From: Sasha Levin Date: Sun, 25 Sep 2022 14:30:25 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.330~45 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=58804af4eafe4d06bfd3fbe7b59d6f7bacebed77;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/cifs-always-initialize-struct-msghdr-smb_msg-complet.patch b/queue-5.10/cifs-always-initialize-struct-msghdr-smb_msg-complet.patch new file mode 100644 index 00000000000..279d0127186 --- /dev/null +++ b/queue-5.10/cifs-always-initialize-struct-msghdr-smb_msg-complet.patch @@ -0,0 +1,104 @@ +From 9f4281484e3373b26d254179b88bcfd288d5ddf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 05:25:47 +0200 +Subject: cifs: always initialize struct msghdr smb_msg completely + +From: Stefan Metzmacher + +[ Upstream commit bedc8f76b3539ac4f952114b316bcc2251e808ce ] + +So far we were just lucky because the uninitialized members +of struct msghdr are not used by default on a SOCK_STREAM tcp +socket. + +But as new things like msg_ubuf and sg_from_iter where added +recently, we should play on the safe side and avoid potention +problems in future. + +Signed-off-by: Stefan Metzmacher +Cc: stable@vger.kernel.org +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 11 +++-------- + fs/cifs/transport.c | 6 +----- + 2 files changed, 4 insertions(+), 13 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6e7d5b9e84b8..d1c3086d7ddd 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -695,9 +695,6 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg) + int length = 0; + int total_read; + +- smb_msg->msg_control = NULL; +- smb_msg->msg_controllen = 0; +- + for (total_read = 0; msg_data_left(smb_msg); total_read += length) { + try_to_freeze(); + +@@ -748,7 +745,7 @@ int + cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + unsigned int to_read) + { +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + struct kvec iov = {.iov_base = buf, .iov_len = to_read}; + iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read); + +@@ -758,15 +755,13 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + ssize_t + cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read) + { +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + + /* + * iov_iter_discard already sets smb_msg.type and count and iov_offset + * and cifs_readv_from_socket sets msg_control and msg_controllen + * so little to initialize in struct msghdr + */ +- smb_msg.msg_name = NULL; +- smb_msg.msg_namelen = 0; + iov_iter_discard(&smb_msg.msg_iter, READ, to_read); + + return cifs_readv_from_socket(server, &smb_msg); +@@ -776,7 +771,7 @@ int + cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page, + unsigned int page_offset, unsigned int to_read) + { +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + struct bio_vec bv = { + .bv_page = page, .bv_len = to_read, .bv_offset = page_offset}; + iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read); +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 383ae8744c33..b137006f0fd2 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -209,10 +209,6 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, + + *sent = 0; + +- smb_msg->msg_name = NULL; +- smb_msg->msg_namelen = 0; +- smb_msg->msg_control = NULL; +- smb_msg->msg_controllen = 0; + if (server->noblocksnd) + smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; + else +@@ -324,7 +320,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + sigset_t mask, oldmask; + size_t total_len = 0, sent, size; + struct socket *ssocket = server->ssocket; +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + __be32 rfc1002_marker; + + if (cifs_rdma_enabled(server)) { +-- +2.35.1 + diff --git a/queue-5.10/cifs-use-discard-iterator-to-discard-unneeded-networ.patch b/queue-5.10/cifs-use-discard-iterator-to-discard-unneeded-networ.patch new file mode 100644 index 00000000000..41bfaa4cc67 --- /dev/null +++ b/queue-5.10/cifs-use-discard-iterator-to-discard-unneeded-networ.patch @@ -0,0 +1,86 @@ +From d0588c67b12a4623801c23cf9b038556babee16e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Feb 2021 00:15:21 -0600 +Subject: cifs: use discard iterator to discard unneeded network data more + efficiently + +From: David Howells + +[ Upstream commit cf0604a686b11175d8beae60281c4ccc95aaa5c2 ] + +The iterator, ITER_DISCARD, that can only be used in READ mode and +just discards any data copied to it, was added to allow a network +filesystem to discard any unwanted data sent by a server. +Convert cifs_discard_from_socket() to use this. + +Signed-off-by: David Howells +Signed-off-by: Steve French +Stable-dep-of: bedc8f76b353 ("cifs: always initialize struct msghdr smb_msg completely") +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsproto.h | 2 ++ + fs/cifs/cifssmb.c | 6 +++--- + fs/cifs/connect.c | 17 +++++++++++++++++ + 3 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 24c6f36177ba..a6ca4eda9a5a 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -230,6 +230,8 @@ extern unsigned int setup_special_user_owner_ACE(struct cifs_ace *pace); + extern void dequeue_mid(struct mid_q_entry *mid, bool malformed); + extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + unsigned int to_read); ++extern ssize_t cifs_discard_from_socket(struct TCP_Server_Info *server, ++ size_t to_read); + extern int cifs_read_page_from_socket(struct TCP_Server_Info *server, + struct page *page, + unsigned int page_offset, +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 0496934feecb..c279527aae92 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1451,9 +1451,9 @@ cifs_discard_remaining_data(struct TCP_Server_Info *server) + while (remaining > 0) { + int length; + +- length = cifs_read_from_socket(server, server->bigbuf, +- min_t(unsigned int, remaining, +- CIFSMaxBufSize + MAX_HEADER_SIZE(server))); ++ length = cifs_discard_from_socket(server, ++ min_t(size_t, remaining, ++ CIFSMaxBufSize + MAX_HEADER_SIZE(server))); + if (length < 0) + return length; + server->total_read += length; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 7f5d173760cf..6e7d5b9e84b8 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -755,6 +755,23 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + return cifs_readv_from_socket(server, &smb_msg); + } + ++ssize_t ++cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read) ++{ ++ struct msghdr smb_msg; ++ ++ /* ++ * iov_iter_discard already sets smb_msg.type and count and iov_offset ++ * and cifs_readv_from_socket sets msg_control and msg_controllen ++ * so little to initialize in struct msghdr ++ */ ++ smb_msg.msg_name = NULL; ++ smb_msg.msg_namelen = 0; ++ iov_iter_discard(&smb_msg.msg_iter, READ, to_read); ++ ++ return cifs_readv_from_socket(server, &smb_msg); ++} ++ + int + cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page, + unsigned int page_offset, unsigned int to_read) +-- +2.35.1 + diff --git a/queue-5.10/drivers-hv-never-allocate-anything-besides-framebuff.patch b/queue-5.10/drivers-hv-never-allocate-anything-besides-framebuff.patch new file mode 100644 index 00000000000..cff1224c42c --- /dev/null +++ b/queue-5.10/drivers-hv-never-allocate-anything-besides-framebuff.patch @@ -0,0 +1,101 @@ +From 90a2e8cac9a1f025b885fbf2e1e00fcf248391c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Aug 2022 15:03:45 +0200 +Subject: Drivers: hv: Never allocate anything besides framebuffer from + framebuffer memory region + +From: Vitaly Kuznetsov + +[ Upstream commit f0880e2cb7e1f8039a048fdd01ce45ab77247221 ] + +Passed through PCI device sometimes misbehave on Gen1 VMs when Hyper-V +DRM driver is also loaded. Looking at IOMEM assignment, we can see e.g. + +$ cat /proc/iomem +... +f8000000-fffbffff : PCI Bus 0000:00 + f8000000-fbffffff : 0000:00:08.0 + f8000000-f8001fff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe +... +fe0000000-fffffffff : PCI Bus 0000:00 + fe0000000-fe07fffff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe + fe0000000-fe07fffff : 2ba2:00:02.0 + fe0000000-fe07fffff : mlx4_core + +the interesting part is the 'f8000000' region as it is actually the +VM's framebuffer: + +$ lspci -v +... +0000:00:08.0 VGA compatible controller: Microsoft Corporation Hyper-V virtual VGA (prog-if 00 [VGA controller]) + Flags: bus master, fast devsel, latency 0, IRQ 11 + Memory at f8000000 (32-bit, non-prefetchable) [size=64M] +... + + hv_vmbus: registering driver hyperv_drm + hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Synthvid Version major 3, minor 5 + hyperv_drm 0000:00:08.0: vgaarb: deactivate vga console + hyperv_drm 0000:00:08.0: BAR 0: can't reserve [mem 0xf8000000-0xfbffffff] + hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Cannot request framebuffer, boot fb still active? + +Note: "Cannot request framebuffer" is not a fatal error in +hyperv_setup_gen1() as the code assumes there's some other framebuffer +device there but we actually have some other PCI device (mlx4 in this +case) config space there! + +The problem appears to be that vmbus_allocate_mmio() can use dedicated +framebuffer region to serve any MMIO request from any device. The +semantics one might assume of a parameter named "fb_overlap_ok" +aren't implemented because !fb_overlap_ok essentially has no effect. +The existing semantics are really "prefer_fb_overlap". This patch +implements the expected and needed semantics, which is to not allocate +from the frame buffer space when !fb_overlap_ok. + +Note, Gen2 VMs are usually unaffected by the issue because +framebuffer region is already taken by EFI fb (in case kernel supports +it) but Gen1 VMs may have this region unclaimed by the time Hyper-V PCI +pass-through driver tries allocating MMIO space if Hyper-V DRM/FB drivers +load after it. Devices can be brought up in any sequence so let's +resolve the issue by always ignoring 'fb_mmio' region for non-FB +requests, even if the region is unclaimed. + +Reviewed-by: Michael Kelley +Signed-off-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/20220827130345.1320254-4-vkuznets@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/vmbus_drv.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 5d820037e291..514279dac7cb 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2251,7 +2251,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, + bool fb_overlap_ok) + { + struct resource *iter, *shadow; +- resource_size_t range_min, range_max, start; ++ resource_size_t range_min, range_max, start, end; + const char *dev_n = dev_name(&device_obj->device); + int retval; + +@@ -2286,6 +2286,14 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, + range_max = iter->end; + start = (range_min + align - 1) & ~(align - 1); + for (; start + size - 1 <= range_max; start += align) { ++ end = start + size - 1; ++ ++ /* Skip the whole fb_mmio region if not fb_overlap_ok */ ++ if (!fb_overlap_ok && fb_mmio && ++ (((start >= fb_mmio->start) && (start <= fb_mmio->end)) || ++ ((end >= fb_mmio->start) && (end <= fb_mmio->end)))) ++ continue; ++ + shadow = __request_region(iter, start, size, NULL, + IORESOURCE_BUSY); + if (!shadow) +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-limit-user-regamma-to-a-valid-value.patch b/queue-5.10/drm-amd-display-limit-user-regamma-to-a-valid-value.patch new file mode 100644 index 00000000000..f9c80bad66b --- /dev/null +++ b/queue-5.10/drm-amd-display-limit-user-regamma-to-a-valid-value.patch @@ -0,0 +1,55 @@ +From f295be33950c226984bccfb2b33d190fc9d16596 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Aug 2022 18:30:31 +0800 +Subject: drm/amd/display: Limit user regamma to a valid value + +From: Yao Wang1 + +[ Upstream commit 3601d620f22e37740cf73f8278eabf9f2aa19eb7 ] + +[Why] +For HDR mode, we get total 512 tf_point and after switching to SDR mode +we actually get 400 tf_point and the rest of points(401~512) still use +dirty value from HDR mode. We should limit the rest of the points to max +value. + +[How] +Limit the value when coordinates_x.x > 1, just like what we do in +translate_from_linear_space for other re-gamma build paths. + +Tested-by: Daniel Wheeler +Reviewed-by: Krunoslav Kovac +Reviewed-by: Aric Cyr +Acked-by: Pavle Kotarac +Signed-off-by: Yao Wang1 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +index 09bc2c249e1a..3c4390d71a82 100644 +--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c ++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +@@ -1524,6 +1524,7 @@ static void interpolate_user_regamma(uint32_t hw_points_num, + struct fixed31_32 lut2; + struct fixed31_32 delta_lut; + struct fixed31_32 delta_index; ++ const struct fixed31_32 one = dc_fixpt_from_int(1); + + i = 0; + /* fixed_pt library has problems handling too small values */ +@@ -1552,6 +1553,9 @@ static void interpolate_user_regamma(uint32_t hw_points_num, + } else + hw_x = coordinates_x[i].x; + ++ if (dc_fixpt_le(one, hw_x)) ++ hw_x = one; ++ + norm_x = dc_fixpt_mul(norm_factor, hw_x); + index = dc_fixpt_floor(norm_x); + if (index < 0 || index > 255) +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-mark-dml30-s-useminimumdcfclk-as-noi.patch b/queue-5.10/drm-amd-display-mark-dml30-s-useminimumdcfclk-as-noi.patch new file mode 100644 index 00000000000..9224c4a6d8b --- /dev/null +++ b/queue-5.10/drm-amd-display-mark-dml30-s-useminimumdcfclk-as-noi.patch @@ -0,0 +1,62 @@ +From 67eb92a10f106aba36b6e3ce0eb015075d016e65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 13:34:09 -0700 +Subject: drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for + stack usage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nathan Chancellor + +[ Upstream commit 41012d715d5d7b9751ae84b8fb255e404ac9c5d0 ] + +This function consumes a lot of stack space and it blows up the size of +dml30_ModeSupportAndSystemConfigurationFull() with clang: + + drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3542:6: error: stack frame size (2200) exceeds limit (2048) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] + void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) + ^ + 1 error generated. + +Commit a0f7e7f759cf ("drm/amd/display: fix i386 frame size warning") +aimed to address this for i386 but it did not help x86_64. + +To reduce the amount of stack space that +dml30_ModeSupportAndSystemConfigurationFull() uses, mark +UseMinimumDCFCLK() as noinline, using the _for_stack variant for +documentation. While this will increase the total amount of stack usage +between the two functions (1632 and 1304 bytes respectively), it will +make sure both stay below the limit of 2048 bytes for these files. The +aforementioned change does help reduce UseMinimumDCFCLK()'s stack usage +so it should not be reverted in favor of this change. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1681 +Reported-by: "Sudip Mukherjee (Codethink)" +Tested-by: Maíra Canal +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Nathan Chancellor +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +index 2663f1b31842..e427f4ffa080 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +@@ -6653,8 +6653,7 @@ static double CalculateUrgentLatency( + return ret; + } + +- +-static void UseMinimumDCFCLK( ++static noinline_for_stack void UseMinimumDCFCLK( + struct display_mode_lib *mode_lib, + int MaxInterDCNTileRepeaters, + int MaxPrefetchMode, +-- +2.35.1 + diff --git a/queue-5.10/drm-amdgpu-fix-check-for-ras-support.patch b/queue-5.10/drm-amdgpu-fix-check-for-ras-support.patch new file mode 100644 index 00000000000..0e096e5f480 --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-check-for-ras-support.patch @@ -0,0 +1,62 @@ +From fff067e0fac3026bbf412681bed661554e18e8ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 19:11:01 -0500 +Subject: drm/amdgpu: Fix check for RAS support + +From: Luben Tuikov + +[ Upstream commit 084e2640e51626f413f85663e3ba7e32d4272477 ] + +Use positive logic to check for RAS +support. Rename the function to actually indicate +what it is testing for. Essentially, make the +function a predicate with the correct name. + +Cc: Stanley Yang +Cc: Alexander Deucher +Signed-off-by: Luben Tuikov +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Stable-dep-of: 6c2049066355 ("drm/amdgpu: Don't enable LTR if not supported") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index eb22a190c242..3638f0e12a2b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -1979,15 +1979,12 @@ int amdgpu_ras_request_reset_on_boot(struct amdgpu_device *adev, + return 0; + } + +-static int amdgpu_ras_check_asic_type(struct amdgpu_device *adev) ++static bool amdgpu_ras_asic_supported(struct amdgpu_device *adev) + { +- if (adev->asic_type != CHIP_VEGA10 && +- adev->asic_type != CHIP_VEGA20 && +- adev->asic_type != CHIP_ARCTURUS && +- adev->asic_type != CHIP_SIENNA_CICHLID) +- return 1; +- else +- return 0; ++ return adev->asic_type == CHIP_VEGA10 || ++ adev->asic_type == CHIP_VEGA20 || ++ adev->asic_type == CHIP_ARCTURUS || ++ adev->asic_type == CHIP_SIENNA_CICHLID; + } + + /* +@@ -2006,7 +2003,7 @@ static void amdgpu_ras_check_supported(struct amdgpu_device *adev, + *supported = 0; + + if (amdgpu_sriov_vf(adev) || !adev->is_atom_fw || +- amdgpu_ras_check_asic_type(adev)) ++ !amdgpu_ras_asic_supported(adev)) + return; + + if (amdgpu_atomfirmware_mem_ecc_supported(adev)) { +-- +2.35.1 + diff --git a/queue-5.10/drm-amdgpu-use-dirty-framebuffer-helper.patch b/queue-5.10/drm-amdgpu-use-dirty-framebuffer-helper.patch new file mode 100644 index 00000000000..4d9491f6194 --- /dev/null +++ b/queue-5.10/drm-amdgpu-use-dirty-framebuffer-helper.patch @@ -0,0 +1,44 @@ +From 222790553c03d70cfc4b1c0e17114c6971612410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 15:01:49 -0400 +Subject: drm/amdgpu: use dirty framebuffer helper + +From: Hamza Mahfooz + +[ Upstream commit 66f99628eb24409cb8feb5061f78283c8b65f820 ] + +Currently, we aren't handling DRM_IOCTL_MODE_DIRTYFB. So, use +drm_atomic_helper_dirtyfb() as the dirty callback in the amdgpu_fb_funcs +struct. + +Signed-off-by: Hamza Mahfooz +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 7cc7af2a6822..947f50e402ba 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -498,6 +499,7 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector, + static const struct drm_framebuffer_funcs amdgpu_fb_funcs = { + .destroy = drm_gem_fb_destroy, + .create_handle = drm_gem_fb_create_handle, ++ .dirty = drm_atomic_helper_dirtyfb, + }; + + uint32_t amdgpu_display_supported_domains(struct amdgpu_device *adev, +-- +2.35.1 + diff --git a/queue-5.10/drm-gma500-fix-bug-sleeping-function-called-from-inv.patch b/queue-5.10/drm-gma500-fix-bug-sleeping-function-called-from-inv.patch new file mode 100644 index 00000000000..59d085e3068 --- /dev/null +++ b/queue-5.10/drm-gma500-fix-bug-sleeping-function-called-from-inv.patch @@ -0,0 +1,106 @@ +From ecfa03b1acd96a9e366edfc58eaca789640c57b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 22:38:50 +0200 +Subject: drm/gma500: Fix BUG: sleeping function called from invalid context + errors + +From: Hans de Goede + +[ Upstream commit 63e37a79f7bd939314997e29c2f5a9f0ef184281 ] + +gma_crtc_page_flip() was holding the event_lock spinlock while calling +crtc_funcs->mode_set_base() which takes ww_mutex. + +The only reason to hold event_lock is to clear gma_crtc->page_flip_event +on mode_set_base() errors. + +Instead unlock it after setting gma_crtc->page_flip_event and on +errors re-take the lock and clear gma_crtc->page_flip_event it +it is still set. + +This fixes the following WARN/stacktrace: + +[ 512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870 +[ 512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell +[ 512.123031] preempt_count: 1, expected: 0 +[ 512.123048] RCU nest depth: 0, expected: 0 +[ 512.123066] INFO: lockdep is turned off. +[ 512.123080] irq event stamp: 0 +[ 512.123094] hardirqs last enabled at (0): [<0000000000000000>] 0x0 +[ 512.123134] hardirqs last disabled at (0): [] copy_process+0x9fc/0x1de0 +[ 512.123176] softirqs last enabled at (0): [] copy_process+0x9fc/0x1de0 +[ 512.123207] softirqs last disabled at (0): [<0000000000000000>] 0x0 +[ 512.123233] Preemption disabled at: +[ 512.123241] [<0000000000000000>] 0x0 +[ 512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G W 5.19.0+ #1 +[ 512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 +[ 512.123323] Call Trace: +[ 512.123346] +[ 512.123370] dump_stack_lvl+0x5b/0x77 +[ 512.123412] __might_resched.cold+0xff/0x13a +[ 512.123458] ww_mutex_lock+0x1e/0xa0 +[ 512.123495] psb_gem_pin+0x2c/0x150 [gma500_gfx] +[ 512.123601] gma_pipe_set_base+0x76/0x240 [gma500_gfx] +[ 512.123708] gma_crtc_page_flip+0x95/0x130 [gma500_gfx] +[ 512.123808] drm_mode_page_flip_ioctl+0x57d/0x5d0 +[ 512.123897] ? drm_mode_cursor2_ioctl+0x10/0x10 +[ 512.123936] drm_ioctl_kernel+0xa1/0x150 +[ 512.123984] drm_ioctl+0x21f/0x420 +[ 512.124025] ? drm_mode_cursor2_ioctl+0x10/0x10 +[ 512.124070] ? rcu_read_lock_bh_held+0xb/0x60 +[ 512.124104] ? lock_release+0x1ef/0x2d0 +[ 512.124161] __x64_sys_ioctl+0x8d/0xd0 +[ 512.124203] do_syscall_64+0x58/0x80 +[ 512.124239] ? do_syscall_64+0x67/0x80 +[ 512.124267] ? trace_hardirqs_on_prepare+0x55/0xe0 +[ 512.124300] ? do_syscall_64+0x67/0x80 +[ 512.124340] ? rcu_read_lock_sched_held+0x10/0x80 +[ 512.124377] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 512.124411] RIP: 0033:0x7fcc4a70740f +[ 512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 +[ 512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +[ 512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f +[ 512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009 +[ 512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034 +[ 512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0 +[ 512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0 +[ 512.124647] + +Signed-off-by: Hans de Goede +Signed-off-by: Patrik Jakobsson +Link: https://patchwork.freedesktop.org/patch/msgid/20220906203852.527663-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/gma_display.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/gma500/gma_display.c b/drivers/gpu/drm/gma500/gma_display.c +index 3df6d6e850f5..70148ae16f14 100644 +--- a/drivers/gpu/drm/gma500/gma_display.c ++++ b/drivers/gpu/drm/gma500/gma_display.c +@@ -529,15 +529,18 @@ int gma_crtc_page_flip(struct drm_crtc *crtc, + WARN_ON(drm_crtc_vblank_get(crtc) != 0); + + gma_crtc->page_flip_event = event; ++ spin_unlock_irqrestore(&dev->event_lock, flags); + + /* Call this locked if we want an event at vblank interrupt. */ + ret = crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y, old_fb); + if (ret) { +- gma_crtc->page_flip_event = NULL; +- drm_crtc_vblank_put(crtc); ++ spin_lock_irqsave(&dev->event_lock, flags); ++ if (gma_crtc->page_flip_event) { ++ gma_crtc->page_flip_event = NULL; ++ drm_crtc_vblank_put(crtc); ++ } ++ spin_unlock_irqrestore(&dev->event_lock, flags); + } +- +- spin_unlock_irqrestore(&dev->event_lock, flags); + } else { + ret = crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y, old_fb); + } +-- +2.35.1 + diff --git a/queue-5.10/drm-rockchip-fix-return-type-of-cdn_dp_connector_mod.patch b/queue-5.10/drm-rockchip-fix-return-type-of-cdn_dp_connector_mod.patch new file mode 100644 index 00000000000..ddd246af771 --- /dev/null +++ b/queue-5.10/drm-rockchip-fix-return-type-of-cdn_dp_connector_mod.patch @@ -0,0 +1,51 @@ +From 8d4dcbdd831eeb0069266e12d50ad9c47ef6791f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 13:55:55 -0700 +Subject: drm/rockchip: Fix return type of cdn_dp_connector_mode_valid + +From: Nathan Huckleberry + +[ Upstream commit b0b9408f132623dc88e78adb5282f74e4b64bb57 ] + +The mode_valid field in drm_connector_helper_funcs is expected to be of +type: +enum drm_mode_status (* mode_valid) (struct drm_connector *connector, + struct drm_display_mode *mode); + +The mismatched return type breaks forward edge kCFI since the underlying +function definition does not match the function hook definition. + +The return type of cdn_dp_connector_mode_valid should be changed from +int to enum drm_mode_status. + +Reported-by: Dan Carpenter +Link: https://github.com/ClangBuiltLinux/linux/issues/1703 +Cc: llvm@lists.linux.dev +Signed-off-by: Nathan Huckleberry +Reviewed-by: Nathan Chancellor +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20220913205555.155149-1-nhuck@google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/cdn-dp-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c +index dec54c70e008..857c47c69ef1 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c +@@ -276,8 +276,9 @@ static int cdn_dp_connector_get_modes(struct drm_connector *connector) + return ret; + } + +-static int cdn_dp_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++cdn_dp_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + struct cdn_dp_device *dp = connector_to_dp(connector); + struct drm_display_info *display_info = &dp->connector.display_info; +-- +2.35.1 + diff --git a/queue-5.10/gpio-ixp4xx-make-irqchip-immutable.patch b/queue-5.10/gpio-ixp4xx-make-irqchip-immutable.patch new file mode 100644 index 00000000000..32bc8220f98 --- /dev/null +++ b/queue-5.10/gpio-ixp4xx-make-irqchip-immutable.patch @@ -0,0 +1,82 @@ +From 7861e366b3c3b67a6fae5273f8994f5986eabe1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Sep 2022 21:07:51 +0200 +Subject: gpio: ixp4xx: Make irqchip immutable + +From: Linus Walleij + +[ Upstream commit 94e9bc73d85aa6ecfe249e985ff57abe0ab35f34 ] + +This turns the IXP4xx GPIO irqchip into an immutable +irqchip, a bit different from the standard template due +to being hierarchical. + +Tested on the IXP4xx which uses drivers/ata/pata_ixp4xx_cf.c +for a rootfs on compact flash with IRQs from this GPIO +block to the CF ATA controller. + +Cc: Marc Zyngier +Signed-off-by: Linus Walleij +Acked-by: Marc Zyngier +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-ixp4xx.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-ixp4xx.c b/drivers/gpio/gpio-ixp4xx.c +index b3b050604e0b..6bd047e2ca46 100644 +--- a/drivers/gpio/gpio-ixp4xx.c ++++ b/drivers/gpio/gpio-ixp4xx.c +@@ -67,6 +67,14 @@ static void ixp4xx_gpio_irq_ack(struct irq_data *d) + __raw_writel(BIT(d->hwirq), g->base + IXP4XX_REG_GPIS); + } + ++static void ixp4xx_gpio_mask_irq(struct irq_data *d) ++{ ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ ++ irq_chip_mask_parent(d); ++ gpiochip_disable_irq(gc, d->hwirq); ++} ++ + static void ixp4xx_gpio_irq_unmask(struct irq_data *d) + { + struct gpio_chip *gc = irq_data_get_irq_chip_data(d); +@@ -76,6 +84,7 @@ static void ixp4xx_gpio_irq_unmask(struct irq_data *d) + if (!(g->irq_edge & BIT(d->hwirq))) + ixp4xx_gpio_irq_ack(d); + ++ gpiochip_enable_irq(gc, d->hwirq); + irq_chip_unmask_parent(d); + } + +@@ -153,12 +162,14 @@ static int ixp4xx_gpio_irq_set_type(struct irq_data *d, unsigned int type) + return irq_chip_set_type_parent(d, IRQ_TYPE_LEVEL_HIGH); + } + +-static struct irq_chip ixp4xx_gpio_irqchip = { ++static const struct irq_chip ixp4xx_gpio_irqchip = { + .name = "IXP4GPIO", + .irq_ack = ixp4xx_gpio_irq_ack, +- .irq_mask = irq_chip_mask_parent, ++ .irq_mask = ixp4xx_gpio_mask_irq, + .irq_unmask = ixp4xx_gpio_irq_unmask, + .irq_set_type = ixp4xx_gpio_irq_set_type, ++ .flags = IRQCHIP_IMMUTABLE, ++ GPIOCHIP_IRQ_RESOURCE_HELPERS, + }; + + static int ixp4xx_gpio_child_to_parent_hwirq(struct gpio_chip *gc, +@@ -282,7 +293,7 @@ static int ixp4xx_gpio_probe(struct platform_device *pdev) + g->gc.owner = THIS_MODULE; + + girq = &g->gc.irq; +- girq->chip = &ixp4xx_gpio_irqchip; ++ gpio_irq_chip_set_chip(girq, &ixp4xx_gpio_irqchip); + girq->fwnode = g->fwnode; + girq->parent_domain = parent; + girq->child_to_parent_hwirq = ixp4xx_gpio_child_to_parent_hwirq; +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 786f427a8ca..0e125418846 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -120,3 +120,13 @@ serial-tegra-tcu-use-uart_xmit_advance-fixes-icount.tx-accounting.patch s390-dasd-fix-oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup.patch usb-xhci-mtk-fix-issue-of-out-of-bounds-array-access.patch vfio-type1-fix-vaddr_get_pfns-return-in-vfio_pin_page_external.patch +drm-amdgpu-fix-check-for-ras-support.patch +cifs-use-discard-iterator-to-discard-unneeded-networ.patch +cifs-always-initialize-struct-msghdr-smb_msg-complet.patch +drivers-hv-never-allocate-anything-besides-framebuff.patch +drm-gma500-fix-bug-sleeping-function-called-from-inv.patch +gpio-ixp4xx-make-irqchip-immutable.patch +drm-amdgpu-use-dirty-framebuffer-helper.patch +drm-amd-display-limit-user-regamma-to-a-valid-value.patch +drm-amd-display-mark-dml30-s-useminimumdcfclk-as-noi.patch +drm-rockchip-fix-return-type-of-cdn_dp_connector_mod.patch