From: Greg Kroah-Hartman Date: Sat, 30 Oct 2021 12:40:50 +0000 (+0200) Subject: 5.14-stable patches X-Git-Tag: v4.4.291~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=36d1ee6e40ffbee73d4a3b85516fede0cb63e8b9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.14-stable patches added patches: arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch block-fix-partition-check-for-host-aware-zoned-block-devices.patch cfg80211-fix-management-registrations-locking.patch cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch drm-amdgpu-fix-out-of-bounds-write.patch drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch drm-i915-catch-yet-another-unconditioal-clflush.patch drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch mac80211-mesh-fix-he-operation-element-length-check.patch mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch mm-hwpoison-remove-the-unnecessary-thp-check.patch mm-khugepaged-skip-huge-page-collapse-for-special-files.patch mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch mmc-cqhci-clear-halt-state-after-cqe-enable.patch mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch mmc-vub300-fix-control-message-timeouts.patch net-lan78xx-fix-division-by-zero-in-send-path.patch nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch --- diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch b/queue-5.14/arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch new file mode 100644 index 00000000000..0de1a287011 --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch @@ -0,0 +1,43 @@ +From ca6f9d85d5944046a241b325700c1ca395651c28 Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Fri, 15 Oct 2021 14:48:39 +0200 +Subject: arm64: dts: imx8mm-kontron: Fix CAN SPI clock frequency + +From: Frieder Schrempf + +commit ca6f9d85d5944046a241b325700c1ca395651c28 upstream. + +The MCP2515 can be used with an SPI clock of up to 10 MHz. Set the +limit accordingly to prevent any performance issues caused by the +really low clock speed of 100 kHz. + +This removes the arbitrarily low limit on the SPI frequency, that was +caused by a typo in the original dts. + +Without this change, receiving CAN messages on the board beyond a +certain bitrate will cause overrun errors (see 'ip -det -stat link show +can0'). + +With this fix, receiving messages on the bus works without any overrun +errors for bitrates up to 1 MBit. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Cc: stable@vger.kernel.org +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +@@ -97,7 +97,7 @@ + clocks = <&osc_can>; + interrupt-parent = <&gpio4>; + interrupts = <28 IRQ_TYPE_EDGE_FALLING>; +- spi-max-frequency = <100000>; ++ spi-max-frequency = <10000000>; + vdd-supply = <®_vdd_3v3>; + xceiver-supply = <®_vdd_5v>; + }; diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch b/queue-5.14/arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch new file mode 100644 index 00000000000..013e914a145 --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch @@ -0,0 +1,40 @@ +From 0b28c41e3c951ea3d4f012cfa9da5ebd6512cf6e Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Fri, 15 Oct 2021 14:48:40 +0200 +Subject: arm64: dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY + +From: Frieder Schrempf + +commit 0b28c41e3c951ea3d4f012cfa9da5ebd6512cf6e upstream. + +Previously we falsely relied on the PHY driver to unconditionally +enable the internal RX delay. Since the following fix for the PHY +driver this is not the case anymore: + +commit 7b005a1742be ("net: phy: mscc: configure both RX and TX internal +delays for RGMII") + +In order to enable the delay we need to set the connection type to +"rgmii-rxid". Without the RX delay the ethernet is not functional at +all. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Cc: stable@vger.kernel.org +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +@@ -113,7 +113,7 @@ + &fec1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-rxid"; + phy-handle = <ðphy>; + status = "okay"; + diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch b/queue-5.14/arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch new file mode 100644 index 00000000000..2f8bd8d4edb --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch @@ -0,0 +1,39 @@ +From 6562d6e350284307e33ea10c7f46a6661ff22770 Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Fri, 15 Oct 2021 14:48:38 +0200 +Subject: arm64: dts: imx8mm-kontron: Fix polarity of reg_rst_eth2 + +From: Frieder Schrempf + +commit 6562d6e350284307e33ea10c7f46a6661ff22770 upstream. + +The regulator reg_rst_eth2 should keep the reset signal of the USB ethernet +adapter deasserted anytime. Fix the polarity and mark it as always-on. + +Anyway, using the regulator is only a workaround for the missing support of +specifying a reset GPIO for USB devices in a generic way. As we don't +have a solution for this at the moment, at least fix the current +workaround. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Cc: stable@vger.kernel.org +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +@@ -70,7 +70,9 @@ + regulator-name = "rst-usb-eth2"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb_eth2>; +- gpio = <&gpio3 2 GPIO_ACTIVE_LOW>; ++ gpio = <&gpio3 2 GPIO_ACTIVE_HIGH>; ++ enable-active-high; ++ regulator-always-on; + }; + + reg_vdd_5v: regulator-5v { diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch b/queue-5.14/arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch new file mode 100644 index 00000000000..cf856bfdfa9 --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch @@ -0,0 +1,51 @@ +From 82a4f329b133ad0de66bee12c0be5c67bb8aa188 Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Fri, 15 Oct 2021 14:48:36 +0200 +Subject: arm64: dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are correct + +From: Frieder Schrempf + +commit 82a4f329b133ad0de66bee12c0be5c67bb8aa188 upstream. + +It looks like the voltages for the SOC and DRAM supply weren't properly +validated before. The datasheet and uboot-imx code tells us that VDD_SOC +should be 800 mV in suspend and 850 mV in run mode. VDD_DRAM should be +950 mV for DDR clock frequencies of up to 1.5 GHz. + +Let's fix these values to make sure the voltages are within the required +range. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Cc: stable@vger.kernel.org +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +@@ -91,10 +91,12 @@ + reg_vdd_soc: BUCK1 { + regulator-name = "buck1"; + regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <900000>; ++ regulator-max-microvolt = <850000>; + regulator-boot-on; + regulator-always-on; + regulator-ramp-delay = <3125>; ++ nxp,dvs-run-voltage = <850000>; ++ nxp,dvs-standby-voltage = <800000>; + }; + + reg_vdd_arm: BUCK2 { +@@ -111,7 +113,7 @@ + reg_vdd_dram: BUCK3 { + regulator-name = "buck3"; + regulator-min-microvolt = <850000>; +- regulator-max-microvolt = <900000>; ++ regulator-max-microvolt = <950000>; + regulator-boot-on; + regulator-always-on; + }; diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch b/queue-5.14/arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch new file mode 100644 index 00000000000..011581fef66 --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch @@ -0,0 +1,33 @@ +From 256a24eba7f897c817fb0103dac73467d3789202 Mon Sep 17 00:00:00 2001 +From: Frieder Schrempf +Date: Fri, 15 Oct 2021 14:48:37 +0200 +Subject: arm64: dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV + +From: Frieder Schrempf + +commit 256a24eba7f897c817fb0103dac73467d3789202 upstream. + +According to the datasheet the typical value for VDD_SNVS should be +800 mV, so let's make sure that this is within the range of the +regulator. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Cc: stable@vger.kernel.org +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +@@ -150,7 +150,7 @@ + + reg_vdd_snvs: LDO2 { + regulator-name = "ldo2"; +- regulator-min-microvolt = <850000>; ++ regulator-min-microvolt = <800000>; + regulator-max-microvolt = <900000>; + regulator-boot-on; + regulator-always-on; diff --git a/queue-5.14/block-fix-partition-check-for-host-aware-zoned-block-devices.patch b/queue-5.14/block-fix-partition-check-for-host-aware-zoned-block-devices.patch new file mode 100644 index 00000000000..18f3a13bb63 --- /dev/null +++ b/queue-5.14/block-fix-partition-check-for-host-aware-zoned-block-devices.patch @@ -0,0 +1,77 @@ +From e0c60d0102a5ad3475401e1a2faa3d3623eefce4 Mon Sep 17 00:00:00 2001 +From: Shin'ichiro Kawasaki +Date: Tue, 26 Oct 2021 15:01:15 +0900 +Subject: block: Fix partition check for host-aware zoned block devices + +From: Shin'ichiro Kawasaki + +commit e0c60d0102a5ad3475401e1a2faa3d3623eefce4 upstream. + +Commit a33df75c6328 ("block: use an xarray for disk->part_tbl") modified +the method to check partition existence in host-aware zoned block +devices from disk_has_partitions() helper function call to empty check +of xarray disk->part_tbl. However, disk->part_tbl always has single +entry for disk->part0 and never becomes empty. This resulted in the +host-aware zoned devices always judged to have partitions, and it made +the sysfs queue/zoned attribute to be "none" instead of "host-aware" +regardless of partition existence in the devices. + +This also caused DEBUG_LOCKS_WARN_ON(lock->magic != lock) for +sdkp->rev_mutex in scsi layer when the kernel detects host-aware zoned +device. Since block layer handled the host-aware zoned devices as non- +zoned devices, scsi layer did not have chance to initialize the mutex +for zone revalidation. Therefore, the warning was triggered. + +To fix the issues, call the helper function disk_has_partitions() in +place of disk->part_tbl empty check. Since the function was removed with +the commit a33df75c6328, reimplement it to walk through entries in the +xarray disk->part_tbl. + +Fixes: a33df75c6328 ("block: use an xarray for disk->part_tbl") +Signed-off-by: Shin'ichiro Kawasaki +Cc: stable@vger.kernel.org # v5.14+ +Reviewed-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20211026060115.753746-1-shinichiro.kawasaki@wdc.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-settings.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -842,6 +842,24 @@ bool blk_queue_can_use_dma_map_merging(s + } + EXPORT_SYMBOL_GPL(blk_queue_can_use_dma_map_merging); + ++static bool disk_has_partitions(struct gendisk *disk) ++{ ++ unsigned long idx; ++ struct block_device *part; ++ bool ret = false; ++ ++ rcu_read_lock(); ++ xa_for_each(&disk->part_tbl, idx, part) { ++ if (bdev_is_partition(part)) { ++ ret = true; ++ break; ++ } ++ } ++ rcu_read_unlock(); ++ ++ return ret; ++} ++ + /** + * blk_queue_set_zoned - configure a disk queue zoned model. + * @disk: the gendisk of the queue to configure +@@ -876,7 +894,7 @@ void blk_queue_set_zoned(struct gendisk + * we do nothing special as far as the block layer is concerned. + */ + if (!IS_ENABLED(CONFIG_BLK_DEV_ZONED) || +- !xa_empty(&disk->part_tbl)) ++ disk_has_partitions(disk)) + model = BLK_ZONED_NONE; + break; + case BLK_ZONED_NONE: diff --git a/queue-5.14/cfg80211-fix-management-registrations-locking.patch b/queue-5.14/cfg80211-fix-management-registrations-locking.patch new file mode 100644 index 00000000000..8787d93643e --- /dev/null +++ b/queue-5.14/cfg80211-fix-management-registrations-locking.patch @@ -0,0 +1,194 @@ +From 09b1d5dc6ce1c9151777f6c4e128a59457704c97 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 25 Oct 2021 13:31:12 +0200 +Subject: cfg80211: fix management registrations locking + +From: Johannes Berg + +commit 09b1d5dc6ce1c9151777f6c4e128a59457704c97 upstream. + +The management registrations locking was broken, the list was +locked for each wdev, but cfg80211_mgmt_registrations_update() +iterated it without holding all the correct spinlocks, causing +list corruption. + +Rather than trying to fix it with fine-grained locking, just +move the lock to the wiphy/rdev (still need the list on each +wdev), we already need to hold the wdev lock to change it, so +there's no contention on the lock in any case. This trivially +fixes the bug since we hold one wdev's lock already, and now +will hold the lock that protects all lists. + +Cc: stable@vger.kernel.org +Reported-by: Jouni Malinen +Fixes: 6cd536fe62ef ("cfg80211: change internal management frame registration API") +Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + include/net/cfg80211.h | 2 -- + net/wireless/core.c | 2 +- + net/wireless/core.h | 2 ++ + net/wireless/mlme.c | 26 ++++++++++++++------------ + 4 files changed, 17 insertions(+), 15 deletions(-) + +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -5350,7 +5350,6 @@ static inline void wiphy_unlock(struct w + * netdev and may otherwise be used by driver read-only, will be update + * by cfg80211 on change_interface + * @mgmt_registrations: list of registrations for management frames +- * @mgmt_registrations_lock: lock for the list + * @mgmt_registrations_need_update: mgmt registrations were updated, + * need to propagate the update to the driver + * @mtx: mutex used to lock data in this struct, may be used by drivers +@@ -5397,7 +5396,6 @@ struct wireless_dev { + u32 identifier; + + struct list_head mgmt_registrations; +- spinlock_t mgmt_registrations_lock; + u8 mgmt_registrations_need_update:1; + + struct mutex mtx; +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -524,6 +524,7 @@ use_default_name: + INIT_WORK(&rdev->propagate_cac_done_wk, cfg80211_propagate_cac_done_wk); + INIT_WORK(&rdev->mgmt_registrations_update_wk, + cfg80211_mgmt_registrations_update_wk); ++ spin_lock_init(&rdev->mgmt_registrations_lock); + + #ifdef CONFIG_CFG80211_DEFAULT_PS + rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; +@@ -1279,7 +1280,6 @@ void cfg80211_init_wdev(struct wireless_ + INIT_LIST_HEAD(&wdev->event_list); + spin_lock_init(&wdev->event_lock); + INIT_LIST_HEAD(&wdev->mgmt_registrations); +- spin_lock_init(&wdev->mgmt_registrations_lock); + INIT_LIST_HEAD(&wdev->pmsr_list); + spin_lock_init(&wdev->pmsr_lock); + INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk); +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -100,6 +100,8 @@ struct cfg80211_registered_device { + struct work_struct propagate_cac_done_wk; + + struct work_struct mgmt_registrations_update_wk; ++ /* lock for all wdev lists */ ++ spinlock_t mgmt_registrations_lock; + + /* must be last because of the way we do wiphy_priv(), + * and it should at least be aligned to NETDEV_ALIGN */ +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -452,9 +452,9 @@ static void cfg80211_mgmt_registrations_ + + lockdep_assert_held(&rdev->wiphy.mtx); + +- spin_lock_bh(&wdev->mgmt_registrations_lock); ++ spin_lock_bh(&rdev->mgmt_registrations_lock); + if (!wdev->mgmt_registrations_need_update) { +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + return; + } + +@@ -479,7 +479,7 @@ static void cfg80211_mgmt_registrations_ + rcu_read_unlock(); + + wdev->mgmt_registrations_need_update = 0; +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + rdev_update_mgmt_frame_registrations(rdev, wdev, &upd); + } +@@ -503,6 +503,7 @@ int cfg80211_mlme_register_mgmt(struct w + int match_len, bool multicast_rx, + struct netlink_ext_ack *extack) + { ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); + struct cfg80211_mgmt_registration *reg, *nreg; + int err = 0; + u16 mgmt_type; +@@ -548,7 +549,7 @@ int cfg80211_mlme_register_mgmt(struct w + if (!nreg) + return -ENOMEM; + +- spin_lock_bh(&wdev->mgmt_registrations_lock); ++ spin_lock_bh(&rdev->mgmt_registrations_lock); + + list_for_each_entry(reg, &wdev->mgmt_registrations, list) { + int mlen = min(match_len, reg->match_len); +@@ -583,7 +584,7 @@ int cfg80211_mlme_register_mgmt(struct w + list_add(&nreg->list, &wdev->mgmt_registrations); + } + wdev->mgmt_registrations_need_update = 1; +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + cfg80211_mgmt_registrations_update(wdev); + +@@ -591,7 +592,7 @@ int cfg80211_mlme_register_mgmt(struct w + + out: + kfree(nreg); +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + return err; + } +@@ -602,7 +603,7 @@ void cfg80211_mlme_unregister_socket(str + struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); + struct cfg80211_mgmt_registration *reg, *tmp; + +- spin_lock_bh(&wdev->mgmt_registrations_lock); ++ spin_lock_bh(&rdev->mgmt_registrations_lock); + + list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { + if (reg->nlportid != nlportid) +@@ -615,7 +616,7 @@ void cfg80211_mlme_unregister_socket(str + schedule_work(&rdev->mgmt_registrations_update_wk); + } + +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + if (nlportid && rdev->crit_proto_nlportid == nlportid) { + rdev->crit_proto_nlportid = 0; +@@ -628,15 +629,16 @@ void cfg80211_mlme_unregister_socket(str + + void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev) + { ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); + struct cfg80211_mgmt_registration *reg, *tmp; + +- spin_lock_bh(&wdev->mgmt_registrations_lock); ++ spin_lock_bh(&rdev->mgmt_registrations_lock); + list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { + list_del(®->list); + kfree(reg); + } + wdev->mgmt_registrations_need_update = 1; +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + cfg80211_mgmt_registrations_update(wdev); + } +@@ -784,7 +786,7 @@ bool cfg80211_rx_mgmt_khz(struct wireles + data = buf + ieee80211_hdrlen(mgmt->frame_control); + data_len = len - ieee80211_hdrlen(mgmt->frame_control); + +- spin_lock_bh(&wdev->mgmt_registrations_lock); ++ spin_lock_bh(&rdev->mgmt_registrations_lock); + + list_for_each_entry(reg, &wdev->mgmt_registrations, list) { + if (reg->frame_type != ftype) +@@ -808,7 +810,7 @@ bool cfg80211_rx_mgmt_khz(struct wireles + break; + } + +- spin_unlock_bh(&wdev->mgmt_registrations_lock); ++ spin_unlock_bh(&rdev->mgmt_registrations_lock); + + trace_cfg80211_return_bool(result); + return result; diff --git a/queue-5.14/cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch b/queue-5.14/cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch new file mode 100644 index 00000000000..af78ec4c2ce --- /dev/null +++ b/queue-5.14/cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch @@ -0,0 +1,44 @@ +From a2083eeb119fb9307258baea9b7c243ca9a2e0b6 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 30 Sep 2021 13:11:21 +0200 +Subject: cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() + +From: Johannes Berg + +commit a2083eeb119fb9307258baea9b7c243ca9a2e0b6 upstream. + +The SSID pointer is pointing to RCU protected data, so we +need to have it under rcu_read_lock() for the entire use. +Fix this. + +Cc: stable@vger.kernel.org +Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") +Link: https://lore.kernel.org/r/20210930131120.6ddfc603aa1d.I2137344c4e2426525b1a8e4ce5fca82f8ecbfe7e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/scan.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -418,14 +418,17 @@ cfg80211_add_nontrans_list(struct cfg802 + } + ssid_len = ssid[1]; + ssid = ssid + 2; +- rcu_read_unlock(); + + /* check if nontrans_bss is in the list */ + list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { +- if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) ++ if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) { ++ rcu_read_unlock(); + return 0; ++ } + } + ++ rcu_read_unlock(); ++ + /* add to the list */ + list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); + return 0; diff --git a/queue-5.14/drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch b/queue-5.14/drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch new file mode 100644 index 00000000000..41a26af132c --- /dev/null +++ b/queue-5.14/drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch @@ -0,0 +1,55 @@ +From 54149d13f369e1ab02f36b91feee02069184c1d8 Mon Sep 17 00:00:00 2001 +From: Michael Strauss +Date: Thu, 21 Oct 2021 13:27:16 -0400 +Subject: drm/amd/display: Fallback to clocks which meet requested voltage on DCN31 + +From: Michael Strauss + +commit 54149d13f369e1ab02f36b91feee02069184c1d8 upstream. + +[WHY] +On certain configs, SMU clock table voltages don't match which cause parser +to behave incorrectly by leaving dcfclk and socclk table entries unpopulated. + +[HOW] +Currently the function that finds the corresponding clock for a given voltage +only checks for exact voltage level matches. In the case that no match gets +found, parser now falls back to searching for the max clock which meets the +requested voltage (i.e. its corresponding voltage is below requested). + +Signed-off-by: Michael Strauss +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 13 ++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c +@@ -518,14 +518,21 @@ static unsigned int find_clk_for_voltage + unsigned int voltage) + { + int i; ++ int max_voltage = 0; ++ int clock = 0; + + for (i = 0; i < NUM_SOC_VOLTAGE_LEVELS; i++) { +- if (clock_table->SocVoltage[i] == voltage) ++ if (clock_table->SocVoltage[i] == voltage) { + return clocks[i]; ++ } else if (clock_table->SocVoltage[i] >= max_voltage && ++ clock_table->SocVoltage[i] < voltage) { ++ max_voltage = clock_table->SocVoltage[i]; ++ clock = clocks[i]; ++ } + } + +- ASSERT(0); +- return 0; ++ ASSERT(clock); ++ return clock; + } + + void dcn31_clk_mgr_helper_populate_bw_params( diff --git a/queue-5.14/drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch b/queue-5.14/drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch new file mode 100644 index 00000000000..e4ea5dd1c73 --- /dev/null +++ b/queue-5.14/drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch @@ -0,0 +1,66 @@ +From ad76744b041d8c87ef1c9adbb04fb7eaa20a179e Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Fri, 22 Oct 2021 16:14:24 -0400 +Subject: drm/amd/display: Fix deadlock when falling back to v2 from v3 + +From: Nicholas Kazlauskas + +commit ad76744b041d8c87ef1c9adbb04fb7eaa20a179e upstream. + +[Why] +A deadlock in the kernel occurs when we fallback from the V3 to V2 +add_topology_to_display or remove_topology_to_display because they +both try to acquire the dtm_mutex but recursive locking isn't +supported on mutex_lock(). + +[How] +Make the mutex_lock/unlock more fine grained and move them up such that +they're only required for the psp invocation itself. + +Fixes: bf62221e9d0e ("drm/amd/display: Add DCN3.1 HDCP support") + +Signed-off-by: Nicholas Kazlauskas +Reviewed-by: Aric Cyr +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +@@ -105,6 +105,7 @@ static enum mod_hdcp_status mod_hdcp_rem + dtm_cmd->dtm_status = TA_DTM_STATUS__GENERIC_FAILURE; + + psp_dtm_invoke(psp, dtm_cmd->cmd_id); ++ mutex_unlock(&psp->dtm_context.mutex); + + if (dtm_cmd->dtm_status != TA_DTM_STATUS__SUCCESS) { + status = mod_hdcp_remove_display_from_topology_v2(hdcp, index); +@@ -115,8 +116,6 @@ static enum mod_hdcp_status mod_hdcp_rem + HDCP_TOP_REMOVE_DISPLAY_TRACE(hdcp, display->index); + } + +- mutex_unlock(&psp->dtm_context.mutex); +- + return status; + } + +@@ -218,6 +217,7 @@ static enum mod_hdcp_status mod_hdcp_add + dtm_cmd->dtm_in_message.topology_update_v3.link_hdcp_cap = link->hdcp_supported_informational; + + psp_dtm_invoke(psp, dtm_cmd->cmd_id); ++ mutex_unlock(&psp->dtm_context.mutex); + + if (dtm_cmd->dtm_status != TA_DTM_STATUS__SUCCESS) { + status = mod_hdcp_add_display_to_topology_v2(hdcp, display); +@@ -227,8 +227,6 @@ static enum mod_hdcp_status mod_hdcp_add + HDCP_TOP_ADD_DISPLAY_TRACE(hdcp, display->index); + } + +- mutex_unlock(&psp->dtm_context.mutex); +- + return status; + } + diff --git a/queue-5.14/drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch b/queue-5.14/drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch new file mode 100644 index 00000000000..2ffba302162 --- /dev/null +++ b/queue-5.14/drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch @@ -0,0 +1,44 @@ +From c938aed88f8259dc913b717a32319101c66e87a9 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Wed, 29 Sep 2021 11:37:33 -0400 +Subject: drm/amd/display: Fix prefetch bandwidth calculation for DCN3.1 + +From: Nicholas Kazlauskas + +commit c938aed88f8259dc913b717a32319101c66e87a9 upstream. + +[Why] +Prefetch BW calculated is lower than the DML reference because of a +porting error that's excluding cursor and row bandwidth from the +pixel data bandwidth. + +[How] +Change the dml_max4 to dml_max3 and include cursor and row bandwidth +in the same calculation as the rest of the pixel data during vactive. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +@@ -5399,9 +5399,9 @@ void dml31_ModeSupportAndSystemConfigura + + v->MaximumReadBandwidthWithPrefetch = + v->MaximumReadBandwidthWithPrefetch +- + dml_max4( +- v->VActivePixelBandwidth[i][j][k], +- v->VActiveCursorBandwidth[i][j][k] ++ + dml_max3( ++ v->VActivePixelBandwidth[i][j][k] ++ + v->VActiveCursorBandwidth[i][j][k] + + v->NoOfDPP[i][j][k] + * (v->meta_row_bandwidth[i][j][k] + + v->dpte_row_bandwidth[i][j][k]), diff --git a/queue-5.14/drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch b/queue-5.14/drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch new file mode 100644 index 00000000000..51d23d46ca2 --- /dev/null +++ b/queue-5.14/drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch @@ -0,0 +1,69 @@ +From dd8cb18906d97b2916fde42d32d915ae363c7e55 Mon Sep 17 00:00:00 2001 +From: Nikola Cornij +Date: Fri, 1 Oct 2021 13:26:05 -0400 +Subject: drm/amd/display: Increase watermark latencies for DCN3.1 + +From: Nikola Cornij + +commit dd8cb18906d97b2916fde42d32d915ae363c7e55 upstream. + +[why] +The original latencies were causing underflow in some modes + +[how] +Replace with the up-to-date watermark values based on new measurments + +Reviewed-by: Ahmad Othman +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Nikola Cornij +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 16 +++++------ + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c +@@ -366,32 +366,32 @@ static struct wm_table lpddr5_wm_table = + .wm_inst = WM_A, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.65333, +- .sr_exit_time_us = 5.32, +- .sr_enter_plus_exit_time_us = 6.38, ++ .sr_exit_time_us = 11.5, ++ .sr_enter_plus_exit_time_us = 14.5, + .valid = true, + }, + { + .wm_inst = WM_B, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.65333, +- .sr_exit_time_us = 9.82, +- .sr_enter_plus_exit_time_us = 11.196, ++ .sr_exit_time_us = 11.5, ++ .sr_enter_plus_exit_time_us = 14.5, + .valid = true, + }, + { + .wm_inst = WM_C, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.65333, +- .sr_exit_time_us = 9.89, +- .sr_enter_plus_exit_time_us = 11.24, ++ .sr_exit_time_us = 11.5, ++ .sr_enter_plus_exit_time_us = 14.5, + .valid = true, + }, + { + .wm_inst = WM_D, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.65333, +- .sr_exit_time_us = 9.748, +- .sr_enter_plus_exit_time_us = 11.102, ++ .sr_exit_time_us = 11.5, ++ .sr_enter_plus_exit_time_us = 14.5, + .valid = true, + }, + } diff --git a/queue-5.14/drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch b/queue-5.14/drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch new file mode 100644 index 00000000000..e0472308816 --- /dev/null +++ b/queue-5.14/drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch @@ -0,0 +1,38 @@ +From 4835ea6c173a8d8dfbfdbb21c4cd987d12681610 Mon Sep 17 00:00:00 2001 +From: Eric Yang +Date: Thu, 30 Sep 2021 13:46:45 -0400 +Subject: drm/amd/display: increase Z9 latency to workaround underflow in Z9 + +From: Eric Yang + +commit 4835ea6c173a8d8dfbfdbb21c4cd987d12681610 upstream. + +[Why] +Z9 latency is higher than when we originally tuned the watermark +parameters, causing underflow. Increasing the value until the latency +issues is resolved. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Eric Yang +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -217,8 +217,8 @@ struct _vcs_dpi_soc_bounding_box_st dcn3 + .num_states = 5, + .sr_exit_time_us = 9.0, + .sr_enter_plus_exit_time_us = 11.0, +- .sr_exit_z8_time_us = 402.0, +- .sr_enter_plus_exit_z8_time_us = 520.0, ++ .sr_exit_z8_time_us = 442.0, ++ .sr_enter_plus_exit_z8_time_us = 560.0, + .writeback_latency_us = 12.0, + .dram_channel_width_bytes = 4, + .round_trip_ping_latency_dcfclk_cycles = 106, diff --git a/queue-5.14/drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch b/queue-5.14/drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch new file mode 100644 index 00000000000..9d5b4e217ce --- /dev/null +++ b/queue-5.14/drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch @@ -0,0 +1,34 @@ +From c21b105380cf86e829c68586ca1315cfc253ad8c Mon Sep 17 00:00:00 2001 +From: Nikola Cornij +Date: Tue, 28 Sep 2021 22:43:52 -0400 +Subject: drm/amd/display: Limit display scaling to up to true 4k for DCN 3.1 + +From: Nikola Cornij + +commit c21b105380cf86e829c68586ca1315cfc253ad8c upstream. + +[why] +The requirement is that image width up to 4096 shall be supported + +Reviewed-by: Aric Cyr +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Nikola Cornij +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -928,7 +928,7 @@ static const struct dc_debug_options deb + .disable_dcc = DCC_ENABLE, + .vsr_support = true, + .performance_trace = false, +- .max_downscale_src_width = 3840,/*upto 4K*/ ++ .max_downscale_src_width = 4096,/*upto true 4K*/ + .disable_pplib_wm_range = false, + .scl_reset_length10 = true, + .sanity_checks = false, diff --git a/queue-5.14/drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch b/queue-5.14/drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch new file mode 100644 index 00000000000..b0c215fcc9f --- /dev/null +++ b/queue-5.14/drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch @@ -0,0 +1,50 @@ +From 2ef8ea23942f4c2569930c34e7689a0cb1b232cc Mon Sep 17 00:00:00 2001 +From: Jake Wang +Date: Fri, 1 Oct 2021 17:14:21 -0400 +Subject: drm/amd/display: Moved dccg init to after bios golden init + +From: Jake Wang + +commit 2ef8ea23942f4c2569930c34e7689a0cb1b232cc upstream. + +[Why] +bios_golden_init will override dccg_init during init_hw. + +[How] +Move dccg_init to after bios_golden_init. + +Reviewed-by: Aric Cyr +Reviewed-by: Eric Yang +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Jake Wang +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hwseq.c +@@ -76,10 +76,6 @@ void dcn31_init_hw(struct dc *dc) + if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks) + dc->clk_mgr->funcs->init_clocks(dc->clk_mgr); + +- // Initialize the dccg +- if (res_pool->dccg->funcs->dccg_init) +- res_pool->dccg->funcs->dccg_init(res_pool->dccg); +- + if (IS_FPGA_MAXIMUS_DC(dc->ctx->dce_environment)) { + + REG_WRITE(REFCLK_CNTL, 0); +@@ -106,6 +102,9 @@ void dcn31_init_hw(struct dc *dc) + hws->funcs.bios_golden_init(dc); + hws->funcs.disable_vga(dc->hwseq); + } ++ // Initialize the dccg ++ if (res_pool->dccg->funcs->dccg_init) ++ res_pool->dccg->funcs->dccg_init(res_pool->dccg); + + if (dc->debug.enable_mem_low_power.bits.dmcu) { + // Force ERAM to shutdown if DMCU is not enabled diff --git a/queue-5.14/drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch b/queue-5.14/drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch new file mode 100644 index 00000000000..794ee966280 --- /dev/null +++ b/queue-5.14/drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch @@ -0,0 +1,50 @@ +From 672437486ee9da3ed0e774937e6d0dd570921b39 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Wed, 29 Sep 2021 16:22:53 -0400 +Subject: drm/amd/display: Require immediate flip support for DCN3.1 planes + +From: Nicholas Kazlauskas + +commit 672437486ee9da3ed0e774937e6d0dd570921b39 upstream. + +[Why] +Immediate flip can be enabled dynamically and has higher BW requirements +when validating which voltage mode to use. + +If we validate when it's not set then potentially DCFCLK will be too low +and we will underflow. + +[How] +DM always requires support so always require it as part of DML input +parameters. + +This can't be enabled unconditionally on older ASIC because it blocks +some expected modes so only target DCN3.1 for now. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Agustin Gutierrez Sanchez +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -1591,6 +1591,13 @@ static int dcn31_populate_dml_pipes_from + pipe = &res_ctx->pipe_ctx[i]; + timing = &pipe->stream->timing; + ++ /* ++ * Immediate flip can be set dynamically after enabling the plane. ++ * We need to require support for immediate flip or underflow can be ++ * intermittently experienced depending on peak b/w requirements. ++ */ ++ pipes[pipe_cnt].pipe.src.immediate_flip = true; ++ + pipes[pipe_cnt].pipe.src.unbounded_req_mode = false; + pipes[pipe_cnt].pipe.src.gpuvm = true; + pipes[pipe_cnt].pipe.src.dcc_fraction_of_zs_req_luma = 0; diff --git a/queue-5.14/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch b/queue-5.14/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch new file mode 100644 index 00000000000..07287c27acf --- /dev/null +++ b/queue-5.14/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch @@ -0,0 +1,116 @@ +From 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Wed, 27 Oct 2021 16:27:30 +0200 +Subject: drm/amdgpu: Fix even more out of bound writes from debugfs + +From: Patrik Jakobsson + +commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream. + +CVE-2021-42327 was fixed by: + +commit f23750b5b3d98653b31d4469592935ef6364ad67 +Author: Thelford Williams +Date: Wed Oct 13 16:04:13 2021 -0400 + + drm/amdgpu: fix out of bounds write + +but amdgpu_dm_debugfs.c contains more of the same issue so fix the +remaining ones. + +v2: + * Add missing fix in dp_max_bpc_write (Harry Wentland) + +Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") +Signed-off-by: Patrik Jakobsson +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 18 +++++++------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -487,7 +487,7 @@ static ssize_t dp_phy_settings_write(str + if (!wr_buf) + return -ENOSPC; + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -639,7 +639,7 @@ static ssize_t dp_phy_test_pattern_debug + if (!wr_buf) + return -ENOSPC; + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -914,7 +914,7 @@ static ssize_t dp_dsc_passthrough_set(st + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + ¶m, buf, + max_param_num, + ¶m_nums)) { +@@ -1211,7 +1211,7 @@ static ssize_t trigger_hotplug(struct fi + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1396,7 +1396,7 @@ static ssize_t dp_dsc_clock_en_write(str + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1581,7 +1581,7 @@ static ssize_t dp_dsc_slice_width_write( + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1766,7 +1766,7 @@ static ssize_t dp_dsc_slice_height_write + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1944,7 +1944,7 @@ static ssize_t dp_dsc_bits_per_pixel_wri + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -2382,7 +2382,7 @@ static ssize_t dp_max_bpc_write(struct f + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { diff --git a/queue-5.14/drm-amdgpu-fix-out-of-bounds-write.patch b/queue-5.14/drm-amdgpu-fix-out-of-bounds-write.patch new file mode 100644 index 00000000000..341e905b219 --- /dev/null +++ b/queue-5.14/drm-amdgpu-fix-out-of-bounds-write.patch @@ -0,0 +1,31 @@ +From 5afa7898ab7a0ec9c28556a91df714bf3c2f725e Mon Sep 17 00:00:00 2001 +From: Thelford Williams +Date: Wed, 13 Oct 2021 16:04:13 -0400 +Subject: drm/amdgpu: fix out of bounds write + +From: Thelford Williams + +commit 5afa7898ab7a0ec9c28556a91df714bf3c2f725e upstream. + +Size can be any value and is user controlled resulting in overwriting the +40 byte array wr_buf with an arbitrary length of data from buf. + +Signed-off-by: Thelford Williams +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(st + if (!wr_buf) + return -ENOSPC; + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { diff --git a/queue-5.14/drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch b/queue-5.14/drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch new file mode 100644 index 00000000000..4828bd793cf --- /dev/null +++ b/queue-5.14/drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch @@ -0,0 +1,47 @@ +From 53c2ff8bcb06acd07e24a62e7f5a0247bd7c6f67 Mon Sep 17 00:00:00 2001 +From: Aaron Liu +Date: Tue, 19 Oct 2021 11:13:25 +0800 +Subject: drm/amdgpu: support B0&B1 external revision id for yellow carp + +From: Aaron Liu + +commit 53c2ff8bcb06acd07e24a62e7f5a0247bd7c6f67 upstream. + +B0 internal rev_id is 0x01, B1 internal rev_id is 0x02. +The external rev_id for B0 and B1 is 0x20. +The original expression is not suitable for B1. + +v2: squash in fix for display code (Alex) + +Signed-off-by: Aaron Liu +Reviewed-by: Huang Rui +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- + drivers/gpu/drm/amd/display/include/dal_asic_id.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -1237,7 +1237,7 @@ static int nv_common_early_init(void *ha + AMD_PG_SUPPORT_VCN_DPG | + AMD_PG_SUPPORT_JPEG; + if (adev->pdev->device == 0x1681) +- adev->external_rev_id = adev->rev_id + 0x19; ++ adev->external_rev_id = 0x20; + else + adev->external_rev_id = adev->rev_id + 0x01; + break; +--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h ++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h +@@ -227,7 +227,7 @@ enum { + #define FAMILY_YELLOW_CARP 146 + + #define YELLOW_CARP_A0 0x01 +-#define YELLOW_CARP_B0 0x1A ++#define YELLOW_CARP_B0 0x20 + #define YELLOW_CARP_UNKNOWN 0xFF + + #ifndef ASICREV_IS_YELLOW_CARP diff --git a/queue-5.14/drm-i915-catch-yet-another-unconditioal-clflush.patch b/queue-5.14/drm-i915-catch-yet-another-unconditioal-clflush.patch new file mode 100644 index 00000000000..fe613682ce8 --- /dev/null +++ b/queue-5.14/drm-i915-catch-yet-another-unconditioal-clflush.patch @@ -0,0 +1,43 @@ +From 9761ffb8f1090289b908590039e2c363cc35cf45 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 14 Oct 2021 12:09:40 +0300 +Subject: drm/i915: Catch yet another unconditioal clflush +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 9761ffb8f1090289b908590039e2c363cc35cf45 upstream. + +Replace the unconditional clflush() with drm_clflush_virt_range() +which does the wbinvd() fallback when clflush is not available. + +This time no justification is given for the clflush in the +offending commit. + +Cc: stable@vger.kernel.org +Cc: Maarten Lankhorst +Cc: Thomas Hellström +Fixes: 2c8ab3339e39 ("drm/i915: Pin timeline map after first timeline pin, v4.") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-4-ville.syrjala@linux.intel.com +Reviewed-by: Dave Airlie +(cherry picked from commit 9ced12182d0d8401d821e9602e56e276459900fc) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_timeline.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -64,7 +64,7 @@ intel_timeline_pin_map(struct intel_time + + timeline->hwsp_map = vaddr; + timeline->hwsp_seqno = memset(vaddr + ofs, 0, TIMELINE_SEQNO_BYTES); +- clflush(vaddr + ofs); ++ drm_clflush_virt_range(vaddr + ofs, TIMELINE_SEQNO_BYTES); + + return 0; + } diff --git a/queue-5.14/drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch b/queue-5.14/drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch new file mode 100644 index 00000000000..70d8a7bd98e --- /dev/null +++ b/queue-5.14/drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch @@ -0,0 +1,42 @@ +From fcf918ffd3b35e288097036c04af7446b2c6f2f1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 14 Oct 2021 12:09:39 +0300 +Subject: drm/i915: Convert unconditional clflush to drm_clflush_virt_range() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit fcf918ffd3b35e288097036c04af7446b2c6f2f1 upstream. + +This one is apparently a "clflush for good measure", so bit more +justification (if you can call it that) than some of the others. +Convert to drm_clflush_virt_range() again so that machines without +clflush will survive the ordeal. + +Cc: stable@vger.kernel.org +Cc: Maarten Lankhorst +Cc: Thomas Hellström #v1 +Fixes: 12ca695d2c1e ("drm/i915: Do not share hwsp across contexts any more, v8.") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-3-ville.syrjala@linux.intel.com +Reviewed-by: Dave Airlie +(cherry picked from commit af7b6d234eefa30c461cc16912bafb32b9e6141c) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/intel_timeline.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -225,7 +225,7 @@ void intel_timeline_reset_seqno(const st + + memset(hwsp_seqno + 1, 0, TIMELINE_SEQNO_BYTES - sizeof(*hwsp_seqno)); + WRITE_ONCE(*hwsp_seqno, tl->seqno); +- clflush(hwsp_seqno); ++ drm_clflush_virt_range(hwsp_seqno, TIMELINE_SEQNO_BYTES); + } + + void intel_timeline_enter(struct intel_timeline *tl) diff --git a/queue-5.14/drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch b/queue-5.14/drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch new file mode 100644 index 00000000000..215120b17bd --- /dev/null +++ b/queue-5.14/drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch @@ -0,0 +1,76 @@ +From 6e6f96630805874fa80b0067e1a57aafc06225f6 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Mon, 18 Oct 2021 12:41:49 +0300 +Subject: drm/i915/dp: Skip the HW readout of DPCD on disabled encoders +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Imre Deak + +commit 6e6f96630805874fa80b0067e1a57aafc06225f6 upstream. + +Reading out the DP encoders' DPCD during booting or resume is only +required for enabled encoders: such encoders may be modesetted during +the initial commit and the link training this involves depends on an +initialized DPCD. For DDI encoders reading out the DPCD is skipped, do +the same on pre-DDI platforms. + +Atm, the first DPCD readout without a sink connected - which is a likely +scneario if the encoder is disabled - leaves intel_dp->num_common_rates +at 0, which resulted in + +intel_dp_sync_state()->intel_dp_max_common_rate() + +in a + +intel_dp->common_rates[-1] + +access. This by definition results in an undefined behaviour, though to +my best knowledge in all HW/compiler configurations it actually results +in accessing the array item type value preceding the array. In this +case the preceding value happens to be intel_dp->num_common_rates, +which is 0, so this issue - by luck - didn't cause a user visible +problem. + +Nevertheless it's still an undefined behaviour and in CONFIG_UBSAN +builds leads to a kernel BUG() (which revealed this problem for us), +hence CC:stable. + +A related problem in case the encoder is enabled but the sink is not +connected or the DPCD readout fails is fixed by the next patch. + +v2: Amend the commit message describing the root cause of the + CONFIG_UBSAN BUG(). + +Fixes: a532cde31de3 ("drm/i915/tc: Fix TypeC port init/resume time sanitization") +References: https://gitlab.freedesktop.org/drm/intel/-/issues/4297 +Reported-and-tested-by: Mat Jonczyk +Cc: Mat Jonczyk +Cc: José Roberto de Souza +Cc: Jani Nikula +Cc: Ville Syrjälä +Cc: +Signed-off-by: Imre Deak +Reviewed-by: Ville Syrjälä +Acked-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20211018094154.1407705-2-imre.deak@intel.com +(cherry picked from commit 4ec5ffc341cecbea060739aea1d53398ac2ec3f8) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -1924,6 +1924,9 @@ void intel_dp_sync_state(struct intel_en + { + struct intel_dp *intel_dp = enc_to_intel_dp(encoder); + ++ if (!crtc_state) ++ return; ++ + /* + * Don't clobber DPCD if it's been already read out during output + * setup (eDP) or detect. diff --git a/queue-5.14/drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch b/queue-5.14/drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch new file mode 100644 index 00000000000..bc8b3ae933e --- /dev/null +++ b/queue-5.14/drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch @@ -0,0 +1,37 @@ +From 0db55f9a1bafbe3dac750ea669de9134922389b5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Wed, 20 Oct 2021 19:19:46 +0200 +Subject: drm/ttm: fix memleak in ttm_transfered_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream. + +We need to cleanup the fences for ghost objects as well. + +Signed-off-by: Christian König +Reported-by: Erhard F. +Tested-by: Erhard F. +Reviewed-by: Huang Rui +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029 +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447 +CC: +Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_bo_util.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/ttm/ttm_bo_util.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c +@@ -190,6 +190,7 @@ static void ttm_transfered_destroy(struc + struct ttm_transfer_obj *fbo; + + fbo = container_of(bo, struct ttm_transfer_obj, base); ++ dma_resv_fini(&fbo->base.base._resv); + ttm_bo_put(fbo->bo); + kfree(fbo); + } diff --git a/queue-5.14/ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch b/queue-5.14/ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch new file mode 100644 index 00000000000..2bd9b72575b --- /dev/null +++ b/queue-5.14/ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch @@ -0,0 +1,49 @@ +From 4e84dc47bb48accbbeeba4e6bb3f31aa7895323c Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (VMware)" +Date: Wed, 27 Oct 2021 12:51:01 -0400 +Subject: ftrace/nds32: Update the proto for ftrace_trace_function to match ftrace_stub + +From: Steven Rostedt (VMware) + +commit 4e84dc47bb48accbbeeba4e6bb3f31aa7895323c upstream. + +The ftrace callback prototype was changed to pass a special ftrace_regs +instead of pt_regs as the last parameter, but the static ftrace for nds32 +missed updating ftrace_trace_function and this caused a warning when +compared to ftrace_stub: + +../arch/nds32/kernel/ftrace.c: In function '_mcount': +../arch/nds32/kernel/ftrace.c:24:35: error: comparison of distinct pointer types lacks a cast [-Werror] + 24 | if (ftrace_trace_function != ftrace_stub) + | ^~ + +Link: https://lore.kernel.org/all/20211027055554.19372-1-rdunlap@infradead.org/ +Link: https://lkml.kernel.org/r/20211027125101.33449969@gandalf.local.home + +Cc: Ingo Molnar +Cc: Andrew Morton +Cc: Nick Hu +Cc: Greentime Hu +Cc: Vincent Chen +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: stable@vger.kernel.org +Fixes: d19ad0775dcd6 ("ftrace: Have the callbacks receive a struct ftrace_regs instead of pt_regs") +Reported-by: Randy Dunlap +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + arch/nds32/kernel/ftrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/nds32/kernel/ftrace.c ++++ b/arch/nds32/kernel/ftrace.c +@@ -6,7 +6,7 @@ + + #ifndef CONFIG_DYNAMIC_FTRACE + extern void (*ftrace_trace_function)(unsigned long, unsigned long, +- struct ftrace_ops*, struct pt_regs*); ++ struct ftrace_ops*, struct ftrace_regs*); + extern void ftrace_graph_caller(void); + + noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip, diff --git a/queue-5.14/mac80211-mesh-fix-he-operation-element-length-check.patch b/queue-5.14/mac80211-mesh-fix-he-operation-element-length-check.patch new file mode 100644 index 00000000000..9db1dd31ab4 --- /dev/null +++ b/queue-5.14/mac80211-mesh-fix-he-operation-element-length-check.patch @@ -0,0 +1,49 @@ +From 636707e593120c9fa35f6a908c0d052f6154910d Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 30 Sep 2021 13:11:20 +0200 +Subject: mac80211: mesh: fix HE operation element length check + +From: Johannes Berg + +commit 636707e593120c9fa35f6a908c0d052f6154910d upstream. + +The length check here was bad, if the length doesn't at +least include the length of the fixed part, we cannot +call ieee80211_he_oper_size() to determine the total. +Fix this, and convert to cfg80211_find_ext_elem() while +at it. + +Cc: stable@vger.kernel.org +Fixes: 70debba3ab7d ("mac80211: save HE oper info in BSS config for mesh") +Link: https://lore.kernel.org/r/20210930131120.b0f940976c56.I954e1be55e9f87cc303165bff5c906afe1e54648@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/mesh.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -672,7 +672,7 @@ ieee80211_mesh_update_bss_params(struct + u8 *ie, u8 ie_len) + { + struct ieee80211_supported_band *sband; +- const u8 *cap; ++ const struct element *cap; + const struct ieee80211_he_operation *he_oper = NULL; + + sband = ieee80211_get_sband(sdata); +@@ -687,9 +687,10 @@ ieee80211_mesh_update_bss_params(struct + + sdata->vif.bss_conf.he_support = true; + +- cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ie, ie_len); +- if (cap && cap[1] >= ieee80211_he_oper_size(&cap[3])) +- he_oper = (void *)(cap + 3); ++ cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ie_len); ++ if (cap && cap->datalen >= 1 + sizeof(*he_oper) && ++ cap->datalen >= 1 + ieee80211_he_oper_size(cap->data + 1)) ++ he_oper = (void *)(cap->data + 1); + + if (he_oper) + sdata->vif.bss_conf.he_oper.params = diff --git a/queue-5.14/mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch b/queue-5.14/mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch new file mode 100644 index 00000000000..eaecefc753d --- /dev/null +++ b/queue-5.14/mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch @@ -0,0 +1,165 @@ +From eac96c3efdb593df1a57bb5b95dbe037bfa9a522 Mon Sep 17 00:00:00 2001 +From: Yang Shi +Date: Thu, 28 Oct 2021 14:36:11 -0700 +Subject: mm: filemap: check if THP has hwpoisoned subpage for PMD page fault + +From: Yang Shi + +commit eac96c3efdb593df1a57bb5b95dbe037bfa9a522 upstream. + +When handling shmem page fault the THP with corrupted subpage could be +PMD mapped if certain conditions are satisfied. But kernel is supposed +to send SIGBUS when trying to map hwpoisoned page. + +There are two paths which may do PMD map: fault around and regular +fault. + +Before commit f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() +codepaths") the thing was even worse in fault around path. The THP +could be PMD mapped as long as the VMA fits regardless what subpage is +accessed and corrupted. After this commit as long as head page is not +corrupted the THP could be PMD mapped. + +In the regular fault path the THP could be PMD mapped as long as the +corrupted page is not accessed and the VMA fits. + +This loophole could be fixed by iterating every subpage to check if any +of them is hwpoisoned or not, but it is somewhat costly in page fault +path. + +So introduce a new page flag called HasHWPoisoned on the first tail +page. It indicates the THP has hwpoisoned subpage(s). It is set if any +subpage of THP is found hwpoisoned by memory failure and after the +refcount is bumped successfully, then cleared when the THP is freed or +split. + +The soft offline path doesn't need this since soft offline handler just +marks a subpage hwpoisoned when the subpage is migrated successfully. +But shmem THP didn't get split then migrated at all. + +Link: https://lkml.kernel.org/r/20211020210755.23964-3-shy828301@gmail.com +Fixes: 800d8c63b2e9 ("shmem: add huge pages support") +Signed-off-by: Yang Shi +Reviewed-by: Naoya Horiguchi +Suggested-by: Kirill A. Shutemov +Cc: Hugh Dickins +Cc: Matthew Wilcox +Cc: Oscar Salvador +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/page-flags.h | 23 +++++++++++++++++++++++ + mm/huge_memory.c | 2 ++ + mm/memory-failure.c | 14 ++++++++++++++ + mm/memory.c | 9 +++++++++ + mm/page_alloc.c | 4 +++- + 5 files changed, 51 insertions(+), 1 deletion(-) + +--- a/include/linux/page-flags.h ++++ b/include/linux/page-flags.h +@@ -171,6 +171,15 @@ enum pageflags { + /* Compound pages. Stored in first tail page's flags */ + PG_double_map = PG_workingset, + ++#ifdef CONFIG_MEMORY_FAILURE ++ /* ++ * Compound pages. Stored in first tail page's flags. ++ * Indicates that at least one subpage is hwpoisoned in the ++ * THP. ++ */ ++ PG_has_hwpoisoned = PG_mappedtodisk, ++#endif ++ + /* non-lru isolated movable page */ + PG_isolated = PG_reclaim, + +@@ -703,6 +712,20 @@ PAGEFLAG_FALSE(DoubleMap) + TESTSCFLAG_FALSE(DoubleMap) + #endif + ++#if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_TRANSPARENT_HUGEPAGE) ++/* ++ * PageHasHWPoisoned indicates that at least one subpage is hwpoisoned in the ++ * compound page. ++ * ++ * This flag is set by hwpoison handler. Cleared by THP split or free page. ++ */ ++PAGEFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND) ++ TESTSCFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND) ++#else ++PAGEFLAG_FALSE(HasHWPoisoned) ++ TESTSCFLAG_FALSE(HasHWPoisoned) ++#endif ++ + /* + * Check if a page is currently marked HWPoisoned. Note that this check is + * best effort only and inherently racy: there is no way to synchronize with +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2452,6 +2452,8 @@ static void __split_huge_page(struct pag + /* lock lru list/PageCompound, ref frozen by page_ref_freeze */ + lruvec = lock_page_lruvec(head); + ++ ClearPageHasHWPoisoned(head); ++ + for (i = nr - 1; i >= 1; i--) { + __split_huge_page_tail(head, i, lruvec, list); + /* Some pages can be beyond i_size: drop them from page cache */ +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1694,6 +1694,20 @@ try_again: + } + + if (PageTransHuge(hpage)) { ++ /* ++ * The flag must be set after the refcount is bumped ++ * otherwise it may race with THP split. ++ * And the flag can't be set in get_hwpoison_page() since ++ * it is called by soft offline too and it is just called ++ * for !MF_COUNT_INCREASE. So here seems to be the best ++ * place. ++ * ++ * Don't need care about the above error handling paths for ++ * get_hwpoison_page() since they handle either free page ++ * or unhandlable page. The refcount is bumped iff the ++ * page is a valid handlable page. ++ */ ++ SetPageHasHWPoisoned(hpage); + if (try_to_split_thp_page(p, "Memory Failure") < 0) { + action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED); + res = -EBUSY; +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3906,6 +3906,15 @@ vm_fault_t do_set_pmd(struct vm_fault *v + return ret; + + /* ++ * Just backoff if any subpage of a THP is corrupted otherwise ++ * the corrupted page may mapped by PMD silently to escape the ++ * check. This kind of THP just can be PTE mapped. Access to ++ * the corrupted subpage should trigger SIGBUS as expected. ++ */ ++ if (unlikely(PageHasHWPoisoned(page))) ++ return ret; ++ ++ /* + * Archs like ppc64 need additional space to store information + * related to pte entry. Use the preallocated table for that. + */ +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1320,8 +1320,10 @@ static __always_inline bool free_pages_p + + VM_BUG_ON_PAGE(compound && compound_order(page) != order, page); + +- if (compound) ++ if (compound) { + ClearPageDoubleMap(page); ++ ClearPageHasHWPoisoned(page); ++ } + for (i = 1; i < (1 << order); i++) { + if (compound) + bad += free_tail_pages_check(page, page + i); diff --git a/queue-5.14/mm-hwpoison-remove-the-unnecessary-thp-check.patch b/queue-5.14/mm-hwpoison-remove-the-unnecessary-thp-check.patch new file mode 100644 index 00000000000..a3e2ac7f526 --- /dev/null +++ b/queue-5.14/mm-hwpoison-remove-the-unnecessary-thp-check.patch @@ -0,0 +1,62 @@ +From c7cb42e94473aafe553c0f2a3d8ca904599399ed Mon Sep 17 00:00:00 2001 +From: Yang Shi +Date: Thu, 28 Oct 2021 14:36:07 -0700 +Subject: mm: hwpoison: remove the unnecessary THP check + +From: Yang Shi + +commit c7cb42e94473aafe553c0f2a3d8ca904599399ed upstream. + +When handling THP hwpoison checked if the THP is in allocation or free +stage since hwpoison may mistreat it as hugetlb page. After commit +415c64c1453a ("mm/memory-failure: split thp earlier in memory error +handling") the problem has been fixed, so this check is no longer +needed. Remove it. The side effect of the removal is hwpoison may +report unsplit THP instead of unknown error for shmem THP. It seems not +like a big deal. + +The following patch "mm: filemap: check if THP has hwpoisoned subpage +for PMD page fault" depends on this, which fixes shmem THP with +hwpoisoned subpage(s) are mapped PMD wrongly. So this patch needs to be +backported to -stable as well. + +Link: https://lkml.kernel.org/r/20211020210755.23964-2-shy828301@gmail.com +Signed-off-by: Yang Shi +Suggested-by: Naoya Horiguchi +Acked-by: Naoya Horiguchi +Cc: Hugh Dickins +Cc: Kirill A. Shutemov +Cc: Matthew Wilcox +Cc: Oscar Salvador +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1148,20 +1148,6 @@ static int __get_hwpoison_page(struct pa + if (!HWPoisonHandlable(head)) + return -EBUSY; + +- if (PageTransHuge(head)) { +- /* +- * Non anonymous thp exists only in allocation/free time. We +- * can't handle such a case correctly, so let's give it up. +- * This should be better than triggering BUG_ON when kernel +- * tries to touch the "partially handled" page. +- */ +- if (!PageAnon(head)) { +- pr_err("Memory failure: %#lx: non anonymous thp\n", +- page_to_pfn(page)); +- return 0; +- } +- } +- + if (get_page_unless_zero(head)) { + if (head == compound_head(page)) + return 1; diff --git a/queue-5.14/mm-khugepaged-skip-huge-page-collapse-for-special-files.patch b/queue-5.14/mm-khugepaged-skip-huge-page-collapse-for-special-files.patch new file mode 100644 index 00000000000..ed2f22ceac0 --- /dev/null +++ b/queue-5.14/mm-khugepaged-skip-huge-page-collapse-for-special-files.patch @@ -0,0 +1,78 @@ +From a4aeaa06d45e90f9b279f0b09de84bd00006e733 Mon Sep 17 00:00:00 2001 +From: Yang Shi +Date: Thu, 28 Oct 2021 14:36:30 -0700 +Subject: mm: khugepaged: skip huge page collapse for special files + +From: Yang Shi + +commit a4aeaa06d45e90f9b279f0b09de84bd00006e733 upstream. + +The read-only THP for filesystems will collapse THP for files opened +readonly and mapped with VM_EXEC. The intended usecase is to avoid TLB +misses for large text segments. But it doesn't restrict the file types +so a THP could be collapsed for a non-regular file, for example, block +device, if it is opened readonly and mapped with EXEC permission. This +may cause bugs, like [1] and [2]. + +This is definitely not the intended usecase, so just collapse THP for +regular files in order to close the attack surface. + +[shy828301@gmail.com: fix vm_file check [3]] + +Link: https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/ [1] +Link: https://lore.kernel.org/linux-mm/000000000000c6a82505ce284e4c@google.com/ [2] +Link: https://lkml.kernel.org/r/CAHbLzkqTW9U3VvTu1Ki5v_cLRC9gHW+znBukg_ycergE0JWj-A@mail.gmail.com [3] +Link: https://lkml.kernel.org/r/20211027195221.3825-1-shy828301@gmail.com +Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") +Signed-off-by: Hugh Dickins +Signed-off-by: Yang Shi +Reported-by: Hao Sun +Reported-by: syzbot+aae069be1de40fb11825@syzkaller.appspotmail.com +Cc: Matthew Wilcox +Cc: Kirill A. Shutemov +Cc: Song Liu +Cc: Andrea Righi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/khugepaged.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -445,22 +445,25 @@ static bool hugepage_vma_check(struct vm + if (!transhuge_vma_enabled(vma, vm_flags)) + return false; + ++ if (vma->vm_file && !IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - ++ vma->vm_pgoff, HPAGE_PMD_NR)) ++ return false; ++ + /* Enabled via shmem mount options or sysfs settings. */ +- if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) { +- return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, +- HPAGE_PMD_NR); +- } ++ if (shmem_file(vma->vm_file)) ++ return shmem_huge_enabled(vma); + + /* THP settings require madvise. */ + if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always()) + return false; + +- /* Read-only file mappings need to be aligned for THP to work. */ ++ /* Only regular file is valid */ + if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file && +- !inode_is_open_for_write(vma->vm_file->f_inode) && + (vm_flags & VM_EXEC)) { +- return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, +- HPAGE_PMD_NR); ++ struct inode *inode = vma->vm_file->f_inode; ++ ++ return !inode_is_open_for_write(inode) && ++ S_ISREG(inode->i_mode); + } + + if (!vma->anon_vma || vma->vm_ops) diff --git a/queue-5.14/mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch b/queue-5.14/mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch new file mode 100644 index 00000000000..cd5061336f6 --- /dev/null +++ b/queue-5.14/mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch @@ -0,0 +1,103 @@ +From 74c42e1baacf206338b1dd6b6199ac964512b5bb Mon Sep 17 00:00:00 2001 +From: Rongwei Wang +Date: Thu, 28 Oct 2021 14:36:27 -0700 +Subject: mm, thp: bail out early in collapse_file for writeback page + +From: Rongwei Wang + +commit 74c42e1baacf206338b1dd6b6199ac964512b5bb upstream. + +Currently collapse_file does not explicitly check PG_writeback, instead, +page_has_private and try_to_release_page are used to filter writeback +pages. This does not work for xfs with blocksize equal to or larger +than pagesize, because in such case xfs has no page->private. + +This makes collapse_file bail out early for writeback page. Otherwise, +xfs end_page_writeback will panic as follows. + + page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32 + aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so" + flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback) + raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8 + raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000 + page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u)) + page->mem_cgroup:ffff0000c3e9a000 + ------------[ cut here ]------------ + kernel BUG at include/linux/mm.h:1212! + Internal error: Oops - BUG: 0 [#1] SMP + Modules linked in: + BUG: Bad page state in process khugepaged pfn:84ef32 + xfs(E) + page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32 + libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ... + CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ... + pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) + Call trace: + end_page_writeback+0x1c0/0x214 + iomap_finish_page_writeback+0x13c/0x204 + iomap_finish_ioend+0xe8/0x19c + iomap_writepage_end_bio+0x38/0x50 + bio_endio+0x168/0x1ec + blk_update_request+0x278/0x3f0 + blk_mq_end_request+0x34/0x15c + virtblk_request_done+0x38/0x74 [virtio_blk] + blk_done_softirq+0xc4/0x110 + __do_softirq+0x128/0x38c + __irq_exit_rcu+0x118/0x150 + irq_exit+0x1c/0x30 + __handle_domain_irq+0x8c/0xf0 + gic_handle_irq+0x84/0x108 + el1_irq+0xcc/0x180 + arch_cpu_idle+0x18/0x40 + default_idle_call+0x4c/0x1a0 + cpuidle_idle_call+0x168/0x1e0 + do_idle+0xb4/0x104 + cpu_startup_entry+0x30/0x9c + secondary_start_kernel+0x104/0x180 + Code: d4210000 b0006161 910c8021 94013f4d (d4210000) + ---[ end trace 4a88c6a074082f8c ]--- + Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt + +Link: https://lkml.kernel.org/r/20211022023052.33114-1-rongwei.wang@linux.alibaba.com +Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") +Signed-off-by: Rongwei Wang +Signed-off-by: Xu Yu +Suggested-by: Yang Shi +Reviewed-by: Matthew Wilcox (Oracle) +Reviewed-by: Yang Shi +Acked-by: Kirill A. Shutemov +Cc: Song Liu +Cc: William Kucharski +Cc: Hugh Dickins +Cc: Mike Kravetz +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/khugepaged.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1763,6 +1763,10 @@ static void collapse_file(struct mm_stru + filemap_flush(mapping); + result = SCAN_FAIL; + goto xa_unlocked; ++ } else if (PageWriteback(page)) { ++ xas_unlock_irq(&xas); ++ result = SCAN_FAIL; ++ goto xa_unlocked; + } else if (trylock_page(page)) { + get_page(page); + xas_unlock_irq(&xas); +@@ -1798,7 +1802,8 @@ static void collapse_file(struct mm_stru + goto out_unlock; + } + +- if (!is_shmem && PageDirty(page)) { ++ if (!is_shmem && (PageDirty(page) || ++ PageWriteback(page))) { + /* + * khugepaged only works on read-only fd, so this + * page is dirty because it hasn't been flushed diff --git a/queue-5.14/mmc-cqhci-clear-halt-state-after-cqe-enable.patch b/queue-5.14/mmc-cqhci-clear-halt-state-after-cqe-enable.patch new file mode 100644 index 00000000000..53e9f9d37a2 --- /dev/null +++ b/queue-5.14/mmc-cqhci-clear-halt-state-after-cqe-enable.patch @@ -0,0 +1,57 @@ +From 92b18252b91de567cd875f2e84722b10ab34ee28 Mon Sep 17 00:00:00 2001 +From: Wenbin Mei +Date: Tue, 26 Oct 2021 15:08:12 +0800 +Subject: mmc: cqhci: clear HALT state after CQE enable + +From: Wenbin Mei + +commit 92b18252b91de567cd875f2e84722b10ab34ee28 upstream. + +While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush +cache) and disable cqe, for resume back, we enable CQE and not clear HALT +state. +In this case MediaTek mmc host controller will keep the value for HALT +state after CQE disable/enable flow, so the next CQE transfer after resume +will be timeout due to CQE is in HALT state, the log as below: +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP =========== +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps: 0x100020b6 | Version: 0x00000510 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config: 0x00001103 | Control: 0x00000001 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat: 0x00000000 | Int enab: 0x00000006 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig: 0x00000006 | Int Coal: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base: 0xfd05f000 | TDL up32: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell: 0x8000203c | TCN: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr: 0x00000000 | SSC1: 0x00001000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2: 0x00000001 | DCMD rsp: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask: 0xfdf9a080 | TERRI: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx: 0x00000000 | Resp arg: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP: 0x00000000 | CRNQDUN: 0x00000000 +<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS: 0x00000000 | CRNQIE: 0x00000000 + +This change check HALT state after CQE enable, if CQE is in HALT state, we +will clear it. + +Signed-off-by: Wenbin Mei +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") +Link: https://lore.kernel.org/r/20211026070812.9359-1-wenbin.mei@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/cqhci-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mmc/host/cqhci-core.c ++++ b/drivers/mmc/host/cqhci-core.c +@@ -282,6 +282,9 @@ static void __cqhci_enable(struct cqhci_ + + cqhci_writel(cq_host, cqcfg, CQHCI_CFG); + ++ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) ++ cqhci_writel(cq_host, 0, CQHCI_CTL); ++ + mmc->cqe_on = true; + + if (cq_host->ops->enable) diff --git a/queue-5.14/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch b/queue-5.14/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch new file mode 100644 index 00000000000..4d9fea70b77 --- /dev/null +++ b/queue-5.14/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch @@ -0,0 +1,55 @@ +From 697542bceae51f7620af333b065dd09d213629fb Mon Sep 17 00:00:00 2001 +From: Jaehoon Chung +Date: Fri, 22 Oct 2021 17:21:06 +0900 +Subject: mmc: dw_mmc: exynos: fix the finding clock sample value + +From: Jaehoon Chung + +commit 697542bceae51f7620af333b065dd09d213629fb upstream. + +Even though there are candiates value if can't find best value, it's +returned -EIO. It's not proper behavior. +If there is not best value, use a first candiate value to work eMMC. + +Signed-off-by: Jaehoon Chung +Tested-by: Marek Szyprowski +Tested-by: Christian Hewitt +Cc: stable@vger.kernel.org +Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence") +Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/dw_mmc-exynos.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/mmc/host/dw_mmc-exynos.c ++++ b/drivers/mmc/host/dw_mmc-exynos.c +@@ -464,6 +464,18 @@ static s8 dw_mci_exynos_get_best_clksmpl + } + } + ++ /* ++ * If there is no cadiates value, then it needs to return -EIO. ++ * If there are candiates values and don't find bset clk sample value, ++ * then use a first candiates clock sample value. ++ */ ++ for (i = 0; i < iter; i++) { ++ __c = ror8(candiates, i); ++ if ((__c & 0x1) == 0x1) { ++ loc = i; ++ goto out; ++ } ++ } + out: + return loc; + } +@@ -494,6 +506,8 @@ static int dw_mci_exynos_execute_tuning( + priv->tuned_sample = found; + } else { + ret = -EIO; ++ dev_warn(&mmc->class_dev, ++ "There is no candiates value about clksmpl!\n"); + } + + return ret; diff --git a/queue-5.14/mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch b/queue-5.14/mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch new file mode 100644 index 00000000000..91ed2bea0a8 --- /dev/null +++ b/queue-5.14/mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch @@ -0,0 +1,78 @@ +From e8a1ff65927080278e6826f797b7c197fb2611a6 Mon Sep 17 00:00:00 2001 +From: Wenbin Mei +Date: Thu, 28 Oct 2021 10:20:49 +0800 +Subject: mmc: mediatek: Move cqhci init behind ungate clock + +From: Wenbin Mei + +commit e8a1ff65927080278e6826f797b7c197fb2611a6 upstream. + +We must enable clock before cqhci init, because crypto needs read +information from CQHCI registers, otherwise, it will hang in MediaTek mmc +host controller. + +Signed-off-by: Wenbin Mei +Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support") +Cc: stable@vger.kernel.org +Acked-by: Chaotian Jing +Link: https://lore.kernel.org/r/20211028022049.22129-1-wenbin.mei@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/mtk-sd.c | 38 +++++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -2577,6 +2577,25 @@ static int msdc_drv_probe(struct platfor + host->dma_mask = DMA_BIT_MASK(32); + mmc_dev(mmc)->dma_mask = &host->dma_mask; + ++ host->timeout_clks = 3 * 1048576; ++ host->dma.gpd = dma_alloc_coherent(&pdev->dev, ++ 2 * sizeof(struct mt_gpdma_desc), ++ &host->dma.gpd_addr, GFP_KERNEL); ++ host->dma.bd = dma_alloc_coherent(&pdev->dev, ++ MAX_BD_NUM * sizeof(struct mt_bdma_desc), ++ &host->dma.bd_addr, GFP_KERNEL); ++ if (!host->dma.gpd || !host->dma.bd) { ++ ret = -ENOMEM; ++ goto release_mem; ++ } ++ msdc_init_gpd_bd(host, &host->dma); ++ INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout); ++ spin_lock_init(&host->lock); ++ ++ platform_set_drvdata(pdev, mmc); ++ msdc_ungate_clock(host); ++ msdc_init_hw(host); ++ + if (mmc->caps2 & MMC_CAP2_CQE) { + host->cq_host = devm_kzalloc(mmc->parent, + sizeof(*host->cq_host), +@@ -2597,25 +2616,6 @@ static int msdc_drv_probe(struct platfor + mmc->max_seg_size = 64 * 1024; + } + +- host->timeout_clks = 3 * 1048576; +- host->dma.gpd = dma_alloc_coherent(&pdev->dev, +- 2 * sizeof(struct mt_gpdma_desc), +- &host->dma.gpd_addr, GFP_KERNEL); +- host->dma.bd = dma_alloc_coherent(&pdev->dev, +- MAX_BD_NUM * sizeof(struct mt_bdma_desc), +- &host->dma.bd_addr, GFP_KERNEL); +- if (!host->dma.gpd || !host->dma.bd) { +- ret = -ENOMEM; +- goto release_mem; +- } +- msdc_init_gpd_bd(host, &host->dma); +- INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout); +- spin_lock_init(&host->lock); +- +- platform_set_drvdata(pdev, mmc); +- msdc_ungate_clock(host); +- msdc_init_hw(host); +- + ret = devm_request_irq(&pdev->dev, host->irq, msdc_irq, + IRQF_TRIGGER_NONE, pdev->name, host); + if (ret) diff --git a/queue-5.14/mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch b/queue-5.14/mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch new file mode 100644 index 00000000000..5e83419698c --- /dev/null +++ b/queue-5.14/mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch @@ -0,0 +1,68 @@ +From 9af372dc70e9fdcbb70939dac75365e7b88580b4 Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Fri, 15 Oct 2021 10:00:36 +0800 +Subject: mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit + +From: Haibo Chen + +commit 9af372dc70e9fdcbb70939dac75365e7b88580b4 upstream. + +To reset standard tuning circuit completely, after clear ESDHC_MIX_CTRL_EXE_TUNE, +also need to clear bit buffer_read_ready, this operation will finally clear the +USDHC IP internal logic flag execute_tuning_with_clr_buf, make sure the following +normal data transfer will not be impacted by standard tuning logic used before. + +Find this issue when do quick SD card insert/remove stress test. During standard +tuning prodedure, if remove SD card, USDHC standard tuning logic can't clear the +internal flag execute_tuning_with_clr_buf. Next time when insert SD card, all +data related commands can't get any data related interrupts, include data transfer +complete interrupt, data timeout interrupt, data CRC interrupt, data end bit interrupt. +Always trigger software timeout issue. Even reset the USDHC through bits in register +SYS_CTRL (0x2C, bit28 reset tuning, bit26 reset data, bit 25 reset command, bit 24 +reset all) can't recover this. From the user's point of view, USDHC stuck, SD can't +be recognized any more. + +Fixes: d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card") +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1634263236-6111-1-git-send-email-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -1133,6 +1133,7 @@ static void esdhc_reset_tuning(struct sd + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); + u32 ctrl; ++ int ret; + + /* Reset the tuning circuit */ + if (esdhc_is_usdhc(imx_data)) { +@@ -1145,7 +1146,22 @@ static void esdhc_reset_tuning(struct sd + } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) { + ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS); + ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL; ++ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE; + writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS); ++ /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */ ++ ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS, ++ ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50); ++ if (ret == -ETIMEDOUT) ++ dev_warn(mmc_dev(host->mmc), ++ "Warning! clear execute tuning bit failed\n"); ++ /* ++ * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the ++ * usdhc IP internal logic flag execute_tuning_with_clr_buf, which ++ * will finally make sure the normal data transfer logic correct. ++ */ ++ ctrl = readl(host->ioaddr + SDHCI_INT_STATUS); ++ ctrl |= SDHCI_INT_DATA_AVAIL; ++ writel(ctrl, host->ioaddr + SDHCI_INT_STATUS); + } + } + } diff --git a/queue-5.14/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch b/queue-5.14/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch new file mode 100644 index 00000000000..1821fe6bad9 --- /dev/null +++ b/queue-5.14/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch @@ -0,0 +1,84 @@ +From 4217d07b9fb328751f877d3bd9550122014860a2 Mon Sep 17 00:00:00 2001 +From: Shawn Guo +Date: Mon, 4 Oct 2021 10:49:35 +0800 +Subject: mmc: sdhci: Map more voltage level to SDHCI_POWER_330 + +From: Shawn Guo + +commit 4217d07b9fb328751f877d3bd9550122014860a2 upstream. + +On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V), +which is being treated as an invalid value by sdhci_set_power_noreg(). +And thus eMMC is totally broken on the platform. + +[ 1.436599] ------------[ cut here ]------------ +[ 1.436606] mmc0: Invalid vdd 0x17 +[ 1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436655] Modules linked in: +[ 1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G W 5.15.0-rc1+ #137 +[ 1.436669] Hardware name: Thundercomm TurboX CM2290 (DT) +[ 1.436674] Workqueue: events_unbound async_run_entry_fn +[ 1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436703] sp : ffff800010803a60 +[ 1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70 +[ 1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280 +[ 1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000 +[ 1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020 +[ 1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff +[ 1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc +[ 1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60 +[ 1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159 +[ 1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff +[ 1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80 +[ 1.436797] Call trace: +[ 1.436800] sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436805] sdhci_set_ios+0xa0/0x7fc +[ 1.436811] mmc_power_up.part.0+0xc4/0x164 +[ 1.436818] mmc_start_host+0xa0/0xb0 +[ 1.436824] mmc_add_host+0x60/0x90 +[ 1.436830] __sdhci_add_host+0x174/0x330 +[ 1.436836] sdhci_msm_probe+0x7c0/0x920 +[ 1.436842] platform_probe+0x68/0xe0 +[ 1.436850] really_probe.part.0+0x9c/0x31c +[ 1.436857] __driver_probe_device+0x98/0x144 +[ 1.436863] driver_probe_device+0xc8/0x15c +[ 1.436869] __device_attach_driver+0xb4/0x120 +[ 1.436875] bus_for_each_drv+0x78/0xd0 +[ 1.436881] __device_attach_async_helper+0xac/0xd0 +[ 1.436888] async_run_entry_fn+0x34/0x110 +[ 1.436895] process_one_work+0x1d0/0x354 +[ 1.436903] worker_thread+0x13c/0x470 +[ 1.436910] kthread+0x150/0x160 +[ 1.436915] ret_from_fork+0x10/0x20 +[ 1.436923] ---[ end trace fcfac44cb045c3a8 ]--- + +Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to +SDHCI_POWER_330 as well. + +Signed-off-by: Shawn Guo +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2042,6 +2042,12 @@ void sdhci_set_power_noreg(struct sdhci_ + break; + case MMC_VDD_32_33: + case MMC_VDD_33_34: ++ /* ++ * 3.4 ~ 3.6V are valid only for those platforms where it's ++ * known that the voltage range is supported by hardware. ++ */ ++ case MMC_VDD_34_35: ++ case MMC_VDD_35_36: + pwr = SDHCI_POWER_330; + break; + default: diff --git a/queue-5.14/mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch b/queue-5.14/mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch new file mode 100644 index 00000000000..d68c6010b3e --- /dev/null +++ b/queue-5.14/mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch @@ -0,0 +1,87 @@ +From 6ab4e2eb5e956a61e4d53cea3ab8c866ba79a830 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 13 Oct 2021 23:17:18 +0300 +Subject: mmc: sdhci-pci: Read card detect from ACPI for Intel Merrifield + +From: Andy Shevchenko + +commit 6ab4e2eb5e956a61e4d53cea3ab8c866ba79a830 upstream. + +Intel Merrifield platform had been converted to use ACPI enumeration. +However, the driver missed an update to retrieve card detect GPIO. +Fix it here. + +Unfortunately we can't rely on CD GPIO state because there are two +different PCB designs in the wild that are using the opposite card +detection sense and there is no way to distinguish those platforms, +that's why ignore CD GPIO completely and use it only as an event. + +Fixes: 4590d98f5a4f ("sfi: Remove framework for deprecated firmware") +BugLink: https://github.com/edison-fw/meta-intel-edison/issues/135 +Signed-off-by: Andy Shevchenko +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211013201723.52212-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-core.c | 29 ++++++++++++++++++++++++----- + 1 file changed, 24 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -616,16 +616,12 @@ static int intel_select_drive_strength(s + return intel_host->drv_strength; + } + +-static int bxt_get_cd(struct mmc_host *mmc) ++static int sdhci_get_cd_nogpio(struct mmc_host *mmc) + { +- int gpio_cd = mmc_gpio_get_cd(mmc); + struct sdhci_host *host = mmc_priv(mmc); + unsigned long flags; + int ret = 0; + +- if (!gpio_cd) +- return 0; +- + spin_lock_irqsave(&host->lock, flags); + + if (host->flags & SDHCI_DEVICE_DEAD) +@@ -638,6 +634,21 @@ out: + return ret; + } + ++static int bxt_get_cd(struct mmc_host *mmc) ++{ ++ int gpio_cd = mmc_gpio_get_cd(mmc); ++ ++ if (!gpio_cd) ++ return 0; ++ ++ return sdhci_get_cd_nogpio(mmc); ++} ++ ++static int mrfld_get_cd(struct mmc_host *mmc) ++{ ++ return sdhci_get_cd_nogpio(mmc); ++} ++ + #define SDHCI_INTEL_PWR_TIMEOUT_CNT 20 + #define SDHCI_INTEL_PWR_TIMEOUT_UDELAY 100 + +@@ -1341,6 +1352,14 @@ static int intel_mrfld_mmc_probe_slot(st + MMC_CAP_1_8V_DDR; + break; + case INTEL_MRFLD_SD: ++ slot->cd_idx = 0; ++ slot->cd_override_level = true; ++ /* ++ * There are two PCB designs of SD card slot with the opposite ++ * card detection sense. Quirk this out by ignoring GPIO state ++ * completely in the custom ->get_cd() callback. ++ */ ++ slot->host->mmc_host_ops.get_cd = mrfld_get_cd; + slot->host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V; + break; + case INTEL_MRFLD_SDIO: diff --git a/queue-5.14/mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch b/queue-5.14/mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch new file mode 100644 index 00000000000..4ed913dadaa --- /dev/null +++ b/queue-5.14/mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch @@ -0,0 +1,64 @@ +From 90935eb303e0d12f3d3d0383262e65290321f5f6 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 28 Oct 2021 21:51:49 +0200 +Subject: mmc: tmio: reenable card irqs after the reset callback + +From: Wolfram Sang + +commit 90935eb303e0d12f3d3d0383262e65290321f5f6 upstream. + +The reset callback may clear the internal card detect interrupts, so +make sure to reenable them if needed. + +Fixes: b4d86f37eacb ("mmc: renesas_sdhi: do hard reset if possible") +Reported-by: Biju Das +Signed-off-by: Wolfram Sang +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211028195149.8003-1-wsa+renesas@sang-engineering.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/tmio_mmc_core.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -195,6 +195,10 @@ static void tmio_mmc_reset(struct tmio_m + sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, host->sdcard_irq_mask_all); + host->sdcard_irq_mask = host->sdcard_irq_mask_all; + ++ if (host->native_hotplug) ++ tmio_mmc_enable_mmc_irqs(host, ++ TMIO_STAT_CARD_REMOVE | TMIO_STAT_CARD_INSERT); ++ + tmio_mmc_set_bus_width(host, host->mmc->ios.bus_width); + + if (host->pdata->flags & TMIO_MMC_SDIO_IRQ) { +@@ -956,8 +960,15 @@ static void tmio_mmc_set_ios(struct mmc_ + case MMC_POWER_OFF: + tmio_mmc_power_off(host); + /* For R-Car Gen2+, we need to reset SDHI specific SCC */ +- if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) ++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) { + host->reset(host); ++ ++ if (host->native_hotplug) ++ tmio_mmc_enable_mmc_irqs(host, ++ TMIO_STAT_CARD_REMOVE | ++ TMIO_STAT_CARD_INSERT); ++ } ++ + host->set_clock(host, 0); + break; + case MMC_POWER_UP: +@@ -1185,10 +1196,6 @@ int tmio_mmc_host_probe(struct tmio_mmc_ + _host->set_clock(_host, 0); + tmio_mmc_reset(_host); + +- if (_host->native_hotplug) +- tmio_mmc_enable_mmc_irqs(_host, +- TMIO_STAT_CARD_REMOVE | TMIO_STAT_CARD_INSERT); +- + spin_lock_init(&_host->lock); + mutex_init(&_host->ios_lock); + diff --git a/queue-5.14/mmc-vub300-fix-control-message-timeouts.patch b/queue-5.14/mmc-vub300-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..5192a0c8997 --- /dev/null +++ b/queue-5.14/mmc-vub300-fix-control-message-timeouts.patch @@ -0,0 +1,103 @@ +From 8c8171929116cc23f74743d99251eedadf62341a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:56:08 +0200 +Subject: mmc: vub300: fix control-message timeouts + +From: Johan Hovold + +commit 8c8171929116cc23f74743d99251eedadf62341a upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") +Cc: stable@vger.kernel.org # 3.0 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/vub300.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -576,7 +576,7 @@ static void check_vub300_port_status(str + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (sizeof(vub300->system_port_status) == retval) + new_system_port_status(vub300); + } +@@ -1241,7 +1241,7 @@ static void __download_offload_pseudocod + SET_INTERRUPT_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) + goto copy_error_message; +@@ -1284,7 +1284,7 @@ static void __download_offload_pseudocod + SET_TRANSFER_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) + goto copy_error_message; +@@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_CLOCK_SPEED, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, 0x00, buf, buf_array_size, HZ); ++ 0x00, 0x00, buf, buf_array_size, 1000); + if (retval != 8) { + dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED" + " %dkHz failed with retval=%d\n", kHzClock, retval); +@@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mm + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0000, 0x0000, NULL, 0, HZ); ++ 0x0000, 0x0000, NULL, 0, 1000); + /* must wait for the VUB300 u-proc to boot up */ + msleep(600); + } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) { + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0001, 0x0000, NULL, 0, HZ); ++ 0x0001, 0x0000, NULL, 0, 1000); + msleep(600); + vub300->card_powered = 1; + } else if (ios->power_mode == MMC_POWER_ON) { +@@ -2275,14 +2275,14 @@ static int vub300_probe(struct usb_inter + GET_HC_INF0, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->hc_info, +- sizeof(vub300->hc_info), HZ); ++ sizeof(vub300->hc_info), 1000); + if (retval < 0) + goto error5; + retval = + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_ROM_WAIT_STATES, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- firmware_rom_wait_states, 0x0000, NULL, 0, HZ); ++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000); + if (retval < 0) + goto error5; + dev_info(&vub300->udev->dev, +@@ -2297,7 +2297,7 @@ static int vub300_probe(struct usb_inter + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (retval < 0) { + goto error4; + } else if (sizeof(vub300->system_port_status) == retval) { diff --git a/queue-5.14/net-lan78xx-fix-division-by-zero-in-send-path.patch b/queue-5.14/net-lan78xx-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..ffe231bcbeb --- /dev/null +++ b/queue-5.14/net-lan78xx-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,43 @@ +From db6c3c064f5d55fa9969f33eafca3cdbefbb3541 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 26 Oct 2021 12:36:17 +0200 +Subject: net: lan78xx: fix division by zero in send path + +From: Johan Hovold + +commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in lan78xx_tx_bh() in case a malicious device has +broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Cc: stable@vger.kernel.org # 4.3 +Cc: Woojung.Huh@microchip.com +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/lan78xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3734,6 +3734,12 @@ static int lan78xx_probe(struct usb_inte + + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); + ++ /* Reject broken descriptors. */ ++ if (dev->maxpacket == 0) { ++ ret = -ENODEV; ++ goto out4; ++ } ++ + /* driver requires remote-wakeup capability during autosuspend. */ + intf->needs_remote_wakeup = 1; + diff --git a/queue-5.14/nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch b/queue-5.14/nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch new file mode 100644 index 00000000000..4bd0f930921 --- /dev/null +++ b/queue-5.14/nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch @@ -0,0 +1,58 @@ +From 25e1f67eda4a19c91dc05c84d6d413c53efb447b Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Sun, 24 Oct 2021 10:43:31 +0300 +Subject: nvme-tcp: fix H2CData PDU send accounting (again) + +From: Sagi Grimberg + +commit 25e1f67eda4a19c91dc05c84d6d413c53efb447b upstream. + +We should not access request members after the last send, even to +determine if indeed it was the last data payload send. The reason is +that a completion could have arrived and trigger a new execution of the +request which overridden these members. This was fixed by commit +825619b09ad3 ("nvme-tcp: fix possible use-after-completion"). + +Commit e371af033c56 broke that assumption again to address cases where +multiple r2t pdus are sent per request. To fix it, we need to record the +request data_sent and data_len and after the payload network send we +reference these counters to determine weather we should advance the +request iterator. + +Fixes: e371af033c56 ("nvme-tcp: fix incorrect h2cdata pdu offset accounting") +Reported-by: Keith Busch +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Sagi Grimberg +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/tcp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -913,12 +913,14 @@ static void nvme_tcp_fail_request(struct + static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) + { + struct nvme_tcp_queue *queue = req->queue; ++ int req_data_len = req->data_len; + + while (true) { + struct page *page = nvme_tcp_req_cur_page(req); + size_t offset = nvme_tcp_req_cur_offset(req); + size_t len = nvme_tcp_req_cur_length(req); + bool last = nvme_tcp_pdu_last_send(req, len); ++ int req_data_sent = req->data_sent; + int ret, flags = MSG_DONTWAIT; + + if (last && !queue->data_digest && !nvme_tcp_queue_more(queue)) +@@ -945,7 +947,7 @@ static int nvme_tcp_try_send_data(struct + * in the request where we don't want to modify it as we may + * compete with the RX path completing the request. + */ +- if (req->data_sent + ret < req->data_len) ++ if (req_data_sent + ret < req_data_len) + nvme_tcp_advance_req(req, ret); + + /* fully successful last send in current PDU */ diff --git a/queue-5.14/ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch b/queue-5.14/ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch new file mode 100644 index 00000000000..af004506f3d --- /dev/null +++ b/queue-5.14/ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch @@ -0,0 +1,105 @@ +From 6f1b228529ae49b0f85ab89bcdb6c365df401558 Mon Sep 17 00:00:00 2001 +From: Gautham Ananthakrishna +Date: Thu, 28 Oct 2021 14:36:17 -0700 +Subject: ocfs2: fix race between searching chunks and release journal_head from buffer_head + +From: Gautham Ananthakrishna + +commit 6f1b228529ae49b0f85ab89bcdb6c365df401558 upstream. + +Encountered a race between ocfs2_test_bg_bit_allocatable() and +jbd2_journal_put_journal_head() resulting in the below vmcore. + + PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3" + Call trace: + panic + oops_end + no_context + __bad_area_nosemaphore + bad_area_nosemaphore + __do_page_fault + do_page_fault + page_fault + [exception RIP: ocfs2_block_group_find_clear_bits+316] + ocfs2_block_group_find_clear_bits [ocfs2] + ocfs2_cluster_group_search [ocfs2] + ocfs2_search_chain [ocfs2] + ocfs2_claim_suballoc_bits [ocfs2] + __ocfs2_claim_clusters [ocfs2] + ocfs2_claim_clusters [ocfs2] + ocfs2_local_alloc_slide_window [ocfs2] + ocfs2_reserve_local_alloc_bits [ocfs2] + ocfs2_reserve_clusters_with_limit [ocfs2] + ocfs2_reserve_clusters [ocfs2] + ocfs2_lock_refcount_allocators [ocfs2] + ocfs2_make_clusters_writable [ocfs2] + ocfs2_replace_cow [ocfs2] + ocfs2_refcount_cow [ocfs2] + ocfs2_file_write_iter [ocfs2] + lo_rw_aio + loop_queue_work + kthread_worker_fn + kthread + ret_from_fork + +When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the +bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and +released the jounal head from the buffer head. Needed to take bit lock +for the bit 'BH_JournalHead' to fix this race. + +Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com +Signed-off-by: Gautham Ananthakrishna +Reviewed-by: Joseph Qi +Cc: +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/suballoc.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -1251,7 +1251,7 @@ static int ocfs2_test_bg_bit_allocatable + { + struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data; + struct journal_head *jh; +- int ret; ++ int ret = 1; + + if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap)) + return 0; +@@ -1259,14 +1259,18 @@ static int ocfs2_test_bg_bit_allocatable + if (!buffer_jbd(bg_bh)) + return 1; + +- jh = bh2jh(bg_bh); +- spin_lock(&jh->b_state_lock); +- bg = (struct ocfs2_group_desc *) jh->b_committed_data; +- if (bg) +- ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap); +- else +- ret = 1; +- spin_unlock(&jh->b_state_lock); ++ jbd_lock_bh_journal_head(bg_bh); ++ if (buffer_jbd(bg_bh)) { ++ jh = bh2jh(bg_bh); ++ spin_lock(&jh->b_state_lock); ++ bg = (struct ocfs2_group_desc *) jh->b_committed_data; ++ if (bg) ++ ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap); ++ else ++ ret = 1; ++ spin_unlock(&jh->b_state_lock); ++ } ++ jbd_unlock_bh_journal_head(bg_bh); + + return ret; + } diff --git a/queue-5.14/series b/queue-5.14/series index 29438639367..d17d647b034 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -14,3 +14,43 @@ tipc-fix-size-validations-for-the-msg_crypto-type.patch nfc-port100-fix-using-errno-as-command-type-mask.patch revert-net-mdiobus-fix-memory-leak-in-__mdiobus_register.patch net-tls-fix-flipped-sign-in-tls_err_abort-calls.patch +mmc-vub300-fix-control-message-timeouts.patch +mmc-cqhci-clear-halt-state-after-cqe-enable.patch +mmc-mediatek-move-cqhci-init-behind-ungate-clock.patch +mmc-tmio-reenable-card-irqs-after-the-reset-callback.patch +mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch +mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch +mmc-sdhci-pci-read-card-detect-from-acpi-for-intel-merrifield.patch +mmc-sdhci-esdhc-imx-clear-the-buffer_read_ready-to-reset-standard-tuning-circuit.patch +block-fix-partition-check-for-host-aware-zoned-block-devices.patch +ocfs2-fix-race-between-searching-chunks-and-release-journal_head-from-buffer_head.patch +nvme-tcp-fix-h2cdata-pdu-send-accounting-again.patch +ftrace-nds32-update-the-proto-for-ftrace_trace_function-to-match-ftrace_stub.patch +cfg80211-scan-fix-rcu-in-cfg80211_add_nontrans_list.patch +cfg80211-fix-management-registrations-locking.patch +net-lan78xx-fix-division-by-zero-in-send-path.patch +drm-amd-display-require-immediate-flip-support-for-dcn3.1-planes.patch +mm-hwpoison-remove-the-unnecessary-thp-check.patch +mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch +mm-thp-bail-out-early-in-collapse_file-for-writeback-page.patch +mm-khugepaged-skip-huge-page-collapse-for-special-files.patch +arm64-dts-imx8mm-kontron-fix-polarity-of-reg_rst_eth2.patch +arm64-dts-imx8mm-kontron-fix-can-spi-clock-frequency.patch +arm64-dts-imx8mm-kontron-fix-connection-type-for-vsc8531-rgmii-phy.patch +arm64-dts-imx8mm-kontron-set-lower-limit-of-vdd_snvs-to-800-mv.patch +arm64-dts-imx8mm-kontron-make-sure-soc-and-dram-supply-voltages-are-correct.patch +mac80211-mesh-fix-he-operation-element-length-check.patch +drm-ttm-fix-memleak-in-ttm_transfered_destroy.patch +drm-i915-convert-unconditional-clflush-to-drm_clflush_virt_range.patch +drm-i915-catch-yet-another-unconditioal-clflush.patch +drm-i915-dp-skip-the-hw-readout-of-dpcd-on-disabled-encoders.patch +drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch +drm-amdgpu-fix-out-of-bounds-write.patch +drm-amdgpu-support-b0-b1-external-revision-id-for-yellow-carp.patch +drm-amd-display-limit-display-scaling-to-up-to-true-4k-for-dcn-3.1.patch +drm-amd-display-fix-prefetch-bandwidth-calculation-for-dcn3.1.patch +drm-amd-display-increase-z9-latency-to-workaround-underflow-in-z9.patch +drm-amd-display-increase-watermark-latencies-for-dcn3.1.patch +drm-amd-display-moved-dccg-init-to-after-bios-golden-init.patch +drm-amd-display-fallback-to-clocks-which-meet-requested-voltage-on-dcn31.patch +drm-amd-display-fix-deadlock-when-falling-back-to-v2-from-v3.patch