From: Greg Kroah-Hartman Date: Sun, 15 Aug 2021 12:54:23 +0000 (+0200) Subject: 5.13-stable patches X-Git-Tag: v5.4.142~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=98fed86ebc7bede1cb159ba2467fe1130ac06bbd;p=thirdparty%2Fkernel%2Fstable-queue.git 5.13-stable patches added patches: acpi-nfit-fix-support-for-virtual-spa-ranges.patch arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch asoc-amd-fix-reference-to-pcm-buffer-address.patch asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch asoc-uniphier-fix-reference-to-pcm-buffer-address.patch asoc-xilinx-fix-reference-to-pcm-buffer-address.patch ceph-reduce-contention-in-ceph_check_delayed_caps.patch cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch cifs-call-close-synchronously-during-unlink-rename-lease-break.patch cifs-create-sd-context-must-be-a-multiple-of-8.patch cifs-handle-race-conditions-during-rename.patch cifs-use-the-correct-max-length-for-dentry_path_raw.patch drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch iio-adc-fix-incorrect-exit-of-for-loop.patch iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch iio-adis-set-gpio-reset-pin-direction.patch iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch lib-use-pfn_phys-in-devmem_is_allowed.patch libnvdimm-region-fix-label-activation-vs-errors.patch net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch pinctrl-k210-fix-k210_fpioa_probe.patch revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch seccomp-fix-setting-loaded-filter-count-during-tsync.patch vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch --- diff --git a/queue-5.13/acpi-nfit-fix-support-for-virtual-spa-ranges.patch b/queue-5.13/acpi-nfit-fix-support-for-virtual-spa-ranges.patch new file mode 100644 index 00000000000..8674ecb73b0 --- /dev/null +++ b/queue-5.13/acpi-nfit-fix-support-for-virtual-spa-ranges.patch @@ -0,0 +1,59 @@ +From b93dfa6bda4d4e88e5386490f2b277a26958f9d3 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Wed, 11 Aug 2021 11:53:37 -0700 +Subject: ACPI: NFIT: Fix support for virtual SPA ranges + +From: Dan Williams + +commit b93dfa6bda4d4e88e5386490f2b277a26958f9d3 upstream. + +Fix the NFIT parsing code to treat a 0 index in a SPA Range Structure as +a special case and not match Region Mapping Structures that use 0 to +indicate that they are not mapped. Without this fix some platform BIOS +descriptions of "virtual disk" ranges do not result in the pmem driver +attaching to the range. + +Details: +In addition to typical persistent memory ranges, the ACPI NFIT may also +convey "virtual" ranges. These ranges are indicated by a UUID in the SPA +Range Structure of UUID_VOLATILE_VIRTUAL_DISK, UUID_VOLATILE_VIRTUAL_CD, +UUID_PERSISTENT_VIRTUAL_DISK, or UUID_PERSISTENT_VIRTUAL_CD. The +critical difference between virtual ranges and UUID_PERSISTENT_MEMORY, +is that virtual do not support associations with Region Mapping +Structures. For this reason the "index" value of virtual SPA Range +Structures is allowed to be 0. If a platform BIOS decides to represent +NVDIMMs with disconnected "Region Mapping Structures" (range-index == +0), the kernel may falsely associate them with standalone ranges where +the "SPA Range Structure Index" is also zero. When this happens the +driver may falsely require labels where "virtual disks" are expected to +be label-less. I.e. "label-less" is where the namespace-range == +region-range and the pmem driver attaches with no user action to create +a namespace. + +Cc: Jacek Zloch +Cc: Lukasz Sobieraj +Cc: "Lee, Chun-Yi" +Cc: +Fixes: c2f32acdf848 ("acpi, nfit: treat virtual ramdisk SPA as pmem region") +Reported-by: Krzysztof Rusocki +Reported-by: Damian Bassa +Reviewed-by: Jeff Moyer +Link: https://lore.kernel.org/r/162870796589.2521182.1240403310175570220.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3021,6 +3021,9 @@ static int acpi_nfit_register_region(str + struct acpi_nfit_memory_map *memdev = nfit_memdev->memdev; + struct nd_mapping_desc *mapping; + ++ /* range index 0 == unmapped in SPA or invalid-SPA */ ++ if (memdev->range_index == 0 || spa->range_index == 0) ++ continue; + if (memdev->range_index != spa->range_index) + continue; + if (count >= ND_MAX_MAPPINGS) { diff --git a/queue-5.13/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch b/queue-5.13/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch new file mode 100644 index 00000000000..903570670d3 --- /dev/null +++ b/queue-5.13/arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch @@ -0,0 +1,72 @@ +From 3a715e80400f452b247caa55344f4f60250ffbcf Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Thu, 8 Jul 2021 17:13:48 -0700 +Subject: ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch + +From: Vineet Gupta + +commit 3a715e80400f452b247caa55344f4f60250ffbcf upstream. + +FPU_STATUS register contains FP exception flags bits which are updated +by core as side-effect of FP instructions but can also be manually +wiggled such as by glibc C99 functions fe{raise,clear,test}except() etc. +To effect the update, the programming model requires OR'ing FWE +bit (31). This bit is write-only and RAZ, meaning it is effectively +auto-cleared after write and thus needs to be set everytime: which +is how glibc implements this. + +However there's another usecase of FPU_STATUS update, at the time of +Linux task switch when incoming task value needs to be programmed into +the register. This was added as part of f45ba2bd6da0dc ("ARCv2: +fpu: preserve userspace fpu state") which missed OR'ing FWE bit, +meaning the new value is effectively not being written at all. +This patch remedies that. + +Interestingly, this snafu was not caught in interm glibc testing as the +race window which relies on a specific exception bit to be set/clear is +really small specially when it nvolves context switch. +Fortunately this was caught by glibc's math/test-fenv-tls test which +repeatedly set/clear exception flags in a big loop, concurrently in main +program and also in a thread. + +Fixes: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/54 +Fixes: f45ba2bd6da0dc ("ARCv2: fpu: preserve userspace fpu state") +Cc: stable@vger.kernel.org #5.6+ +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/kernel/fpu.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/arc/kernel/fpu.c ++++ b/arch/arc/kernel/fpu.c +@@ -57,23 +57,26 @@ void fpu_save_restore(struct task_struct + + void fpu_init_task(struct pt_regs *regs) + { ++ const unsigned int fwe = 0x80000000; ++ + /* default rounding mode */ + write_aux_reg(ARC_REG_FPU_CTRL, 0x100); + +- /* set "Write enable" to allow explicit write to exception flags */ +- write_aux_reg(ARC_REG_FPU_STATUS, 0x80000000); ++ /* Initialize to zero: setting requires FWE be set */ ++ write_aux_reg(ARC_REG_FPU_STATUS, fwe); + } + + void fpu_save_restore(struct task_struct *prev, struct task_struct *next) + { + struct arc_fpu *save = &prev->thread.fpu; + struct arc_fpu *restore = &next->thread.fpu; ++ const unsigned int fwe = 0x80000000; + + save->ctrl = read_aux_reg(ARC_REG_FPU_CTRL); + save->status = read_aux_reg(ARC_REG_FPU_STATUS); + + write_aux_reg(ARC_REG_FPU_CTRL, restore->ctrl); +- write_aux_reg(ARC_REG_FPU_STATUS, restore->status); ++ write_aux_reg(ARC_REG_FPU_STATUS, (fwe | restore->status)); + } + + #endif diff --git a/queue-5.13/asoc-amd-fix-reference-to-pcm-buffer-address.patch b/queue-5.13/asoc-amd-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..9c3c1d27b9f --- /dev/null +++ b/queue-5.13/asoc-amd-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,59 @@ +From 8b5d95313b6d30f642e4ed0125891984c446604e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 31 Jul 2021 10:43:31 +0200 +Subject: ASoC: amd: Fix reference to PCM buffer address + +From: Takashi Iwai + +commit 8b5d95313b6d30f642e4ed0125891984c446604e upstream. + +PCM buffers might be allocated dynamically when the buffer +preallocation failed or a larger buffer is requested, and it's not +guaranteed that substream->dma_buffer points to the actually used +buffer. The driver needs to refer to substream->runtime->dma_addr +instead for the buffer address. + +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210731084331.32225-1-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/acp-pcm-dma.c | 2 +- + sound/soc/amd/raven/acp3x-pcm-dma.c | 2 +- + sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/amd/acp-pcm-dma.c ++++ b/sound/soc/amd/acp-pcm-dma.c +@@ -969,7 +969,7 @@ static int acp_dma_hw_params(struct snd_ + + acp_set_sram_bank_state(rtd->acp_mmio, 0, true); + /* Save for runtime private data */ +- rtd->dma_addr = substream->dma_buffer.addr; ++ rtd->dma_addr = runtime->dma_addr; + rtd->order = get_order(size); + + /* Fill the page table entries in ACP SRAM */ +--- a/sound/soc/amd/raven/acp3x-pcm-dma.c ++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c +@@ -286,7 +286,7 @@ static int acp3x_dma_hw_params(struct sn + pr_err("pinfo failed\n"); + } + size = params_buffer_bytes(params); +- rtd->dma_addr = substream->dma_buffer.addr; ++ rtd->dma_addr = substream->runtime->dma_addr; + rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT); + config_acp3x_dma(rtd, substream->stream); + return 0; +--- a/sound/soc/amd/renoir/acp3x-pdm-dma.c ++++ b/sound/soc/amd/renoir/acp3x-pdm-dma.c +@@ -246,7 +246,7 @@ static int acp_pdm_dma_hw_params(struct + return -EINVAL; + size = params_buffer_bytes(params); + period_bytes = params_period_bytes(params); +- rtd->dma_addr = substream->dma_buffer.addr; ++ rtd->dma_addr = substream->runtime->dma_addr; + rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT); + config_acp_dma(rtd, substream->stream); + init_pdm_ring_buffer(MEM_WINDOW_START, size, period_bytes, diff --git a/queue-5.13/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch b/queue-5.13/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..7e11a3a37ba --- /dev/null +++ b/queue-5.13/asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,48 @@ +From 2e6b836312a477d647a7920b56810a5a25f6c856 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Jul 2021 13:23:50 +0200 +Subject: ASoC: intel: atom: Fix reference to PCM buffer address + +From: Takashi Iwai + +commit 2e6b836312a477d647a7920b56810a5a25f6c856 upstream. + +PCM buffers might be allocated dynamically when the buffer +preallocation failed or a larger buffer is requested, and it's not +guaranteed that substream->dma_buffer points to the actually used +buffer. The address should be retrieved from runtime->dma_addr, +instead of substream->dma_buffer (and shouldn't use virt_to_phys). + +Also, remove the line overriding runtime->dma_area superfluously, +which was already set up at the PCM buffer allocation. + +Cc: Cezary Rojewski +Cc: Pierre-Louis Bossart +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210728112353.6675-3-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -127,7 +127,7 @@ static void sst_fill_alloc_params(struct + snd_pcm_uframes_t period_size; + ssize_t periodbytes; + ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream); +- u32 buffer_addr = virt_to_phys(substream->dma_buffer.area); ++ u32 buffer_addr = substream->runtime->dma_addr; + + channels = substream->runtime->channels; + period_size = substream->runtime->period_size; +@@ -233,7 +233,6 @@ static int sst_platform_alloc_stream(str + /* set codec params and inform SST driver the same */ + sst_fill_pcm_params(substream, ¶m); + sst_fill_alloc_params(substream, &alloc_params); +- substream->runtime->dma_area = substream->dma_buffer.area; + str_params.sparams = param; + str_params.aparams = alloc_params; + str_params.codec = SST_CODEC_TYPE_PCM; diff --git a/queue-5.13/asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch b/queue-5.13/asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..61426e98af6 --- /dev/null +++ b/queue-5.13/asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,91 @@ +From bb6a40fc5a830cae45ddd5cd6cfa151b008522ed Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Jul 2021 13:23:53 +0200 +Subject: ASoC: kirkwood: Fix reference to PCM buffer address + +From: Takashi Iwai + +commit bb6a40fc5a830cae45ddd5cd6cfa151b008522ed upstream. + +The transition to the managed PCM buffers allowed the dynamically +buffer allocation, while the driver code still assumes the fixed +preallocation buffer and sets up the DMA stuff at the open call. +This needs to be moved to hw_params after the buffer allocation and +setup. Also, the reference to the buffer address has to be corrected +to runtime->dma_addr. + +Fixes: b3c0ae75f5d3 ("ASoC: kirkwood: Use managed DMA buffer allocation") +Cc: Lars-Peter Clausen +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210728112353.6675-6-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/kirkwood/kirkwood-dma.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/sound/soc/kirkwood/kirkwood-dma.c ++++ b/sound/soc/kirkwood/kirkwood-dma.c +@@ -104,8 +104,6 @@ static int kirkwood_dma_open(struct snd_ + int err; + struct snd_pcm_runtime *runtime = substream->runtime; + struct kirkwood_dma_data *priv = kirkwood_priv(substream); +- const struct mbus_dram_target_info *dram; +- unsigned long addr; + + snd_soc_set_runtime_hwparams(substream, &kirkwood_dma_snd_hw); + +@@ -142,20 +140,14 @@ static int kirkwood_dma_open(struct snd_ + writel((unsigned int)-1, priv->io + KIRKWOOD_ERR_MASK); + } + +- dram = mv_mbus_dram_info(); +- addr = substream->dma_buffer.addr; + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + if (priv->substream_play) + return -EBUSY; + priv->substream_play = substream; +- kirkwood_dma_conf_mbus_windows(priv->io, +- KIRKWOOD_PLAYBACK_WIN, addr, dram); + } else { + if (priv->substream_rec) + return -EBUSY; + priv->substream_rec = substream; +- kirkwood_dma_conf_mbus_windows(priv->io, +- KIRKWOOD_RECORD_WIN, addr, dram); + } + + return 0; +@@ -182,6 +174,23 @@ static int kirkwood_dma_close(struct snd + return 0; + } + ++static int kirkwood_dma_hw_params(struct snd_soc_component *component, ++ struct snd_pcm_substream *substream, ++ struct snd_pcm_hw_params *params) ++{ ++ struct kirkwood_dma_data *priv = kirkwood_priv(substream); ++ const struct mbus_dram_target_info *dram = mv_mbus_dram_info(); ++ unsigned long addr = substream->runtime->dma_addr; ++ ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ++ kirkwood_dma_conf_mbus_windows(priv->io, ++ KIRKWOOD_PLAYBACK_WIN, addr, dram); ++ else ++ kirkwood_dma_conf_mbus_windows(priv->io, ++ KIRKWOOD_RECORD_WIN, addr, dram); ++ return 0; ++} ++ + static int kirkwood_dma_prepare(struct snd_soc_component *component, + struct snd_pcm_substream *substream) + { +@@ -246,6 +255,7 @@ const struct snd_soc_component_driver ki + .name = DRV_NAME, + .open = kirkwood_dma_open, + .close = kirkwood_dma_close, ++ .hw_params = kirkwood_dma_hw_params, + .prepare = kirkwood_dma_prepare, + .pointer = kirkwood_dma_pointer, + .pcm_construct = kirkwood_dma_new, diff --git a/queue-5.13/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch b/queue-5.13/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch new file mode 100644 index 00000000000..e7600c82ab1 --- /dev/null +++ b/queue-5.13/asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch @@ -0,0 +1,58 @@ +From 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Fri, 23 Jul 2021 19:02:00 +0100 +Subject: ASoC: tlv320aic31xx: Fix jack detection after suspend + +From: Mark Brown + +commit 2c39ca6885a2ec03e5c9e7c12a4da2aa8926605a upstream. + +The tlv320aic31xx driver relies on regcache_sync() to restore the register +contents after going to _BIAS_OFF, for example during system suspend. This +does not work for the jack detection configuration since that is configured +via the same register that status is read back from so the register is +volatile and not cached. This can also cause issues during init if the jack +detection ends up getting set up before the CODEC is initially brought out +of _BIAS_OFF, we will reset the CODEC and resync the cache as part of that +process. + +Fix this by explicitly reapplying the jack detection configuration after +resyncing the register cache during power on. + +This issue was found by an engineer working off-list on a product +kernel, I just wrote up the upstream fix. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20210723180200.25105-1-broonie@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/tlv320aic31xx.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/sound/soc/codecs/tlv320aic31xx.c ++++ b/sound/soc/codecs/tlv320aic31xx.c +@@ -35,6 +35,9 @@ + + #include "tlv320aic31xx.h" + ++static int aic31xx_set_jack(struct snd_soc_component *component, ++ struct snd_soc_jack *jack, void *data); ++ + static const struct reg_default aic31xx_reg_defaults[] = { + { AIC31XX_CLKMUX, 0x00 }, + { AIC31XX_PLLPR, 0x11 }, +@@ -1256,6 +1259,13 @@ static int aic31xx_power_on(struct snd_s + return ret; + } + ++ /* ++ * The jack detection configuration is in the same register ++ * that is used to report jack detect status so is volatile ++ * and not covered by the cache sync, restore it separately. ++ */ ++ aic31xx_set_jack(component, aic31xx->jack, NULL); ++ + return 0; + } + diff --git a/queue-5.13/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch b/queue-5.13/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..0c46eb87f67 --- /dev/null +++ b/queue-5.13/asoc-uniphier-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,39 @@ +From 827f3164aaa579eee6fd50c6654861d54f282a11 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Jul 2021 13:23:52 +0200 +Subject: ASoC: uniphier: Fix reference to PCM buffer address + +From: Takashi Iwai + +commit 827f3164aaa579eee6fd50c6654861d54f282a11 upstream. + +Along with the transition to the managed PCM buffers, the driver now +accepts the dynamically allocated buffer, while it still kept the +reference to the old preallocated buffer address. This patch corrects +to the right reference via runtime->dma_addr. + +(Although this might have been already buggy before the cleanup with +the managed buffer, let's put Fixes tag to point that; it's a corner +case, after all.) + +Fixes: d55894bc2763 ("ASoC: uniphier: Use managed buffer allocation") +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210728112353.6675-5-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/uniphier/aio-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/uniphier/aio-dma.c ++++ b/sound/soc/uniphier/aio-dma.c +@@ -198,7 +198,7 @@ static int uniphier_aiodma_mmap(struct s + vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); + + return remap_pfn_range(vma, vma->vm_start, +- substream->dma_buffer.addr >> PAGE_SHIFT, ++ substream->runtime->dma_addr >> PAGE_SHIFT, + vma->vm_end - vma->vm_start, vma->vm_page_prot); + } + diff --git a/queue-5.13/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch b/queue-5.13/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch new file mode 100644 index 00000000000..e7d159dae3b --- /dev/null +++ b/queue-5.13/asoc-xilinx-fix-reference-to-pcm-buffer-address.patch @@ -0,0 +1,37 @@ +From 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 28 Jul 2021 13:23:51 +0200 +Subject: ASoC: xilinx: Fix reference to PCM buffer address + +From: Takashi Iwai + +commit 42bc62c9f1d3d4880bdc27acb5ab4784209bb0b0 upstream. + +PCM buffers might be allocated dynamically when the buffer +preallocation failed or a larger buffer is requested, and it's not +guaranteed that substream->dma_buffer points to the actually used +buffer. The driver needs to refer to substream->runtime->dma_addr +instead for the buffer address. + +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210728112353.6675-4-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/xilinx/xlnx_formatter_pcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/xilinx/xlnx_formatter_pcm.c ++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c +@@ -452,8 +452,8 @@ static int xlnx_formatter_pcm_hw_params( + + stream_data->buffer_size = size; + +- low = lower_32_bits(substream->dma_buffer.addr); +- high = upper_32_bits(substream->dma_buffer.addr); ++ low = lower_32_bits(runtime->dma_addr); ++ high = upper_32_bits(runtime->dma_addr); + writel(low, stream_data->mmio + XLNX_AUD_BUFF_ADDR_LSB); + writel(high, stream_data->mmio + XLNX_AUD_BUFF_ADDR_MSB); + diff --git a/queue-5.13/ceph-reduce-contention-in-ceph_check_delayed_caps.patch b/queue-5.13/ceph-reduce-contention-in-ceph_check_delayed_caps.patch new file mode 100644 index 00000000000..f029181c7d1 --- /dev/null +++ b/queue-5.13/ceph-reduce-contention-in-ceph_check_delayed_caps.patch @@ -0,0 +1,154 @@ +From bf2ba432213fade50dd39f2e348085b758c0726e Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Tue, 6 Jul 2021 14:52:41 +0100 +Subject: ceph: reduce contention in ceph_check_delayed_caps() + +From: Luis Henriques + +commit bf2ba432213fade50dd39f2e348085b758c0726e upstream. + +Function ceph_check_delayed_caps() is called from the mdsc->delayed_work +workqueue and it can be kept looping for quite some time if caps keep +being added back to the mdsc->cap_delay_list. This may result in the +watchdog tainting the kernel with the softlockup flag. + +This patch breaks this loop if the caps have been recently (i.e. during +the loop execution). Any new caps added to the list will be handled in +the next run. + +Also, allow schedule_delayed() callers to explicitly set the delay value +instead of defaulting to 5s, so we can ensure that it runs soon +afterward if it looks like there is more work. + +Cc: stable@vger.kernel.org +URL: https://tracker.ceph.com/issues/46284 +Signed-off-by: Luis Henriques +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/caps.c | 17 ++++++++++++++++- + fs/ceph/mds_client.c | 25 ++++++++++++++++--------- + fs/ceph/super.h | 2 +- + 3 files changed, 33 insertions(+), 11 deletions(-) + +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -4224,11 +4224,19 @@ bad: + + /* + * Delayed work handler to process end of delayed cap release LRU list. ++ * ++ * If new caps are added to the list while processing it, these won't get ++ * processed in this run. In this case, the ci->i_hold_caps_max will be ++ * returned so that the work can be scheduled accordingly. + */ +-void ceph_check_delayed_caps(struct ceph_mds_client *mdsc) ++unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc) + { + struct inode *inode; + struct ceph_inode_info *ci; ++ struct ceph_mount_options *opt = mdsc->fsc->mount_options; ++ unsigned long delay_max = opt->caps_wanted_delay_max * HZ; ++ unsigned long loop_start = jiffies; ++ unsigned long delay = 0; + + dout("check_delayed_caps\n"); + spin_lock(&mdsc->cap_delay_lock); +@@ -4236,6 +4244,11 @@ void ceph_check_delayed_caps(struct ceph + ci = list_first_entry(&mdsc->cap_delay_list, + struct ceph_inode_info, + i_cap_delay_list); ++ if (time_before(loop_start, ci->i_hold_caps_max - delay_max)) { ++ dout("%s caps added recently. Exiting loop", __func__); ++ delay = ci->i_hold_caps_max; ++ break; ++ } + if ((ci->i_ceph_flags & CEPH_I_FLUSH) == 0 && + time_before(jiffies, ci->i_hold_caps_max)) + break; +@@ -4252,6 +4265,8 @@ void ceph_check_delayed_caps(struct ceph + } + } + spin_unlock(&mdsc->cap_delay_lock); ++ ++ return delay; + } + + /* +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -4502,22 +4502,29 @@ void inc_session_sequence(struct ceph_md + } + + /* +- * delayed work -- periodically trim expired leases, renew caps with mds ++ * delayed work -- periodically trim expired leases, renew caps with mds. If ++ * the @delay parameter is set to 0 or if it's more than 5 secs, the default ++ * workqueue delay value of 5 secs will be used. + */ +-static void schedule_delayed(struct ceph_mds_client *mdsc) ++static void schedule_delayed(struct ceph_mds_client *mdsc, unsigned long delay) + { +- int delay = 5; +- unsigned hz = round_jiffies_relative(HZ * delay); +- schedule_delayed_work(&mdsc->delayed_work, hz); ++ unsigned long max_delay = HZ * 5; ++ ++ /* 5 secs default delay */ ++ if (!delay || (delay > max_delay)) ++ delay = max_delay; ++ schedule_delayed_work(&mdsc->delayed_work, ++ round_jiffies_relative(delay)); + } + + static void delayed_work(struct work_struct *work) + { +- int i; + struct ceph_mds_client *mdsc = + container_of(work, struct ceph_mds_client, delayed_work.work); ++ unsigned long delay; + int renew_interval; + int renew_caps; ++ int i; + + dout("mdsc delayed_work\n"); + +@@ -4557,7 +4564,7 @@ static void delayed_work(struct work_str + } + mutex_unlock(&mdsc->mutex); + +- ceph_check_delayed_caps(mdsc); ++ delay = ceph_check_delayed_caps(mdsc); + + ceph_queue_cap_reclaim_work(mdsc); + +@@ -4565,7 +4572,7 @@ static void delayed_work(struct work_str + + maybe_recover_session(mdsc); + +- schedule_delayed(mdsc); ++ schedule_delayed(mdsc, delay); + } + + int ceph_mdsc_init(struct ceph_fs_client *fsc) +@@ -5042,7 +5049,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph + mdsc->mdsmap->m_epoch); + + mutex_unlock(&mdsc->mutex); +- schedule_delayed(mdsc); ++ schedule_delayed(mdsc, 0); + return; + + bad_unlock: +--- a/fs/ceph/super.h ++++ b/fs/ceph/super.h +@@ -1170,7 +1170,7 @@ extern void ceph_flush_snaps(struct ceph + extern bool __ceph_should_report_size(struct ceph_inode_info *ci); + extern void ceph_check_caps(struct ceph_inode_info *ci, int flags, + struct ceph_mds_session *session); +-extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc); ++extern unsigned long ceph_check_delayed_caps(struct ceph_mds_client *mdsc); + extern void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc); + extern int ceph_drop_caps_for_unlink(struct inode *inode); + extern int ceph_encode_inode_release(void **p, struct inode *inode, diff --git a/queue-5.13/cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch b/queue-5.13/cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch new file mode 100644 index 00000000000..36931fd2db4 --- /dev/null +++ b/queue-5.13/cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch @@ -0,0 +1,150 @@ +From c3df5fb57fe8756d67fd56ed29da65cdfde839f9 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 27 Jul 2021 13:12:20 -1000 +Subject: cgroup: rstat: fix A-A deadlock on 32bit around u64_stats_sync + +From: Tejun Heo + +commit c3df5fb57fe8756d67fd56ed29da65cdfde839f9 upstream. + +0fa294fb1985 ("cgroup: Replace cgroup_rstat_mutex with a spinlock") added +cgroup_rstat_flush_irqsafe() allowing flushing to happen from the irq +context. However, rstat paths use u64_stats_sync to synchronize access to +64bit stat counters on 32bit machines. u64_stats_sync is implemented using +seq_lock and trying to read from an irq context can lead to A-A deadlock if +the irq happens to interrupt the stat update. + +Fix it by using the irqsafe variants - u64_stats_update_begin_irqsave() and +u64_stats_update_end_irqrestore() - in the update paths. Note that none of +this matters on 64bit machines. All these are just for 32bit SMP setups. + +Note that the interface was introduced way back, its first and currently +only use was recently added by 2d146aa3aa84 ("mm: memcontrol: switch to +rstat"). Stable tagging targets this commit. + +Signed-off-by: Tejun Heo +Reported-by: Rik van Riel +Fixes: 2d146aa3aa84 ("mm: memcontrol: switch to rstat") +Cc: stable@vger.kernel.org # v5.13+ +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-cgroup.c | 14 ++++++++------ + kernel/cgroup/rstat.c | 19 +++++++++++-------- + 2 files changed, 19 insertions(+), 14 deletions(-) + +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -774,6 +774,7 @@ static void blkcg_rstat_flush(struct cgr + struct blkcg_gq *parent = blkg->parent; + struct blkg_iostat_set *bisc = per_cpu_ptr(blkg->iostat_cpu, cpu); + struct blkg_iostat cur, delta; ++ unsigned long flags; + unsigned int seq; + + /* fetch the current per-cpu values */ +@@ -783,21 +784,21 @@ static void blkcg_rstat_flush(struct cgr + } while (u64_stats_fetch_retry(&bisc->sync, seq)); + + /* propagate percpu delta to global */ +- u64_stats_update_begin(&blkg->iostat.sync); ++ flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync); + blkg_iostat_set(&delta, &cur); + blkg_iostat_sub(&delta, &bisc->last); + blkg_iostat_add(&blkg->iostat.cur, &delta); + blkg_iostat_add(&bisc->last, &delta); +- u64_stats_update_end(&blkg->iostat.sync); ++ u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); + + /* propagate global delta to parent (unless that's root) */ + if (parent && parent->parent) { +- u64_stats_update_begin(&parent->iostat.sync); ++ flags = u64_stats_update_begin_irqsave(&parent->iostat.sync); + blkg_iostat_set(&delta, &blkg->iostat.cur); + blkg_iostat_sub(&delta, &blkg->iostat.last); + blkg_iostat_add(&parent->iostat.cur, &delta); + blkg_iostat_add(&blkg->iostat.last, &delta); +- u64_stats_update_end(&parent->iostat.sync); ++ u64_stats_update_end_irqrestore(&parent->iostat.sync, flags); + } + } + +@@ -832,6 +833,7 @@ static void blkcg_fill_root_iostats(void + memset(&tmp, 0, sizeof(tmp)); + for_each_possible_cpu(cpu) { + struct disk_stats *cpu_dkstats; ++ unsigned long flags; + + cpu_dkstats = per_cpu_ptr(bdev->bd_stats, cpu); + tmp.ios[BLKG_IOSTAT_READ] += +@@ -848,9 +850,9 @@ static void blkcg_fill_root_iostats(void + tmp.bytes[BLKG_IOSTAT_DISCARD] += + cpu_dkstats->sectors[STAT_DISCARD] << 9; + +- u64_stats_update_begin(&blkg->iostat.sync); ++ flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync); + blkg_iostat_set(&blkg->iostat.cur, &tmp); +- u64_stats_update_end(&blkg->iostat.sync); ++ u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); + } + } + } +--- a/kernel/cgroup/rstat.c ++++ b/kernel/cgroup/rstat.c +@@ -347,19 +347,20 @@ static void cgroup_base_stat_flush(struc + } + + static struct cgroup_rstat_cpu * +-cgroup_base_stat_cputime_account_begin(struct cgroup *cgrp) ++cgroup_base_stat_cputime_account_begin(struct cgroup *cgrp, unsigned long *flags) + { + struct cgroup_rstat_cpu *rstatc; + + rstatc = get_cpu_ptr(cgrp->rstat_cpu); +- u64_stats_update_begin(&rstatc->bsync); ++ *flags = u64_stats_update_begin_irqsave(&rstatc->bsync); + return rstatc; + } + + static void cgroup_base_stat_cputime_account_end(struct cgroup *cgrp, +- struct cgroup_rstat_cpu *rstatc) ++ struct cgroup_rstat_cpu *rstatc, ++ unsigned long flags) + { +- u64_stats_update_end(&rstatc->bsync); ++ u64_stats_update_end_irqrestore(&rstatc->bsync, flags); + cgroup_rstat_updated(cgrp, smp_processor_id()); + put_cpu_ptr(rstatc); + } +@@ -367,18 +368,20 @@ static void cgroup_base_stat_cputime_acc + void __cgroup_account_cputime(struct cgroup *cgrp, u64 delta_exec) + { + struct cgroup_rstat_cpu *rstatc; ++ unsigned long flags; + +- rstatc = cgroup_base_stat_cputime_account_begin(cgrp); ++ rstatc = cgroup_base_stat_cputime_account_begin(cgrp, &flags); + rstatc->bstat.cputime.sum_exec_runtime += delta_exec; +- cgroup_base_stat_cputime_account_end(cgrp, rstatc); ++ cgroup_base_stat_cputime_account_end(cgrp, rstatc, flags); + } + + void __cgroup_account_cputime_field(struct cgroup *cgrp, + enum cpu_usage_stat index, u64 delta_exec) + { + struct cgroup_rstat_cpu *rstatc; ++ unsigned long flags; + +- rstatc = cgroup_base_stat_cputime_account_begin(cgrp); ++ rstatc = cgroup_base_stat_cputime_account_begin(cgrp, &flags); + + switch (index) { + case CPUTIME_USER: +@@ -394,7 +397,7 @@ void __cgroup_account_cputime_field(stru + break; + } + +- cgroup_base_stat_cputime_account_end(cgrp, rstatc); ++ cgroup_base_stat_cputime_account_end(cgrp, rstatc, flags); + } + + /* diff --git a/queue-5.13/cifs-call-close-synchronously-during-unlink-rename-lease-break.patch b/queue-5.13/cifs-call-close-synchronously-during-unlink-rename-lease-break.patch new file mode 100644 index 00000000000..2a6789c1fdd --- /dev/null +++ b/queue-5.13/cifs-call-close-synchronously-during-unlink-rename-lease-break.patch @@ -0,0 +1,173 @@ +From 9e992755be8f2d458a0bcbefd19e493483c1dba2 Mon Sep 17 00:00:00 2001 +From: Rohith Surabattula +Date: Mon, 9 Aug 2021 09:32:46 +0000 +Subject: cifs: Call close synchronously during unlink/rename/lease break. + +From: Rohith Surabattula + +commit 9e992755be8f2d458a0bcbefd19e493483c1dba2 upstream. + +During unlink/rename/lease break, deferred work for close is +scheduled immediately but in an asynchronous manner which might +lead to race with actual(unlink/rename) commands. + +This change will schedule close synchronously which will avoid +the race conditions with other commands. + +Signed-off-by: Rohith Surabattula +Reviewed-by: Shyam Prasad N +Cc: stable@vger.kernel.org # 5.13 +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/cifsglob.h | 5 +++++ + fs/cifs/file.c | 35 +++++++++++++++++------------------ + fs/cifs/misc.c | 46 ++++++++++++++++++++++++++++++++++------------ + 3 files changed, 56 insertions(+), 30 deletions(-) + +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1615,6 +1615,11 @@ struct dfs_info3_param { + int ttl; + }; + ++struct file_list { ++ struct list_head list; ++ struct cifsFileInfo *cfile; ++}; ++ + /* + * common struct for holding inode info when searching for or updating an + * inode with new info +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -4860,34 +4860,33 @@ void cifs_oplock_break(struct work_struc + + oplock_break_ack: + /* +- * releasing stale oplock after recent reconnect of smb session using +- * a now incorrect file handle is not a data integrity issue but do +- * not bother sending an oplock release if session to server still is +- * disconnected since oplock already released by the server +- */ +- if (!cfile->oplock_break_cancelled) { +- rc = tcon->ses->server->ops->oplock_response(tcon, &cfile->fid, +- cinode); +- cifs_dbg(FYI, "Oplock release rc = %d\n", rc); +- } +- /* + * When oplock break is received and there are no active + * file handles but cached, then schedule deferred close immediately. + * So, new open will not use cached handle. + */ + spin_lock(&CIFS_I(inode)->deferred_lock); + is_deferred = cifs_is_deferred_close(cfile, &dclose); ++ spin_unlock(&CIFS_I(inode)->deferred_lock); + if (is_deferred && + cfile->deferred_close_scheduled && + delayed_work_pending(&cfile->deferred)) { +- /* +- * If there is no pending work, mod_delayed_work queues new work. +- * So, Increase the ref count to avoid use-after-free. +- */ +- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0)) +- cifsFileInfo_get(cfile); ++ if (cancel_delayed_work(&cfile->deferred)) { ++ _cifsFileInfo_put(cfile, false, false); ++ goto oplock_break_done; ++ } + } +- spin_unlock(&CIFS_I(inode)->deferred_lock); ++ /* ++ * releasing stale oplock after recent reconnect of smb session using ++ * a now incorrect file handle is not a data integrity issue but do ++ * not bother sending an oplock release if session to server still is ++ * disconnected since oplock already released by the server ++ */ ++ if (!cfile->oplock_break_cancelled) { ++ rc = tcon->ses->server->ops->oplock_response(tcon, &cfile->fid, ++ cinode); ++ cifs_dbg(FYI, "Oplock release rc = %d\n", rc); ++ } ++oplock_break_done: + _cifsFileInfo_put(cfile, false /* do not wait for ourself */, false); + cifs_done_oplock_break(cinode); + } +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -735,20 +735,32 @@ void + cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + { + struct cifsFileInfo *cfile = NULL; ++ struct file_list *tmp_list, *tmp_next_list; ++ struct list_head file_head; + + if (cifs_inode == NULL) + return; + ++ INIT_LIST_HEAD(&file_head); ++ spin_lock(&cifs_inode->open_file_lock); + list_for_each_entry(cfile, &cifs_inode->openFileList, flist) { + if (delayed_work_pending(&cfile->deferred)) { +- /* +- * If there is no pending work, mod_delayed_work queues new work. +- * So, Increase the ref count to avoid use-after-free. +- */ +- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0)) +- cifsFileInfo_get(cfile); ++ if (cancel_delayed_work(&cfile->deferred)) { ++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); ++ if (tmp_list == NULL) ++ continue; ++ tmp_list->cfile = cfile; ++ list_add_tail(&tmp_list->list, &file_head); ++ } + } + } ++ spin_unlock(&cifs_inode->open_file_lock); ++ ++ list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { ++ _cifsFileInfo_put(tmp_list->cfile, true, false); ++ list_del(&tmp_list->list); ++ kfree(tmp_list); ++ } + } + + void +@@ -756,20 +768,30 @@ cifs_close_all_deferred_files(struct cif + { + struct cifsFileInfo *cfile; + struct list_head *tmp; ++ struct file_list *tmp_list, *tmp_next_list; ++ struct list_head file_head; + ++ INIT_LIST_HEAD(&file_head); + spin_lock(&tcon->open_file_lock); + list_for_each(tmp, &tcon->openFileList) { + cfile = list_entry(tmp, struct cifsFileInfo, tlist); + if (delayed_work_pending(&cfile->deferred)) { +- /* +- * If there is no pending work, mod_delayed_work queues new work. +- * So, Increase the ref count to avoid use-after-free. +- */ +- if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0)) +- cifsFileInfo_get(cfile); ++ if (cancel_delayed_work(&cfile->deferred)) { ++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); ++ if (tmp_list == NULL) ++ continue; ++ tmp_list->cfile = cfile; ++ list_add_tail(&tmp_list->list, &file_head); ++ } + } + } + spin_unlock(&tcon->open_file_lock); ++ ++ list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { ++ _cifsFileInfo_put(tmp_list->cfile, true, false); ++ list_del(&tmp_list->list); ++ kfree(tmp_list); ++ } + } + + /* parses DFS refferal V3 structure diff --git a/queue-5.13/cifs-create-sd-context-must-be-a-multiple-of-8.patch b/queue-5.13/cifs-create-sd-context-must-be-a-multiple-of-8.patch new file mode 100644 index 00000000000..f68d071fcf5 --- /dev/null +++ b/queue-5.13/cifs-create-sd-context-must-be-a-multiple-of-8.patch @@ -0,0 +1,34 @@ +From 7d3fc01796fc895e5fcce45c994c5a8db8120a8d Mon Sep 17 00:00:00 2001 +From: Shyam Prasad N +Date: Wed, 4 Aug 2021 18:37:22 +0000 +Subject: cifs: create sd context must be a multiple of 8 + +From: Shyam Prasad N + +commit 7d3fc01796fc895e5fcce45c994c5a8db8120a8d upstream. + +We used to follow the rule earlier that the create SD context +always be a multiple of 8. However, with the change: +cifs: refactor create_sd_buf() and and avoid corrupting the buffer +...we recompute the length, and we failed that rule. +Fixing that with this change. + +Cc: # v5.10+ +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2375,7 +2375,7 @@ create_sd_buf(umode_t mode, bool set_own + memcpy(aclptr, &acl, sizeof(struct cifs_acl)); + + buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); +- *len = ptr - (__u8 *)buf; ++ *len = roundup(ptr - (__u8 *)buf, 8); + + return buf; + } diff --git a/queue-5.13/cifs-handle-race-conditions-during-rename.patch b/queue-5.13/cifs-handle-race-conditions-during-rename.patch new file mode 100644 index 00000000000..388c973973b --- /dev/null +++ b/queue-5.13/cifs-handle-race-conditions-during-rename.patch @@ -0,0 +1,97 @@ +From 41535701da3324b80029cabb501e86c4fafe339d Mon Sep 17 00:00:00 2001 +From: Rohith Surabattula +Date: Thu, 29 Jul 2021 07:45:29 +0000 +Subject: cifs: Handle race conditions during rename + +From: Rohith Surabattula + +commit 41535701da3324b80029cabb501e86c4fafe339d upstream. + +When rename is executed on directory which has files for which +close is deferred, then rename will fail with EACCES. + +This patch will try to close all deferred files when EACCES is received +and retry rename on a directory. + +Signed-off-by: Rohith Surabattula +Cc: stable@vger.kernel.org # 5.13 +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/inode.c | 19 +++++++++++++++++-- + fs/cifs/misc.c | 16 +++++++++++----- + 2 files changed, 28 insertions(+), 7 deletions(-) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1637,7 +1637,7 @@ int cifs_unlink(struct inode *dir, struc + goto unlink_out; + } + +- cifs_close_all_deferred_files(tcon); ++ cifs_close_deferred_file(CIFS_I(inode)); + if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & + le64_to_cpu(tcon->fsUnixInfo.Capability))) { + rc = CIFSPOSIXDelFile(xid, tcon, full_path, +@@ -2096,6 +2096,7 @@ cifs_rename2(struct user_namespace *mnt_ + FILE_UNIX_BASIC_INFO *info_buf_target; + unsigned int xid; + int rc, tmprc; ++ int retry_count = 0; + + if (flags & ~RENAME_NOREPLACE) + return -EINVAL; +@@ -2125,10 +2126,24 @@ cifs_rename2(struct user_namespace *mnt_ + goto cifs_rename_exit; + } + +- cifs_close_all_deferred_files(tcon); ++ cifs_close_deferred_file(CIFS_I(d_inode(source_dentry))); ++ if (d_inode(target_dentry) != NULL) ++ cifs_close_deferred_file(CIFS_I(d_inode(target_dentry))); ++ + rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, + to_name); + ++ if (rc == -EACCES) { ++ while (retry_count < 3) { ++ cifs_close_all_deferred_files(tcon); ++ rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, ++ to_name); ++ if (rc != -EACCES) ++ break; ++ retry_count++; ++ } ++ } ++ + /* + * No-replace is the natural behavior for CIFS, so skip unlink hacks. + */ +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -735,13 +735,19 @@ void + cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) + { + struct cifsFileInfo *cfile = NULL; +- struct cifs_deferred_close *dclose; ++ ++ if (cifs_inode == NULL) ++ return; + + list_for_each_entry(cfile, &cifs_inode->openFileList, flist) { +- spin_lock(&cifs_inode->deferred_lock); +- if (cifs_is_deferred_close(cfile, &dclose)) +- mod_delayed_work(deferredclose_wq, &cfile->deferred, 0); +- spin_unlock(&cifs_inode->deferred_lock); ++ if (delayed_work_pending(&cfile->deferred)) { ++ /* ++ * If there is no pending work, mod_delayed_work queues new work. ++ * So, Increase the ref count to avoid use-after-free. ++ */ ++ if (!mod_delayed_work(deferredclose_wq, &cfile->deferred, 0)) ++ cifsFileInfo_get(cfile); ++ } + } + } + diff --git a/queue-5.13/cifs-use-the-correct-max-length-for-dentry_path_raw.patch b/queue-5.13/cifs-use-the-correct-max-length-for-dentry_path_raw.patch new file mode 100644 index 00000000000..0745c127fe8 --- /dev/null +++ b/queue-5.13/cifs-use-the-correct-max-length-for-dentry_path_raw.patch @@ -0,0 +1,36 @@ +From 981567bd965329df7e64b13e92a54da816c1e0a4 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Tue, 10 Aug 2021 16:33:55 +1000 +Subject: cifs: use the correct max-length for dentry_path_raw() + +From: Ronnie Sahlberg + +commit 981567bd965329df7e64b13e92a54da816c1e0a4 upstream. + +RHBZ: 1972502 + +PATH_MAX is 4096 but PAGE_SIZE can be >4096 on some architectures +such as ppc and would thus write beyond the end of the actual object. + +Cc: +Reported-by: Xiaoli Feng +Suggested-by: Brian foster +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -112,7 +112,7 @@ build_path_from_dentry_optional_prefix(s + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) + pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0; + +- s = dentry_path_raw(direntry, page, PAGE_SIZE); ++ s = dentry_path_raw(direntry, page, PATH_MAX); + if (IS_ERR(s)) + return s; + if (!s[1]) // for root we want "", not "/" diff --git a/queue-5.13/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch b/queue-5.13/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch new file mode 100644 index 00000000000..4fa24e996b1 --- /dev/null +++ b/queue-5.13/drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch @@ -0,0 +1,30 @@ +From c90f6263f58a28c3d97b83679d6fd693b33dfd4e Mon Sep 17 00:00:00 2001 +From: Eric Bernstein +Date: Mon, 26 Jul 2021 15:53:18 -0400 +Subject: drm/amd/display: Remove invalid assert for ODM + MPC case + +From: Eric Bernstein + +commit c90f6263f58a28c3d97b83679d6fd693b33dfd4e upstream. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Anson Jacob +Signed-off-by: Eric Bernstein +Cc: stable@vger.kernel.org +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +@@ -1788,7 +1788,6 @@ static bool dcn30_split_stream_for_mpc_o + } + pri_pipe->next_odm_pipe = sec_pipe; + sec_pipe->prev_odm_pipe = pri_pipe; +- ASSERT(sec_pipe->top_pipe == NULL); + + if (!sec_pipe->top_pipe) + sec_pipe->stream_res.opp = pool->opps[pipe_idx]; diff --git a/queue-5.13/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch b/queue-5.13/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch new file mode 100644 index 00000000000..6b53500045d --- /dev/null +++ b/queue-5.13/drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch @@ -0,0 +1,92 @@ +From 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d Mon Sep 17 00:00:00 2001 +From: Anson Jacob +Date: Fri, 30 Jul 2021 19:46:20 -0400 +Subject: drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work + +From: Anson Jacob + +commit 0cde63a8fc4d9f9f580c297211fd05f91c0fd66d upstream. + +Replace GFP_KERNEL with GFP_ATOMIC as amdgpu_dm_irq_schedule_work +can't sleep. + +BUG: sleeping function called from invalid context at include/linux/sched/mm.h:196 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 253, name: kworker/6:1H +CPU: 6 PID: 253 Comm: kworker/6:1H Tainted: G W OE 5.11.0-promotion_2021_06_07-18_36_28_prelim_revert_retrain #8 +Hardware name: System manufacturer System Product Name/PRIME X570-PRO, BIOS 3405 02/01/2021 +Workqueue: events_highpri dm_irq_work_func [amdgpu] +Call Trace: + + dump_stack+0x5e/0x74 + ___might_sleep.cold+0x87/0x98 + __might_sleep+0x4b/0x80 + kmem_cache_alloc_trace+0x390/0x4f0 + amdgpu_dm_irq_handler+0x171/0x230 [amdgpu] + amdgpu_irq_dispatch+0xc0/0x1e0 [amdgpu] + amdgpu_ih_process+0x81/0x100 [amdgpu] + amdgpu_irq_handler+0x26/0xa0 [amdgpu] + __handle_irq_event_percpu+0x49/0x190 + ? __hrtimer_get_next_event+0x4d/0x80 + handle_irq_event_percpu+0x33/0x80 + handle_irq_event+0x33/0x60 + handle_edge_irq+0x82/0x190 + asm_call_irq_on_stack+0x12/0x20 + + common_interrupt+0xbb/0x140 + asm_common_interrupt+0x1e/0x40 +RIP: 0010:amdgpu_device_rreg.part.0+0x44/0xf0 [amdgpu] +Code: 53 48 89 fb 4c 3b af c8 08 00 00 73 6d 83 e2 02 75 0d f6 87 40 62 01 00 10 0f 85 83 00 00 00 4c 03 ab d0 08 00 00 45 8b 6d 00 <8b> 05 3e b6 52 00 85 c0 7e 62 48 8b 43 08 0f b7 70 3e 65 8b 05 e3 +RSP: 0018:ffffae7740fff9e8 EFLAGS: 00000286 +RAX: ffffffffc05ee610 RBX: ffff8aaf8f620000 RCX: 0000000000000006 +RDX: 0000000000000000 RSI: 0000000000005430 RDI: ffff8aaf8f620000 +RBP: ffffae7740fffa08 R08: 0000000000000001 R09: 000000000000000a +R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000005430 +R13: 0000000071000000 R14: 0000000000000001 R15: 0000000000005430 + ? amdgpu_cgs_write_register+0x20/0x20 [amdgpu] + amdgpu_device_rreg+0x17/0x20 [amdgpu] + amdgpu_cgs_read_register+0x14/0x20 [amdgpu] + dm_read_reg_func+0x38/0xb0 [amdgpu] + generic_reg_wait+0x80/0x160 [amdgpu] + dce_aux_transfer_raw+0x324/0x7c0 [amdgpu] + dc_link_aux_transfer_raw+0x43/0x50 [amdgpu] + dm_dp_aux_transfer+0x87/0x110 [amdgpu] + drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper] + drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper] + drm_dp_get_one_sb_msg+0x349/0x480 [drm_kms_helper] + drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper] + ? drm_dp_mst_hpd_irq+0xc5/0xe40 [drm_kms_helper] + dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu] + ? dm_handle_hpd_rx_irq+0x184/0x1a0 [amdgpu] + handle_hpd_rx_irq+0x195/0x240 [amdgpu] + ? __switch_to_asm+0x42/0x70 + ? __switch_to+0x131/0x450 + dm_irq_work_func+0x19/0x20 [amdgpu] + process_one_work+0x209/0x400 + worker_thread+0x4d/0x3e0 + ? cancel_delayed_work+0xa0/0xa0 + kthread+0x124/0x160 + ? kthread_park+0x90/0x90 + ret_from_fork+0x22/0x30 + +Reviewed-by: Aurabindo Jayamohanan Pillai +Acked-by: Anson Jacob +Signed-off-by: Anson Jacob +Cc: stable@vger.kernel.org +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +@@ -584,7 +584,7 @@ static void amdgpu_dm_irq_schedule_work( + handler_data = container_of(handler_list->next, struct amdgpu_dm_irq_handler_data, list); + + /*allocate a new amdgpu_dm_irq_handler_data*/ +- handler_data_add = kzalloc(sizeof(*handler_data), GFP_KERNEL); ++ handler_data_add = kzalloc(sizeof(*handler_data), GFP_ATOMIC); + if (!handler_data_add) { + DRM_ERROR("DM_IRQ: failed to allocate irq handler!\n"); + return; diff --git a/queue-5.13/drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch b/queue-5.13/drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch new file mode 100644 index 00000000000..313974d5943 --- /dev/null +++ b/queue-5.13/drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch @@ -0,0 +1,43 @@ +From 46dd2965bdd1c5a4f6499c73ff32e636fa8f9769 Mon Sep 17 00:00:00 2001 +From: Solomon Chiu +Date: Wed, 28 Jul 2021 00:20:30 +0800 +Subject: drm/amdgpu: Add preferred mode in modeset when freesync video mode's enabled. + +From: Solomon Chiu + +commit 46dd2965bdd1c5a4f6499c73ff32e636fa8f9769 upstream. + +[Why] +With kernel module parameter "freesync_video" is enabled, if the mode +is changed to preferred mode(the mode with highest rate), then Freesync +fails because the preferred mode is treated as one of freesync video +mode, and then be configurated as freesync video mode(fixed refresh +rate). + +[How] +Skip freesync fixed rate configurating when modeset to preferred mode. + +Signed-off-by: Solomon Chiu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -9410,7 +9410,12 @@ static int dm_update_crtc_state(struct a + } else if (amdgpu_freesync_vid_mode && aconnector && + is_freesync_video_mode(&new_crtc_state->mode, + aconnector)) { +- set_freesync_fixed_config(dm_new_crtc_state); ++ struct drm_display_mode *high_mode; ++ ++ high_mode = get_highest_refresh_rate_mode(aconnector, false); ++ if (!drm_mode_equal(&new_crtc_state->mode, high_mode)) { ++ set_freesync_fixed_config(dm_new_crtc_state); ++ } + } + + ret = dm_atomic_get_state(state, &dm_state); diff --git a/queue-5.13/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch b/queue-5.13/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch new file mode 100644 index 00000000000..720230c187f --- /dev/null +++ b/queue-5.13/drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch @@ -0,0 +1,33 @@ +From 202ead5a3c589b0594a75cb99f080174f6851fed Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 2 Aug 2021 10:03:30 -0400 +Subject: drm/amdgpu: don't enable baco on boco platforms in runpm + +From: Alex Deucher + +commit 202ead5a3c589b0594a75cb99f080174f6851fed upstream. + +If the platform uses BOCO, don't use BACO in runtime suspend. +We could end up executing the BACO path if the platform supports +both. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1669 +Reviewed-by: Evan Quan +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1537,6 +1537,8 @@ static int amdgpu_pmops_runtime_suspend( + pci_ignore_hotplug(pdev); + pci_set_power_state(pdev, PCI_D3cold); + drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF; ++ } else if (amdgpu_device_supports_boco(drm_dev)) { ++ /* nothing to do */ + } else if (amdgpu_device_supports_baco(drm_dev)) { + amdgpu_device_baco_enter(drm_dev); + } diff --git a/queue-5.13/drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch b/queue-5.13/drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch new file mode 100644 index 00000000000..4d21fb7f040 --- /dev/null +++ b/queue-5.13/drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch @@ -0,0 +1,66 @@ +From 7cbe08a930a132d84b4cf79953b00b074ec7a2a7 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 9 Aug 2021 11:22:20 -0400 +Subject: drm/amdgpu: handle VCN instances when harvesting (v2) + +From: Alex Deucher + +commit 7cbe08a930a132d84b4cf79953b00b074ec7a2a7 upstream. + +There may be multiple instances and only one is harvested. + +v2: fix typo in commit message + +Fixes: 83a0b8639185 ("drm/amdgpu: add judgement when add ip blocks (v2)") +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1673 +Reviewed-by: Guchun Chen +Reviewed-by: James Zhu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -299,6 +299,9 @@ int amdgpu_discovery_reg_base_init(struc + ip->major, ip->minor, + ip->revision); + ++ if (le16_to_cpu(ip->hw_id) == VCN_HWID) ++ adev->vcn.num_vcn_inst++; ++ + for (k = 0; k < num_base_address; k++) { + /* + * convert the endianness of base addresses in place, +@@ -377,7 +380,7 @@ void amdgpu_discovery_harvest_ip(struct + { + struct binary_header *bhdr; + struct harvest_table *harvest_info; +- int i; ++ int i, vcn_harvest_count = 0; + + bhdr = (struct binary_header *)adev->mman.discovery_bin; + harvest_info = (struct harvest_table *)(adev->mman.discovery_bin + +@@ -389,8 +392,7 @@ void amdgpu_discovery_harvest_ip(struct + + switch (le32_to_cpu(harvest_info->list[i].hw_id)) { + case VCN_HWID: +- adev->harvest_ip_mask |= AMD_HARVEST_IP_VCN_MASK; +- adev->harvest_ip_mask |= AMD_HARVEST_IP_JPEG_MASK; ++ vcn_harvest_count++; + break; + case DMU_HWID: + adev->harvest_ip_mask |= AMD_HARVEST_IP_DMU_MASK; +@@ -399,6 +401,10 @@ void amdgpu_discovery_harvest_ip(struct + break; + } + } ++ if (vcn_harvest_count == adev->vcn.num_vcn_inst) { ++ adev->harvest_ip_mask |= AMD_HARVEST_IP_VCN_MASK; ++ adev->harvest_ip_mask |= AMD_HARVEST_IP_JPEG_MASK; ++ } + } + + int amdgpu_discovery_get_gfx_info(struct amdgpu_device *adev) diff --git a/queue-5.13/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch b/queue-5.13/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch new file mode 100644 index 00000000000..c7ce92a0e6b --- /dev/null +++ b/queue-5.13/drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch @@ -0,0 +1,134 @@ +From abd9d66a055722393d33685214c08386694871d7 Mon Sep 17 00:00:00 2001 +From: Ankit Nautiyal +Date: Wed, 11 Aug 2021 10:48:57 +0530 +Subject: drm/i915/display: Fix the 12 BPC bits for PIPE_MISC reg +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ankit Nautiyal + +commit abd9d66a055722393d33685214c08386694871d7 upstream. + +Till DISPLAY12 the PIPE_MISC bits 5-7 are used to set the +Dithering BPC, with valid values of 6, 8, 10 BPC. +For ADLP+ these bits are used to set the PORT OUTPUT BPC, with valid +values of: 6, 8, 10, 12 BPC, and need to be programmed whether +dithering is enabled or not. + +This patch: +-corrects the bits 5-7 for PIPE MISC register for 12 BPC. +-renames the bits and mask to have generic names for these bits for +dithering bpc and port output bpc. + +v3: Added a note for MIPI DSI which uses the PIPE_MISC for readout +for pipe_bpp. (Uma Shankar) + +v2: Added 'display' to the subject and fixes tag. (Uma Shankar) + +Fixes: 756f85cffef2 ("drm/i915/bdw: Broadwell has PIPEMISC") +Cc: Paulo Zanoni (v1) +Cc: Ville Syrjälä +Cc: Daniel Vetter +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: intel-gfx@lists.freedesktop.org +Cc: # v3.13+ + +Signed-off-by: Ankit Nautiyal +Reviewed-by: Uma Shankar +Signed-off-by: Uma Shankar +Link: https://patchwork.freedesktop.org/patch/msgid/20210811051857.109723-1-ankit.k.nautiyal@intel.com +(cherry picked from commit 70418a68713c13da3f36c388087d0220b456a430) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_display.c | 34 +++++++++++++++++++-------- + drivers/gpu/drm/i915/i915_reg.h | 16 ++++++++---- + 2 files changed, 35 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -5424,16 +5424,18 @@ static void bdw_set_pipemisc(const struc + + switch (crtc_state->pipe_bpp) { + case 18: +- val |= PIPEMISC_DITHER_6_BPC; ++ val |= PIPEMISC_6_BPC; + break; + case 24: +- val |= PIPEMISC_DITHER_8_BPC; ++ val |= PIPEMISC_8_BPC; + break; + case 30: +- val |= PIPEMISC_DITHER_10_BPC; ++ val |= PIPEMISC_10_BPC; + break; + case 36: +- val |= PIPEMISC_DITHER_12_BPC; ++ /* Port output 12BPC defined for ADLP+ */ ++ if (DISPLAY_VER(dev_priv) > 12) ++ val |= PIPEMISC_12_BPC_ADLP; + break; + default: + MISSING_CASE(crtc_state->pipe_bpp); +@@ -5469,15 +5471,27 @@ int bdw_get_pipemisc_bpp(struct intel_cr + + tmp = intel_de_read(dev_priv, PIPEMISC(crtc->pipe)); + +- switch (tmp & PIPEMISC_DITHER_BPC_MASK) { +- case PIPEMISC_DITHER_6_BPC: ++ switch (tmp & PIPEMISC_BPC_MASK) { ++ case PIPEMISC_6_BPC: + return 18; +- case PIPEMISC_DITHER_8_BPC: ++ case PIPEMISC_8_BPC: + return 24; +- case PIPEMISC_DITHER_10_BPC: ++ case PIPEMISC_10_BPC: + return 30; +- case PIPEMISC_DITHER_12_BPC: +- return 36; ++ /* ++ * PORT OUTPUT 12 BPC defined for ADLP+. ++ * ++ * TODO: ++ * For previous platforms with DSI interface, bits 5:7 ++ * are used for storing pipe_bpp irrespective of dithering. ++ * Since the value of 12 BPC is not defined for these bits ++ * on older platforms, need to find a workaround for 12 BPC ++ * MIPI DSI HW readout. ++ */ ++ case PIPEMISC_12_BPC_ADLP: ++ if (DISPLAY_VER(dev_priv) > 12) ++ return 36; ++ fallthrough; + default: + MISSING_CASE(tmp); + return 0; +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -6134,11 +6134,17 @@ enum { + #define PIPEMISC_HDR_MODE_PRECISION (1 << 23) /* icl+ */ + #define PIPEMISC_OUTPUT_COLORSPACE_YUV (1 << 11) + #define PIPEMISC_PIXEL_ROUNDING_TRUNC REG_BIT(8) /* tgl+ */ +-#define PIPEMISC_DITHER_BPC_MASK (7 << 5) +-#define PIPEMISC_DITHER_8_BPC (0 << 5) +-#define PIPEMISC_DITHER_10_BPC (1 << 5) +-#define PIPEMISC_DITHER_6_BPC (2 << 5) +-#define PIPEMISC_DITHER_12_BPC (3 << 5) ++/* ++ * For Display < 13, Bits 5-7 of PIPE MISC represent DITHER BPC with ++ * valid values of: 6, 8, 10 BPC. ++ * ADLP+, the bits 5-7 represent PORT OUTPUT BPC with valid values of: ++ * 6, 8, 10, 12 BPC. ++ */ ++#define PIPEMISC_BPC_MASK (7 << 5) ++#define PIPEMISC_8_BPC (0 << 5) ++#define PIPEMISC_10_BPC (1 << 5) ++#define PIPEMISC_6_BPC (2 << 5) ++#define PIPEMISC_12_BPC_ADLP (4 << 5) /* adlp+ */ + #define PIPEMISC_DITHER_ENABLE (1 << 4) + #define PIPEMISC_DITHER_TYPE_MASK (3 << 2) + #define PIPEMISC_DITHER_TYPE_SP (0 << 2) diff --git a/queue-5.13/drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch b/queue-5.13/drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch new file mode 100644 index 00000000000..c54927e09eb --- /dev/null +++ b/queue-5.13/drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch @@ -0,0 +1,53 @@ +From 699aa57b35672c3b2f230e2b7e5d0ab8c2bde80a Mon Sep 17 00:00:00 2001 +From: Zhenyu Wang +Date: Fri, 6 Aug 2021 12:40:56 +0800 +Subject: drm/i915/gvt: Fix cached atomics setting for Windows VM + +From: Zhenyu Wang + +commit 699aa57b35672c3b2f230e2b7e5d0ab8c2bde80a upstream. + +We've seen recent regression with host and windows VM running +simultaneously that cause gpu hang or even crash. Finally bisect to +commit 58586680ffad ("drm/i915: Disable atomics in L3 for gen9"), +which seems cached atomics behavior difference caused regression +issue. + +This tries to add new scratch register handler and add those in mmio +save/restore list for context switch. No gpu hang produced with this one. + +Cc: stable@vger.kernel.org # 5.12+ +Cc: "Xu, Terrence" +Cc: "Bloomfield, Jon" +Cc: "Ekstrand, Jason" +Reviewed-by: Colin Xu +Fixes: 58586680ffad ("drm/i915: Disable atomics in L3 for gen9") +Signed-off-by: Zhenyu Wang +Link: http://patchwork.freedesktop.org/patch/msgid/20210806044056.648016-1-zhenyuw@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gvt/handlers.c | 1 + + drivers/gpu/drm/i915/gvt/mmio_context.c | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/gvt/handlers.c ++++ b/drivers/gpu/drm/i915/gvt/handlers.c +@@ -3149,6 +3149,7 @@ static int init_bdw_mmio_info(struct int + MMIO_DFH(_MMIO(0xb100), D_BDW, F_CMD_ACCESS, NULL, NULL); + MMIO_DFH(_MMIO(0xb10c), D_BDW, F_CMD_ACCESS, NULL, NULL); + MMIO_D(_MMIO(0xb110), D_BDW); ++ MMIO_D(GEN9_SCRATCH_LNCF1, D_BDW_PLUS); + + MMIO_F(_MMIO(0x24d0), 48, F_CMD_ACCESS | F_CMD_WRITE_PATCH, 0, 0, + D_BDW_PLUS, NULL, force_nonpriv_write); +--- a/drivers/gpu/drm/i915/gvt/mmio_context.c ++++ b/drivers/gpu/drm/i915/gvt/mmio_context.c +@@ -105,6 +105,8 @@ static struct engine_mmio gen9_engine_mm + {RCS0, COMMON_SLICE_CHICKEN2, 0xffff, true}, /* 0x7014 */ + {RCS0, GEN9_CS_DEBUG_MODE1, 0xffff, false}, /* 0x20ec */ + {RCS0, GEN8_L3SQCREG4, 0, false}, /* 0xb118 */ ++ {RCS0, GEN9_SCRATCH1, 0, false}, /* 0xb11c */ ++ {RCS0, GEN9_SCRATCH_LNCF1, 0, false}, /* 0xb008 */ + {RCS0, GEN7_HALF_SLICE_CHICKEN1, 0xffff, true}, /* 0xe100 */ + {RCS0, HALF_SLICE_CHICKEN2, 0xffff, true}, /* 0xe180 */ + {RCS0, HALF_SLICE_CHICKEN3, 0xffff, true}, /* 0xe184 */ diff --git a/queue-5.13/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch b/queue-5.13/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch new file mode 100644 index 00000000000..011ffaf1808 --- /dev/null +++ b/queue-5.13/i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch @@ -0,0 +1,48 @@ +From 86ff25ed6cd8240d18df58930bd8848b19fce308 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 29 Jul 2021 16:35:32 +0200 +Subject: i2c: dev: zero out array used for i2c reads from userspace + +From: Greg Kroah-Hartman + +commit 86ff25ed6cd8240d18df58930bd8848b19fce308 upstream. + +If an i2c driver happens to not provide the full amount of data that a +user asks for, it is possible that some uninitialized data could be sent +to userspace. While all in-kernel drivers look to be safe, just be sure +by initializing the buffer to zero before it is passed to the i2c driver +so that any future drivers will not have this issue. + +Also properly copy the amount of data recvieved to the userspace buffer, +as pointed out by Dan Carpenter. + +Reported-by: Eric Dumazet +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-dev.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -141,7 +141,7 @@ static ssize_t i2cdev_read(struct file * + if (count > 8192) + count = 8192; + +- tmp = kmalloc(count, GFP_KERNEL); ++ tmp = kzalloc(count, GFP_KERNEL); + if (tmp == NULL) + return -ENOMEM; + +@@ -150,7 +150,8 @@ static ssize_t i2cdev_read(struct file * + + ret = i2c_master_recv(client, tmp, count); + if (ret >= 0) +- ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret; ++ if (copy_to_user(buf, tmp, ret)) ++ ret = -EFAULT; + kfree(tmp); + return ret; + } diff --git a/queue-5.13/iio-adc-fix-incorrect-exit-of-for-loop.patch b/queue-5.13/iio-adc-fix-incorrect-exit-of-for-loop.patch new file mode 100644 index 00000000000..79b19e6335c --- /dev/null +++ b/queue-5.13/iio-adc-fix-incorrect-exit-of-for-loop.patch @@ -0,0 +1,39 @@ +From 5afc1540f13804a31bb704b763308e17688369c5 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 30 Jul 2021 08:16:51 +0100 +Subject: iio: adc: Fix incorrect exit of for-loop + +From: Colin Ian King + +commit 5afc1540f13804a31bb704b763308e17688369c5 upstream. + +Currently the for-loop that scans for the optimial adc_period iterates +through all the possible adc_period levels because the exit logic in +the loop is inverted. I believe the comparison should be swapped and +the continue replaced with a break to exit the loop at the correct +point. + +Addresses-Coverity: ("Continue has no effect") +Fixes: e08e19c331fb ("iio:adc: add iio driver for Palmas (twl6035/7) gpadc") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210730071651.17394-1-colin.king@canonical.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/palmas_gpadc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/palmas_gpadc.c ++++ b/drivers/iio/adc/palmas_gpadc.c +@@ -664,8 +664,8 @@ static int palmas_adc_wakeup_configure(s + + adc_period = adc->auto_conversion_period; + for (i = 0; i < 16; ++i) { +- if (((1000 * (1 << i)) / 32) < adc_period) +- continue; ++ if (((1000 * (1 << i)) / 32) >= adc_period) ++ break; + } + if (i > 0) + i--; diff --git a/queue-5.13/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch b/queue-5.13/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch new file mode 100644 index 00000000000..594f3d413cd --- /dev/null +++ b/queue-5.13/iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch @@ -0,0 +1,43 @@ +From 9898cb24e454602beb6e17bacf9f97b26c85c955 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Fri, 9 Jul 2021 12:11:10 +0200 +Subject: iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 9898cb24e454602beb6e17bacf9f97b26c85c955 upstream. + +The ADS7950 requires that CS is deasserted after each SPI word. Before +commit e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce +CPU usage") the driver used a message with one spi transfer per channel +where each but the last one had .cs_change set to enforce a CS toggle. +This was wrongly translated into a message with a single transfer and +.cs_change set which results in a CS toggle after each word but the +last which corrupts the first adc conversion of all readouts after the +first readout. + +Fixes: e2540da86ef8 ("iio: adc: ti-ads7950: use SPI_CS_WORD to reduce CPU usage") +Signed-off-by: Uwe Kleine-König +Reviewed-by: David Lechner +Tested-by: David Lechner +Cc: +Link: https://lore.kernel.org/r/20210709101110.1814294-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads7950.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/iio/adc/ti-ads7950.c ++++ b/drivers/iio/adc/ti-ads7950.c +@@ -568,7 +568,6 @@ static int ti_ads7950_probe(struct spi_d + st->ring_xfer.tx_buf = &st->tx_buf[0]; + st->ring_xfer.rx_buf = &st->rx_buf[0]; + /* len will be set later */ +- st->ring_xfer.cs_change = true; + + spi_message_add_tail(&st->ring_xfer, &st->ring_msg); + diff --git a/queue-5.13/iio-adis-set-gpio-reset-pin-direction.patch b/queue-5.13/iio-adis-set-gpio-reset-pin-direction.patch new file mode 100644 index 00000000000..8577b5c58e7 --- /dev/null +++ b/queue-5.13/iio-adis-set-gpio-reset-pin-direction.patch @@ -0,0 +1,44 @@ +From 7e77ef8b8d600cf8448a2bbd32f682c28884551f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Antti=20Ker=C3=A4nen?= +Date: Thu, 8 Jul 2021 12:54:29 +0300 +Subject: iio: adis: set GPIO reset pin direction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antti Keränen + +commit 7e77ef8b8d600cf8448a2bbd32f682c28884551f upstream. + +Set reset pin direction to output as the reset pin needs to be an active +low output pin. + +Co-developed-by: Hannu Hartikainen +Signed-off-by: Hannu Hartikainen +Signed-off-by: Antti Keränen +Reviewed-by: Nuno Sá +Fixes: ecb010d44108 ("iio: imu: adis: Refactor adis_initial_startup") +Link: https://lore.kernel.org/r/20210708095425.13295-1-detegr@rbx.email +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/adis.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/imu/adis.c ++++ b/drivers/iio/imu/adis.c +@@ -415,12 +415,11 @@ int __adis_initial_startup(struct adis * + int ret; + + /* check if the device has rst pin low */ +- gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_ASIS); ++ gpio = devm_gpiod_get_optional(&adis->spi->dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(gpio)) + return PTR_ERR(gpio); + + if (gpio) { +- gpiod_set_value_cansleep(gpio, 1); + msleep(10); + /* bring device out of reset */ + gpiod_set_value_cansleep(gpio, 0); diff --git a/queue-5.13/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch b/queue-5.13/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch new file mode 100644 index 00000000000..c36eb317a1e --- /dev/null +++ b/queue-5.13/iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch @@ -0,0 +1,59 @@ +From 84edec86f449adea9ee0b4912a79ab8d9d65abb7 Mon Sep 17 00:00:00 2001 +From: Chris Lesiak +Date: Mon, 14 Jun 2021 09:18:20 -0500 +Subject: iio: humidity: hdc100x: Add margin to the conversion time + +From: Chris Lesiak + +commit 84edec86f449adea9ee0b4912a79ab8d9d65abb7 upstream. + +The datasheets have the following note for the conversion time +specification: "This parameter is specified by design and/or +characterization and it is not tested in production." + +Parts have been seen that require more time to do 14-bit conversions for +the relative humidity channel. The result is ENXIO due to the address +phase of a transfer not getting an ACK. + +Delay an additional 1 ms per conversion to allow for additional margin. + +Fixes: 4839367d99e3 ("iio: humidity: add HDC100x support") +Signed-off-by: Chris Lesiak +Acked-by: Matt Ranostay +Link: https://lore.kernel.org/r/20210614141820.2034827-1-chris.lesiak@licor.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/humidity/hdc100x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -25,6 +25,8 @@ + #include + #include + ++#include ++ + #define HDC100X_REG_TEMP 0x00 + #define HDC100X_REG_HUMIDITY 0x01 + +@@ -166,7 +168,7 @@ static int hdc100x_get_measurement(struc + struct iio_chan_spec const *chan) + { + struct i2c_client *client = data->client; +- int delay = data->adc_int_us[chan->address]; ++ int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC; + int ret; + __be16 val; + +@@ -316,7 +318,7 @@ static irqreturn_t hdc100x_trigger_handl + struct iio_dev *indio_dev = pf->indio_dev; + struct hdc100x_data *data = iio_priv(indio_dev); + struct i2c_client *client = data->client; +- int delay = data->adc_int_us[0] + data->adc_int_us[1]; ++ int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC; + int ret; + + /* dual read starts at temp register */ diff --git a/queue-5.13/io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch b/queue-5.13/io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch new file mode 100644 index 00000000000..4f98b21959b --- /dev/null +++ b/queue-5.13/io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch @@ -0,0 +1,122 @@ +From c018db4a57f3e31a9cb24d528e9f094eda89a499 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Mon, 9 Aug 2021 08:15:50 -0600 +Subject: io_uring: drop ctx->uring_lock before flushing work item + +From: Jens Axboe + +commit c018db4a57f3e31a9cb24d528e9f094eda89a499 upstream. + +Ammar reports that he's seeing a lockdep splat on running test/rsrc_tags +from the regression suite: + +====================================================== +WARNING: possible circular locking dependency detected +5.14.0-rc3-bluetea-test-00249-gc7d102232649 #5 Tainted: G OE +------------------------------------------------------ +kworker/2:4/2684 is trying to acquire lock: +ffff88814bb1c0a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_rsrc_put_work+0x13d/0x1a0 + +but task is already holding lock: +ffffc90001c6be70 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}: + __flush_work+0x31b/0x490 + io_rsrc_ref_quiesce.part.0.constprop.0+0x35/0xb0 + __do_sys_io_uring_register+0x45b/0x1060 + do_syscall_64+0x35/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +-> #0 (&ctx->uring_lock){+.+.}-{3:3}: + __lock_acquire+0x119a/0x1e10 + lock_acquire+0xc8/0x2f0 + __mutex_lock+0x86/0x740 + io_rsrc_put_work+0x13d/0x1a0 + process_one_work+0x236/0x530 + worker_thread+0x52/0x3b0 + kthread+0x135/0x160 + ret_from_fork+0x1f/0x30 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock((work_completion)(&(&ctx->rsrc_put_work)->work)); + lock(&ctx->uring_lock); + lock((work_completion)(&(&ctx->rsrc_put_work)->work)); + lock(&ctx->uring_lock); + + *** DEADLOCK *** + +2 locks held by kworker/2:4/2684: + #0: ffff88810004d938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530 + #1: ffffc90001c6be70 ((work_completion)(&(&ctx->rsrc_put_work)->work)){+.+.}-{0:0}, at: process_one_work+0x1bc/0x530 + +stack backtrace: +CPU: 2 PID: 2684 Comm: kworker/2:4 Tainted: G OE 5.14.0-rc3-bluetea-test-00249-gc7d102232649 #5 +Hardware name: Acer Aspire ES1-421/OLVIA_BE, BIOS V1.05 07/02/2015 +Workqueue: events io_rsrc_put_work +Call Trace: + dump_stack_lvl+0x6a/0x9a + check_noncircular+0xfe/0x110 + __lock_acquire+0x119a/0x1e10 + lock_acquire+0xc8/0x2f0 + ? io_rsrc_put_work+0x13d/0x1a0 + __mutex_lock+0x86/0x740 + ? io_rsrc_put_work+0x13d/0x1a0 + ? io_rsrc_put_work+0x13d/0x1a0 + ? io_rsrc_put_work+0x13d/0x1a0 + ? process_one_work+0x1ce/0x530 + io_rsrc_put_work+0x13d/0x1a0 + process_one_work+0x236/0x530 + worker_thread+0x52/0x3b0 + ? process_one_work+0x530/0x530 + kthread+0x135/0x160 + ? set_kthread_struct+0x40/0x40 + ret_from_fork+0x1f/0x30 + +which is due to holding the ctx->uring_lock when flushing existing +pending work, while the pending work flushing may need to grab the uring +lock if we're using IOPOLL. + +Fix this by dropping the uring_lock a bit earlier as part of the flush. + +Cc: stable@vger.kernel.org +Link: https://github.com/axboe/liburing/issues/404 +Tested-by: Ammar Faizi +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/io_uring.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -7166,17 +7166,19 @@ static int io_rsrc_ref_quiesce(struct io + /* kill initial ref, already quiesced if zero */ + if (atomic_dec_and_test(&data->refs)) + break; ++ mutex_unlock(&ctx->uring_lock); + flush_delayed_work(&ctx->rsrc_put_work); + ret = wait_for_completion_interruptible(&data->done); +- if (!ret) ++ if (!ret) { ++ mutex_lock(&ctx->uring_lock); + break; ++ } + + atomic_inc(&data->refs); + /* wait for all works potentially completing data->done */ + flush_delayed_work(&ctx->rsrc_put_work); + reinit_completion(&data->done); + +- mutex_unlock(&ctx->uring_lock); + ret = io_run_task_work_sig(); + mutex_lock(&ctx->uring_lock); + } while (ret >= 0); diff --git a/queue-5.13/io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch b/queue-5.13/io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch new file mode 100644 index 00000000000..eb7f0129c4a --- /dev/null +++ b/queue-5.13/io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch @@ -0,0 +1,61 @@ +From 43597aac1f87230cb565ab354d331682f13d3c7a Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Tue, 10 Aug 2021 02:44:23 +0100 +Subject: io_uring: fix ctx-exit io_rsrc_put_work() deadlock + +From: Pavel Begunkov + +commit 43597aac1f87230cb565ab354d331682f13d3c7a upstream. + +__io_rsrc_put_work() might need ->uring_lock, so nobody should wait for +rsrc nodes holding the mutex. However, that's exactly what +io_ring_ctx_free() does with io_wait_rsrc_data(). + +Split it into rsrc wait + dealloc, and move the first one out of the +lock. + +Cc: stable@vger.kernel.org +Fixes: b60c8dce33895 ("io_uring: preparation for rsrc tagging") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/0130c5c2693468173ec1afab714e0885d2c9c363.1628559783.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/io_uring.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -8614,13 +8614,10 @@ static void io_req_caches_free(struct io + mutex_unlock(&ctx->uring_lock); + } + +-static bool io_wait_rsrc_data(struct io_rsrc_data *data) ++static void io_wait_rsrc_data(struct io_rsrc_data *data) + { +- if (!data) +- return false; +- if (!atomic_dec_and_test(&data->refs)) ++ if (data && !atomic_dec_and_test(&data->refs)) + wait_for_completion(&data->done); +- return true; + } + + static void io_ring_ctx_free(struct io_ring_ctx *ctx) +@@ -8632,10 +8629,14 @@ static void io_ring_ctx_free(struct io_r + ctx->mm_account = NULL; + } + ++ /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */ ++ io_wait_rsrc_data(ctx->buf_data); ++ io_wait_rsrc_data(ctx->file_data); ++ + mutex_lock(&ctx->uring_lock); +- if (io_wait_rsrc_data(ctx->buf_data)) ++ if (ctx->buf_data) + __io_sqe_buffers_unregister(ctx); +- if (io_wait_rsrc_data(ctx->file_data)) ++ if (ctx->file_data) + __io_sqe_files_unregister(ctx); + if (ctx->rings) + __io_cqring_overflow_flush(ctx, true); diff --git a/queue-5.13/lib-use-pfn_phys-in-devmem_is_allowed.patch b/queue-5.13/lib-use-pfn_phys-in-devmem_is_allowed.patch new file mode 100644 index 00000000000..a4e505bdeca --- /dev/null +++ b/queue-5.13/lib-use-pfn_phys-in-devmem_is_allowed.patch @@ -0,0 +1,51 @@ +From 854f32648b8a5e424d682953b1a9f3b7c3322701 Mon Sep 17 00:00:00 2001 +From: Liang Wang +Date: Fri, 13 Aug 2021 16:54:45 -0700 +Subject: lib: use PFN_PHYS() in devmem_is_allowed() + +From: Liang Wang + +commit 854f32648b8a5e424d682953b1a9f3b7c3322701 upstream. + +The physical address may exceed 32 bits on 32-bit systems with more than +32 bits of physcial address. Use PFN_PHYS() in devmem_is_allowed(), or +the physical address may overflow and be truncated. + +We found this bug when mapping a high addresses through devmem tool, +when CONFIG_STRICT_DEVMEM is enabled on the ARM with ARM_LPAE and devmem +is used to map a high address that is not in the iomem address range, an +unexpected error indicating no permission is returned. + +This bug was initially introduced from v2.6.37, and the function was +moved to lib in v5.11. + +Link: https://lkml.kernel.org/r/20210731025057.78825-1-wangliang101@huawei.com +Fixes: 087aaffcdf9c ("ARM: implement CONFIG_STRICT_DEVMEM by disabling access to RAM via /dev/mem") +Fixes: 527701eda5f1 ("lib: Add a generic version of devmem_is_allowed()") +Signed-off-by: Liang Wang +Reviewed-by: Luis Chamberlain +Cc: Palmer Dabbelt +Cc: Greg Kroah-Hartman +Cc: Russell King +Cc: Liang Wang +Cc: Xiaoming Ni +Cc: Kefeng Wang +Cc: [2.6.37+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + lib/devmem_is_allowed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/devmem_is_allowed.c ++++ b/lib/devmem_is_allowed.c +@@ -19,7 +19,7 @@ + */ + int devmem_is_allowed(unsigned long pfn) + { +- if (iomem_is_exclusive(pfn << PAGE_SHIFT)) ++ if (iomem_is_exclusive(PFN_PHYS(pfn))) + return 0; + if (!page_is_ram(pfn)) + return 1; diff --git a/queue-5.13/libnvdimm-region-fix-label-activation-vs-errors.patch b/queue-5.13/libnvdimm-region-fix-label-activation-vs-errors.patch new file mode 100644 index 00000000000..b0d026a0ccb --- /dev/null +++ b/queue-5.13/libnvdimm-region-fix-label-activation-vs-errors.patch @@ -0,0 +1,76 @@ +From d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Fri, 30 Jul 2021 09:46:04 -0700 +Subject: libnvdimm/region: Fix label activation vs errors + +From: Dan Williams + +commit d9cee9f85b22fab88d2b76d2e92b18e3d0e6aa8c upstream. + +There are a few scenarios where init_active_labels() can return without +registering deactivate_labels() to run when the region is disabled. In +particular label error injection creates scenarios where a DIMM is +disabled, but labels on other DIMMs in the region become activated. + +Arrange for init_active_labels() to always register deactivate_labels(). + +Reported-by: Krzysztof Kensicki +Cc: +Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation.") +Reviewed-by: Jeff Moyer +Link: https://lore.kernel.org/r/162766356450.3223041.1183118139023841447.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvdimm/namespace_devs.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/nvdimm/namespace_devs.c ++++ b/drivers/nvdimm/namespace_devs.c +@@ -2527,7 +2527,7 @@ static void deactivate_labels(void *regi + + static int init_active_labels(struct nd_region *nd_region) + { +- int i; ++ int i, rc = 0; + + for (i = 0; i < nd_region->ndr_mappings; i++) { + struct nd_mapping *nd_mapping = &nd_region->mapping[i]; +@@ -2546,13 +2546,14 @@ static int init_active_labels(struct nd_ + else if (test_bit(NDD_LABELING, &nvdimm->flags)) + /* fail, labels needed to disambiguate dpa */; + else +- return 0; ++ continue; + + dev_err(&nd_region->dev, "%s: is %s, failing probe\n", + dev_name(&nd_mapping->nvdimm->dev), + test_bit(NDD_LOCKED, &nvdimm->flags) + ? "locked" : "disabled"); +- return -ENXIO; ++ rc = -ENXIO; ++ goto out; + } + nd_mapping->ndd = ndd; + atomic_inc(&nvdimm->busy); +@@ -2586,13 +2587,17 @@ static int init_active_labels(struct nd_ + break; + } + +- if (i < nd_region->ndr_mappings) { ++ if (i < nd_region->ndr_mappings) ++ rc = -ENOMEM; ++ ++out: ++ if (rc) { + deactivate_labels(nd_region); +- return -ENOMEM; ++ return rc; + } + + return devm_add_action_or_reset(&nd_region->dev, deactivate_labels, +- nd_region); ++ nd_region); + } + + int nd_region_register_namespaces(struct nd_region *nd_region, int *err) diff --git a/queue-5.13/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch b/queue-5.13/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch new file mode 100644 index 00000000000..bc24e555b70 --- /dev/null +++ b/queue-5.13/net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch @@ -0,0 +1,104 @@ +From acc68b8d2a1196c4db806947606f162dbeed2274 Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Thu, 5 Aug 2021 17:55:11 +0300 +Subject: net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases + +From: Grygorii Strashko + +commit acc68b8d2a1196c4db806947606f162dbeed2274 upstream. + +The CPSW switchdev driver inherited fix from commit 9421c9015047 ("net: +ethernet: ti: cpsw: fix min eth packet size") which changes min TX packet +size to 64bytes (VLAN_ETH_ZLEN, excluding ETH_FCS). It was done to fix HW +packed drop issue when packets are sent from Host to the port with PVID and +un-tagging enabled. Unfortunately this breaks some other non-switch +specific use-cases, like: +- [1] CPSW port as DSA CPU port with DSA-tag applied at the end of the +packet +- [2] Some industrial protocols, which expects min TX packet size 60Bytes +(excluding FCS). + +Fix it by configuring min TX packet size depending on driver mode + - 60Bytes (ETH_ZLEN) for multi mac (dual-mac) mode + - 64Bytes (VLAN_ETH_ZLEN) for switch mode +and update it during driver mode change and annotate with +READ_ONCE()/WRITE_ONCE() as it can be read by napi while writing. + +[1] https://lore.kernel.org/netdev/20210531124051.GA15218@cephalopod/ +[2] https://e2e.ti.com/support/arm/sitara_arm/f/791/t/701669 + +Cc: stable@vger.kernel.org +Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") +Reported-by: Ben Hutchings +Signed-off-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw_new.c | 7 +++++-- + drivers/net/ethernet/ti/cpsw_priv.h | 4 +++- + 2 files changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/ti/cpsw_new.c ++++ b/drivers/net/ethernet/ti/cpsw_new.c +@@ -920,7 +920,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(s + struct cpdma_chan *txch; + int ret, q_idx; + +- if (skb_padto(skb, CPSW_MIN_PACKET_SIZE)) { ++ if (skb_put_padto(skb, READ_ONCE(priv->tx_packet_min))) { + cpsw_err(priv, tx_err, "packet pad failed\n"); + ndev->stats.tx_dropped++; + return NET_XMIT_DROP; +@@ -1100,7 +1100,7 @@ static int cpsw_ndo_xdp_xmit(struct net_ + + for (i = 0; i < n; i++) { + xdpf = frames[i]; +- if (xdpf->len < CPSW_MIN_PACKET_SIZE) ++ if (xdpf->len < READ_ONCE(priv->tx_packet_min)) + break; + + if (cpsw_xdp_tx_frame(priv, xdpf, NULL, priv->emac_port)) +@@ -1389,6 +1389,7 @@ static int cpsw_create_ports(struct cpsw + priv->dev = dev; + priv->msg_enable = netif_msg_init(debug_level, CPSW_DEBUG); + priv->emac_port = i + 1; ++ priv->tx_packet_min = CPSW_MIN_PACKET_SIZE; + + if (is_valid_ether_addr(slave_data->mac_addr)) { + ether_addr_copy(priv->mac_addr, slave_data->mac_addr); +@@ -1686,6 +1687,7 @@ static int cpsw_dl_switch_mode_set(struc + + priv = netdev_priv(sl_ndev); + slave->port_vlan = vlan; ++ WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE_VLAN); + if (netif_running(sl_ndev)) + cpsw_port_add_switch_def_ale_entries(priv, + slave); +@@ -1714,6 +1716,7 @@ static int cpsw_dl_switch_mode_set(struc + + priv = netdev_priv(slave->ndev); + slave->port_vlan = slave->data->dual_emac_res_vlan; ++ WRITE_ONCE(priv->tx_packet_min, CPSW_MIN_PACKET_SIZE); + cpsw_port_add_dual_emac_def_ale_entries(priv, slave); + } + +--- a/drivers/net/ethernet/ti/cpsw_priv.h ++++ b/drivers/net/ethernet/ti/cpsw_priv.h +@@ -89,7 +89,8 @@ do { \ + + #define CPSW_POLL_WEIGHT 64 + #define CPSW_RX_VLAN_ENCAP_HDR_SIZE 4 +-#define CPSW_MIN_PACKET_SIZE (VLAN_ETH_ZLEN) ++#define CPSW_MIN_PACKET_SIZE_VLAN (VLAN_ETH_ZLEN) ++#define CPSW_MIN_PACKET_SIZE (ETH_ZLEN) + #define CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN +\ + ETH_FCS_LEN +\ + CPSW_RX_VLAN_ENCAP_HDR_SIZE) +@@ -380,6 +381,7 @@ struct cpsw_priv { + u32 emac_port; + struct cpsw_common *cpsw; + int offload_fwd_mark; ++ u32 tx_packet_min; + }; + + #define ndev_to_cpsw(ndev) (((struct cpsw_priv *)netdev_priv(ndev))->cpsw) diff --git a/queue-5.13/net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch b/queue-5.13/net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch new file mode 100644 index 00000000000..efc4ebad5dd --- /dev/null +++ b/queue-5.13/net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch @@ -0,0 +1,85 @@ +From 34737e1320db6d51f0d140d5c684b9eb32f0da76 Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Fri, 6 Aug 2021 12:35:09 +0200 +Subject: net: wwan: mhi_wwan_ctrl: Fix possible deadlock + +From: Loic Poulain + +commit 34737e1320db6d51f0d140d5c684b9eb32f0da76 upstream. + +Lockdep detected possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&mhiwwan->rx_lock); + local_irq_disable(); + lock(&mhi_cntrl->pm_lock); + lock(&mhiwwan->rx_lock); + + lock(&mhi_cntrl->pm_lock); + + *** DEADLOCK *** + +To prevent this we need to disable the soft-interrupts when taking +the rx_lock. + +Cc: stable@vger.kernel.org +Fixes: fa588eba632d ("net: Add Qcom WWAN control driver") +Reported-by: Thomas Perrot +Signed-off-by: Loic Poulain +Reviewed-by: Sergey Ryazanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/mhi_wwan_ctrl.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/wwan/mhi_wwan_ctrl.c ++++ b/drivers/net/wwan/mhi_wwan_ctrl.c +@@ -41,14 +41,14 @@ struct mhi_wwan_dev { + /* Increment RX budget and schedule RX refill if necessary */ + static void mhi_wwan_rx_budget_inc(struct mhi_wwan_dev *mhiwwan) + { +- spin_lock(&mhiwwan->rx_lock); ++ spin_lock_bh(&mhiwwan->rx_lock); + + mhiwwan->rx_budget++; + + if (test_bit(MHI_WWAN_RX_REFILL, &mhiwwan->flags)) + schedule_work(&mhiwwan->rx_refill); + +- spin_unlock(&mhiwwan->rx_lock); ++ spin_unlock_bh(&mhiwwan->rx_lock); + } + + /* Decrement RX budget if non-zero and return true on success */ +@@ -56,7 +56,7 @@ static bool mhi_wwan_rx_budget_dec(struc + { + bool ret = false; + +- spin_lock(&mhiwwan->rx_lock); ++ spin_lock_bh(&mhiwwan->rx_lock); + + if (mhiwwan->rx_budget) { + mhiwwan->rx_budget--; +@@ -64,7 +64,7 @@ static bool mhi_wwan_rx_budget_dec(struc + ret = true; + } + +- spin_unlock(&mhiwwan->rx_lock); ++ spin_unlock_bh(&mhiwwan->rx_lock); + + return ret; + } +@@ -130,9 +130,9 @@ static void mhi_wwan_ctrl_stop(struct ww + { + struct mhi_wwan_dev *mhiwwan = wwan_port_get_drvdata(port); + +- spin_lock(&mhiwwan->rx_lock); ++ spin_lock_bh(&mhiwwan->rx_lock); + clear_bit(MHI_WWAN_RX_REFILL, &mhiwwan->flags); +- spin_unlock(&mhiwwan->rx_lock); ++ spin_unlock_bh(&mhiwwan->rx_lock); + + cancel_work_sync(&mhiwwan->rx_refill); + diff --git a/queue-5.13/pinctrl-k210-fix-k210_fpioa_probe.patch b/queue-5.13/pinctrl-k210-fix-k210_fpioa_probe.patch new file mode 100644 index 00000000000..554e6e69147 --- /dev/null +++ b/queue-5.13/pinctrl-k210-fix-k210_fpioa_probe.patch @@ -0,0 +1,71 @@ +From 31697ef7f3f45293bba3da87bcc710953e97fc3e Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Fri, 6 Aug 2021 09:43:11 +0900 +Subject: pinctrl: k210: Fix k210_fpioa_probe() + +From: Damien Le Moal + +commit 31697ef7f3f45293bba3da87bcc710953e97fc3e upstream. + +In k210_fpioa_probe(), add missing calls to clk_disable_unprepare() in +case of error after cenabling the clk and pclk clocks. Also add missing +error handling when enabling pclk. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Fixes: d4c34d09ab03 ("pinctrl: Add RISC-V Canaan Kendryte K210 FPIOA driver") +Cc: +Signed-off-by: Damien Le Moal +Link: https://lore.kernel.org/r/20210806004311.52859-1-damien.lemoal@wdc.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-k210.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/pinctrl/pinctrl-k210.c ++++ b/drivers/pinctrl/pinctrl-k210.c +@@ -950,23 +950,37 @@ static int k210_fpioa_probe(struct platf + return ret; + + pdata->pclk = devm_clk_get_optional(dev, "pclk"); +- if (!IS_ERR(pdata->pclk)) +- clk_prepare_enable(pdata->pclk); ++ if (!IS_ERR(pdata->pclk)) { ++ ret = clk_prepare_enable(pdata->pclk); ++ if (ret) ++ goto disable_clk; ++ } + + pdata->sysctl_map = + syscon_regmap_lookup_by_phandle_args(np, + "canaan,k210-sysctl-power", + 1, &pdata->power_offset); +- if (IS_ERR(pdata->sysctl_map)) +- return PTR_ERR(pdata->sysctl_map); ++ if (IS_ERR(pdata->sysctl_map)) { ++ ret = PTR_ERR(pdata->sysctl_map); ++ goto disable_pclk; ++ } + + k210_fpioa_init_ties(pdata); + + pdata->pctl = pinctrl_register(&k210_pinctrl_desc, dev, (void *)pdata); +- if (IS_ERR(pdata->pctl)) +- return PTR_ERR(pdata->pctl); ++ if (IS_ERR(pdata->pctl)) { ++ ret = PTR_ERR(pdata->pctl); ++ goto disable_pclk; ++ } + + return 0; ++ ++disable_pclk: ++ clk_disable_unprepare(pdata->pclk); ++disable_clk: ++ clk_disable_unprepare(pdata->clk); ++ ++ return ret; + } + + static const struct of_device_id k210_fpioa_dt_ids[] = { diff --git a/queue-5.13/revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch b/queue-5.13/revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch new file mode 100644 index 00000000000..e1d434f530c --- /dev/null +++ b/queue-5.13/revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch @@ -0,0 +1,76 @@ +From 664cc971fb259007e49cc8a3ac43b0787d89443f Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 10 Aug 2021 09:10:15 +0200 +Subject: Revert "usb: dwc3: gadget: Use list_replace_init() before traversing lists" + +From: Greg Kroah-Hartman + +commit 664cc971fb259007e49cc8a3ac43b0787d89443f upstream. + +This reverts commit d25d85061bd856d6be221626605319154f9b5043 as it is +reported to cause problems on many different types of boards. + +Reported-by: Thinh Nguyen +Reported-by: John Stultz +Cc: Ray Chi +Link: https://lore.kernel.org/r/CANcMJZCEVxVLyFgLwK98hqBEdc0_n4P0x_K6Gih8zNH3ouzbJQ@mail.gmail.com +Fixes: d25d85061bd8 ("usb: dwc3: gadget: Use list_replace_init() before traversing lists") +Cc: stable +Cc: Felipe Balbi +Cc: Wesley Cheng +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 18 ++---------------- + 1 file changed, 2 insertions(+), 16 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1741,13 +1741,9 @@ static void dwc3_gadget_ep_cleanup_cance + { + struct dwc3_request *req; + struct dwc3_request *tmp; +- struct list_head local; + struct dwc3 *dwc = dep->dwc; + +-restart: +- list_replace_init(&dep->cancelled_list, &local); +- +- list_for_each_entry_safe(req, tmp, &local, list) { ++ list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) { + dwc3_gadget_ep_skip_trbs(dep, req); + switch (req->status) { + case DWC3_REQUEST_STATUS_DISCONNECTED: +@@ -1765,9 +1761,6 @@ restart: + break; + } + } +- +- if (!list_empty(&dep->cancelled_list)) +- goto restart; + } + + static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, +@@ -2963,12 +2956,8 @@ static void dwc3_gadget_ep_cleanup_compl + { + struct dwc3_request *req; + struct dwc3_request *tmp; +- struct list_head local; + +-restart: +- list_replace_init(&dep->started_list, &local); +- +- list_for_each_entry_safe(req, tmp, &local, list) { ++ list_for_each_entry_safe(req, tmp, &dep->started_list, list) { + int ret; + + ret = dwc3_gadget_ep_cleanup_completed_request(dep, event, +@@ -2976,9 +2965,6 @@ restart: + if (ret) + break; + } +- +- if (!list_empty(&dep->started_list)) +- goto restart; + } + + static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep) diff --git a/queue-5.13/riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch b/queue-5.13/riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch new file mode 100644 index 00000000000..39d373e52ce --- /dev/null +++ b/queue-5.13/riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch @@ -0,0 +1,33 @@ +From 030d6dbf0c2e5fdf23ad29557f0c87a882993e26 Mon Sep 17 00:00:00 2001 +From: Changbin Du +Date: Thu, 22 Jul 2021 10:17:15 +0800 +Subject: riscv: kexec: do not add '-mno-relax' flag if compiler doesn't support it + +From: Changbin Du + +commit 030d6dbf0c2e5fdf23ad29557f0c87a882993e26 upstream. + +The RISC-V special option '-mno-relax' which to disable linker relaxations +is supported by GCC8+. For GCC7 and lower versions do not support this +option. + +Fixes: fba8a8674f68 ("RISC-V: Add kexec support") +Signed-off-by: Changbin Du +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/kernel/Makefile ++++ b/arch/riscv/kernel/Makefile +@@ -11,7 +11,7 @@ endif + CFLAGS_syscall_table.o += $(call cc-option,-Wno-override-init,) + + ifdef CONFIG_KEXEC +-AFLAGS_kexec_relocate.o := -mcmodel=medany -mno-relax ++AFLAGS_kexec_relocate.o := -mcmodel=medany $(call cc-option,-mno-relax) + endif + + extra-y += head.o diff --git a/queue-5.13/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch b/queue-5.13/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch new file mode 100644 index 00000000000..f3439468a35 --- /dev/null +++ b/queue-5.13/scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch @@ -0,0 +1,85 @@ +From 9977d880f7a3c233db9165a75a3a14defc2a4aee Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Mon, 9 Aug 2021 11:09:47 -0400 +Subject: scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash + +From: Ewan D. Milne + +commit 9977d880f7a3c233db9165a75a3a14defc2a4aee upstream. + +The phba->poll_list is traversed in case of an error in +lpfc_sli4_hba_setup(), so it must be initialized earlier in case the error +path is taken. + +[ 490.030738] lpfc 0000:65:00.0: 0:1413 Failed to init iocb list. +[ 490.036661] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 +[ 490.044485] PGD 0 P4D 0 +[ 490.047027] Oops: 0000 [#1] SMP PTI +[ 490.050518] CPU: 0 PID: 7 Comm: kworker/0:1 Kdump: loaded Tainted: G I --------- - - 4.18. +[ 490.060511] Hardware name: Dell Inc. PowerEdge R440/0WKGTH, BIOS 1.4.8 05/22/2018 +[ 490.067994] Workqueue: events work_for_cpu_fn +[ 490.072371] RIP: 0010:lpfc_sli4_cleanup_poll_list+0x20/0xb0 [lpfc] +[ 490.078546] Code: cf e9 04 f7 fe ff 0f 1f 40 00 0f 1f 44 00 00 41 57 49 89 ff 41 56 41 55 41 54 4d 8d a79 +[ 490.097291] RSP: 0018:ffffbd1a463dbcc8 EFLAGS: 00010246 +[ 490.102518] RAX: 0000000000008200 RBX: ffff945cdb8c0000 RCX: 0000000000000000 +[ 490.109649] RDX: 0000000000018200 RSI: ffff9468d0e16818 RDI: 0000000000000000 +[ 490.116783] RBP: ffff945cdb8c1740 R08: 00000000000015c5 R09: 0000000000000042 +[ 490.123915] R10: 0000000000000000 R11: ffffbd1a463dbab0 R12: ffff945cdb8c25c0 +[ 490.131049] R13: 00000000fffffff4 R14: 0000000000001800 R15: ffff945cdb8c0000 +[ 490.138182] FS: 0000000000000000(0000) GS:ffff9468d0e00000(0000) knlGS:0000000000000000 +[ 490.146267] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 490.152013] CR2: 0000000000000000 CR3: 000000042ca10002 CR4: 00000000007706f0 +[ 490.159146] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 490.166277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 490.173409] PKRU: 55555554 +[ 490.176123] Call Trace: +[ 490.178598] lpfc_sli4_queue_destroy+0x7f/0x3c0 [lpfc] +[ 490.183745] lpfc_sli4_hba_setup+0x1bc7/0x23e0 [lpfc] +[ 490.188797] ? kernfs_activate+0x63/0x80 +[ 490.192721] ? kernfs_add_one+0xe7/0x130 +[ 490.196647] ? __kernfs_create_file+0x80/0xb0 +[ 490.201020] ? lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc] +[ 490.206944] lpfc_pci_probe_one_s4.isra.48+0x46f/0x9e0 [lpfc] +[ 490.212697] lpfc_pci_probe_one+0x179/0xb70 [lpfc] +[ 490.217492] local_pci_probe+0x41/0x90 +[ 490.221246] work_for_cpu_fn+0x16/0x20 +[ 490.224994] process_one_work+0x1a7/0x360 +[ 490.229009] ? create_worker+0x1a0/0x1a0 +[ 490.232933] worker_thread+0x1cf/0x390 +[ 490.236687] ? create_worker+0x1a0/0x1a0 +[ 490.240612] kthread+0x116/0x130 +[ 490.243846] ? kthread_flush_work_fn+0x10/0x10 +[ 490.248293] ret_from_fork+0x35/0x40 +[ 490.251869] Modules linked in: lpfc(+) xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4i +[ 490.332609] CR2: 0000000000000000 + +Link: https://lore.kernel.org/r/20210809150947.18104-1-emilne@redhat.com +Fixes: 93a4d6f40198 ("scsi: lpfc: Add registration for CPU Offline/Online events") +Cc: stable@vger.kernel.org +Reviewed-by: James Smart +Signed-off-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -13091,6 +13091,8 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd + if (!phba) + return -ENOMEM; + ++ INIT_LIST_HEAD(&phba->poll_list); ++ + /* Perform generic PCI device enabling operation */ + error = lpfc_enable_pci_dev(phba); + if (error) +@@ -13225,7 +13227,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pd + /* Enable RAS FW log support */ + lpfc_sli4_ras_setup(phba); + +- INIT_LIST_HEAD(&phba->poll_list); + timer_setup(&phba->cpuhp_poll_timer, lpfc_sli4_poll_hbtimer, 0); + cpuhp_state_add_instance_nocalls(lpfc_cpuhp_state, &phba->cpuhp); + diff --git a/queue-5.13/seccomp-fix-setting-loaded-filter-count-during-tsync.patch b/queue-5.13/seccomp-fix-setting-loaded-filter-count-during-tsync.patch new file mode 100644 index 00000000000..6244cd835e2 --- /dev/null +++ b/queue-5.13/seccomp-fix-setting-loaded-filter-count-during-tsync.patch @@ -0,0 +1,37 @@ +From b4d8a58f8dcfcc890f296696cadb76e77be44b5f Mon Sep 17 00:00:00 2001 +From: Hsuan-Chi Kuo +Date: Thu, 4 Mar 2021 17:37:08 -0600 +Subject: seccomp: Fix setting loaded filter count during TSYNC + +From: Hsuan-Chi Kuo + +commit b4d8a58f8dcfcc890f296696cadb76e77be44b5f upstream. + +The desired behavior is to set the caller's filter count to thread's. +This value is reported via /proc, so this fixes the inaccurate count +exposed to userspace; it is not used for reference counting, etc. + +Signed-off-by: Hsuan-Chi Kuo +Link: https://lore.kernel.org/r/20210304233708.420597-1-hsuanchikuo@gmail.com +Co-developed-by: Wiktor Garbacz +Signed-off-by: Wiktor Garbacz +Link: https://lore.kernel.org/lkml/20210810125158.329849-1-wiktorg@google.com +Signed-off-by: Kees Cook +Cc: stable@vger.kernel.org +Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status") +Signed-off-by: Greg Kroah-Hartman +--- + kernel/seccomp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -602,7 +602,7 @@ static inline void seccomp_sync_threads( + smp_store_release(&thread->seccomp.filter, + caller->seccomp.filter); + atomic_set(&thread->seccomp.filter_count, +- atomic_read(&thread->seccomp.filter_count)); ++ atomic_read(&caller->seccomp.filter_count)); + + /* + * Don't let an unprivileged task work around diff --git a/queue-5.13/series b/queue-5.13/series new file mode 100644 index 00000000000..548840c3453 --- /dev/null +++ b/queue-5.13/series @@ -0,0 +1,38 @@ +lib-use-pfn_phys-in-devmem_is_allowed.patch +revert-usb-dwc3-gadget-use-list_replace_init-before-traversing-lists.patch +iio-adc-ti-ads7950-ensure-cs-is-deasserted-after-reading-channels.patch +iio-adis-set-gpio-reset-pin-direction.patch +iio-humidity-hdc100x-add-margin-to-the-conversion-time.patch +iio-adc-fix-incorrect-exit-of-for-loop.patch +asoc-amd-fix-reference-to-pcm-buffer-address.patch +asoc-xilinx-fix-reference-to-pcm-buffer-address.patch +asoc-uniphier-fix-reference-to-pcm-buffer-address.patch +asoc-tlv320aic31xx-fix-jack-detection-after-suspend.patch +asoc-kirkwood-fix-reference-to-pcm-buffer-address.patch +asoc-intel-atom-fix-reference-to-pcm-buffer-address.patch +i2c-dev-zero-out-array-used-for-i2c-reads-from-userspace.patch +cifs-handle-race-conditions-during-rename.patch +cifs-create-sd-context-must-be-a-multiple-of-8.patch +cifs-call-close-synchronously-during-unlink-rename-lease-break.patch +cifs-use-the-correct-max-length-for-dentry_path_raw.patch +io_uring-drop-ctx-uring_lock-before-flushing-work-item.patch +io_uring-fix-ctx-exit-io_rsrc_put_work-deadlock.patch +scsi-lpfc-move-initialization-of-phba-poll_list-earlier-to-avoid-crash.patch +cgroup-rstat-fix-a-a-deadlock-on-32bit-around-u64_stats_sync.patch +seccomp-fix-setting-loaded-filter-count-during-tsync.patch +net-wwan-mhi_wwan_ctrl-fix-possible-deadlock.patch +net-ethernet-ti-cpsw-fix-min-eth-packet-size-for-non-switch-use-cases.patch +arc-fp-set-fpu_status.fwe-to-enable-fpu_status-update-on-context-switch.patch +ceph-reduce-contention-in-ceph_check_delayed_caps.patch +pinctrl-k210-fix-k210_fpioa_probe.patch +acpi-nfit-fix-support-for-virtual-spa-ranges.patch +libnvdimm-region-fix-label-activation-vs-errors.patch +riscv-kexec-do-not-add-mno-relax-flag-if-compiler-doesn-t-support-it.patch +vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch +drm-i915-gvt-fix-cached-atomics-setting-for-windows-vm.patch +drm-i915-display-fix-the-12-bpc-bits-for-pipe_misc-reg.patch +drm-amd-display-remove-invalid-assert-for-odm-mpc-case.patch +drm-amd-display-use-gfp_atomic-in-amdgpu_dm_irq_schedule_work.patch +drm-amdgpu-add-preferred-mode-in-modeset-when-freesync-video-mode-s-enabled.patch +drm-amdgpu-don-t-enable-baco-on-boco-platforms-in-runpm.patch +drm-amdgpu-handle-vcn-instances-when-harvesting-v2.patch diff --git a/queue-5.13/vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch b/queue-5.13/vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch new file mode 100644 index 00000000000..eb7215d206d --- /dev/null +++ b/queue-5.13/vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch @@ -0,0 +1,49 @@ +From 848378812e40152abe9b9baf58ce2004f76fb988 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 30 Jul 2021 19:31:08 -0700 +Subject: vmlinux.lds.h: Handle clang's module.{c,d}tor sections + +From: Nathan Chancellor + +commit 848378812e40152abe9b9baf58ce2004f76fb988 upstream. + +A recent change in LLVM causes module_{c,d}tor sections to appear when +CONFIG_K{A,C}SAN are enabled, which results in orphan section warnings +because these are not handled anywhere: + +ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_ctor) is being placed in '.text.asan.module_ctor' +ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_dtor) is being placed in '.text.asan.module_dtor' +ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.tsan.module_ctor) is being placed in '.text.tsan.module_ctor' + +Fangrui explains: "the function asan.module_ctor has the SHF_GNU_RETAIN +flag, so it is in a separate section even with -fno-function-sections +(default)". + +Place them in the TEXT_TEXT section so that these technologies continue +to work with the newer compiler versions. All of the KASAN and KCSAN +KUnit tests continue to pass after this change. + +Cc: stable@vger.kernel.org +Link: https://github.com/ClangBuiltLinux/linux/issues/1432 +Link: https://github.com/llvm/llvm-project/commit/7b789562244ee941b7bf2cefeb3fc08a59a01865 +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Reviewed-by: Fangrui Song +Acked-by: Marco Elver +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20210731023107.1932981-1-nathan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + include/asm-generic/vmlinux.lds.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -586,6 +586,7 @@ + NOINSTR_TEXT \ + *(.text..refcount) \ + *(.ref.text) \ ++ *(.text.asan.* .text.tsan.*) \ + TEXT_CFI_JT \ + MEM_KEEP(init.text*) \ + MEM_KEEP(exit.text*) \