From: Sasha Levin Date: Fri, 2 Sep 2022 04:23:50 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.327~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1de43c1d5dbe61cc2574af80046c134dab65e3f8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/drm-amd-display-avoid-mpc-infinite-loop.patch b/queue-5.10/drm-amd-display-avoid-mpc-infinite-loop.patch new file mode 100644 index 00000000000..0ad821858eb --- /dev/null +++ b/queue-5.10/drm-amd-display-avoid-mpc-infinite-loop.patch @@ -0,0 +1,66 @@ +From ce5b2eaf52553ad9443f3e5017c234bf8edaf2ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 15:33:00 -0400 +Subject: drm/amd/display: Avoid MPC infinite loop + +From: Josip Pavic + +[ Upstream commit 8de297dc046c180651c0500f8611663ae1c3828a ] + +[why] +In some cases MPC tree bottom pipe ends up point to itself. This causes +iterating from top to bottom to hang the system in an infinite loop. + +[how] +When looping to next MPC bottom pipe, check that the pointer is not same +as current to avoid infinite loop. + +Reviewed-by: Josip Pavic +Reviewed-by: Jun Lei +Acked-by: Alex Hung +Signed-off-by: Aric Cyr +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 6 ++++++ + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c +index 3fcd408e91032..855682590c1bb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c +@@ -125,6 +125,12 @@ struct mpcc *mpc1_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id) + while (tmp_mpcc != NULL) { + if (tmp_mpcc->dpp_id == dpp_id) + return tmp_mpcc; ++ ++ /* avoid circular linked list */ ++ ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot); ++ if (tmp_mpcc == tmp_mpcc->mpcc_bot) ++ break; ++ + tmp_mpcc = tmp_mpcc->mpcc_bot; + } + return NULL; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c +index 99cc095dc33c7..a701ea56c0aa0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c +@@ -533,6 +533,12 @@ struct mpcc *mpc2_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id) + while (tmp_mpcc != NULL) { + if (tmp_mpcc->dpp_id == 0xf || tmp_mpcc->dpp_id == dpp_id) + return tmp_mpcc; ++ ++ /* avoid circular linked list */ ++ ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot); ++ if (tmp_mpcc == tmp_mpcc->mpcc_bot) ++ break; ++ + tmp_mpcc = tmp_mpcc->mpcc_bot; + } + return NULL; +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-clear-optc-underflow-before-turn-off.patch b/queue-5.10/drm-amd-display-clear-optc-underflow-before-turn-off.patch new file mode 100644 index 00000000000..c2d4ab2f2b3 --- /dev/null +++ b/queue-5.10/drm-amd-display-clear-optc-underflow-before-turn-off.patch @@ -0,0 +1,45 @@ +From 558a8181abf3e169e7be69019c9cf32d0cae4a9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 12:01:29 +0800 +Subject: drm/amd/display: clear optc underflow before turn off odm clock + +From: Fudong Wang + +[ Upstream commit b2a93490201300a749ad261b5c5d05cb50179c44 ] + +[Why] +After ODM clock off, optc underflow bit will be kept there always and clear not work. +We need to clear that before clock off. + +[How] +Clear that if have when clock off. + +Reviewed-by: Alvin Lee +Acked-by: Tom Chung +Signed-off-by: Fudong Wang +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +index 800be2693faca..963d72f96dca3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +@@ -464,6 +464,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable) + OTG_CLOCK_ON, 1, + 1, 1000); + } else { ++ ++ //last chance to clear underflow, otherwise, it will always there due to clock is off. ++ if (optc->funcs->is_optc_underflow_occurred(optc) == true) ++ optc->funcs->clear_optc_underflow(optc); ++ + REG_UPDATE_2(OTG_CLOCK_CONTROL, + OTG_CLOCK_GATE_DIS, 0, + OTG_CLOCK_EN, 0); +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-fix-pixel-clock-programming.patch b/queue-5.10/drm-amd-display-fix-pixel-clock-programming.patch new file mode 100644 index 00000000000..452900f3d33 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-pixel-clock-programming.patch @@ -0,0 +1,50 @@ +From e6afa6615c2d75def67739dce504cfd012dd70f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 16:19:38 -0400 +Subject: drm/amd/display: Fix pixel clock programming + +From: Ilya Bakoulin + +[ Upstream commit 04fb918bf421b299feaee1006e82921d7d381f18 ] + +[Why] +Some pixel clock values could cause HDMI TMDS SSCPs to be misaligned +between different HDMI lanes when using YCbCr420 10-bit pixel format. + +BIOS functions for transmitter/encoder control take pixel clock in kHz +increments, whereas the function for setting the pixel clock is in 100Hz +increments. Setting pixel clock to a value that is not on a kHz boundary +will cause the issue. + +[How] +Round pixel clock down to nearest kHz in 10/12-bpc cases. + +Reviewed-by: Aric Cyr +Acked-by: Brian Chang +Signed-off-by: Ilya Bakoulin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +index bae3a146b2cc2..89cc852cb27c5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +@@ -546,9 +546,11 @@ static void dce112_get_pix_clk_dividers_helper ( + switch (pix_clk_params->color_depth) { + case COLOR_DEPTH_101010: + actual_pixel_clock_100hz = (actual_pixel_clock_100hz * 5) >> 2; ++ actual_pixel_clock_100hz -= actual_pixel_clock_100hz % 10; + break; + case COLOR_DEPTH_121212: + actual_pixel_clock_100hz = (actual_pixel_clock_100hz * 6) >> 2; ++ actual_pixel_clock_100hz -= actual_pixel_clock_100hz % 10; + break; + case COLOR_DEPTH_161616: + actual_pixel_clock_100hz = actual_pixel_clock_100hz * 2; +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-for-stereo-keep-flip_any_frame.patch b/queue-5.10/drm-amd-display-for-stereo-keep-flip_any_frame.patch new file mode 100644 index 00000000000..c2f731aa137 --- /dev/null +++ b/queue-5.10/drm-amd-display-for-stereo-keep-flip_any_frame.patch @@ -0,0 +1,40 @@ +From 9921ab8d731a95d7479b8304f759a7e0bf327e42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 09:51:05 -0400 +Subject: drm/amd/display: For stereo keep "FLIP_ANY_FRAME" + +From: Alvin Lee + +[ Upstream commit 84ef99c728079dfd21d6bc70b4c3e4af20602b3c ] + +[Description] +Observed in stereomode that programming FLIP_LEFT_EYE +can cause hangs. Keep FLIP_ANY_FRAME in stereo mode so +the surface flip can take place before left or right eye + +Reviewed-by: Martin Leung +Acked-by: Tom Chung +Signed-off-by: Alvin Lee +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +index af462fe4260de..b0fd8859bd2f2 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c +@@ -86,7 +86,7 @@ bool hubp3_program_surface_flip_and_addr( + VMID, address->vmid); + + if (address->type == PLN_ADDR_TYPE_GRPH_STEREO) { +- REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_MODE_FOR_STEREOSYNC, 0x1); ++ REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_MODE_FOR_STEREOSYNC, 0); + REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_IN_STEREOSYNC, 0x1); + + } else { +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-pm-add-missing-fini_microcode-interface-for-.patch b/queue-5.10/drm-amd-pm-add-missing-fini_microcode-interface-for-.patch new file mode 100644 index 00000000000..3f3bbafc7e4 --- /dev/null +++ b/queue-5.10/drm-amd-pm-add-missing-fini_microcode-interface-for-.patch @@ -0,0 +1,34 @@ +From 917a2a73dbe2600c1c4d1299a245a6455da155a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Aug 2022 11:08:31 +0800 +Subject: drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid + +From: Evan Quan + +[ Upstream commit 0a2d922a5618377cdf8fa476351362733ef55342 ] + +To avoid any potential memory leak. + +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +index 8556c229ff598..49d7fa1d08427 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -2759,6 +2759,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = { + .dump_pptable = sienna_cichlid_dump_pptable, + .init_microcode = smu_v11_0_init_microcode, + .load_microcode = smu_v11_0_load_microcode, ++ .fini_microcode = smu_v11_0_fini_microcode, + .init_smc_tables = sienna_cichlid_init_smc_tables, + .fini_smc_tables = smu_v11_0_fini_smc_tables, + .init_power = smu_v11_0_init_power, +-- +2.35.1 + diff --git a/queue-5.10/drm-amdgpu-increase-tlb-flush-timeout-for-sriov.patch b/queue-5.10/drm-amdgpu-increase-tlb-flush-timeout-for-sriov.patch new file mode 100644 index 00000000000..dc4566a8c18 --- /dev/null +++ b/queue-5.10/drm-amdgpu-increase-tlb-flush-timeout-for-sriov.patch @@ -0,0 +1,87 @@ +From e5a932bef886ce191a39e16f61b37c2786d1249c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Aug 2022 09:43:15 +0200 +Subject: drm/amdgpu: Increase tlb flush timeout for sriov + +From: Dusica Milinkovic + +[ Upstream commit 373008bfc9cdb0f050258947fa5a095f0657e1bc ] + +[Why] +During multi-vf executing benchmark (Luxmark) observed kiq error timeout. +It happenes because all of VFs do the tlb invalidation at the same time. +Although each VF has the invalidate register set, from hardware side +the invalidate requests are queue to execute. + +[How] +In case of 12 VF increase timeout on 12*100ms + +Signed-off-by: Dusica Milinkovic +Acked-by: Shaoyun Liu +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- + drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index d949d6c52f24b..ff5555353eb4f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -283,7 +283,7 @@ enum amdgpu_kiq_irq { + AMDGPU_CP_KIQ_IRQ_DRIVER0 = 0, + AMDGPU_CP_KIQ_IRQ_LAST + }; +- ++#define SRIOV_USEC_TIMEOUT 1200000 /* wait 12 * 100ms for SRIOV */ + #define MAX_KIQ_REG_WAIT 5000 /* in usecs, 5ms */ + #define MAX_KIQ_REG_BAILOUT_INTERVAL 5 /* in msecs, 5ms */ + #define MAX_KIQ_REG_TRY 80 /* 20 -> 80 */ +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +index 150fa5258fb6f..2aa9242c58ab9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +@@ -371,6 +371,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev, + uint32_t seq; + uint16_t queried_pasid; + bool ret; ++ u32 usec_timeout = amdgpu_sriov_vf(adev) ? SRIOV_USEC_TIMEOUT : adev->usec_timeout; + struct amdgpu_ring *ring = &adev->gfx.kiq.ring; + struct amdgpu_kiq *kiq = &adev->gfx.kiq; + +@@ -389,7 +390,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev, + + amdgpu_ring_commit(ring); + spin_unlock(&adev->gfx.kiq.ring_lock); +- r = amdgpu_fence_wait_polling(ring, seq, adev->usec_timeout); ++ r = amdgpu_fence_wait_polling(ring, seq, usec_timeout); + if (r < 1) { + dev_err(adev->dev, "wait for kiq fence error: %ld.\n", r); + return -ETIME; +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index 3a864041968f6..1673bf3bae55a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -839,6 +839,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev, + uint32_t seq; + uint16_t queried_pasid; + bool ret; ++ u32 usec_timeout = amdgpu_sriov_vf(adev) ? SRIOV_USEC_TIMEOUT : adev->usec_timeout; + struct amdgpu_ring *ring = &adev->gfx.kiq.ring; + struct amdgpu_kiq *kiq = &adev->gfx.kiq; + +@@ -878,7 +879,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev, + + amdgpu_ring_commit(ring); + spin_unlock(&adev->gfx.kiq.ring_lock); +- r = amdgpu_fence_wait_polling(ring, seq, adev->usec_timeout); ++ r = amdgpu_fence_wait_polling(ring, seq, usec_timeout); + if (r < 1) { + dev_err(adev->dev, "wait for kiq fence error: %ld.\n", r); + up_read(&adev->reset_sem); +-- +2.35.1 + diff --git a/queue-5.10/lib-vdso-mark-do_hres_timens-and-do_coarse_timens-__.patch b/queue-5.10/lib-vdso-mark-do_hres_timens-and-do_coarse_timens-__.patch new file mode 100644 index 00000000000..960841b7b6e --- /dev/null +++ b/queue-5.10/lib-vdso-mark-do_hres_timens-and-do_coarse_timens-__.patch @@ -0,0 +1,89 @@ +From 619b4a5816c3c69378d9f104c948e8bf797dd792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 16:48:44 +0000 +Subject: lib/vdso: Mark do_hres_timens() and do_coarse_timens() + __always_inline() + +From: Christophe Leroy + +[ Upstream commit 58efe9f696cf908f40d6672aeca81cb2ad2bc762 ] + +In the same spirit as commit c966533f8c6c ("lib/vdso: Mark do_hres() +and do_coarse() as __always_inline"), mark do_hres_timens() and +do_coarse_timens() __always_inline. + +The measurement below in on a non timens process, ie on the fastest path. + +On powerpc32, without the patch: + +clock-gettime-monotonic-raw: vdso: 1155 nsec/call +clock-gettime-monotonic-coarse: vdso: 813 nsec/call +clock-gettime-monotonic: vdso: 1076 nsec/call + +With the patch: + +clock-gettime-monotonic-raw: vdso: 1100 nsec/call +clock-gettime-monotonic-coarse: vdso: 667 nsec/call +clock-gettime-monotonic: vdso: 1025 nsec/call + +Signed-off-by: Christophe Leroy +Reviewed-by: Thomas Gleixner +Reviewed-by: Vincenzo Frascino +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/90dcf45ebadfd5a07f24241551c62f619d1cb930.1617209142.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + lib/vdso/gettimeofday.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c +index 2919f16981404..c6f6dee087460 100644 +--- a/lib/vdso/gettimeofday.c ++++ b/lib/vdso/gettimeofday.c +@@ -46,8 +46,8 @@ static inline bool vdso_cycles_ok(u64 cycles) + #endif + + #ifdef CONFIG_TIME_NS +-static int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, +- struct __kernel_timespec *ts) ++static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, ++ struct __kernel_timespec *ts) + { + const struct vdso_data *vd = __arch_get_timens_vdso_data(); + const struct timens_offset *offs = &vdns->offset[clk]; +@@ -97,8 +97,8 @@ static __always_inline const struct vdso_data *__arch_get_timens_vdso_data(void) + return NULL; + } + +-static int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, +- struct __kernel_timespec *ts) ++static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, ++ struct __kernel_timespec *ts) + { + return -EINVAL; + } +@@ -159,8 +159,8 @@ static __always_inline int do_hres(const struct vdso_data *vd, clockid_t clk, + } + + #ifdef CONFIG_TIME_NS +-static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, +- struct __kernel_timespec *ts) ++static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, ++ struct __kernel_timespec *ts) + { + const struct vdso_data *vd = __arch_get_timens_vdso_data(); + const struct vdso_timestamp *vdso_ts = &vd->basetime[clk]; +@@ -188,8 +188,8 @@ static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, + return 0; + } + #else +-static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, +- struct __kernel_timespec *ts) ++static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, ++ struct __kernel_timespec *ts) + { + return -1; + } +-- +2.35.1 + diff --git a/queue-5.10/mmc-mtk-sd-clear-interrupts-when-cqe-off-disable.patch b/queue-5.10/mmc-mtk-sd-clear-interrupts-when-cqe-off-disable.patch new file mode 100644 index 00000000000..0355797d797 --- /dev/null +++ b/queue-5.10/mmc-mtk-sd-clear-interrupts-when-cqe-off-disable.patch @@ -0,0 +1,60 @@ +From 52c9a3cf6ec7f4361c2adc2cd8ceaeabe1dd4526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 16:00:48 +0800 +Subject: mmc: mtk-sd: Clear interrupts when cqe off/disable + +From: Wenbin Mei + +[ Upstream commit cc5d1692600613e72f32af60e27330fe0c79f4fe ] + +Currently we don't clear MSDC interrupts when cqe off/disable, which led +to the data complete interrupt will be reserved for the next command. +If the next command with data transfer after cqe off/disable, we process +the CMD ready interrupt and trigger DMA start for data, but the data +complete interrupt is already exists, then SW assume that the data transfer +is complete, SW will trigger DMA stop, but the data may not be transmitted +yet or is transmitting, so we may encounter the following error: +mtk-msdc 11230000.mmc: CMD bus busy detected. + +Signed-off-by: Wenbin Mei +Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220728080048.21336-1-wenbin.mei@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mtk-sd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index f5c965da95013..d71c113f428f6 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -2293,6 +2293,9 @@ static void msdc_cqe_disable(struct mmc_host *mmc, bool recovery) + /* disable busy check */ + sdr_clr_bits(host->base + MSDC_PATCH_BIT1, MSDC_PB1_BUSY_CHECK_SEL); + ++ val = readl(host->base + MSDC_INT); ++ writel(val, host->base + MSDC_INT); ++ + if (recovery) { + sdr_set_field(host->base + MSDC_DMA_CTRL, + MSDC_DMA_CTRL_STOP, 1); +@@ -2693,11 +2696,14 @@ static int __maybe_unused msdc_suspend(struct device *dev) + { + struct mmc_host *mmc = dev_get_drvdata(dev); + int ret; ++ u32 val; + + if (mmc->caps2 & MMC_CAP2_CQE) { + ret = cqhci_suspend(mmc); + if (ret) + return ret; ++ val = readl(((struct msdc_host *)mmc_priv(mmc))->base + MSDC_INT); ++ writel(val, ((struct msdc_host *)mmc_priv(mmc))->base + MSDC_INT); + } + + return pm_runtime_force_suspend(dev); +-- +2.35.1 + diff --git a/queue-5.10/neigh-fix-possible-dos-due-to-net-iface-start-stop-l.patch b/queue-5.10/neigh-fix-possible-dos-due-to-net-iface-start-stop-l.patch new file mode 100644 index 00000000000..8981760b0c8 --- /dev/null +++ b/queue-5.10/neigh-fix-possible-dos-due-to-net-iface-start-stop-l.patch @@ -0,0 +1,129 @@ +From b73029bd5e01fe5939dcabedbdf0fcaf49549885 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 18:20:11 +0300 +Subject: neigh: fix possible DoS due to net iface start/stop loop + +From: Denis V. Lunev + +[ Upstream commit 66ba215cb51323e4e55e38fd5f250e0fae0cbc94 ] + +Normal processing of ARP request (usually this is Ethernet broadcast +packet) coming to the host is looking like the following: +* the packet comes to arp_process() call and is passed through routing + procedure +* the request is put into the queue using pneigh_enqueue() if + corresponding ARP record is not local (common case for container + records on the host) +* the request is processed by timer (within 80 jiffies by default) and + ARP reply is sent from the same arp_process() using + NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED condition (flag is set inside + pneigh_enqueue()) + +And here the problem comes. Linux kernel calls pneigh_queue_purge() +which destroys the whole queue of ARP requests on ANY network interface +start/stop event through __neigh_ifdown(). + +This is actually not a problem within the original world as network +interface start/stop was accessible to the host 'root' only, which +could do more destructive things. But the world is changed and there +are Linux containers available. Here container 'root' has an access +to this API and could be considered as untrusted user in the hosting +(container's) world. + +Thus there is an attack vector to other containers on node when +container's root will endlessly start/stop interfaces. We have observed +similar situation on a real production node when docker container was +doing such activity and thus other containers on the node become not +accessible. + +The patch proposed doing very simple thing. It drops only packets from +the same namespace in the pneigh_queue_purge() where network interface +state change is detected. This is enough to prevent the problem for the +whole node preserving original semantics of the code. + +v2: + - do del_timer_sync() if queue is empty after pneigh_queue_purge() +v3: + - rebase to net tree + +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Daniel Borkmann +Cc: David Ahern +Cc: Yajun Deng +Cc: Roopa Prabhu +Cc: Christian Brauner +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: Alexey Kuznetsov +Cc: Alexander Mikhalitsyn +Cc: Konstantin Khorenko +Cc: kernel@openvz.org +Cc: devel@openvz.org +Investigated-by: Alexander Mikhalitsyn +Signed-off-by: Denis V. Lunev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 52a1c8725337b..e7dcdad5876b1 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -280,14 +280,23 @@ static int neigh_del_timer(struct neighbour *n) + return 0; + } + +-static void pneigh_queue_purge(struct sk_buff_head *list) ++static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net) + { ++ unsigned long flags; + struct sk_buff *skb; + +- while ((skb = skb_dequeue(list)) != NULL) { +- dev_put(skb->dev); +- kfree_skb(skb); ++ spin_lock_irqsave(&list->lock, flags); ++ skb = skb_peek(list); ++ while (skb != NULL) { ++ struct sk_buff *skb_next = skb_peek_next(skb, list); ++ if (net == NULL || net_eq(dev_net(skb->dev), net)) { ++ __skb_unlink(skb, list); ++ dev_put(skb->dev); ++ kfree_skb(skb); ++ } ++ skb = skb_next; + } ++ spin_unlock_irqrestore(&list->lock, flags); + } + + static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev, +@@ -358,9 +367,9 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev, + write_lock_bh(&tbl->lock); + neigh_flush_dev(tbl, dev, skip_perm); + pneigh_ifdown_and_unlock(tbl, dev); +- +- del_timer_sync(&tbl->proxy_timer); +- pneigh_queue_purge(&tbl->proxy_queue); ++ pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev)); ++ if (skb_queue_empty_lockless(&tbl->proxy_queue)) ++ del_timer_sync(&tbl->proxy_timer); + return 0; + } + +@@ -1743,7 +1752,7 @@ int neigh_table_clear(int index, struct neigh_table *tbl) + /* It is not clean... Fix it to unload IPv6 module safely */ + cancel_delayed_work_sync(&tbl->gc_work); + del_timer_sync(&tbl->proxy_timer); +- pneigh_queue_purge(&tbl->proxy_queue); ++ pneigh_queue_purge(&tbl->proxy_queue, NULL); + neigh_ifdown(tbl, NULL); + if (atomic_read(&tbl->entries)) + pr_crit("neighbour leakage\n"); +-- +2.35.1 + diff --git a/queue-5.10/netfilter-conntrack-nf_conntrack_procfs-should-no-lo.patch b/queue-5.10/netfilter-conntrack-nf_conntrack_procfs-should-no-lo.patch new file mode 100644 index 00000000000..33befc0cf20 --- /dev/null +++ b/queue-5.10/netfilter-conntrack-nf_conntrack_procfs-should-no-lo.patch @@ -0,0 +1,36 @@ +From 0fe0c889e9d3147945b4507be72cf7993b2662e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 12:39:20 +0200 +Subject: netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to + y + +From: Geert Uytterhoeven + +[ Upstream commit aa5762c34213aba7a72dc58e70601370805fa794 ] + +NF_CONNTRACK_PROCFS was marked obsolete in commit 54b07dca68557b09 +("netfilter: provide config option to disable ancient procfs parts") in +v3.3. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig +index 6bafd3876aff3..8bf70ce03f951 100644 +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -118,7 +118,6 @@ config NF_CONNTRACK_ZONES + + config NF_CONNTRACK_PROCFS + bool "Supply CT list in procfs (OBSOLETE)" +- default y + depends on PROC_FS + help + This option enables for the list of known conntrack entries +-- +2.35.1 + diff --git a/queue-5.10/s390-hypfs-avoid-error-message-under-kvm.patch b/queue-5.10/s390-hypfs-avoid-error-message-under-kvm.patch new file mode 100644 index 00000000000..6ede90b6c63 --- /dev/null +++ b/queue-5.10/s390-hypfs-avoid-error-message-under-kvm.patch @@ -0,0 +1,60 @@ +From 2a3c735695691f18adc936ddbbba8fdfa79c23e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 11:45:34 +0200 +Subject: s390/hypfs: avoid error message under KVM + +From: Juergen Gross + +[ Upstream commit 7b6670b03641ac308aaa6fa2e6f964ac993b5ea3 ] + +When booting under KVM the following error messages are issued: + +hypfs.7f5705: The hardware system does not support hypfs +hypfs.7a79f0: Initialization of hypfs failed with rc=-61 + +Demote the severity of first message from "error" to "info" and issue +the second message only in other error cases. + +Signed-off-by: Juergen Gross +Acked-by: Heiko Carstens +Acked-by: Christian Borntraeger +Link: https://lore.kernel.org/r/20220620094534.18967-1-jgross@suse.com +[arch/s390/hypfs/hypfs_diag.c changed description] +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/hypfs/hypfs_diag.c | 2 +- + arch/s390/hypfs/inode.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c +index f0bc4dc3e9bf0..6511d15ace45e 100644 +--- a/arch/s390/hypfs/hypfs_diag.c ++++ b/arch/s390/hypfs/hypfs_diag.c +@@ -437,7 +437,7 @@ __init int hypfs_diag_init(void) + int rc; + + if (diag204_probe()) { +- pr_err("The hardware system does not support hypfs\n"); ++ pr_info("The hardware system does not support hypfs\n"); + return -ENODATA; + } + +diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c +index 5c97f48cea91d..ee919bfc81867 100644 +--- a/arch/s390/hypfs/inode.c ++++ b/arch/s390/hypfs/inode.c +@@ -496,9 +496,9 @@ static int __init hypfs_init(void) + hypfs_vm_exit(); + fail_hypfs_diag_exit: + hypfs_diag_exit(); ++ pr_err("Initialization of hypfs failed with rc=%i\n", rc); + fail_dbfs_exit: + hypfs_dbfs_exit(); +- pr_err("Initialization of hypfs failed with rc=%i\n", rc); + return rc; + } + device_initcall(hypfs_init) +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 21b596e484c..d9666470da5 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -15,3 +15,14 @@ fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch bpf-don-t-redirect-packets-with-invalid-pkt_len.patch mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch +mmc-mtk-sd-clear-interrupts-when-cqe-off-disable.patch +drm-amd-display-avoid-mpc-infinite-loop.patch +drm-amd-display-for-stereo-keep-flip_any_frame.patch +drm-amd-display-clear-optc-underflow-before-turn-off.patch +neigh-fix-possible-dos-due-to-net-iface-start-stop-l.patch +s390-hypfs-avoid-error-message-under-kvm.patch +drm-amd-pm-add-missing-fini_microcode-interface-for-.patch +drm-amd-display-fix-pixel-clock-programming.patch +drm-amdgpu-increase-tlb-flush-timeout-for-sriov.patch +netfilter-conntrack-nf_conntrack_procfs-should-no-lo.patch +lib-vdso-mark-do_hres_timens-and-do_coarse_timens-__.patch