ * Some data types as stored in coredump. ++ */ ++#define user_long_t compat_long_t ++#define user_siginfo_t compat_siginfo_t ++#define copy_siginfo_to_external copy_siginfo_to_external32 ++ + #include "../../../fs/binfmt_elf.c" +--- a/arch/mips/kernel/binfmt_elfo32.c ++++ b/arch/mips/kernel/binfmt_elfo32.c +@@ -106,4 +106,11 @@ jiffies_to_old_timeval32(unsigned long j + #undef ns_to_kernel_old_timeval + #define ns_to_kernel_old_timeval ns_to_old_timeval32 + ++/* ++ * Some data types as stored in coredump. ++ */ ++#define user_long_t compat_long_t ++#define user_siginfo_t compat_siginfo_t ++#define copy_siginfo_to_external copy_siginfo_to_external32 ++ + #include "../../../fs/binfmt_elf.c" diff --git a/queue-5.10/mips-fix-section-mismatch-in-reference.patch b/queue-5.10/mips-fix-section-mismatch-in-reference.patch new file mode 100644 index 00000000000..2e7cb8e0053 --- /dev/null +++ b/queue-5.10/mips-fix-section-mismatch-in-reference.patch @@ -0,0 +1,61 @@ +From ad4fddef5f2345aa9214e979febe2f47639c10d9 Mon Sep 17 00:00:00 2001 +From: Anders Roxell +Date: Fri, 27 Nov 2020 09:39:43 +0100 +Subject: mips: fix Section mismatch in reference + +From: Anders Roxell + +commit ad4fddef5f2345aa9214e979febe2f47639c10d9 upstream. + +When building mips tinyconfig with clang the following error show up: + +WARNING: modpost: vmlinux.o(.text+0x1940c): Section mismatch in reference from the function r4k_cache_init() to the function .init.text:loongson3_sc_init() +The function r4k_cache_init() references +the function __init loongson3_sc_init(). +This is often because r4k_cache_init lacks a __init +annotation or the annotation of loongson3_sc_init is wrong. + +Remove marked __init from function loongson3_sc_init(), +mips_sc_probe_cm3(), and mips_sc_probe(). + +Signed-off-by: Anders Roxell +Reviewed-by: Nick Desaulniers +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/c-r4k.c | 2 +- + arch/mips/mm/sc-mips.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -1609,7 +1609,7 @@ static void __init loongson2_sc_init(voi + c->options |= MIPS_CPU_INCLUSIVE_CACHES; + } + +-static void __init loongson3_sc_init(void) ++static void loongson3_sc_init(void) + { + struct cpuinfo_mips *c = ¤t_cpu_data; + unsigned int config2, lsize; +--- a/arch/mips/mm/sc-mips.c ++++ b/arch/mips/mm/sc-mips.c +@@ -146,7 +146,7 @@ static inline int mips_sc_is_activated(s + return 1; + } + +-static int __init mips_sc_probe_cm3(void) ++static int mips_sc_probe_cm3(void) + { + struct cpuinfo_mips *c = ¤t_cpu_data; + unsigned long cfg = read_gcr_l2_config(); +@@ -180,7 +180,7 @@ static int __init mips_sc_probe_cm3(void + return 0; + } + +-static inline int __init mips_sc_probe(void) ++static inline int mips_sc_probe(void) + { + struct cpuinfo_mips *c = ¤t_cpu_data; + unsigned int config1, config2; diff --git a/queue-5.10/mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch b/queue-5.10/mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch new file mode 100644 index 00000000000..63fe231ec47 --- /dev/null +++ b/queue-5.10/mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch @@ -0,0 +1,61 @@ +From 5b058973d3205578aa6c9a71392e072a11ca44ef Mon Sep 17 00:00:00 2001 +From: Anders Roxell +Date: Fri, 11 Dec 2020 11:24:37 +0100 +Subject: mips: lib: uncached: fix non-standard usage of variable 'sp' + +From: Anders Roxell + +commit 5b058973d3205578aa6c9a71392e072a11ca44ef upstream. + +When building mips tinyconfig with clang the following warning show up: + +arch/mips/lib/uncached.c:45:6: warning: variable 'sp' is uninitialized when used here [-Wuninitialized] + if (sp >= (long)CKSEG0 && sp < (long)CKSEG2) + ^~ +arch/mips/lib/uncached.c:40:18: note: initialize the variable 'sp' to silence this warning + register long sp __asm__("$sp"); + ^ + = 0 +1 warning generated. + +Rework to make an explicit inline move, instead of the non-standard use +of specifying registers for local variables. This is what's written +from the gcc-10 manual [1] about specifying registers for local +variables: + +"6.47.5.2 Specifying Registers for Local Variables +................................................. +[...] + +"The only supported use for this feature is to specify registers for +input and output operands when calling Extended 'asm' (*note Extended +Asm::). [...]". + +[1] https://docs.w3cub.com/gcc~10/local-register-variables +Signed-off-by: Anders Roxell +Reported-by: Nathan Chancellor +Reported-by: Naresh Kamboju +Reviewed-by: Nick Desaulniers +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/lib/uncached.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/mips/lib/uncached.c ++++ b/arch/mips/lib/uncached.c +@@ -37,10 +37,12 @@ + */ + unsigned long run_uncached(void *func) + { +- register long sp __asm__("$sp"); + register long ret __asm__("$2"); + long lfunc = (long)func, ufunc; + long usp; ++ long sp; ++ ++ __asm__("move %0, $sp" : "=r" (sp)); + + if (sp >= (long)CKSEG0 && sp < (long)CKSEG2) + usp = CKSEG1ADDR(sp); diff --git a/queue-5.10/mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch b/queue-5.10/mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch new file mode 100644 index 00000000000..777fd400ee6 --- /dev/null +++ b/queue-5.10/mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch @@ -0,0 +1,51 @@ +From 69e976831cd53f9ba304fd20305b2025ecc78eab Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin +Date: Sun, 10 Jan 2021 14:21:05 +0000 +Subject: MIPS: relocatable: fix possible boot hangup with KASLR enabled + +From: Alexander Lobakin + +commit 69e976831cd53f9ba304fd20305b2025ecc78eab upstream. + +LLVM-built Linux triggered a boot hangup with KASLR enabled. + +arch/mips/kernel/relocate.c:get_random_boot() uses linux_banner, +which is a string constant, as a random seed, but accesses it +as an array of unsigned long (in rotate_xor()). +When the address of linux_banner is not aligned to sizeof(long), +such access emits unaligned access exception and hangs the kernel. + +Use PTR_ALIGN() to align input address to sizeof(long) and also +align down the input length to prevent possible access-beyond-end. + +Fixes: 405bc8fd12f5 ("MIPS: Kernel: Implement KASLR using CONFIG_RELOCATABLE") +Cc: stable@vger.kernel.org # 4.7+ +Signed-off-by: Alexander Lobakin +Tested-by: Nathan Chancellor +Reviewed-by: Kees Cook +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/relocate.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/relocate.c ++++ b/arch/mips/kernel/relocate.c +@@ -187,8 +187,14 @@ static int __init relocate_exception_tab + static inline __init unsigned long rotate_xor(unsigned long hash, + const void *area, size_t size) + { +- size_t i; +- unsigned long *ptr = (unsigned long *)area; ++ const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash)); ++ size_t diff, i; ++ ++ diff = (void *)ptr - area; ++ if (unlikely(size < diff + sizeof(hash))) ++ return hash; ++ ++ size = ALIGN_DOWN(size - diff, sizeof(hash)); + + for (i = 0; i < size / sizeof(hash); i++) { + /* Rotate by odd number of bits and XOR. */ diff --git a/queue-5.10/mm-hugetlb-fix-potential-missing-huge-page-size-info.patch b/queue-5.10/mm-hugetlb-fix-potential-missing-huge-page-size-info.patch new file mode 100644 index 00000000000..77966a78033 --- /dev/null +++ b/queue-5.10/mm-hugetlb-fix-potential-missing-huge-page-size-info.patch @@ -0,0 +1,36 @@ +From 0eb98f1588c2cc7a79816d84ab18a55d254f481c Mon Sep 17 00:00:00 2001 +From: Miaohe Lin +Date: Tue, 12 Jan 2021 15:49:24 -0800 +Subject: mm/hugetlb: fix potential missing huge page size info + +From: Miaohe Lin + +commit 0eb98f1588c2cc7a79816d84ab18a55d254f481c upstream. + +The huge page size is encoded for VM_FAULT_HWPOISON errors only. So if +we return VM_FAULT_HWPOISON, huge page size would just be ignored. + +Link: https://lkml.kernel.org/r/20210107123449.38481-1-linmiaohe@huawei.com +Fixes: aa50d3a7aa81 ("Encode huge page size for VM_FAULT_HWPOISON errors") +Signed-off-by: Miaohe Lin +Reviewed-by: Mike Kravetz +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4372,7 +4372,7 @@ retry: + * So we need to block hugepage fault by PG_hwpoison bit check. + */ + if (unlikely(PageHWPoison(page))) { +- ret = VM_FAULT_HWPOISON | ++ ret = VM_FAULT_HWPOISON_LARGE | + VM_FAULT_SET_HINDEX(hstate_index(h)); + goto backout_unlocked; + } diff --git a/queue-5.10/mm-process_vm_access.c-include-compat.h.patch b/queue-5.10/mm-process_vm_access.c-include-compat.h.patch new file mode 100644 index 00000000000..9ba9c69e9b7 --- /dev/null +++ b/queue-5.10/mm-process_vm_access.c-include-compat.h.patch @@ -0,0 +1,38 @@ +From eb351d75ce1e75b4f793d609efac08426ca50acd Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Tue, 12 Jan 2021 15:49:33 -0800 +Subject: mm/process_vm_access.c: include compat.h + +From: Andrew Morton + +commit eb351d75ce1e75b4f793d609efac08426ca50acd upstream. + +Fix the build error: + + mm/process_vm_access.c:277:5: error: implicit declaration of function 'in_compat_syscall'; did you mean 'in_ia32_syscall'? [-Werror=implicit-function-declaration] + +Fixes: 38dc5079da7081e "Fix compat regression in process_vm_rw()" +Reported-by: syzbot+5b0d0de84d6c65b8dd2b@syzkaller.appspotmail.com +Cc: Kyle Huey +Cc: Jens Axboe +Cc: Al Viro +Cc: Christoph Hellwig +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/process_vm_access.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/process_vm_access.c ++++ b/mm/process_vm_access.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-5.10/mm-vmalloc.c-fix-potential-memory-leak.patch b/queue-5.10/mm-vmalloc.c-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..b22538321e2 --- /dev/null +++ b/queue-5.10/mm-vmalloc.c-fix-potential-memory-leak.patch @@ -0,0 +1,41 @@ +From c22ee5284cf58017fa8c6d21d8f8c68159b6faab Mon Sep 17 00:00:00 2001 +From: Miaohe Lin +Date: Tue, 12 Jan 2021 15:49:18 -0800 +Subject: mm/vmalloc.c: fix potential memory leak + +From: Miaohe Lin + +commit c22ee5284cf58017fa8c6d21d8f8c68159b6faab upstream. + +In VM_MAP_PUT_PAGES case, we should put pages and free array in vfree. +But we missed to set area->nr_pages in vmap(). So we would fail to put +pages in __vunmap() because area->nr_pages = 0. + +Link: https://lkml.kernel.org/r/20210107123541.39206-1-linmiaohe@huawei.com +Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap") +Signed-off-by: Shijie Luo +Signed-off-by: Miaohe Lin +Reviewed-by: Uladzislau Rezki (Sony) +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2405,8 +2405,10 @@ void *vmap(struct page **pages, unsigned + return NULL; + } + +- if (flags & VM_MAP_PUT_PAGES) ++ if (flags & VM_MAP_PUT_PAGES) { + area->pages = pages; ++ area->nr_pages = count; ++ } + return area->addr; + } + EXPORT_SYMBOL(vmap); diff --git a/queue-5.10/r8152-add-lenovo-powered-usb-c-travel-hub.patch b/queue-5.10/r8152-add-lenovo-powered-usb-c-travel-hub.patch new file mode 100644 index 00000000000..fc90e48dbf7 --- /dev/null +++ b/queue-5.10/r8152-add-lenovo-powered-usb-c-travel-hub.patch @@ -0,0 +1,55 @@ +From cb82a54904a99df9e8f9e9d282046055dae5a730 Mon Sep 17 00:00:00 2001 +From: Leon Schuermann +Date: Mon, 11 Jan 2021 20:03:13 +0100 +Subject: r8152: Add Lenovo Powered USB-C Travel Hub + +From: Leon Schuermann + +commit cb82a54904a99df9e8f9e9d282046055dae5a730 upstream. + +This USB-C Hub (17ef:721e) based on the Realtek RTL8153B chip used to +use the cdc_ether driver. However, using this driver, with the system +suspended the device constantly sends pause-frames as soon as the +receive buffer fills up. This causes issues with other devices, where +some Ethernet switches stop forwarding packets altogether. + +Using the Realtek driver (r8152) fixes this issue. Pause frames are no +longer sent while the host system is suspended. + +Signed-off-by: Leon Schuermann +Tested-by: Leon Schuermann +Link: https://lore.kernel.org/r/20210111190312.12589-2-leon@is.currently.online +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ether.c | 7 +++++++ + drivers/net/usb/r8152.c | 1 + + 2 files changed, 8 insertions(+) + +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -793,6 +793,13 @@ static const struct usb_device_id produc + .driver_info = 0, + }, + ++/* Lenovo Powered USB-C Travel Hub (4X90S92381, based on Realtek RTL8153) */ ++{ ++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x721e, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), ++ .driver_info = 0, ++}, ++ + /* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */ + { + USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM, +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -6893,6 +6893,7 @@ static const struct usb_device_id rtl815 + {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205)}, + {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x720c)}, + {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7214)}, ++ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x721e)}, + {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0xa387)}, + {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)}, + {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff)}, diff --git a/queue-5.10/rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch b/queue-5.10/rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch new file mode 100644 index 00000000000..5e0266679f8 --- /dev/null +++ b/queue-5.10/rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch @@ -0,0 +1,41 @@ +From f2bc3af6353cb2a33dfa9d270d999d839eef54cb Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Tue, 29 Dec 2020 18:46:53 -0800 +Subject: RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() + +From: Tom Rix + +commit f2bc3af6353cb2a33dfa9d270d999d839eef54cb upstream. + +In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable +pd and then after uctx->cntxt_pd is freed, the variable pd is passed to +function _ocrdma_dealloc_pd() which dereferences pd directly or through +its call to ocrdma_mbx_dealloc_pd(). + +Reorder the free using the variable pd. + +Cc: stable@vger.kernel.org +Fixes: 21a428a019c9 ("RDMA: Handle PD allocations by IB/core") +Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com +Signed-off-by: Tom Rix +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +@@ -434,9 +434,9 @@ static void ocrdma_dealloc_ucontext_pd(s + pr_err("%s(%d) Freeing in use pdid=0x%x.\n", + __func__, dev->id, pd->id); + } +- kfree(uctx->cntxt_pd); + uctx->cntxt_pd = NULL; + _ocrdma_dealloc_pd(dev, pd); ++ kfree(pd); + } + + static struct ocrdma_pd *ocrdma_get_ucontext_pd(struct ocrdma_ucontext *uctx) diff --git a/queue-5.10/revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch b/queue-5.10/revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch new file mode 100644 index 00000000000..3c59d63bde5 --- /dev/null +++ b/queue-5.10/revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch @@ -0,0 +1,57 @@ +From 4eec66c014e9a406d8d453de958f6791d05427e4 Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Mon, 11 Jan 2021 11:31:51 -0500 +Subject: Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel" + +From: Rodrigo Siqueira + +commit 4eec66c014e9a406d8d453de958f6791d05427e4 upstream. + +commit a861736dae64 ("drm/amd/display: Fixed Intermittent blue screen on OLED panel") + +causes power regression for many users. It seems that this change causes +the MCLK to get forced high; this creates a regression for many users +since their devices were not able to drop to a low state after this +change. For this reason, this reverts commit +a861736dae644a0d7abbca0c638ae6aad28feeb8. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1407 +Cc: Aurabindo Pillai +Cc: Alex Deucher +Cc: Harry Wentland +Cc: Naveed Ashfaq +Cc: Hersen Wu +Cc: Roman Li +Acked-by: Alex Deucher +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 11 +++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +@@ -2635,14 +2635,15 @@ static void dml20v2_DISPCLKDPPCLKDCFCLKD + } + + if (mode_lib->vba.DRAMClockChangeSupportsVActive && +- mode_lib->vba.MinActiveDRAMClockChangeMargin > 60 && +- mode_lib->vba.PrefetchMode[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] == 0) { ++ mode_lib->vba.MinActiveDRAMClockChangeMargin > 60) { + mode_lib->vba.DRAMClockChangeWatermark += 25; + + for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) { +- if (mode_lib->vba.DRAMClockChangeWatermark > +- dml_max(mode_lib->vba.StutterEnterPlusExitWatermark, mode_lib->vba.UrgentWatermark)) +- mode_lib->vba.MinTTUVBlank[k] += 25; ++ if (mode_lib->vba.PrefetchMode[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] == 0) { ++ if (mode_lib->vba.DRAMClockChangeWatermark > ++ dml_max(mode_lib->vba.StutterEnterPlusExitWatermark, mode_lib->vba.UrgentWatermark)) ++ mode_lib->vba.MinTTUVBlank[k] += 25; ++ } + } + + mode_lib->vba.DRAMClockChangeSupport[0][0] = dm_dram_clock_change_vactive; diff --git a/queue-5.10/riscv-drop-a-duplicated-page_kernel_exec.patch b/queue-5.10/riscv-drop-a-duplicated-page_kernel_exec.patch new file mode 100644 index 00000000000..ad636f7b2a9 --- /dev/null +++ b/queue-5.10/riscv-drop-a-duplicated-page_kernel_exec.patch @@ -0,0 +1,34 @@ +From 0ea02c73775277001c651ad4a0e83781a9acf406 Mon Sep 17 00:00:00 2001 +From: Kefeng Wang +Date: Wed, 11 Nov 2020 19:52:16 +0800 +Subject: riscv: Drop a duplicated PAGE_KERNEL_EXEC + +From: Kefeng Wang + +commit 0ea02c73775277001c651ad4a0e83781a9acf406 upstream. + +commit b91540d52a08 ("RISC-V: Add EFI runtime services") add +a duplicated PAGE_KERNEL_EXEC, kill it. + +Signed-off-by: Kefeng Wang +Reviewed-by: Pekka Enberg +Reviewed-by: Atish Patra +Fixes: b91540d52a08 ("RISC-V: Add EFI runtime services") +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/include/asm/pgtable.h | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -99,7 +99,6 @@ + | _PAGE_DIRTY) + + #define PAGE_KERNEL __pgprot(_PAGE_KERNEL) +-#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC) + #define PAGE_KERNEL_READ __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE) + #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC) + #define PAGE_KERNEL_READ_EXEC __pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \ diff --git a/queue-5.10/riscv-fix-kasan-memory-mapping.patch b/queue-5.10/riscv-fix-kasan-memory-mapping.patch new file mode 100644 index 00000000000..7ff82a5ab62 --- /dev/null +++ b/queue-5.10/riscv-fix-kasan-memory-mapping.patch @@ -0,0 +1,36 @@ +From c25a053e15778f6b4d6553708673736e27a6c2cf Mon Sep 17 00:00:00 2001 +From: Nick Hu +Date: Wed, 13 Jan 2021 10:24:10 +0800 +Subject: riscv: Fix KASAN memory mapping. + +From: Nick Hu + +commit c25a053e15778f6b4d6553708673736e27a6c2cf upstream. + +Use virtual address instead of physical address when translating +the address to shadow memory by kasan_mem_to_shadow(). + +Signed-off-by: Nick Hu +Signed-off-by: Nylon Chen +Fixes: b10d6bca8720 ("arch, drivers: replace for_each_membock() with for_each_mem_range()") +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/mm/kasan_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/riscv/mm/kasan_init.c ++++ b/arch/riscv/mm/kasan_init.c +@@ -93,8 +93,8 @@ void __init kasan_init(void) + VMALLOC_END)); + + for_each_mem_range(i, &_start, &_end) { +- void *start = (void *)_start; +- void *end = (void *)_end; ++ void *start = (void *)__va(_start); ++ void *end = (void *)__va(_end); + + if (start >= end) + break; diff --git a/queue-5.10/riscv-fixup-config_generic_time_vsyscall.patch b/queue-5.10/riscv-fixup-config_generic_time_vsyscall.patch new file mode 100644 index 00000000000..3e869c75907 --- /dev/null +++ b/queue-5.10/riscv-fixup-config_generic_time_vsyscall.patch @@ -0,0 +1,49 @@ +From 0aa2ec8a475fb505fd98d93bbcf4e03beeeebcb6 Mon Sep 17 00:00:00 2001 +From: Guo Ren +Date: Sat, 2 Jan 2021 13:24:34 +0000 +Subject: riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL + +From: Guo Ren + +commit 0aa2ec8a475fb505fd98d93bbcf4e03beeeebcb6 upstream. + +The patch fix commit: ad5d112 ("riscv: use vDSO common flow to +reduce the latency of the time-related functions"). + +The GENERIC_TIME_VSYSCALL should be CONFIG_GENERIC_TIME_VSYSCALL +or vgettimeofday won't work. + +Signed-off-by: Guo Ren +Reviewed-by: Pekka Enberg +Fixes: ad5d1122b82f ("riscv: use vDSO common flow to reduce the latency of the time-related functions") +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/include/asm/vdso.h | 2 +- + arch/riscv/kernel/vdso.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/riscv/include/asm/vdso.h ++++ b/arch/riscv/include/asm/vdso.h +@@ -10,7 +10,7 @@ + + #include + +-#ifndef GENERIC_TIME_VSYSCALL ++#ifndef CONFIG_GENERIC_TIME_VSYSCALL + struct vdso_data { + }; + #endif +--- a/arch/riscv/kernel/vdso.c ++++ b/arch/riscv/kernel/vdso.c +@@ -12,7 +12,7 @@ + #include + #include + #include +-#ifdef GENERIC_TIME_VSYSCALL ++#ifdef CONFIG_GENERIC_TIME_VSYSCALL + #include + #else + #include diff --git a/queue-5.10/riscv-return-enosys-for-syscall-1.patch b/queue-5.10/riscv-return-enosys-for-syscall-1.patch new file mode 100644 index 00000000000..1dc8557d8fb --- /dev/null +++ b/queue-5.10/riscv-return-enosys-for-syscall-1.patch @@ -0,0 +1,41 @@ +From cf7b2ae4d70432fa94ebba3fbaab825481ae7189 Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Mon, 21 Dec 2020 23:52:00 +0100 +Subject: riscv: return -ENOSYS for syscall -1 + +From: Andreas Schwab + +commit cf7b2ae4d70432fa94ebba3fbaab825481ae7189 upstream. + +Properly return -ENOSYS for syscall -1 instead of leaving the return value +uninitialized. This fixes the strace teststuite. + +Fixes: 5340627e3fe0 ("riscv: add support for SECCOMP and SECCOMP_FILTER") +Cc: stable@vger.kernel.org +Signed-off-by: Andreas Schwab +Reviewed-by: Tycho Andersen +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/kernel/entry.S | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/arch/riscv/kernel/entry.S ++++ b/arch/riscv/kernel/entry.S +@@ -186,14 +186,7 @@ check_syscall_nr: + * Syscall number held in a7. + * If syscall number is above allowed value, redirect to ni_syscall. + */ +- bge a7, t0, 1f +- /* +- * Check if syscall is rejected by tracer, i.e., a7 == -1. +- * If yes, we pretend it was executed. +- */ +- li t1, -1 +- beq a7, t1, ret_from_syscall_rejected +- blt a7, t1, 1f ++ bgeu a7, t0, 1f + /* Call syscall */ + la s0, sys_call_table + slli t0, a7, RISCV_LGPTR diff --git a/queue-5.10/series b/queue-5.10/series index 8d516b0eb12..0b35ef7ba0e 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,2 +1,50 @@ btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch +alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch +alsa-doc-fix-reference-to-mixart.rst.patch +asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch +asoc-dapm-remove-widget-from-dirty-list-on-free.patch +x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch +drm-amdgpu-add-green_sardine-device-id-v2.patch +drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch +revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch +drm-amdgpu-add-new-device-id-for-renior.patch +drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch +drm-i915-gt-limit-vfe-threads-based-on-gt.patch +drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch +drm-bridge-sii902x-refactor-init-code-into-separate-function.patch +dt-bindings-display-sii902x-add-supply-bindings.patch +drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch +tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch +tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch +ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch +ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch +ext4-fix-bug-for-rename-with-rename_whiteout.patch +cifs-check-pointer-before-freeing.patch +cifs-fix-interrupted-close-commands.patch +riscv-drop-a-duplicated-page_kernel_exec.patch +riscv-return-enosys-for-syscall-1.patch +riscv-fixup-config_generic_time_vsyscall.patch +riscv-fix-kasan-memory-mapping.patch +mips-fix-section-mismatch-in-reference.patch +mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch +mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch +mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch +mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch +rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch +acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch +xen-privcmd-allow-fetching-resource-sizes.patch +compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch +mm-vmalloc.c-fix-potential-memory-leak.patch +mm-hugetlb-fix-potential-missing-huge-page-size-info.patch +mm-process_vm_access.c-include-compat.h.patch +dm-raid-fix-discard-limits-for-raid1.patch +dm-snapshot-flush-merged-data-before-committing-metadata.patch +dm-integrity-fix-flush-with-external-metadata-device.patch +dm-integrity-fix-the-maximum-number-of-arguments.patch +dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch +dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch +dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch +dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch +stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch +r8152-add-lenovo-powered-usb-c-travel-hub.patch diff --git a/queue-5.10/stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch b/queue-5.10/stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch new file mode 100644 index 00000000000..04bb114e8eb --- /dev/null +++ b/queue-5.10/stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch @@ -0,0 +1,72 @@ +From bff6f1db91e330d7fba56f815cdbc412c75fe163 Mon Sep 17 00:00:00 2001 +From: Voon Weifeng +Date: Fri, 6 Nov 2020 17:43:41 +0800 +Subject: stmmac: intel: change all EHL/TGL to auto detect phy addr + +From: Voon Weifeng + +commit bff6f1db91e330d7fba56f815cdbc412c75fe163 upstream. + +Set all EHL/TGL phy_addr to -1 so that the driver will automatically +detect it at run-time by probing all the possible 32 addresses. + +Signed-off-by: Voon Weifeng +Signed-off-by: Wong Vee Khee +Link: https://lore.kernel.org/r/20201106094341.4241-1-vee.khee.wong@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +@@ -236,6 +236,7 @@ static int intel_mgbe_common_data(struct + int ret; + int i; + ++ plat->phy_addr = -1; + plat->clk_csr = 5; + plat->has_gmac = 0; + plat->has_gmac4 = 1; +@@ -345,7 +346,6 @@ static int ehl_sgmii_data(struct pci_dev + struct plat_stmmacenet_data *plat) + { + plat->bus_id = 1; +- plat->phy_addr = 0; + plat->phy_interface = PHY_INTERFACE_MODE_SGMII; + + plat->serdes_powerup = intel_serdes_powerup; +@@ -362,7 +362,6 @@ static int ehl_rgmii_data(struct pci_dev + struct plat_stmmacenet_data *plat) + { + plat->bus_id = 1; +- plat->phy_addr = 0; + plat->phy_interface = PHY_INTERFACE_MODE_RGMII; + + return ehl_common_data(pdev, plat); +@@ -376,7 +375,6 @@ static int ehl_pse0_common_data(struct p + struct plat_stmmacenet_data *plat) + { + plat->bus_id = 2; +- plat->phy_addr = 1; + return ehl_common_data(pdev, plat); + } + +@@ -408,7 +406,6 @@ static int ehl_pse1_common_data(struct p + struct plat_stmmacenet_data *plat) + { + plat->bus_id = 3; +- plat->phy_addr = 1; + return ehl_common_data(pdev, plat); + } + +@@ -450,7 +447,6 @@ static int tgl_sgmii_data(struct pci_dev + struct plat_stmmacenet_data *plat) + { + plat->bus_id = 1; +- plat->phy_addr = 0; + plat->phy_interface = PHY_INTERFACE_MODE_SGMII; + plat->serdes_powerup = intel_serdes_powerup; + plat->serdes_powerdown = intel_serdes_powerdown; diff --git a/queue-5.10/tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch b/queue-5.10/tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch new file mode 100644 index 00000000000..de7782d2355 --- /dev/null +++ b/queue-5.10/tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch @@ -0,0 +1,52 @@ +From 55ed4560774d81d7343223b8fd2784c530a9c6c1 Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Wed, 9 Dec 2020 14:27:44 +0900 +Subject: tools/bootconfig: Add tracing_on support to helper scripts + +From: Masami Hiramatsu + +commit 55ed4560774d81d7343223b8fd2784c530a9c6c1 upstream. + +Add ftrace.instance.INSTANCE.tracing_on support to ftrace2bconf.sh +and bconf2ftrace.sh. + +commit 8490db06f914 ("tracing/boot: Add per-instance tracing_on +option support") added the per-instance tracing_on option, +but forgot to update the helper scripts. + +Link: https://lkml.kernel.org/r/160749166410.3497930.14204335886811029800.stgit@devnote2 + +Cc: stable@vger.kernel.org +Fixes: 8490db06f914 ("tracing/boot: Add per-instance tracing_on option support") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + tools/bootconfig/scripts/bconf2ftrace.sh | 1 + + tools/bootconfig/scripts/ftrace2bconf.sh | 4 ++++ + 2 files changed, 5 insertions(+) + +--- a/tools/bootconfig/scripts/bconf2ftrace.sh ++++ b/tools/bootconfig/scripts/bconf2ftrace.sh +@@ -152,6 +152,7 @@ setup_instance() { # [instance] + set_array_of ${instance}.options ${instancedir}/trace_options + set_value_of ${instance}.trace_clock ${instancedir}/trace_clock + set_value_of ${instance}.cpumask ${instancedir}/tracing_cpumask ++ set_value_of ${instance}.tracing_on ${instancedir}/tracing_on + set_value_of ${instance}.tracer ${instancedir}/current_tracer + set_array_of ${instance}.ftrace.filters \ + ${instancedir}/set_ftrace_filter +--- a/tools/bootconfig/scripts/ftrace2bconf.sh ++++ b/tools/bootconfig/scripts/ftrace2bconf.sh +@@ -221,6 +221,10 @@ instance_options() { # [instance-name] + if [ `echo $val | sed -e s/f//g`x != x ]; then + emit_kv $PREFIX.cpumask = $val + fi ++ val=`cat $INSTANCE/tracing_on` ++ if [ `echo $val | sed -e s/f//g`x != x ]; then ++ emit_kv $PREFIX.tracing_on = $val ++ fi + + val= + for i in `cat $INSTANCE/set_event`; do diff --git a/queue-5.10/tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch b/queue-5.10/tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch new file mode 100644 index 00000000000..bfa7dfff17e --- /dev/null +++ b/queue-5.10/tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch @@ -0,0 +1,58 @@ +From 7bb83f6fc4ee84e95d0ac0d14452c2619fb3fe70 Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Fri, 8 Jan 2021 13:19:38 +0900 +Subject: tracing/kprobes: Do the notrace functions check without kprobes on ftrace + +From: Masami Hiramatsu + +commit 7bb83f6fc4ee84e95d0ac0d14452c2619fb3fe70 upstream. + +Enable the notrace function check on the architecture which doesn't +support kprobes on ftrace but support dynamic ftrace. This notrace +function check is not only for the kprobes on ftrace but also +sw-breakpoint based kprobes. +Thus there is no reason to limit this check for the arch which +supports kprobes on ftrace. + +This also changes the dependency of Kconfig. Because kprobe event +uses the function tracer's address list for identifying notrace +function, if the CONFIG_DYNAMIC_FTRACE=n, it can not check whether +the target function is notrace or not. + +Link: https://lkml.kernel.org/r/20210105065730.2634785-1-naveen.n.rao@linux.vnet.ibm.com +Link: https://lkml.kernel.org/r/161007957862.114704.4512260007555399463.stgit@devnote2 + +Cc: stable@vger.kernel.org +Fixes: 45408c4f92506 ("tracing: kprobes: Prohibit probing on notrace function") +Acked-by: Naveen N. Rao +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/Kconfig | 2 +- + kernel/trace/trace_kprobe.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/trace/Kconfig ++++ b/kernel/trace/Kconfig +@@ -531,7 +531,7 @@ config KPROBE_EVENTS + config KPROBE_EVENTS_ON_NOTRACE + bool "Do NOT protect notrace function from kprobe events" + depends on KPROBE_EVENTS +- depends on KPROBES_ON_FTRACE ++ depends on DYNAMIC_FTRACE + default n + help + This is only for the developers who want to debug ftrace itself +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -434,7 +434,7 @@ static int disable_trace_kprobe(struct t + return 0; + } + +-#if defined(CONFIG_KPROBES_ON_FTRACE) && \ ++#if defined(CONFIG_DYNAMIC_FTRACE) && \ + !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE) + static bool __within_notrace_func(unsigned long addr) + { diff --git a/queue-5.10/x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch b/queue-5.10/x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch new file mode 100644 index 00000000000..d06f39f3bf3 --- /dev/null +++ b/queue-5.10/x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch @@ -0,0 +1,51 @@ +From ad0a6bad44758afa3b440c254a24999a0c7e35d5 Mon Sep 17 00:00:00 2001 +From: Wei Liu +Date: Tue, 5 Jan 2021 17:50:43 +0000 +Subject: x86/hyperv: check cpu mask after interrupt has been disabled + +From: Wei Liu + +commit ad0a6bad44758afa3b440c254a24999a0c7e35d5 upstream. + +We've observed crashes due to an empty cpu mask in +hyperv_flush_tlb_others. Obviously the cpu mask in question is changed +between the cpumask_empty call at the beginning of the function and when +it is actually used later. + +One theory is that an interrupt comes in between and a code path ends up +changing the mask. Move the check after interrupt has been disabled to +see if it fixes the issue. + +Signed-off-by: Wei Liu +Cc: stable@kernel.org +Link: https://lore.kernel.org/r/20210105175043.28325-1-wei.liu@kernel.org +Reviewed-by: Michael Kelley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/hyperv/mmu.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/arch/x86/hyperv/mmu.c ++++ b/arch/x86/hyperv/mmu.c +@@ -66,11 +66,17 @@ static void hyperv_flush_tlb_others(cons + if (!hv_hypercall_pg) + goto do_native; + +- if (cpumask_empty(cpus)) +- return; +- + local_irq_save(flags); + ++ /* ++ * Only check the mask _after_ interrupt has been disabled to avoid the ++ * mask changing under our feet. ++ */ ++ if (cpumask_empty(cpus)) { ++ local_irq_restore(flags); ++ return; ++ } ++ + flush_pcpu = (struct hv_tlb_flush **) + this_cpu_ptr(hyperv_pcpu_input_arg); + diff --git a/queue-5.10/xen-privcmd-allow-fetching-resource-sizes.patch b/queue-5.10/xen-privcmd-allow-fetching-resource-sizes.patch new file mode 100644 index 00000000000..596f29026f0 --- /dev/null +++ b/queue-5.10/xen-privcmd-allow-fetching-resource-sizes.patch @@ -0,0 +1,87 @@ +From ef3a575baf53571dc405ee4028e26f50856898e7 Mon Sep 17 00:00:00 2001 +From: Roger Pau Monne +Date: Tue, 12 Jan 2021 12:53:58 +0100 +Subject: xen/privcmd: allow fetching resource sizes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +commit ef3a575baf53571dc405ee4028e26f50856898e7 upstream. + +Allow issuing an IOCTL_PRIVCMD_MMAP_RESOURCE ioctl with num = 0 and +addr = 0 in order to fetch the size of a specific resource. + +Add a shortcut to the default map resource path, since fetching the +size requires no address to be passed in, and thus no VMA to setup. + +This is missing from the initial implementation, and causes issues +when mapping resources that don't have fixed or known sizes. + +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Tested-by: Andrew Cooper +Cc: stable@vger.kernel.org # >= 4.18 +Link: https://lore.kernel.org/r/20210112115358.23346-1-roger.pau@citrix.com +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/privcmd.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +--- a/drivers/xen/privcmd.c ++++ b/drivers/xen/privcmd.c +@@ -717,14 +717,15 @@ static long privcmd_ioctl_restrict(struc + return 0; + } + +-static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata) ++static long privcmd_ioctl_mmap_resource(struct file *file, ++ struct privcmd_mmap_resource __user *udata) + { + struct privcmd_data *data = file->private_data; + struct mm_struct *mm = current->mm; + struct vm_area_struct *vma; + struct privcmd_mmap_resource kdata; + xen_pfn_t *pfns = NULL; +- struct xen_mem_acquire_resource xdata; ++ struct xen_mem_acquire_resource xdata = { }; + int rc; + + if (copy_from_user(&kdata, udata, sizeof(kdata))) +@@ -734,6 +735,22 @@ static long privcmd_ioctl_mmap_resource( + if (data->domid != DOMID_INVALID && data->domid != kdata.dom) + return -EPERM; + ++ /* Both fields must be set or unset */ ++ if (!!kdata.addr != !!kdata.num) ++ return -EINVAL; ++ ++ xdata.domid = kdata.dom; ++ xdata.type = kdata.type; ++ xdata.id = kdata.id; ++ ++ if (!kdata.addr && !kdata.num) { ++ /* Query the size of the resource. */ ++ rc = HYPERVISOR_memory_op(XENMEM_acquire_resource, &xdata); ++ if (rc) ++ return rc; ++ return __put_user(xdata.nr_frames, &udata->num); ++ } ++ + mmap_write_lock(mm); + + vma = find_vma(mm, kdata.addr); +@@ -768,10 +785,6 @@ static long privcmd_ioctl_mmap_resource( + } else + vma->vm_private_data = PRIV_VMA_LOCKED; + +- memset(&xdata, 0, sizeof(xdata)); +- xdata.domid = kdata.dom; +- xdata.type = kdata.type; +- xdata.id = kdata.id; + xdata.frame = kdata.idx; + xdata.nr_frames = kdata.num; + set_xen_guest_handle(xdata.frame_list, pfns); -- 2.47.3