From: Greg Kroah-Hartman Date: Sat, 13 Mar 2021 13:45:04 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.4.262~58 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=74009714e1fd8673070a87ef56ca926b77f53247;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch alsa-hda-flush-pending-unsolicited-events-before-suspend.patch alsa-hda-hdmi-cancel-pending-works-before-suspend.patch alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch arm64-mte-map-hotplugged-memory-as-normal-tagged.patch arm64-perf-fix-64-bit-event-counter-read-truncation.patch block-discard-page-cache-of-zone-reset-target-range.patch block-try-to-handle-busy-underlying-device-on-discard.patch cifs-do-not-send-close-in-compound-create-close-requests.patch mmc-core-fix-partition-switch-time-for-emmc.patch mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch s390-dasd-fix-hanging-dasd-driver-unbind.patch s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch software-node-fix-node-registration.patch xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch --- diff --git a/queue-5.10/alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch b/queue-5.10/alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch new file mode 100644 index 00000000000..dbc5c3870df --- /dev/null +++ b/queue-5.10/alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch @@ -0,0 +1,44 @@ +From 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 10 Mar 2021 12:28:08 +0100 +Subject: ALSA: hda: Avoid spurious unsol event handling during S3/S4 + +From: Takashi Iwai + +commit 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab upstream. + +When HD-audio bus receives unsolicited events during its system +suspend/resume (S3 and S4) phase, the controller driver may still try +to process events although the codec chips are already (or yet) +powered down. This might screw up the codec communication, resulting +in CORB/RIRB errors. Such events should be rather skipped, as the +codec chip status such as the jack status will be fully refreshed at +the system resume time. + +Since we're tracking the system suspend/resume state in codec +power.power_state field, let's add the check in the common unsol event +handler entry point to filter out such events. + +BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377 +Tested-by: Abhishek Sahu +Cc: # 183ab39eb0ea: ALSA: hda: Initialize power_state +Link: https://lore.kernel.org/r/20210310112809.9215-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_bind.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/hda_bind.c ++++ b/sound/pci/hda/hda_bind.c +@@ -47,6 +47,10 @@ static void hda_codec_unsol_event(struct + if (codec->bus->shutdown) + return; + ++ /* ignore unsol events during system suspend/resume */ ++ if (codec->core.dev.power.power_state.event != PM_EVENT_ON) ++ return; ++ + if (codec->patch_ops.unsol_event) + codec->patch_ops.unsol_event(codec, ev); + } diff --git a/queue-5.10/alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch b/queue-5.10/alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch new file mode 100644 index 00000000000..df66f2a59af --- /dev/null +++ b/queue-5.10/alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch @@ -0,0 +1,31 @@ +From f15c5c11abfbf8909eb30598315ecbec2311cfdc Mon Sep 17 00:00:00 2001 +From: Simeon Simeonoff +Date: Mon, 8 Mar 2021 20:48:35 +0200 +Subject: ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support + +From: Simeon Simeonoff + +commit f15c5c11abfbf8909eb30598315ecbec2311cfdc upstream. + +The new AE-5 Plus model has a different Subsystem ID compared to the +non-plus model. Adding the new id to the list of quirks. + +Signed-off-by: Simeon Simeonoff +Cc: +Link: https://lore.kernel.org/r/998cafbe10b648f724ee33570553f2d780a38963.camel@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_ca0132.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1275,6 +1275,7 @@ static const struct snd_pci_quirk ca0132 + SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D), + SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D), + SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5), ++ SND_PCI_QUIRK(0x1102, 0x0191, "Sound Blaster AE-5 Plus", QUIRK_AE5), + SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7), + {} + }; diff --git a/queue-5.10/alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch b/queue-5.10/alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch new file mode 100644 index 00000000000..175fb065179 --- /dev/null +++ b/queue-5.10/alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch @@ -0,0 +1,147 @@ +From 56b26497bb4b7ff970612dc25a8a008c34463f7b Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 6 Mar 2021 10:50:18 +0100 +Subject: ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5 + +From: Takashi Iwai + +commit 56b26497bb4b7ff970612dc25a8a008c34463f7b upstream. + +The mute and mic-mute LEDs on HP ZBook Studio G5 are controlled via +GPIO bits 0x10 and 0x20, respectively, and we need the extra setup for +those. + +As the similar code is already present for other HP models but with +different GPIO pins, this patch factors out the common helper code and +applies those GPIO values for each model. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211893 +Cc: +Link: https://lore.kernel.org/r/20210306095018.11746-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_conexant.c | 62 +++++++++++++++++++++++++++++------------ + 1 file changed, 45 insertions(+), 17 deletions(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -149,6 +149,21 @@ static int cx_auto_vmaster_mute_led(stru + return 0; + } + ++static void cxt_init_gpio_led(struct hda_codec *codec) ++{ ++ struct conexant_spec *spec = codec->spec; ++ unsigned int mask = spec->gpio_mute_led_mask | spec->gpio_mic_led_mask; ++ ++ if (mask) { ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, ++ mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, ++ mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, ++ spec->gpio_led); ++ } ++} ++ + static int cx_auto_init(struct hda_codec *codec) + { + struct conexant_spec *spec = codec->spec; +@@ -156,6 +171,7 @@ static int cx_auto_init(struct hda_codec + if (!spec->dynamic_eapd) + cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, true); + ++ cxt_init_gpio_led(codec); + snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT); + + return 0; +@@ -215,6 +231,7 @@ enum { + CXT_FIXUP_HP_SPECTRE, + CXT_FIXUP_HP_GATE_MIC, + CXT_FIXUP_MUTE_LED_GPIO, ++ CXT_FIXUP_HP_ZBOOK_MUTE_LED, + CXT_FIXUP_HEADSET_MIC, + CXT_FIXUP_HP_MIC_NO_PRESENCE, + }; +@@ -654,31 +671,36 @@ static int cxt_gpio_micmute_update(struc + return 0; + } + +- +-static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, +- const struct hda_fixup *fix, int action) ++static void cxt_setup_mute_led(struct hda_codec *codec, ++ unsigned int mute, unsigned int mic_mute) + { + struct conexant_spec *spec = codec->spec; +- static const struct hda_verb gpio_init[] = { +- { 0x01, AC_VERB_SET_GPIO_MASK, 0x03 }, +- { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 }, +- {} +- }; + +- if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->gpio_led = 0; ++ spec->mute_led_polarity = 0; ++ if (mute) { + snd_hda_gen_add_mute_led_cdev(codec, cxt_gpio_mute_update); +- spec->gpio_led = 0; +- spec->mute_led_polarity = 0; +- spec->gpio_mute_led_mask = 0x01; +- spec->gpio_mic_led_mask = 0x02; ++ spec->gpio_mute_led_mask = mute; ++ } ++ if (mic_mute) { + snd_hda_gen_add_micmute_led_cdev(codec, cxt_gpio_micmute_update); ++ spec->gpio_mic_led_mask = mic_mute; + } +- snd_hda_add_verbs(codec, gpio_init); +- if (spec->gpio_led) +- snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, +- spec->gpio_led); + } + ++static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ cxt_setup_mute_led(codec, 0x01, 0x02); ++} ++ ++static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ cxt_setup_mute_led(codec, 0x10, 0x20); ++} + + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { +@@ -839,6 +861,10 @@ static const struct hda_fixup cxt_fixups + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_mute_led_gpio, + }, ++ [CXT_FIXUP_HP_ZBOOK_MUTE_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_zbook_mute_led, ++ }, + [CXT_FIXUP_HEADSET_MIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_headset_mic, +@@ -917,6 +943,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x8427, "HP ZBook Studio G5", CXT_FIXUP_HP_ZBOOK_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), +@@ -956,6 +983,7 @@ static const struct hda_model_fixup cxt5 + { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" }, + { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" }, + { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, ++ { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" }, + { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, + {} + }; diff --git a/queue-5.10/alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch b/queue-5.10/alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch new file mode 100644 index 00000000000..6ba0f3a881f --- /dev/null +++ b/queue-5.10/alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch @@ -0,0 +1,46 @@ +From 28e96c1693ec1cdc963807611f8b5ad400431e82 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 8 Mar 2021 17:07:26 +0100 +Subject: ALSA: hda: Drop the BATCH workaround for AMD controllers + +From: Takashi Iwai + +commit 28e96c1693ec1cdc963807611f8b5ad400431e82 upstream. + +The commit c02f77d32d2c ("ALSA: hda - Workaround for crackled sound on +AMD controller (1022:1457)") introduced a few workarounds for the +recent AMD HD-audio controller, and one of them is the forced BATCH +PCM mode so that PulseAudio avoids the timer-based scheduling. This +was thought to cover for some badly working applications, but this +actually worsens for more others. In total, this wasn't a good idea +to enforce it. + +This is a partial revert of the commit above for dropping the PCM +BATCH enforcement part to recover from the regression again. + +Fixes: c02f77d32d2c ("ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303 +Cc: +Link: https://lore.kernel.org/r/20210308160726.22930-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_controller.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -609,13 +609,6 @@ static int azx_pcm_open(struct snd_pcm_s + 20, + 178000000); + +- /* by some reason, the playback stream stalls on PulseAudio with +- * tsched=1 when a capture stream triggers. Until we figure out the +- * real cause, disable tsched mode by telling the PCM info flag. +- */ +- if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND) +- runtime->hw.info |= SNDRV_PCM_INFO_BATCH; +- + if (chip->align_buffer_size) + /* constrain buffer sizes to be multiple of 128 + bytes. This is more efficient in terms of memory diff --git a/queue-5.10/alsa-hda-flush-pending-unsolicited-events-before-suspend.patch b/queue-5.10/alsa-hda-flush-pending-unsolicited-events-before-suspend.patch new file mode 100644 index 00000000000..5122c1ecda0 --- /dev/null +++ b/queue-5.10/alsa-hda-flush-pending-unsolicited-events-before-suspend.patch @@ -0,0 +1,40 @@ +From 13661fc48461282e43fe8f76bf5bf449b3d40687 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 10 Mar 2021 12:28:07 +0100 +Subject: ALSA: hda: Flush pending unsolicited events before suspend + +From: Takashi Iwai + +commit 13661fc48461282e43fe8f76bf5bf449b3d40687 upstream. + +The HD-audio controller driver processes the unsolicited events via +its work asynchronously, and this might be pending when the system +goes to suspend. When a lengthy event handling like ELD byte reads is +running, this might trigger unexpected accesses among suspend/resume +procedure, typically seen with Nvidia driver that still requires the +handling via unsolicited event verbs for ELD updates. + +This patch adds the flush of unsol_work to assure that pending events +are processed before going into suspend. + +Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1182377 +Reported-and-tested-by: Abhishek Sahu +Cc: +Link: https://lore.kernel.org/r/20210310112809.9215-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1026,6 +1026,8 @@ static int azx_prepare(struct device *de + chip = card->private_data; + chip->pm_prepared = 1; + ++ flush_work(&azx_bus(chip)->unsol_work); ++ + /* HDA controller always requires different WAKEEN for runtime suspend + * and system suspend, so don't use direct-complete here. + */ diff --git a/queue-5.10/alsa-hda-hdmi-cancel-pending-works-before-suspend.patch b/queue-5.10/alsa-hda-hdmi-cancel-pending-works-before-suspend.patch new file mode 100644 index 00000000000..ea676b1d371 --- /dev/null +++ b/queue-5.10/alsa-hda-hdmi-cancel-pending-works-before-suspend.patch @@ -0,0 +1,57 @@ +From eea46a0879bcca23e15071f9968c0f6e6596e470 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 10 Mar 2021 12:28:09 +0100 +Subject: ALSA: hda/hdmi: Cancel pending works before suspend + +From: Takashi Iwai + +commit eea46a0879bcca23e15071f9968c0f6e6596e470 upstream. + +The per_pin->work might be still floating at the suspend, and this may +hit the access to the hardware at an unexpected timing. Cancel the +work properly at the suspend callback for avoiding the buggy access. + +Note that the bug doesn't trigger easily in the recent kernels since +the work is queued only when the repoll count is set, and usually it's +only at the resume callback, but it's still possible to hit in +theory. + +BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377 +Reported-and-tested-by: Abhishek Sahu +Cc: +Link: https://lore.kernel.org/r/20210310112809.9215-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_hdmi.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2475,6 +2475,18 @@ static void generic_hdmi_free(struct hda + } + + #ifdef CONFIG_PM ++static int generic_hdmi_suspend(struct hda_codec *codec) ++{ ++ struct hdmi_spec *spec = codec->spec; ++ int pin_idx; ++ ++ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { ++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); ++ cancel_delayed_work_sync(&per_pin->work); ++ } ++ return 0; ++} ++ + static int generic_hdmi_resume(struct hda_codec *codec) + { + struct hdmi_spec *spec = codec->spec; +@@ -2498,6 +2510,7 @@ static const struct hda_codec_ops generi + .build_controls = generic_hdmi_build_controls, + .unsol_event = hdmi_unsol_event, + #ifdef CONFIG_PM ++ .suspend = generic_hdmi_suspend, + .resume = generic_hdmi_resume, + #endif + }; diff --git a/queue-5.10/alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch b/queue-5.10/alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch new file mode 100644 index 00000000000..ab61ee088b6 --- /dev/null +++ b/queue-5.10/alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch @@ -0,0 +1,42 @@ +From fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 Mon Sep 17 00:00:00 2001 +From: John Ernberg +Date: Wed, 3 Mar 2021 18:14:39 +0000 +Subject: ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk + +From: John Ernberg + +commit fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 upstream. + +The microphone in the Plantronics C320-M headset will randomly +fail to initialize properly, at least when using Microsoft Teams. +Introducing a 20ms delay on the control messages appears to +resolve the issue. + +Link: https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/1065 +Tested-by: Andreas Kempe +Signed-off-by: John Ernberg +Cc: +Link: https://lore.kernel.org/r/20210303181405.39835-1-john.ernberg@actia.se +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1672,6 +1672,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de + && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + msleep(20); + ++ /* ++ * Plantronics C320-M needs a delay to avoid random ++ * microhpone failures. ++ */ ++ if (chip->usb_id == USB_ID(0x047f, 0xc025) && ++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) ++ msleep(20); ++ + /* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950), + * Jabra 550a, Kingston HyperX needs a tiny delay here, + * otherwise requests like get/set frequency return diff --git a/queue-5.10/alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch b/queue-5.10/alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch new file mode 100644 index 00000000000..9f964ecc7f1 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch @@ -0,0 +1,43 @@ +From 06abcb18b3a021ba1a3f2020cbefb3ed04e59e72 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 4 Mar 2021 09:50:09 +0100 +Subject: ALSA: usb-audio: Apply the control quirk to Plantronics headsets + +From: Takashi Iwai + +commit 06abcb18b3a021ba1a3f2020cbefb3ed04e59e72 upstream. + +Other Plantronics headset models seem requiring the same workaround as +C320-M to add the 20ms delay for the control messages, too. Apply the +workaround generically for devices with the vendor ID 0x047f. + +Note that the problem didn't surface before 5.11 just with luck. +Since 5.11 got a big code rewrite about the stream handling, the +parameter setup procedure has changed, and this seemed triggering the +problem more often. + +BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182552 +Cc: +Link: https://lore.kernel.org/r/20210304085009.4770-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1674,10 +1674,10 @@ void snd_usb_ctl_msg_quirk(struct usb_de + msleep(20); + + /* +- * Plantronics C320-M needs a delay to avoid random +- * microhpone failures. ++ * Plantronics headsets (C320, C320-M, etc) need a delay to avoid ++ * random microhpone failures. + */ +- if (chip->usb_id == USB_ID(0x047f, 0xc025) && ++ if (USB_ID_VENDOR(chip->usb_id) == 0x047f && + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + msleep(20); + diff --git a/queue-5.10/alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch b/queue-5.10/alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch new file mode 100644 index 00000000000..fad73656328 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch @@ -0,0 +1,91 @@ +From 9799110825dba087c2bdce886977cf84dada2005 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Thu, 4 Mar 2021 12:34:16 +0800 +Subject: ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() + +From: Kai-Heng Feng + +commit 9799110825dba087c2bdce886977cf84dada2005 upstream. + +Rear audio on Lenovo ThinkStation P620 stops working after commit +1965c4364bdd ("ALSA: usb-audio: Disable autosuspend for Lenovo +ThinkStation P620"): +[ 6.013526] usbcore: registered new interface driver snd-usb-audio +[ 6.023064] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.023083] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 +[ 6.023090] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.023098] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 +[ 6.023103] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.023110] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 +[ 6.045846] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.045866] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 +[ 6.045877] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.045886] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 +[ 6.045894] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1 +[ 6.045908] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4 + +I overlooked the issue because when I was working on the said commit, +only the front audio is tested. Apology for that. + +Changing supports_autosuspend in driver is too late for disabling +autosuspend, because it was already used by USB probe routine, so it can +break the balance on the following code that depends on +supports_autosuspend. + +Fix it by using usb_disable_autosuspend() helper, and balance the +suspend count in disconnect callback. + +Fixes: 1965c4364bdd ("ALSA: usb-audio: Disable autosuspend for Lenovo ThinkStation P620") +Signed-off-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/20210304043419.287191-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.c | 5 +++++ + sound/usb/quirks.c | 2 +- + sound/usb/usbaudio.h | 1 + + 3 files changed, 7 insertions(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -830,6 +830,8 @@ static int usb_audio_probe(struct usb_in + snd_media_device_create(chip, intf); + } + ++ chip->quirk_type = quirk->type; ++ + usb_chip[chip->index] = chip; + chip->intf[chip->num_interfaces] = intf; + chip->num_interfaces++; +@@ -912,6 +914,9 @@ static void usb_audio_disconnect(struct + } else { + mutex_unlock(®ister_mutex); + } ++ ++ if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) ++ usb_enable_autosuspend(interface_to_usbdev(intf)); + } + + /* lock the shutdown (disconnect) task and autoresume */ +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -523,7 +523,7 @@ static int setup_disable_autosuspend(str + struct usb_driver *driver, + const struct snd_usb_audio_quirk *quirk) + { +- driver->supports_autosuspend = 0; ++ usb_disable_autosuspend(interface_to_usbdev(iface)); + return 1; /* Continue with creating streams and mixer */ + } + +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -27,6 +27,7 @@ struct snd_usb_audio { + struct snd_card *card; + struct usb_interface *intf[MAX_CARD_INTERFACES]; + u32 usb_id; ++ uint16_t quirk_type; + struct mutex mutex; + unsigned int system_suspend; + atomic_t active; diff --git a/queue-5.10/alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch b/queue-5.10/alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch new file mode 100644 index 00000000000..88a44124761 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch @@ -0,0 +1,32 @@ +From fec60c3bc5d1713db2727cdffc638d48f9c07dc3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 4 Mar 2021 09:30:21 +0100 +Subject: ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar + +From: Takashi Iwai + +commit fec60c3bc5d1713db2727cdffc638d48f9c07dc3 upstream. + +Dell AE515 sound bar (413c:a506) spews the error messages when the +driver tries to read the current sample frequency, hence it needs to +be on the list in snd_usb_get_sample_rate_quirk(). + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211551 +Cc: +Link: https://lore.kernel.org/r/20210304083021.2152-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1520,6 +1520,7 @@ bool snd_usb_get_sample_rate_quirk(struc + case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ + case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */ + case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */ ++ case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */ + return true; + } + diff --git a/queue-5.10/alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch b/queue-5.10/alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch new file mode 100644 index 00000000000..05c1d41f709 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch @@ -0,0 +1,65 @@ +From 30dea07180de3aa0ad613af88431ef4e34b5ef68 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Tue, 9 Mar 2021 01:30:36 +0300 +Subject: ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe + +From: Pavel Skripkin + +commit 30dea07180de3aa0ad613af88431ef4e34b5ef68 upstream. + +syzbot reported null pointer dereference in usb_audio_probe. +The problem was in case, when quirk == NULL. It's not an +error condition, so quirk must be checked before dereferencing. + +Call Trace: + usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 + really_probe+0x291/0xe60 drivers/base/dd.c:554 + driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:740 + __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:846 + bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431 + __device_attach+0x228/0x4a0 drivers/base/dd.c:914 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 + device_add+0xbdb/0x1db0 drivers/base/core.c:3242 + usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2164 + usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 + usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 + really_probe+0x291/0xe60 drivers/base/dd.c:554 + driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:740 + __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:846 + bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431 + __device_attach+0x228/0x4a0 drivers/base/dd.c:914 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 + device_add+0xbdb/0x1db0 drivers/base/core.c:3242 + usb_new_device.cold+0x721/0x1058 drivers/usb/core/hub.c:2555 + hub_port_connect drivers/usb/core/hub.c:5223 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5363 [inline] + port_event drivers/usb/core/hub.c:5509 [inline] + hub_event+0x2357/0x4320 drivers/usb/core/hub.c:5591 + process_one_work+0x98d/0x1600 kernel/workqueue.c:2275 + worker_thread+0x64c/0x1120 kernel/workqueue.c:2421 + kthread+0x3b1/0x4a0 kernel/kthread.c:292 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 + +Reported-by: syzbot+719da9b149a931f5143f@syzkaller.appspotmail.com +Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()") +Signed-off-by: Pavel Skripkin +Cc: +Link: https://lore.kernel.org/r/f1ebad6e721412843bd1b12584444c0a63c6b2fb.1615242183.git.paskripkin@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -830,7 +830,8 @@ static int usb_audio_probe(struct usb_in + snd_media_device_create(chip, intf); + } + +- chip->quirk_type = quirk->type; ++ if (quirk) ++ chip->quirk_type = quirk->type; + + usb_chip[chip->index] = chip; + chip->intf[chip->num_interfaces] = intf; diff --git a/queue-5.10/alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch b/queue-5.10/alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch new file mode 100644 index 00000000000..7dbd56d5a7d --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch @@ -0,0 +1,44 @@ +From c5aa956eaeb05fe87e33433d7fd9f5e4d23c7416 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Tue, 9 Mar 2021 01:30:57 +0300 +Subject: ALSA: usb-audio: fix use after free in usb_audio_disconnect + +From: Pavel Skripkin + +commit c5aa956eaeb05fe87e33433d7fd9f5e4d23c7416 upstream. + +The problem was in wrong "if" placement. chip->quirk_type is freed +in snd_card_free_when_closed(), but inside if statement it's accesed. + +Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()") +Signed-off-by: Pavel Skripkin +Cc: +Link: https://lore.kernel.org/r/16da19126ff461e5e64a9aec648cce28fb8ed73e.1615242183.git.paskripkin@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -907,6 +907,9 @@ static void usb_audio_disconnect(struct + } + } + ++ if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) ++ usb_enable_autosuspend(interface_to_usbdev(intf)); ++ + chip->num_interfaces--; + if (chip->num_interfaces <= 0) { + usb_chip[chip->index] = NULL; +@@ -915,9 +918,6 @@ static void usb_audio_disconnect(struct + } else { + mutex_unlock(®ister_mutex); + } +- +- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) +- usb_enable_autosuspend(interface_to_usbdev(intf)); + } + + /* lock the shutdown (disconnect) task and autoresume */ diff --git a/queue-5.10/arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch b/queue-5.10/arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch new file mode 100644 index 00000000000..c6bc74da18c --- /dev/null +++ b/queue-5.10/arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch @@ -0,0 +1,41 @@ +From 86c83365ab76e4b43cedd3ce07a07d32a4dc79ba Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Mon, 8 Mar 2021 17:10:23 +0100 +Subject: arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL + +From: Andrey Konovalov + +commit 86c83365ab76e4b43cedd3ce07a07d32a4dc79ba upstream. + +When CONFIG_DEBUG_VIRTUAL is enabled, the default page_to_virt() macro +implementation from include/linux/mm.h is used. That definition doesn't +account for KASAN tags, which leads to no tags on page_alloc allocations. + +Provide an arm64-specific definition for page_to_virt() when +CONFIG_DEBUG_VIRTUAL is enabled that takes care of KASAN tags. + +Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") +Cc: +Signed-off-by: Andrey Konovalov +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/4b55b35202706223d3118230701c6a59749d9b72.1615219501.git.andreyknvl@google.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/memory.h | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -306,6 +306,11 @@ static inline void *phys_to_virt(phys_ad + #define ARCH_PFN_OFFSET ((unsigned long)PHYS_PFN_OFFSET) + + #if !defined(CONFIG_SPARSEMEM_VMEMMAP) || defined(CONFIG_DEBUG_VIRTUAL) ++#define page_to_virt(x) ({ \ ++ __typeof__(x) __page = x; \ ++ void *__addr = __va(page_to_phys(__page)); \ ++ (void *)__tag_set((const void *)__addr, page_kasan_tag(__page));\ ++}) + #define virt_to_page(x) pfn_to_page(virt_to_pfn(x)) + #else + #define page_to_virt(x) ({ \ diff --git a/queue-5.10/arm64-mte-map-hotplugged-memory-as-normal-tagged.patch b/queue-5.10/arm64-mte-map-hotplugged-memory-as-normal-tagged.patch new file mode 100644 index 00000000000..95fac34caae --- /dev/null +++ b/queue-5.10/arm64-mte-map-hotplugged-memory-as-normal-tagged.patch @@ -0,0 +1,103 @@ +From d15dfd31384ba3cb93150e5f87661a76fa419f74 Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Tue, 9 Mar 2021 12:26:01 +0000 +Subject: arm64: mte: Map hotplugged memory as Normal Tagged + +From: Catalin Marinas + +commit d15dfd31384ba3cb93150e5f87661a76fa419f74 upstream. + +In a system supporting MTE, the linear map must allow reading/writing +allocation tags by setting the memory type as Normal Tagged. Currently, +this is only handled for memory present at boot. Hotplugged memory uses +Normal non-Tagged memory. + +Introduce pgprot_mhp() for hotplugged memory and use it in +add_memory_resource(). The arm64 code maps pgprot_mhp() to +pgprot_tagged(). + +Note that ZONE_DEVICE memory should not be mapped as Tagged and +therefore setting the memory type in arch_add_memory() is not feasible. + +Signed-off-by: Catalin Marinas +Fixes: 0178dc761368 ("arm64: mte: Use Normal Tagged attributes for the linear map") +Reported-by: Patrick Daly +Tested-by: Patrick Daly +Link: https://lore.kernel.org/r/1614745263-27827-1-git-send-email-pdaly@codeaurora.org +Cc: # 5.10.x +Cc: Will Deacon +Cc: Andrew Morton +Cc: Vincenzo Frascino +Cc: David Hildenbrand +Reviewed-by: David Hildenbrand +Reviewed-by: Vincenzo Frascino +Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20210309122601.5543-1-catalin.marinas@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/pgtable-prot.h | 1 - + arch/arm64/include/asm/pgtable.h | 3 +++ + arch/arm64/mm/mmu.c | 3 ++- + include/linux/pgtable.h | 4 ++++ + mm/memory_hotplug.c | 2 +- + 5 files changed, 10 insertions(+), 3 deletions(-) + +--- a/arch/arm64/include/asm/pgtable-prot.h ++++ b/arch/arm64/include/asm/pgtable-prot.h +@@ -66,7 +66,6 @@ extern bool arm64_use_ng_mappings; + #define _PAGE_DEFAULT (_PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL)) + + #define PAGE_KERNEL __pgprot(PROT_NORMAL) +-#define PAGE_KERNEL_TAGGED __pgprot(PROT_NORMAL_TAGGED) + #define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) | PTE_RDONLY) + #define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE | PTE_PXN)) | PTE_RDONLY) + #define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN) +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -484,6 +484,9 @@ static inline pmd_t pmd_mkdevmap(pmd_t p + __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN) + #define pgprot_device(prot) \ + __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_PXN | PTE_UXN) ++#define pgprot_tagged(prot) \ ++ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_TAGGED)) ++#define pgprot_mhp pgprot_tagged + /* + * DMA allocations for non-coherent devices use what the Arm architecture calls + * "Normal non-cacheable" memory, which permits speculation, unaligned accesses +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -502,7 +502,8 @@ static void __init map_mem(pgd_t *pgdp) + * if MTE is present. Otherwise, it has the same attributes as + * PAGE_KERNEL. + */ +- __map_memblock(pgdp, start, end, PAGE_KERNEL_TAGGED, flags); ++ __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL), ++ flags); + } + + /* +--- a/include/linux/pgtable.h ++++ b/include/linux/pgtable.h +@@ -857,6 +857,10 @@ static inline void ptep_modify_prot_comm + #define pgprot_device pgprot_noncached + #endif + ++#ifndef pgprot_mhp ++#define pgprot_mhp(prot) (prot) ++#endif ++ + #ifdef CONFIG_MMU + #ifndef pgprot_modify + #define pgprot_modify pgprot_modify +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1020,7 +1020,7 @@ static int online_memory_block(struct me + */ + int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags) + { +- struct mhp_params params = { .pgprot = PAGE_KERNEL }; ++ struct mhp_params params = { .pgprot = pgprot_mhp(PAGE_KERNEL) }; + u64 start, size; + bool new_node = false; + int ret; diff --git a/queue-5.10/arm64-perf-fix-64-bit-event-counter-read-truncation.patch b/queue-5.10/arm64-perf-fix-64-bit-event-counter-read-truncation.patch new file mode 100644 index 00000000000..9d6d746a588 --- /dev/null +++ b/queue-5.10/arm64-perf-fix-64-bit-event-counter-read-truncation.patch @@ -0,0 +1,49 @@ +From 7bb8bc6eb550116c504fb25af8678b9d7ca2abc5 Mon Sep 17 00:00:00 2001 +From: Rob Herring +Date: Tue, 9 Mar 2021 17:44:12 -0700 +Subject: arm64: perf: Fix 64-bit event counter read truncation + +From: Rob Herring + +commit 7bb8bc6eb550116c504fb25af8678b9d7ca2abc5 upstream. + +Commit 0fdf1bb75953 ("arm64: perf: Avoid PMXEV* indirection") changed +armv8pmu_read_evcntr() to return a u32 instead of u64. The result is +silent truncation of the event counter when using 64-bit counters. Given +the offending commit appears to have passed thru several folks, it seems +likely this was a bad rebase after v8.5 PMU 64-bit counters landed. + +Cc: Alexandru Elisei +Cc: Julien Thierry +Cc: Mark Rutland +Cc: Will Deacon +Cc: Catalin Marinas +Cc: Peter Zijlstra +Cc: Ingo Molnar +Cc: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: +Fixes: 0fdf1bb75953 ("arm64: perf: Avoid PMXEV* indirection") +Signed-off-by: Rob Herring +Acked-by: Mark Rutland +Reviewed-by: Alexandru Elisei +Link: https://lore.kernel.org/r/20210310004412.1450128-1-robh@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -460,7 +460,7 @@ static inline int armv8pmu_counter_has_o + return pmnc & BIT(ARMV8_IDX_TO_COUNTER(idx)); + } + +-static inline u32 armv8pmu_read_evcntr(int idx) ++static inline u64 armv8pmu_read_evcntr(int idx) + { + u32 counter = ARMV8_IDX_TO_COUNTER(idx); + diff --git a/queue-5.10/block-discard-page-cache-of-zone-reset-target-range.patch b/queue-5.10/block-discard-page-cache-of-zone-reset-target-range.patch new file mode 100644 index 00000000000..068ac1e84c7 --- /dev/null +++ b/queue-5.10/block-discard-page-cache-of-zone-reset-target-range.patch @@ -0,0 +1,101 @@ +From e5113505904ea1c1c0e1f92c1cfa91fbf4da1694 Mon Sep 17 00:00:00 2001 +From: Shin'ichiro Kawasaki +Date: Thu, 11 Mar 2021 16:25:46 +0900 +Subject: block: Discard page cache of zone reset target range + +From: Shin'ichiro Kawasaki + +commit e5113505904ea1c1c0e1f92c1cfa91fbf4da1694 upstream. + +When zone reset ioctl and data read race for a same zone on zoned block +devices, the data read leaves stale page cache even though the zone +reset ioctl zero clears all the zone data on the device. To avoid +non-zero data read from the stale page cache after zone reset, discard +page cache of reset target zones in blkdev_zone_mgmt_ioctl(). Introduce +the helper function blkdev_truncate_zone_range() to discard the page +cache. Ensure the page cache discarded by calling the helper function +before and after zone reset in same manner as fallocate does. + +This patch can be applied back to the stable kernel version v5.10.y. +Rework is needed for older stable kernels. + +Signed-off-by: Shin'ichiro Kawasaki +Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls") +Cc: # 5.10+ +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/20210311072546.678999-1-shinichiro.kawasaki@wdc.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-zoned.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -318,6 +318,22 @@ int blkdev_report_zones_ioctl(struct blo + return 0; + } + ++static int blkdev_truncate_zone_range(struct block_device *bdev, fmode_t mode, ++ const struct blk_zone_range *zrange) ++{ ++ loff_t start, end; ++ ++ if (zrange->sector + zrange->nr_sectors <= zrange->sector || ++ zrange->sector + zrange->nr_sectors > get_capacity(bdev->bd_disk)) ++ /* Out of range */ ++ return -EINVAL; ++ ++ start = zrange->sector << SECTOR_SHIFT; ++ end = ((zrange->sector + zrange->nr_sectors) << SECTOR_SHIFT) - 1; ++ ++ return truncate_bdev_range(bdev, mode, start, end); ++} ++ + /* + * BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE ioctl processing. + * Called from blkdev_ioctl. +@@ -329,6 +345,7 @@ int blkdev_zone_mgmt_ioctl(struct block_ + struct request_queue *q; + struct blk_zone_range zrange; + enum req_opf op; ++ int ret; + + if (!argp) + return -EINVAL; +@@ -352,6 +369,11 @@ int blkdev_zone_mgmt_ioctl(struct block_ + switch (cmd) { + case BLKRESETZONE: + op = REQ_OP_ZONE_RESET; ++ ++ /* Invalidate the page cache, including dirty pages. */ ++ ret = blkdev_truncate_zone_range(bdev, mode, &zrange); ++ if (ret) ++ return ret; + break; + case BLKOPENZONE: + op = REQ_OP_ZONE_OPEN; +@@ -366,8 +388,20 @@ int blkdev_zone_mgmt_ioctl(struct block_ + return -ENOTTY; + } + +- return blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors, +- GFP_KERNEL); ++ ret = blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors, ++ GFP_KERNEL); ++ ++ /* ++ * Invalidate the page cache again for zone reset: writes can only be ++ * direct for zoned devices so concurrent writes would not add any page ++ * to the page cache after/during reset. The page cache may be filled ++ * again due to concurrent reads though and dropping the pages for ++ * these is fine. ++ */ ++ if (!ret && cmd == BLKRESETZONE) ++ ret = blkdev_truncate_zone_range(bdev, mode, &zrange); ++ ++ return ret; + } + + static inline unsigned long *blk_alloc_zone_bitmap(int node, diff --git a/queue-5.10/block-try-to-handle-busy-underlying-device-on-discard.patch b/queue-5.10/block-try-to-handle-busy-underlying-device-on-discard.patch new file mode 100644 index 00000000000..6b8341ad3f4 --- /dev/null +++ b/queue-5.10/block-try-to-handle-busy-underlying-device-on-discard.patch @@ -0,0 +1,59 @@ +From 56887cffe946bb0a90c74429fa94d6110a73119d Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 22 Feb 2021 10:48:09 +0100 +Subject: block: Try to handle busy underlying device on discard + +From: Jan Kara + +commit 56887cffe946bb0a90c74429fa94d6110a73119d upstream. + +Commit 384d87ef2c95 ("block: Do not discard buffers under a mounted +filesystem") made paths issuing discard or zeroout requests to the +underlying device try to grab block device in exclusive mode. If that +failed we returned EBUSY to userspace. This however caused unexpected +fallout in userspace where e.g. FUSE filesystems issue discard requests +from userspace daemons although the device is open exclusively by the +kernel. Also shrinking of logical volume by LVM issues discard requests +to a device which may be claimed exclusively because there's another LV +on the same PV. So to avoid these userspace regressions, fall back to +invalidate_inode_pages2_range() instead of returning EBUSY to userspace +and return EBUSY only of that call fails as well (meaning that there's +indeed someone using the particular device range we are trying to +discard). + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=211167 +Fixes: 384d87ef2c95 ("block: Do not discard buffers under a mounted filesystem") +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/block_dev.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -123,12 +123,21 @@ int truncate_bdev_range(struct block_dev + err = bd_prepare_to_claim(bdev, claimed_bdev, + truncate_bdev_range); + if (err) +- return err; ++ goto invalidate; + } + truncate_inode_pages_range(bdev->bd_inode->i_mapping, lstart, lend); + if (claimed_bdev) + bd_abort_claiming(bdev, claimed_bdev, truncate_bdev_range); + return 0; ++ ++invalidate: ++ /* ++ * Someone else has handle exclusively open. Try invalidating instead. ++ * The 'end' argument is inclusive so the rounding is safe. ++ */ ++ return invalidate_inode_pages2_range(bdev->bd_inode->i_mapping, ++ lstart >> PAGE_SHIFT, ++ lend >> PAGE_SHIFT); + } + EXPORT_SYMBOL(truncate_bdev_range); + diff --git a/queue-5.10/cifs-do-not-send-close-in-compound-create-close-requests.patch b/queue-5.10/cifs-do-not-send-close-in-compound-create-close-requests.patch new file mode 100644 index 00000000000..d2bc831ff5d --- /dev/null +++ b/queue-5.10/cifs-do-not-send-close-in-compound-create-close-requests.patch @@ -0,0 +1,182 @@ +From 04ad69c342fc4de5bd23be9ef15ea7574fb1a87e Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Mon, 8 Mar 2021 12:00:50 -0300 +Subject: cifs: do not send close in compound create+close requests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paulo Alcantara + +commit 04ad69c342fc4de5bd23be9ef15ea7574fb1a87e upstream. + +In case of interrupted syscalls, prevent sending CLOSE commands for +compound CREATE+CLOSE requests by introducing an +CIFS_CP_CREATE_CLOSE_OP flag to indicate lower layers that it should +not send a CLOSE command to the MIDs corresponding the compound +CREATE+CLOSE request. + +A simple reproducer: + + #!/bin/bash + + mount //server/share /mnt -o username=foo,password=*** + tc qdisc add dev eth0 root netem delay 450ms + stat -f /mnt &>/dev/null & pid=$! + sleep 0.01 + kill $pid + tc qdisc del dev eth0 root + umount /mnt + +Before patch: + + ... + 6 0.256893470 192.168.122.2 → 192.168.122.15 SMB2 402 Create Request File: ;GetInfo Request FS_INFO/FileFsFullSizeInformation;Close Request + 7 0.257144491 192.168.122.15 → 192.168.122.2 SMB2 498 Create Response File: ;GetInfo Response;Close Response + 9 0.260798209 192.168.122.2 → 192.168.122.15 SMB2 146 Close Request File: + 10 0.260841089 192.168.122.15 → 192.168.122.2 SMB2 130 Close Response, Error: STATUS_FILE_CLOSED + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Reviewed-by: Aurelien Aptel +CC: +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsglob.h | 11 ++++++----- + fs/cifs/smb2inode.c | 1 + + fs/cifs/smb2misc.c | 8 ++++---- + fs/cifs/smb2ops.c | 10 +++++----- + fs/cifs/smb2proto.h | 3 +-- + fs/cifs/transport.c | 2 +- + 6 files changed, 18 insertions(+), 17 deletions(-) + +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -256,7 +256,7 @@ struct smb_version_operations { + /* verify the message */ + int (*check_message)(char *, unsigned int, struct TCP_Server_Info *); + bool (*is_oplock_break)(char *, struct TCP_Server_Info *); +- int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *); ++ int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *); + void (*downgrade_oplock)(struct TCP_Server_Info *server, + struct cifsInodeInfo *cinode, __u32 oplock, + unsigned int epoch, bool *purge_cache); +@@ -1785,10 +1785,11 @@ static inline bool is_retryable_error(in + #define CIFS_NO_RSP_BUF 0x040 /* no response buffer required */ + + /* Type of request operation */ +-#define CIFS_ECHO_OP 0x080 /* echo request */ +-#define CIFS_OBREAK_OP 0x0100 /* oplock break request */ +-#define CIFS_NEG_OP 0x0200 /* negotiate request */ +-#define CIFS_OP_MASK 0x0380 /* mask request type */ ++#define CIFS_ECHO_OP 0x080 /* echo request */ ++#define CIFS_OBREAK_OP 0x0100 /* oplock break request */ ++#define CIFS_NEG_OP 0x0200 /* negotiate request */ ++#define CIFS_CP_CREATE_CLOSE_OP 0x0400 /* compound create+close request */ ++#define CIFS_OP_MASK 0x0780 /* mask request type */ + + #define CIFS_HAS_CREDITS 0x0400 /* already has credits */ + #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */ +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -358,6 +358,7 @@ smb2_compound_op(const unsigned int xid, + if (cfile) + goto after_close; + /* Close */ ++ flags |= CIFS_CP_CREATE_CLOSE_OP; + rqst[num_rqst].rq_iov = &vars->close_iov[0]; + rqst[num_rqst].rq_nvec = 1; + rc = SMB2_close_init(tcon, server, +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -835,14 +835,14 @@ smb2_handle_cancelled_close(struct cifs_ + } + + int +-smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server) ++smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server) + { +- struct smb2_sync_hdr *sync_hdr = (struct smb2_sync_hdr *)buffer; +- struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer; ++ struct smb2_sync_hdr *sync_hdr = mid->resp_buf; ++ struct smb2_create_rsp *rsp = mid->resp_buf; + struct cifs_tcon *tcon; + int rc; + +- if (sync_hdr->Command != SMB2_CREATE || ++ if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || sync_hdr->Command != SMB2_CREATE || + sync_hdr->Status != STATUS_SUCCESS) + return 0; + +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1137,7 +1137,7 @@ smb2_set_ea(const unsigned int xid, stru + struct TCP_Server_Info *server = cifs_pick_channel(ses); + __le16 *utf16_path = NULL; + int ea_name_len = strlen(ea_name); +- int flags = 0; ++ int flags = CIFS_CP_CREATE_CLOSE_OP; + int len; + struct smb_rqst rqst[3]; + int resp_buftype[3]; +@@ -1515,7 +1515,7 @@ smb2_ioctl_query_info(const unsigned int + struct smb_query_info qi; + struct smb_query_info __user *pqi; + int rc = 0; +- int flags = 0; ++ int flags = CIFS_CP_CREATE_CLOSE_OP; + struct smb2_query_info_rsp *qi_rsp = NULL; + struct smb2_ioctl_rsp *io_rsp = NULL; + void *buffer = NULL; +@@ -2482,7 +2482,7 @@ smb2_query_info_compound(const unsigned + { + struct cifs_ses *ses = tcon->ses; + struct TCP_Server_Info *server = cifs_pick_channel(ses); +- int flags = 0; ++ int flags = CIFS_CP_CREATE_CLOSE_OP; + struct smb_rqst rqst[3]; + int resp_buftype[3]; + struct kvec rsp_iov[3]; +@@ -2880,7 +2880,7 @@ smb2_query_symlink(const unsigned int xi + unsigned int sub_offset; + unsigned int print_len; + unsigned int print_offset; +- int flags = 0; ++ int flags = CIFS_CP_CREATE_CLOSE_OP; + struct smb_rqst rqst[3]; + int resp_buftype[3]; + struct kvec rsp_iov[3]; +@@ -3062,7 +3062,7 @@ smb2_query_reparse_tag(const unsigned in + struct cifs_open_parms oparms; + struct cifs_fid fid; + struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses); +- int flags = 0; ++ int flags = CIFS_CP_CREATE_CLOSE_OP; + struct smb_rqst rqst[3]; + int resp_buftype[3]; + struct kvec rsp_iov[3]; +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -246,8 +246,7 @@ extern int SMB2_oplock_break(const unsig + extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon, + __u64 persistent_fid, + __u64 volatile_fid); +-extern int smb2_handle_cancelled_mid(char *buffer, +- struct TCP_Server_Info *server); ++extern int smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server); + void smb2_cancelled_close_fid(struct work_struct *work); + extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_file_id, u64 volatile_file_id, +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -101,7 +101,7 @@ static void _cifs_mid_q_entry_release(st + if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && + midEntry->mid_state == MID_RESPONSE_RECEIVED && + server->ops->handle_cancelled_mid) +- server->ops->handle_cancelled_mid(midEntry->resp_buf, server); ++ server->ops->handle_cancelled_mid(midEntry, server); + + midEntry->mid_state = MID_FREE; + atomic_dec(&midCount); diff --git a/queue-5.10/mmc-core-fix-partition-switch-time-for-emmc.patch b/queue-5.10/mmc-core-fix-partition-switch-time-for-emmc.patch new file mode 100644 index 00000000000..10c04a1279f --- /dev/null +++ b/queue-5.10/mmc-core-fix-partition-switch-time-for-emmc.patch @@ -0,0 +1,57 @@ +From 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Wed, 3 Mar 2021 11:26:14 +0200 +Subject: mmc: core: Fix partition switch time for eMMC + +From: Adrian Hunter + +commit 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 upstream. + +Avoid the following warning by always defining partition switch time: + + [ 3.209874] mmc1: unspecified timeout for CMD6 - use generic + [ 3.222780] ------------[ cut here ]------------ + [ 3.233363] WARNING: CPU: 1 PID: 111 at drivers/mmc/core/mmc_ops.c:575 __mmc_switch+0x200/0x204 + +Reported-by: Paul Fertser +Fixes: 1c447116d017 ("mmc: mmc: Fix partition switch timeout for some eMMCs") +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/168bbfd6-0c5b-5ace-ab41-402e7937c46e@intel.com +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/mmc.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -423,10 +423,6 @@ static int mmc_decode_ext_csd(struct mmc + + /* EXT_CSD value is in units of 10ms, but we store in ms */ + card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; +- /* Some eMMC set the value too low so set a minimum */ +- if (card->ext_csd.part_time && +- card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) +- card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; + + /* Sleep / awake timeout in 100ns units */ + if (sa_shift > 0 && sa_shift <= 0x17) +@@ -616,6 +612,17 @@ static int mmc_decode_ext_csd(struct mmc + card->ext_csd.data_sector_size = 512; + } + ++ /* ++ * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined ++ * when accessing a specific field", so use it here if there is no ++ * PARTITION_SWITCH_TIME. ++ */ ++ if (!card->ext_csd.part_time) ++ card->ext_csd.part_time = card->ext_csd.generic_cmd6_time; ++ /* Some eMMC set the value too low so set a minimum */ ++ if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) ++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; ++ + /* eMMC v5 or later */ + if (card->ext_csd.rev >= 7) { + memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION], diff --git a/queue-5.10/mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch b/queue-5.10/mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch new file mode 100644 index 00000000000..ee893d0639b --- /dev/null +++ b/queue-5.10/mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch @@ -0,0 +1,94 @@ +From f06391c45e83f9a731045deb23df7cc3814fd795 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Wed, 3 Mar 2021 11:42:48 -0600 +Subject: mmc: cqhci: Fix random crash when remove mmc module/card + +From: Frank Li + +commit f06391c45e83f9a731045deb23df7cc3814fd795 upstream. + +[ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0 +[ 6684.498531] mmc0: card 0001 removed +[ 6684.501556] Mem abort info: +[ 6684.509681] ESR = 0x96000047 +[ 6684.512786] EC = 0x25: DABT (current EL), IL = 32 bits +[ 6684.518394] SET = 0, FnV = 0 +[ 6684.521707] EA = 0, S1PTW = 0 +[ 6684.524998] Data abort info: +[ 6684.528236] ISV = 0, ISS = 0x00000047 +[ 6684.532986] CM = 0, WnR = 1 +[ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000 +[ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000 +[ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP +[ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core] +[ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10 +[ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT) +[ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn + +[ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--) +[ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci] +^GMessage from syslogd@ at Thu Jan 1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci] +[ 6684.626734] sp : ffff80001243b9f0 +[ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000 +[ 6684.635367] x27: 0000000000000001 x26: 0000000000000001 +[ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f +[ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000 +[ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550 +[ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500 +[ 6684.661977] x17: 0000000000000000 x16: 0000000000000000 +[ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278 +[ 6684.672610] x13: 0000000000000001 x12: 0000000000000001 +[ 6684.677927] x11: 0000000000000000 x10: 0000000000000000 +[ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000 +[ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678 +[ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000 +[ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008 +[ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f +[ 6684.709854] Call trace: +[ 6684.712313] cqhci_request+0x148/0x4e8 [cqhci] +[ 6684.716803] mmc_cqe_start_req+0x58/0x68 [mmc_core] +[ 6684.721698] mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block] +[ 6684.727018] mmc_mq_queue_rq+0x118/0x2b0 [mmc_block] + +The problem occurs when cqhci_request() get called after cqhci_disable() as +it leads to access of allocated memory that has already been freed. Let's +fix the problem by calling cqhci_disable() a bit later in the remove path. + +Signed-off-by: Frank Li +Diagnosed-by: Adrian Hunter +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20210303174248.542175-1-Frank.Li@nxp.com +Fixes: f690f4409ddd ("mmc: mmc: Enable CQE's") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/bus.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/core/bus.c ++++ b/drivers/mmc/core/bus.c +@@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *ca + mmc_remove_card_debugfs(card); + #endif + +- if (host->cqe_enabled) { +- host->cqe_ops->cqe_disable(host); +- host->cqe_enabled = false; +- } +- + if (mmc_card_present(card)) { + if (mmc_host_is_spi(card->host)) { + pr_info("%s: SPI card removed\n", +@@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *ca + of_node_put(card->dev.of_node); + } + ++ if (host->cqe_enabled) { ++ host->cqe_ops->cqe_disable(host); ++ host->cqe_enabled = false; ++ } ++ + put_device(&card->dev); + } +- diff --git a/queue-5.10/mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch b/queue-5.10/mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch new file mode 100644 index 00000000000..90a6f4c045c --- /dev/null +++ b/queue-5.10/mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch @@ -0,0 +1,68 @@ +From 774514bf977377c9137640a0310bd64eed0f7323 Mon Sep 17 00:00:00 2001 +From: Yann Gautier +Date: Thu, 25 Feb 2021 15:54:54 +0100 +Subject: mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants + +From: Yann Gautier + +commit 774514bf977377c9137640a0310bd64eed0f7323 upstream. + +An issue has been observed on STM32MP157C-EV1 board, with an erase command +with secure erase argument, ending up waiting for ~4 hours before timeout. + +The requested busy timeout from the mmc core ends up with 14784000ms (~4 +hours), but the supported host->max_busy_timeout is 86767ms, which leads to +that the core switch to use an R1 response in favor of the R1B and polls +for busy with the host->card_busy() ops. In this case the polling doesn't +work as expected, as we never detects that the card stops signaling busy, +which leads to the following message: + + mmc1: Card stuck being busy! __mmc_poll_for_busy + +The problem boils done to that the stm32 variants can't use R1 responses in +favor of R1B responses, as it leads to an internal state machine in the +controller to get stuck. To continue to process requests, it would need to +be reset. + +To fix this problem, let's set MMC_CAP_NEED_RSP_BUSY for the stm32 variant, +which prevent the mmc core from switching to R1 responses. Additionally, +let's cap the cmd->busy_timeout to the host->max_busy_timeout, thus rely on +86767ms to be sufficient (~66 seconds was need for this test case). + +Fixes: 94fe2580a2f3 ("mmc: core: Enable erase/discard/trim support for all mmc hosts") +Signed-off-by: Yann Gautier +Link: https://lore.kernel.org/r/20210225145454.12780-1-yann.gautier@foss.st.com +Cc: stable@vger.kernel.org +[Ulf: Simplified the code and extended the commit message] +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/mmci.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/mmci.c ++++ b/drivers/mmc/host/mmci.c +@@ -1241,7 +1241,11 @@ mmci_start_command(struct mmci_host *hos + if (!cmd->busy_timeout) + cmd->busy_timeout = 10 * MSEC_PER_SEC; + +- clks = (unsigned long long)cmd->busy_timeout * host->cclk; ++ if (cmd->busy_timeout > host->mmc->max_busy_timeout) ++ clks = (unsigned long long)host->mmc->max_busy_timeout * host->cclk; ++ else ++ clks = (unsigned long long)cmd->busy_timeout * host->cclk; ++ + do_div(clks, MSEC_PER_SEC); + writel_relaxed(clks, host->base + MMCIDATATIMER); + } +@@ -2091,6 +2095,10 @@ static int mmci_probe(struct amba_device + mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY; + } + ++ /* Variants with mandatory busy timeout in HW needs R1B responses. */ ++ if (variant->busy_timeout) ++ mmc->caps |= MMC_CAP_NEED_RSP_BUSY; ++ + /* Prepare a CMD12 - needed to clear the DPSM on some variants. */ + host->stop_abort.opcode = MMC_STOP_TRANSMISSION; + host->stop_abort.arg = 0; diff --git a/queue-5.10/net-bonding-fix-error-return-code-of-bond_neigh_init.patch b/queue-5.10/net-bonding-fix-error-return-code-of-bond_neigh_init.patch deleted file mode 100644 index eafc26191f7..00000000000 --- a/queue-5.10/net-bonding-fix-error-return-code-of-bond_neigh_init.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 2055a99da8a253a357bdfd359b3338ef3375a26c Mon Sep 17 00:00:00 2001 -From: Jia-Ju Bai -Date: Sun, 7 Mar 2021 19:11:02 -0800 -Subject: net: bonding: fix error return code of bond_neigh_init() - -From: Jia-Ju Bai - -commit 2055a99da8a253a357bdfd359b3338ef3375a26c upstream. - -When slave is NULL or slave_ops->ndo_neigh_setup is NULL, no error -return code of bond_neigh_init() is assigned. -To fix this bug, ret is assigned with -EINVAL in these cases. - -Fixes: 9e99bfefdbce ("bonding: fix bond_neigh_init()") -Reported-by: TOTE Robot -Signed-off-by: Jia-Ju Bai -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/bonding/bond_main.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3918,11 +3918,15 @@ static int bond_neigh_init(struct neighb - - rcu_read_lock(); - slave = bond_first_slave_rcu(bond); -- if (!slave) -+ if (!slave) { -+ ret = -EINVAL; - goto out; -+ } - slave_ops = slave->dev->netdev_ops; -- if (!slave_ops->ndo_neigh_setup) -+ if (!slave_ops->ndo_neigh_setup) { -+ ret = -EINVAL; - goto out; -+ } - - /* TODO: find another way [1] to implement this. - * Passing a zeroed structure is fragile, diff --git a/queue-5.10/revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch b/queue-5.10/revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch new file mode 100644 index 00000000000..dd716c115c9 --- /dev/null +++ b/queue-5.10/revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch @@ -0,0 +1,54 @@ +From 3b0c2d3eaa83da259d7726192cf55a137769012f Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Fri, 12 Mar 2021 15:07:09 -0600 +Subject: Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") + +From: Eric W. Biederman + +commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream. + +It turns out that there are in fact userspace implementations that +care and this recent change caused a regression. + +https://github.com/containers/buildah/issues/3071 + +As the motivation for the original change was future development, +and the impact is existing real world code just revert this change +and allow the ambiguity in v3 file caps. + +Cc: stable@vger.kernel.org +Fixes: 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") +Signed-off-by: Eric W. Biederman +Signed-off-by: Greg Kroah-Hartman +--- + security/commoncap.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -500,8 +500,7 @@ int cap_convert_nscap(struct dentry *den + __u32 magic, nsmagic; + struct inode *inode = d_backing_inode(dentry); + struct user_namespace *task_ns = current_user_ns(), +- *fs_ns = inode->i_sb->s_user_ns, +- *ancestor; ++ *fs_ns = inode->i_sb->s_user_ns; + kuid_t rootid; + size_t newsize; + +@@ -524,15 +523,6 @@ int cap_convert_nscap(struct dentry *den + if (nsrootid == -1) + return -EINVAL; + +- /* +- * Do not allow allow adding a v3 filesystem capability xattr +- * if the rootid field is ambiguous. +- */ +- for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) { +- if (from_kuid(ancestor, rootid) == 0) +- return -EINVAL; +- } +- + newsize = sizeof(struct vfs_ns_cap_data); + nscap = kmalloc(newsize, GFP_ATOMIC); + if (!nscap) diff --git a/queue-5.10/s390-dasd-fix-hanging-dasd-driver-unbind.patch b/queue-5.10/s390-dasd-fix-hanging-dasd-driver-unbind.patch new file mode 100644 index 00000000000..e440560b406 --- /dev/null +++ b/queue-5.10/s390-dasd-fix-hanging-dasd-driver-unbind.patch @@ -0,0 +1,49 @@ +From 7d365bd0bff3c0310c39ebaffc9a8458e036d666 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Fri, 5 Mar 2021 13:54:38 +0100 +Subject: s390/dasd: fix hanging DASD driver unbind + +From: Stefan Haberland + +commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream. + +In case of an unbind of the DASD device driver the function +dasd_generic_remove() is called which shuts down the device. +Among others this functions removes the int_handler from the cdev. +During shutdown the device cancels all outstanding IO requests and waits +for completion of the clear request. +Unfortunately the clear interrupt will never be received when there is no +interrupt handler connected. + +Fix by moving the int_handler removal after the call to the state machine +where no request or interrupt is outstanding. + +Cc: stable@vger.kernel.org +Signed-off-by: Stefan Haberland +Tested-by: Bjoern Walk +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -3522,8 +3522,6 @@ void dasd_generic_remove(struct ccw_devi + struct dasd_device *device; + struct dasd_block *block; + +- cdev->handler = NULL; +- + device = dasd_device_from_cdev(cdev); + if (IS_ERR(device)) { + dasd_remove_sysfs_files(cdev); +@@ -3542,6 +3540,7 @@ void dasd_generic_remove(struct ccw_devi + * no quite down yet. + */ + dasd_set_target_state(device, DASD_STATE_NEW); ++ cdev->handler = NULL; + /* dasd_delete_device destroys the device reference. */ + block = device->block; + dasd_delete_device(device); diff --git a/queue-5.10/s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch b/queue-5.10/s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch new file mode 100644 index 00000000000..0af6c1848d8 --- /dev/null +++ b/queue-5.10/s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch @@ -0,0 +1,40 @@ +From 66f669a272898feb1c69b770e1504aa2ec7723d1 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Fri, 5 Mar 2021 13:54:39 +0100 +Subject: s390/dasd: fix hanging IO request during DASD driver unbind + +From: Stefan Haberland + +commit 66f669a272898feb1c69b770e1504aa2ec7723d1 upstream. + +Prevent that an IO request is build during device shutdown initiated by +a driver unbind. This request will never be able to be processed or +canceled and will hang forever. This will lead also to a hanging unbind. + +Fix by checking not only if the device is in READY state but also check +that there is no device offline initiated before building a new IO request. + +Fixes: e443343e509a ("s390/dasd: blk-mq conversion") + +Cc: # v4.14+ +Signed-off-by: Stefan Haberland +Tested-by: Bjoern Walk +Reviewed-by: Jan Hoeppner +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -3087,7 +3087,8 @@ static blk_status_t do_dasd_request(stru + + basedev = block->base; + spin_lock_irq(&dq->lock); +- if (basedev->state < DASD_STATE_READY) { ++ if (basedev->state < DASD_STATE_READY || ++ test_bit(DASD_FLAG_OFFLINE, &basedev->flags)) { + DBF_DEV_EVENT(DBF_ERR, basedev, + "device not ready for request %p", req); + rc = BLK_STS_IOERR; diff --git a/queue-5.10/series b/queue-5.10/series index 96d1be6562b..16828e582f6 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -57,7 +57,6 @@ net-lapbether-remove-netif_start_queue-netif_stop_queue.patch net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch net-enetc-allow-hardware-timestamping-on-tx-queues-with-tc-etf-enabled.patch -net-bonding-fix-error-return-code-of-bond_neigh_init.patch net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch s390-qeth-fix-memory-leak-after-failed-tx-buffer-allocation.patch r8169-fix-r8168fp_adjust_ocp_cmd-function.patch @@ -170,3 +169,29 @@ mmc-sdhci-update-firmware-interface-api.patch arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch +alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch +alsa-hda-hdmi-cancel-pending-works-before-suspend.patch +alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch +alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch +alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch +alsa-hda-flush-pending-unsolicited-events-before-suspend.patch +alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch +alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch +alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch +alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch +alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch +alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch +revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch +block-discard-page-cache-of-zone-reset-target-range.patch +block-try-to-handle-busy-underlying-device-on-discard.patch +arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch +arm64-mte-map-hotplugged-memory-as-normal-tagged.patch +arm64-perf-fix-64-bit-event-counter-read-truncation.patch +s390-dasd-fix-hanging-dasd-driver-unbind.patch +s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch +software-node-fix-node-registration.patch +xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch +mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch +mmc-core-fix-partition-switch-time-for-emmc.patch +mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch +cifs-do-not-send-close-in-compound-create-close-requests.patch diff --git a/queue-5.10/software-node-fix-node-registration.patch b/queue-5.10/software-node-fix-node-registration.patch new file mode 100644 index 00000000000..b32b18354a1 --- /dev/null +++ b/queue-5.10/software-node-fix-node-registration.patch @@ -0,0 +1,34 @@ +From 8891123f9cbb9c1ee531e5a87fa116f0af685c48 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Mon, 1 Mar 2021 17:30:11 +0300 +Subject: software node: Fix node registration + +From: Heikki Krogerus + +commit 8891123f9cbb9c1ee531e5a87fa116f0af685c48 upstream. + +Software node can not be registered before its parent. + +Fixes: 80488a6b1d3c ("software node: Add support for static node descriptors") +Cc: 5.10+ # 5.10+ +Signed-off-by: Heikki Krogerus +Reviewed-by: Andy Shevchenko +Tested-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/swnode.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/base/swnode.c ++++ b/drivers/base/swnode.c +@@ -786,6 +786,9 @@ int software_node_register(const struct + if (software_node_to_swnode(node)) + return -EEXIST; + ++ if (node->parent && !parent) ++ return -EINVAL; ++ + return PTR_ERR_OR_ZERO(swnode_register(node, parent, 0)); + } + EXPORT_SYMBOL_GPL(software_node_register); diff --git a/queue-5.10/xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch b/queue-5.10/xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch new file mode 100644 index 00000000000..e1bdbdec412 --- /dev/null +++ b/queue-5.10/xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch @@ -0,0 +1,108 @@ +From 9e77d96b8e2724ed00380189f7b0ded61113b39f Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Sat, 6 Mar 2021 17:18:31 +0100 +Subject: xen/events: reset affinity of 2-level event when tearing it down + +From: Juergen Gross + +commit 9e77d96b8e2724ed00380189f7b0ded61113b39f upstream. + +When creating a new event channel with 2-level events the affinity +needs to be reset initially in order to avoid using an old affinity +from earlier usage of the event channel port. So when tearing an event +channel down reset all affinity bits. + +The same applies to the affinity when onlining a vcpu: all old +affinity settings for this vcpu must be reset. As percpu events get +initialized before the percpu event channel hook is called, +resetting of the affinities happens after offlining a vcpu (this is +working, as initial percpu memory is zeroed out). + +Cc: stable@vger.kernel.org +Reported-by: Julien Grall +Signed-off-by: Juergen Gross +Reviewed-by: Julien Grall +Link: https://lore.kernel.org/r/20210306161833.4552-2-jgross@suse.com +Signed-off-by: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_2l.c | 15 +++++++++++++++ + drivers/xen/events/events_base.c | 1 + + drivers/xen/events/events_internal.h | 8 ++++++++ + 3 files changed, 24 insertions(+) + +--- a/drivers/xen/events/events_2l.c ++++ b/drivers/xen/events/events_2l.c +@@ -47,6 +47,11 @@ static unsigned evtchn_2l_max_channels(v + return EVTCHN_2L_NR_CHANNELS; + } + ++static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu) ++{ ++ clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu))); ++} ++ + static void evtchn_2l_bind_to_cpu(evtchn_port_t evtchn, unsigned int cpu, + unsigned int old_cpu) + { +@@ -355,9 +360,18 @@ static void evtchn_2l_resume(void) + EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); + } + ++static int evtchn_2l_percpu_deinit(unsigned int cpu) ++{ ++ memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) * ++ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); ++ ++ return 0; ++} ++ + static const struct evtchn_ops evtchn_ops_2l = { + .max_channels = evtchn_2l_max_channels, + .nr_channels = evtchn_2l_max_channels, ++ .remove = evtchn_2l_remove, + .bind_to_cpu = evtchn_2l_bind_to_cpu, + .clear_pending = evtchn_2l_clear_pending, + .set_pending = evtchn_2l_set_pending, +@@ -367,6 +381,7 @@ static const struct evtchn_ops evtchn_op + .unmask = evtchn_2l_unmask, + .handle_events = evtchn_2l_handle_events, + .resume = evtchn_2l_resume, ++ .percpu_deinit = evtchn_2l_percpu_deinit, + }; + + void __init xen_evtchn_2l_init(void) +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -338,6 +338,7 @@ static int xen_irq_info_pirq_setup(unsig + static void xen_irq_info_cleanup(struct irq_info *info) + { + set_evtchn_to_irq(info->evtchn, -1); ++ xen_evtchn_port_remove(info->evtchn, info->cpu); + info->evtchn = 0; + } + +--- a/drivers/xen/events/events_internal.h ++++ b/drivers/xen/events/events_internal.h +@@ -14,6 +14,7 @@ struct evtchn_ops { + unsigned (*nr_channels)(void); + + int (*setup)(evtchn_port_t port); ++ void (*remove)(evtchn_port_t port, unsigned int cpu); + void (*bind_to_cpu)(evtchn_port_t evtchn, unsigned int cpu, + unsigned int old_cpu); + +@@ -54,6 +55,13 @@ static inline int xen_evtchn_port_setup( + return 0; + } + ++static inline void xen_evtchn_port_remove(evtchn_port_t evtchn, ++ unsigned int cpu) ++{ ++ if (evtchn_ops->remove) ++ evtchn_ops->remove(evtchn, cpu); ++} ++ + static inline void xen_evtchn_port_bind_to_cpu(evtchn_port_t evtchn, + unsigned int cpu, + unsigned int old_cpu)