From: Greg Kroah-Hartman Date: Sun, 31 Jan 2021 14:46:44 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.4.255~52 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be23dee9c53a740e8059d5d59021374b18a0a1df;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch arm-dts-tbs2910-rename-mmc-node-aliases.patch arm-dts-ux500-reserve-memory-carveouts.patch asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch media-cec-add-stm32-driver.patch media-cedrus-fix-h264-decoding.patch media-hantro-fix-reset_raw_fmt-initialization.patch media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch media-rc-ite-cir-fix-min_timeout-calculation.patch net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch pm-hibernate-flush-swap-writer-after-marking.patch revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch --- diff --git a/queue-5.10/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch b/queue-5.10/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch new file mode 100644 index 00000000000..6f68923791d --- /dev/null +++ b/queue-5.10/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch @@ -0,0 +1,38 @@ +From 5a22747b76ca2384057d8e783265404439d31d7f Mon Sep 17 00:00:00 2001 +From: Koen Vandeputte +Date: Thu, 7 Jan 2021 10:19:06 +0100 +Subject: ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming + +From: Koen Vandeputte + +commit 5a22747b76ca2384057d8e783265404439d31d7f upstream. + +2 regulator descriptions carry identical naming. + +This leads to following boot warning: +[ 0.173138] debugfs: Directory 'vdd1p8' with parent 'regulator' already present! + +Fix this by renaming the one used for audio. + +Fixes: 5051bff33102 ("ARM: dts: imx: ventana: add LTC3676 PMIC support") +Signed-off-by: Tim Harvey +Signed-off-by: Koen Vandeputte +Cc: stable@vger.kernel.org # v4.11 +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi +@@ -418,7 +418,7 @@ + + /* VDD_AUD_1P8: Audio codec */ + reg_aud_1p8v: ldo3 { +- regulator-name = "vdd1p8"; ++ regulator-name = "vdd1p8a"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-boot-on; diff --git a/queue-5.10/arm-dts-tbs2910-rename-mmc-node-aliases.patch b/queue-5.10/arm-dts-tbs2910-rename-mmc-node-aliases.patch new file mode 100644 index 00000000000..3417344be27 --- /dev/null +++ b/queue-5.10/arm-dts-tbs2910-rename-mmc-node-aliases.patch @@ -0,0 +1,38 @@ +From fd25c883667b61f845a4188b6be110bb45de0bac Mon Sep 17 00:00:00 2001 +From: Soeren Moch +Date: Tue, 22 Dec 2020 16:59:08 +0100 +Subject: ARM: dts: tbs2910: rename MMC node aliases + +From: Soeren Moch + +commit fd25c883667b61f845a4188b6be110bb45de0bac upstream. + +to be consistent with kernel versions up to v5.9 (mmc aliases not used here). +usdhc1 is not wired up on this board and therefore cannot be used. +Start mmc aliases with usdhc2. + +Signed-off-by: Soeren Moch +Cc: stable@vger.kernel.org # 5.10.x +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6q-tbs2910.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/arm/boot/dts/imx6q-tbs2910.dts ++++ b/arch/arm/boot/dts/imx6q-tbs2910.dts +@@ -16,6 +16,13 @@ + stdout-path = &uart1; + }; + ++ aliases { ++ mmc0 = &usdhc2; ++ mmc1 = &usdhc3; ++ mmc2 = &usdhc4; ++ /delete-property/ mmc3; ++ }; ++ + memory@10000000 { + device_type = "memory"; + reg = <0x10000000 0x80000000>; diff --git a/queue-5.10/arm-dts-ux500-reserve-memory-carveouts.patch b/queue-5.10/arm-dts-ux500-reserve-memory-carveouts.patch new file mode 100644 index 00000000000..c876da30af6 --- /dev/null +++ b/queue-5.10/arm-dts-ux500-reserve-memory-carveouts.patch @@ -0,0 +1,198 @@ +From 8a996b2d8a03beae3cb6adfc12673778c192085d Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Sun, 13 Dec 2020 23:55:17 +0100 +Subject: ARM: dts: ux500: Reserve memory carveouts + +From: Linus Walleij + +commit 8a996b2d8a03beae3cb6adfc12673778c192085d upstream. + +The Ux500 platforms have some memory carveouts set aside for +communicating with the modem and for the initial secure software +(ISSW). These areas are protected by the memory controller +and will result in an external abort if accessed like common +read/write memory. + +On the legacy boot loaders, these were set aside by using +cmdline arguments such as this: + + mem=96M@0 mem_mtrace=15M@96M mem_mshared=1M@111M + mem_modem=16M@112M mali.mali_mem=32M@128M mem=96M@160M + hwmem=127M@256M mem_issw=1M@383M mem_ram_console=1M@384M + mem=638M@385M + +Reserve the relevant areas in the device tree instead. The +"mali", "hwmem", "mem_ram_console" and the trailing 1MB at the +end of the memory reservations in the list are not relevant for +the upstream kernel as these are nowadays replaced with +upstream technologies such as CMA. The modem and ISSW +reservations are necessary. + +This was manifested in a bug that surfaced in response to +commit 7fef431be9c9 ("mm/page_alloc: place pages to tail in __free_pages_core()") +which changes the behaviour of memory allocations +in such a way that the platform will sooner run into these +dangerous areas, with "Unhandled fault: imprecise external +abort (0xc06) at 0xb6fd83dc" or similar: the real reason +turns out to be that the PTE is pointing right into one of +the reserved memory areas. We were just lucky until now. + +We need to augment the DB8500 and DB8520 SoCs similarly +and also create a new include for the DB9500 used in the +Snowball since this does not have a modem and thus does +not need the modem memory reservation, albeit it needs +the ISSW reservation. + +Signed-off-by: Linus Walleij +Cc: stable@vger.kernel.org +Cc: David Hildenbrand +Link: https://lore.kernel.org/r/20201213225517.3838501-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/ste-db8500.dtsi | 38 +++++++++++++++++++++++++++++++++++++ + arch/arm/boot/dts/ste-db8520.dtsi | 38 +++++++++++++++++++++++++++++++++++++ + arch/arm/boot/dts/ste-db9500.dtsi | 35 ++++++++++++++++++++++++++++++++++ + arch/arm/boot/dts/ste-snowball.dts | 2 - + 4 files changed, 112 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/ste-db8500.dtsi ++++ b/arch/arm/boot/dts/ste-db8500.dtsi +@@ -12,4 +12,42 @@ + 200000 0>; + }; + }; ++ ++ reserved-memory { ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges; ++ ++ /* Modem trace memory */ ++ ram@06000000 { ++ reg = <0x06000000 0x00f00000>; ++ no-map; ++ }; ++ ++ /* Modem shared memory */ ++ ram@06f00000 { ++ reg = <0x06f00000 0x00100000>; ++ no-map; ++ }; ++ ++ /* Modem private memory */ ++ ram@07000000 { ++ reg = <0x07000000 0x01000000>; ++ no-map; ++ }; ++ ++ /* ++ * Initial Secure Software ISSW memory ++ * ++ * This is probably only used if the kernel tries ++ * to actually call into trustzone to run secure ++ * applications, which the mainline kernel probably ++ * will not do on this old chipset. But you can never ++ * be too careful, so reserve this memory anyway. ++ */ ++ ram@17f00000 { ++ reg = <0x17f00000 0x00100000>; ++ no-map; ++ }; ++ }; + }; +--- a/arch/arm/boot/dts/ste-db8520.dtsi ++++ b/arch/arm/boot/dts/ste-db8520.dtsi +@@ -12,4 +12,42 @@ + 200000 0>; + }; + }; ++ ++ reserved-memory { ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges; ++ ++ /* Modem trace memory */ ++ ram@06000000 { ++ reg = <0x06000000 0x00f00000>; ++ no-map; ++ }; ++ ++ /* Modem shared memory */ ++ ram@06f00000 { ++ reg = <0x06f00000 0x00100000>; ++ no-map; ++ }; ++ ++ /* Modem private memory */ ++ ram@07000000 { ++ reg = <0x07000000 0x01000000>; ++ no-map; ++ }; ++ ++ /* ++ * Initial Secure Software ISSW memory ++ * ++ * This is probably only used if the kernel tries ++ * to actually call into trustzone to run secure ++ * applications, which the mainline kernel probably ++ * will not do on this old chipset. But you can never ++ * be too careful, so reserve this memory anyway. ++ */ ++ ram@17f00000 { ++ reg = <0x17f00000 0x00100000>; ++ no-map; ++ }; ++ }; + }; +--- /dev/null ++++ b/arch/arm/boot/dts/ste-db9500.dtsi +@@ -0,0 +1,35 @@ ++// SPDX-License-Identifier: GPL-2.0-or-later ++ ++#include "ste-dbx5x0.dtsi" ++ ++/ { ++ cpus { ++ cpu@300 { ++ /* cpufreq controls */ ++ operating-points = <1152000 0 ++ 800000 0 ++ 400000 0 ++ 200000 0>; ++ }; ++ }; ++ ++ reserved-memory { ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges; ++ ++ /* ++ * Initial Secure Software ISSW memory ++ * ++ * This is probably only used if the kernel tries ++ * to actually call into trustzone to run secure ++ * applications, which the mainline kernel probably ++ * will not do on this old chipset. But you can never ++ * be too careful, so reserve this memory anyway. ++ */ ++ ram@17f00000 { ++ reg = <0x17f00000 0x00100000>; ++ no-map; ++ }; ++ }; ++}; +--- a/arch/arm/boot/dts/ste-snowball.dts ++++ b/arch/arm/boot/dts/ste-snowball.dts +@@ -4,7 +4,7 @@ + */ + + /dts-v1/; +-#include "ste-db8500.dtsi" ++#include "ste-db9500.dtsi" + #include "ste-href-ab8500.dtsi" + #include "ste-href-family-pinctrl.dtsi" + diff --git a/queue-5.10/asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch b/queue-5.10/asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch new file mode 100644 index 00000000000..64bac0dd6cb --- /dev/null +++ b/queue-5.10/asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch @@ -0,0 +1,57 @@ +From 40caffd66ca9ad1baa2d5541232675160bc6c772 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Wed, 20 Jan 2021 15:42:11 +0100 +Subject: ASoC: AMD Renoir - refine DMI entries for some Lenovo products + +From: Jaroslav Kysela + +commit 40caffd66ca9ad1baa2d5541232675160bc6c772 upstream. + +Apparently, the DMI board name LNVNB161216 is also used also +for products with the digital microphones connected to the AMD's +audio bridge. Refine the DMI table - use product name identifiers +extracted from https://bugzilla.redhat.com/show_bug.cgi?id=1892115 . + +The report for Lenovo Yoga Slim 7 14ARE05 (82A2) is in buglink. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211299 +Cc: +Signed-off-by: Jaroslav Kysela +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210120144211.817937-1-perex@perex.cz +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/amd/renoir/rn-pci-acp3x.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/sound/soc/amd/renoir/rn-pci-acp3x.c ++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c +@@ -165,10 +165,24 @@ static int rn_acp_deinit(void __iomem *a + + static const struct dmi_system_id rn_acp_quirk_table[] = { + { +- /* Lenovo IdeaPad Flex 5 14ARE05, IdeaPad 5 15ARE05 */ ++ /* Lenovo IdeaPad S340-14API */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"), +- DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81NB"), ++ } ++ }, ++ { ++ /* Lenovo IdeaPad Flex 5 14ARE05 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81X2"), ++ } ++ }, ++ { ++ /* Lenovo IdeaPad 5 15ARE05 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81YQ"), + } + }, + { diff --git a/queue-5.10/bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch b/queue-5.10/bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch new file mode 100644 index 00000000000..fbd1016d7f6 --- /dev/null +++ b/queue-5.10/bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch @@ -0,0 +1,55 @@ +From 0df28cad06eb41cc36bfea69d9c882fb567fd0d6 Mon Sep 17 00:00:00 2001 +From: Coly Li +Date: Thu, 28 Jan 2021 18:48:47 +0800 +Subject: bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FEATURES + +From: Coly Li + +commit 0df28cad06eb41cc36bfea69d9c882fb567fd0d6 upstream. + +For super block version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES, it +doesn't make sense to check the feature sets. This patch checks +super block version in bch_has_feature_* routines, if the version +doesn't have feature sets yet, returns 0 (false) to the caller. + +Fixes: 5342fd425502 ("bcache: set bcache device into read-only mode for BCH_FEATURE_INCOMPAT_OBSO_LARGE_BUCKET") +Fixes: ffa470327572 ("bcache: add bucket_size_hi into struct cache_sb_disk for large bucket") +Cc: stable@vger.kernel.org # 5.9+ +Reported-and-tested-by: Bockholdt Arne +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/features.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/bcache/features.h ++++ b/drivers/md/bcache/features.h +@@ -33,6 +33,8 @@ + #define BCH_FEATURE_COMPAT_FUNCS(name, flagname) \ + static inline int bch_has_feature_##name(struct cache_sb *sb) \ + { \ ++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \ ++ return 0; \ + return (((sb)->feature_compat & \ + BCH##_FEATURE_COMPAT_##flagname) != 0); \ + } \ +@@ -50,6 +52,8 @@ static inline void bch_clear_feature_##n + #define BCH_FEATURE_RO_COMPAT_FUNCS(name, flagname) \ + static inline int bch_has_feature_##name(struct cache_sb *sb) \ + { \ ++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \ ++ return 0; \ + return (((sb)->feature_ro_compat & \ + BCH##_FEATURE_RO_COMPAT_##flagname) != 0); \ + } \ +@@ -67,6 +71,8 @@ static inline void bch_clear_feature_##n + #define BCH_FEATURE_INCOMPAT_FUNCS(name, flagname) \ + static inline int bch_has_feature_##name(struct cache_sb *sb) \ + { \ ++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \ ++ return 0; \ + return (((sb)->feature_incompat & \ + BCH##_FEATURE_INCOMPAT_##flagname) != 0); \ + } \ diff --git a/queue-5.10/drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch b/queue-5.10/drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch new file mode 100644 index 00000000000..8972183fd71 --- /dev/null +++ b/queue-5.10/drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch @@ -0,0 +1,69 @@ +From 7c6d659868c77da9b518f32348160340dcdfa008 Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Mon, 18 Jan 2021 20:54:12 -0500 +Subject: drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes + +From: Lyude Paul + +commit 7c6d659868c77da9b518f32348160340dcdfa008 upstream. + +Nvidia hardware doesn't actually support using tiling formats with the +cursor plane, only linear is allowed. In the future, we should write a +testcase for this. + +Fixes: c586f30bf74c ("drm/nouveau/kms: Add format mod prop to base/ovly/nvdisp") +Cc: James Jones +Cc: Martin Peres +Cc: Jeremy Cline +Cc: Simon Ser +Cc: # v5.8+ +Signed-off-by: Lyude Paul +Reviewed-by: Simon Ser +Reviewed-by: James Jones +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c +@@ -702,6 +702,11 @@ nv50_wndw_init(struct nv50_wndw *wndw) + nvif_notify_get(&wndw->notify); + } + ++static const u64 nv50_cursor_format_modifiers[] = { ++ DRM_FORMAT_MOD_LINEAR, ++ DRM_FORMAT_MOD_INVALID, ++}; ++ + int + nv50_wndw_new_(const struct nv50_wndw_func *func, struct drm_device *dev, + enum drm_plane_type type, const char *name, int index, +@@ -713,6 +718,7 @@ nv50_wndw_new_(const struct nv50_wndw_fu + struct nvif_mmu *mmu = &drm->client.mmu; + struct nv50_disp *disp = nv50_disp(dev); + struct nv50_wndw *wndw; ++ const u64 *format_modifiers; + int nformat; + int ret; + +@@ -728,10 +734,13 @@ nv50_wndw_new_(const struct nv50_wndw_fu + + for (nformat = 0; format[nformat]; nformat++); + +- ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw, +- format, nformat, +- nouveau_display(dev)->format_modifiers, +- type, "%s-%d", name, index); ++ if (type == DRM_PLANE_TYPE_CURSOR) ++ format_modifiers = nv50_cursor_format_modifiers; ++ else ++ format_modifiers = nouveau_display(dev)->format_modifiers; ++ ++ ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw, format, nformat, ++ format_modifiers, type, "%s-%d", name, index); + if (ret) { + kfree(*pwndw); + *pwndw = NULL; diff --git a/queue-5.10/drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch b/queue-5.10/drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch new file mode 100644 index 00000000000..2b9fa573ccf --- /dev/null +++ b/queue-5.10/drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch @@ -0,0 +1,78 @@ +From f6e98a1809faa02f40e0d089d6cfc1aa372a34c0 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 21 Jan 2021 23:28:07 +0000 +Subject: drm/i915: Always flush the active worker before returning from the wait + +From: Chris Wilson + +commit f6e98a1809faa02f40e0d089d6cfc1aa372a34c0 upstream. + +The first thing the active retirement worker does is decrement the +i915_active count. + +The first thing we do during i915_active_wait is try to increment the +i915_active count, but only if already active [non-zero]. + +The wait may see that the retirement is already started and so marked the +i915_active as idle, and skip waiting for the retirement handler. +However, the caller of i915_active_wait may immediately free the +i915_active upon returning (e.g. i915_vma_destroy) so we must not return +before the concurrent access from the worker is completed. We must +always flush the worker. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2473 +Fixes: 274cbf20fd10 ("drm/i915: Push the i915_active.retire into a worker") +Signed-off-by: Chris Wilson +Cc: Matthew Auld +Cc: Tvrtko Ursulin +Cc: # v5.5+ +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20210121232807.16618-1-chris@chris-wilson.co.uk +(cherry picked from commit 977a372e972cb42799746c284035a33c64ebace9) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c +index 10a865f3dc09..9ed19b8bca60 100644 +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -631,24 +631,26 @@ static int flush_lazy_signals(struct i915_active *ref) + + int __i915_active_wait(struct i915_active *ref, int state) + { +- int err; +- + might_sleep(); + +- if (!i915_active_acquire_if_busy(ref)) +- return 0; +- + /* Any fence added after the wait begins will not be auto-signaled */ +- err = flush_lazy_signals(ref); +- i915_active_release(ref); +- if (err) +- return err; ++ if (i915_active_acquire_if_busy(ref)) { ++ int err; + +- if (!i915_active_is_idle(ref) && +- ___wait_var_event(ref, i915_active_is_idle(ref), +- state, 0, 0, schedule())) +- return -EINTR; ++ err = flush_lazy_signals(ref); ++ i915_active_release(ref); ++ if (err) ++ return err; + ++ if (___wait_var_event(ref, i915_active_is_idle(ref), ++ state, 0, 0, schedule())) ++ return -EINTR; ++ } ++ ++ /* ++ * After the wait is complete, the caller may free the active. ++ * We have to flush any concurrent retirement before returning. ++ */ + flush_work(&ref->work); + return 0; + } diff --git a/queue-5.10/drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch b/queue-5.10/drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch new file mode 100644 index 00000000000..00fc4201521 --- /dev/null +++ b/queue-5.10/drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch @@ -0,0 +1,89 @@ +From 489140b5ba2e7cc4b853c29e0591895ddb462a82 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 25 Jan 2021 12:50:33 +0000 +Subject: drm/i915/gt: Always try to reserve GGTT address 0x0 + +From: Chris Wilson + +commit 489140b5ba2e7cc4b853c29e0591895ddb462a82 upstream. + +Since writing to address 0 is a very common mistake, let's try to avoid +putting anything sensitive there. + +References: https://gitlab.freedesktop.org/drm/intel/-/issues/2989 +Signed-off-by: Chris Wilson +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20210125125033.23656-1-chris@chris-wilson.co.uk +Cc: stable@vger.kernel.org +(cherry picked from commit 56b429cc584c6ed8b895d8d8540959655db1ff73) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gt/intel_ggtt.c | 47 ++++++++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_ggtt.c ++++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c +@@ -526,16 +526,39 @@ static int init_ggtt(struct i915_ggtt *g + + mutex_init(&ggtt->error_mutex); + if (ggtt->mappable_end) { +- /* Reserve a mappable slot for our lockless error capture */ +- ret = drm_mm_insert_node_in_range(&ggtt->vm.mm, +- &ggtt->error_capture, +- PAGE_SIZE, 0, +- I915_COLOR_UNEVICTABLE, +- 0, ggtt->mappable_end, +- DRM_MM_INSERT_LOW); +- if (ret) +- return ret; ++ /* ++ * Reserve a mappable slot for our lockless error capture. ++ * ++ * We strongly prefer taking address 0x0 in order to protect ++ * other critical buffers against accidental overwrites, ++ * as writing to address 0 is a very common mistake. ++ * ++ * Since 0 may already be in use by the system (e.g. the BIOS ++ * framebuffer), we let the reservation fail quietly and hope ++ * 0 remains reserved always. ++ * ++ * If we fail to reserve 0, and then fail to find any space ++ * for an error-capture, remain silent. We can afford not ++ * to reserve an error_capture node as we have fallback ++ * paths, and we trust that 0 will remain reserved. However, ++ * the only likely reason for failure to insert is a driver ++ * bug, which we expect to cause other failures... ++ */ ++ ggtt->error_capture.size = I915_GTT_PAGE_SIZE; ++ ggtt->error_capture.color = I915_COLOR_UNEVICTABLE; ++ if (drm_mm_reserve_node(&ggtt->vm.mm, &ggtt->error_capture)) ++ drm_mm_insert_node_in_range(&ggtt->vm.mm, ++ &ggtt->error_capture, ++ ggtt->error_capture.size, 0, ++ ggtt->error_capture.color, ++ 0, ggtt->mappable_end, ++ DRM_MM_INSERT_LOW); + } ++ if (drm_mm_node_allocated(&ggtt->error_capture)) ++ drm_dbg(&ggtt->vm.i915->drm, ++ "Reserved GGTT:[%llx, %llx] for use by error capture\n", ++ ggtt->error_capture.start, ++ ggtt->error_capture.start + ggtt->error_capture.size); + + /* + * The upper portion of the GuC address space has a sizeable hole +@@ -548,9 +571,9 @@ static int init_ggtt(struct i915_ggtt *g + + /* Clear any non-preallocated blocks */ + drm_mm_for_each_hole(entry, &ggtt->vm.mm, hole_start, hole_end) { +- drm_dbg_kms(&ggtt->vm.i915->drm, +- "clearing unused GTT space: [%lx, %lx]\n", +- hole_start, hole_end); ++ drm_dbg(&ggtt->vm.i915->drm, ++ "clearing unused GTT space: [%lx, %lx]\n", ++ hole_start, hole_end); + ggtt->vm.clear_range(&ggtt->vm, hole_start, + hole_end - hole_start); + } diff --git a/queue-5.10/drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch b/queue-5.10/drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch new file mode 100644 index 00000000000..ea739c46a48 --- /dev/null +++ b/queue-5.10/drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch @@ -0,0 +1,97 @@ +From ba839b7598440a5d78550a115bac21b08d57cc32 Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Mon, 18 Jan 2021 20:54:14 -0500 +Subject: drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors + +From: Lyude Paul + +commit ba839b7598440a5d78550a115bac21b08d57cc32 upstream. + +While we do handle the additional cursor sizes introduced in NVE4, it looks +like we accidentally broke this when converting over to use Nvidia's +display headers. Since we now use NVVAL in dispnv50/head907d.c in order to +format the value for the cursor layout and NVD9 only had one byte reserved +vs. the 2 bytes reserved in later generations, we end up accidentally +stripping the second bit in the cursor layout format parameter - causing us +to set the wrong cursor size. + +This fixes that by adding our own curs_set hook for 917d which uses the +NV917D headers. + +Cc: Martin Peres +Cc: Jeremy Cline +Cc: Simon Ser +Cc: # v5.9+ +Signed-off-by: Lyude Paul +Fixes: ed0b86a90bf9 ("drm/nouveau/kms/nv50-: use NVIDIA's headers for core head_curs_set()") +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +diff --git a/drivers/gpu/drm/nouveau/dispnv50/head917d.c b/drivers/gpu/drm/nouveau/dispnv50/head917d.c +index a5d827403660..ea9f8667305e 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/head917d.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/head917d.c +@@ -22,6 +22,7 @@ + #include "head.h" + #include "core.h" + ++#include "nvif/push.h" + #include + + #include +@@ -73,6 +74,31 @@ head917d_base(struct nv50_head *head, struct nv50_head_atom *asyh) + return 0; + } + ++static int ++head917d_curs_set(struct nv50_head *head, struct nv50_head_atom *asyh) ++{ ++ struct nvif_push *push = nv50_disp(head->base.base.dev)->core->chan.push; ++ const int i = head->base.index; ++ int ret; ++ ++ ret = PUSH_WAIT(push, 5); ++ if (ret) ++ return ret; ++ ++ PUSH_MTHD(push, NV917D, HEAD_SET_CONTROL_CURSOR(i), ++ NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, ENABLE, ENABLE) | ++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, FORMAT, asyh->curs.format) | ++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, SIZE, asyh->curs.layout) | ++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_X, 0) | ++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_Y, 0) | ++ NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, COMPOSITION, ALPHA_BLEND), ++ ++ HEAD_SET_OFFSET_CURSOR(i), asyh->curs.offset >> 8); ++ ++ PUSH_MTHD(push, NV917D, HEAD_SET_CONTEXT_DMA_CURSOR(i), asyh->curs.handle); ++ return 0; ++} ++ + int + head917d_curs_layout(struct nv50_head *head, struct nv50_wndw_atom *asyw, + struct nv50_head_atom *asyh) +@@ -101,7 +127,7 @@ head917d = { + .core_clr = head907d_core_clr, + .curs_layout = head917d_curs_layout, + .curs_format = head507d_curs_format, +- .curs_set = head907d_curs_set, ++ .curs_set = head917d_curs_set, + .curs_clr = head907d_curs_clr, + .base = head917d_base, + .ovly = head907d_ovly, +diff --git a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h +index 2a2612d6e1e0..fb223723a38a 100644 +--- a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h ++++ b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h +@@ -66,6 +66,10 @@ + #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_ALPHA_BLEND (0x00000000) + #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_PREMULT_ALPHA_BLEND (0x00000001) + #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_XOR (0x00000002) ++#define NV917D_HEAD_SET_OFFSET_CURSOR(a) (0x00000484 + (a)*0x00000300) ++#define NV917D_HEAD_SET_OFFSET_CURSOR_ORIGIN 31:0 ++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR(a) (0x0000048C + (a)*0x00000300) ++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR_HANDLE 31:0 + #define NV917D_HEAD_SET_DITHER_CONTROL(a) (0x000004A0 + (a)*0x00000300) + #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE 0:0 + #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE_DISABLE (0x00000000) diff --git a/queue-5.10/media-cec-add-stm32-driver.patch b/queue-5.10/media-cec-add-stm32-driver.patch new file mode 100644 index 00000000000..e8c223f7f3c --- /dev/null +++ b/queue-5.10/media-cec-add-stm32-driver.patch @@ -0,0 +1,31 @@ +From eaf18a4165141f04dd26f0c48a7e53438e5a3ea2 Mon Sep 17 00:00:00 2001 +From: Yannick Fertre +Date: Fri, 15 Jan 2021 15:31:44 +0100 +Subject: media: cec: add stm32 driver + +From: Yannick Fertre + +commit eaf18a4165141f04dd26f0c48a7e53438e5a3ea2 upstream. + +Missing stm32 directory to Makefile. + +Signed-off-by: Yannick Fertre +Signed-off-by: Hans Verkuil +Fixes: 4be5e8648b0c ("media: move CEC platform drivers to a separate directory") +Cc: +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/cec/platform/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/cec/platform/Makefile ++++ b/drivers/media/cec/platform/Makefile +@@ -10,5 +10,6 @@ obj-$(CONFIG_CEC_MESON_AO) += meson/ + obj-$(CONFIG_CEC_SAMSUNG_S5P) += s5p/ + obj-$(CONFIG_CEC_SECO) += seco/ + obj-$(CONFIG_CEC_STI) += sti/ ++obj-$(CONFIG_CEC_STM32) += stm32/ + obj-$(CONFIG_CEC_TEGRA) += tegra/ + diff --git a/queue-5.10/media-cedrus-fix-h264-decoding.patch b/queue-5.10/media-cedrus-fix-h264-decoding.patch new file mode 100644 index 00000000000..1534d9fd249 --- /dev/null +++ b/queue-5.10/media-cedrus-fix-h264-decoding.patch @@ -0,0 +1,42 @@ +From 73bc0b0c2a96b31199da0ce6c3d04be81ef73bb9 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Wed, 23 Dec 2020 12:06:59 +0100 +Subject: media: cedrus: Fix H264 decoding + +From: Jernej Skrabec + +commit 73bc0b0c2a96b31199da0ce6c3d04be81ef73bb9 upstream. + +During H264 API overhaul subtle bug was introduced Cedrus driver. +Progressive references have both, top and bottom reference flags set. +Cedrus reference list expects only bottom reference flag and only when +interlaced frames are decoded. However, due to a bug in Cedrus check, +exclusivity is not tested and that flag is set also for progressive +references. That causes "jumpy" background with many videos. + +Fix that by checking that only bottom reference flag is set in control +and nothing else. + +Tested-by: Andre Heider +Fixes: cfc8c3ed533e ("media: cedrus: h264: Properly configure reference field") +Signed-off-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Cc: +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -203,7 +203,7 @@ static void _cedrus_write_ref_list(struc + position = cedrus_buf->codec.h264.position; + + sram_array[i] |= position << 1; +- if (ref_list[i].fields & V4L2_H264_BOTTOM_FIELD_REF) ++ if (ref_list[i].fields == V4L2_H264_BOTTOM_FIELD_REF) + sram_array[i] |= BIT(0); + } + diff --git a/queue-5.10/media-hantro-fix-reset_raw_fmt-initialization.patch b/queue-5.10/media-hantro-fix-reset_raw_fmt-initialization.patch new file mode 100644 index 00000000000..7eddc4d2f0b --- /dev/null +++ b/queue-5.10/media-hantro-fix-reset_raw_fmt-initialization.patch @@ -0,0 +1,33 @@ +From e081863ab48d9b2eee9e899cbd05752a2a30308d Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Thu, 14 Jan 2021 14:03:16 +0100 +Subject: media: hantro: Fix reset_raw_fmt initialization + +From: Ricardo Ribalda + +commit e081863ab48d9b2eee9e899cbd05752a2a30308d upstream. + +raw_fmt->height in never initialized. But width in initialized twice. + +Fixes: 88d06362d1d05 ("media: hantro: Refactor for V4L2 API spec compliancy") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Cc: +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_v4l2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/media/hantro/hantro_v4l2.c ++++ b/drivers/staging/media/hantro/hantro_v4l2.c +@@ -367,7 +367,7 @@ hantro_reset_raw_fmt(struct hantro_ctx * + + hantro_reset_fmt(raw_fmt, raw_vpu_fmt); + raw_fmt->width = encoded_fmt->width; +- raw_fmt->width = encoded_fmt->width; ++ raw_fmt->height = encoded_fmt->height; + if (ctx->is_encoder) + hantro_set_fmt_out(ctx, raw_fmt); + else diff --git a/queue-5.10/media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch b/queue-5.10/media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch new file mode 100644 index 00000000000..454290c5df5 --- /dev/null +++ b/queue-5.10/media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch @@ -0,0 +1,44 @@ +From 896111dc4bcf887b835b3ef54f48b450d4692a1d Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sun, 20 Dec 2020 13:29:54 +0100 +Subject: media: rc: ensure that uevent can be read directly after rc device register + +From: Sean Young + +commit 896111dc4bcf887b835b3ef54f48b450d4692a1d upstream. + +There is a race condition where if the /sys/class/rc0/uevent file is read +before rc_dev->registered is set to true, -ENODEV will be returned. + +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1901089 + +Cc: stable@vger.kernel.org +Fixes: a2e2d73fa281 ("media: rc: do not access device via sysfs after rc_unregister_device()") +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/rc-main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1928,6 +1928,8 @@ int rc_register_device(struct rc_dev *de + goto out_raw; + } + ++ dev->registered = true; ++ + rc = device_add(&dev->dev); + if (rc) + goto out_rx_free; +@@ -1937,8 +1939,6 @@ int rc_register_device(struct rc_dev *de + dev->device_name ?: "Unspecified device", path ?: "N/A"); + kfree(path); + +- dev->registered = true; +- + /* + * once the the input device is registered in rc_setup_rx_device, + * userspace can open the input device and rc_open() will be called diff --git a/queue-5.10/media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch b/queue-5.10/media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch new file mode 100644 index 00000000000..7c737057a88 --- /dev/null +++ b/queue-5.10/media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch @@ -0,0 +1,73 @@ +From 06b831588b639ad9d94e4789b0250562228722c2 Mon Sep 17 00:00:00 2001 +From: Matthias Reichl +Date: Tue, 5 Jan 2021 10:30:23 +0100 +Subject: media: rc: fix timeout handling after switch to microsecond durations + +From: Matthias Reichl + +commit 06b831588b639ad9d94e4789b0250562228722c2 upstream. + +Commit 528222d853f92 ("media: rc: harmonize infrared durations to +microseconds") missed to switch some timeout calculations from +nanoseconds to microseconds. This resulted in spurious key_up+key_down +events at the last scancode if the rc device uses a long timeout +(eg 100ms on nuvoton-cir) as the device timeout wasn't properly +accounted for in the keyup timeout calculation. + +Fix this by applying the proper conversion functions. + +Cc: stable@vger.kernel.org +Fixes: 528222d853f92 ("media: rc: harmonize infrared durations to microseconds") +Signed-off-by: Matthias Reichl +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/ir-mce_kbd-decoder.c | 2 +- + drivers/media/rc/rc-main.c | 4 ++-- + drivers/media/rc/serial_ir.c | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/ir-mce_kbd-decoder.c ++++ b/drivers/media/rc/ir-mce_kbd-decoder.c +@@ -320,7 +320,7 @@ again: + data->body); + spin_lock(&data->keylock); + if (scancode) { +- delay = nsecs_to_jiffies(dev->timeout) + ++ delay = usecs_to_jiffies(dev->timeout) + + msecs_to_jiffies(100); + mod_timer(&data->rx_timeout, jiffies + delay); + } else { +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -737,7 +737,7 @@ static unsigned int repeat_period(int pr + void rc_repeat(struct rc_dev *dev) + { + unsigned long flags; +- unsigned int timeout = nsecs_to_jiffies(dev->timeout) + ++ unsigned int timeout = usecs_to_jiffies(dev->timeout) + + msecs_to_jiffies(repeat_period(dev->last_protocol)); + struct lirc_scancode sc = { + .scancode = dev->last_scancode, .rc_proto = dev->last_protocol, +@@ -855,7 +855,7 @@ void rc_keydown(struct rc_dev *dev, enum + ir_do_keydown(dev, protocol, scancode, keycode, toggle); + + if (dev->keypressed) { +- dev->keyup_jiffies = jiffies + nsecs_to_jiffies(dev->timeout) + ++ dev->keyup_jiffies = jiffies + usecs_to_jiffies(dev->timeout) + + msecs_to_jiffies(repeat_period(protocol)); + mod_timer(&dev->timer_keyup, dev->keyup_jiffies); + } +--- a/drivers/media/rc/serial_ir.c ++++ b/drivers/media/rc/serial_ir.c +@@ -385,7 +385,7 @@ static irqreturn_t serial_ir_irq_handler + } while (!(sinp(UART_IIR) & UART_IIR_NO_INT)); /* still pending ? */ + + mod_timer(&serial_ir.timeout_timer, +- jiffies + nsecs_to_jiffies(serial_ir.rcdev->timeout)); ++ jiffies + usecs_to_jiffies(serial_ir.rcdev->timeout)); + + ir_raw_event_handle(serial_ir.rcdev); + diff --git a/queue-5.10/media-rc-ite-cir-fix-min_timeout-calculation.patch b/queue-5.10/media-rc-ite-cir-fix-min_timeout-calculation.patch new file mode 100644 index 00000000000..83d3715c507 --- /dev/null +++ b/queue-5.10/media-rc-ite-cir-fix-min_timeout-calculation.patch @@ -0,0 +1,38 @@ +From e1def45b5291278590bc3033cc518bf5c964a18d Mon Sep 17 00:00:00 2001 +From: Matthias Reichl +Date: Sat, 9 Jan 2021 21:10:55 +0100 +Subject: media: rc: ite-cir: fix min_timeout calculation + +From: Matthias Reichl + +commit e1def45b5291278590bc3033cc518bf5c964a18d upstream. + +Commit 528222d853f92 ("media: rc: harmonize infrared durations to +microseconds") missed to switch the min_timeout calculation from ns +to us. This resulted in a minimum timeout of 1.2 seconds instead of 1.2ms, +leading to large delays and long key repeats. + +Fix this by applying proper ns->us conversion. + +Cc: stable@vger.kernel.org +Fixes: 528222d853f92 ("media: rc: harmonize infrared durations to microseconds") +Signed-off-by: Matthias Reichl +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/ite-cir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -1551,7 +1551,7 @@ static int ite_probe(struct pnp_dev *pde + rdev->s_rx_carrier_range = ite_set_rx_carrier_range; + /* FIFO threshold is 17 bytes, so 17 * 8 samples minimum */ + rdev->min_timeout = 17 * 8 * ITE_BAUDRATE_DIVISOR * +- itdev->params.sample_period; ++ itdev->params.sample_period / 1000; + rdev->timeout = IR_DEFAULT_TIMEOUT; + rdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT; + rdev->rx_resolution = ITE_BAUDRATE_DIVISOR * diff --git a/queue-5.10/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch b/queue-5.10/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch new file mode 100644 index 00000000000..c2b0a08eeee --- /dev/null +++ b/queue-5.10/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch @@ -0,0 +1,400 @@ +From 7e0e63d09516e96994c879f07c5a3c3269d7015e Mon Sep 17 00:00:00 2001 +From: Giacinto Cifelli +Date: Wed, 20 Jan 2021 05:56:50 +0100 +Subject: net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Giacinto Cifelli + +commit 7e0e63d09516e96994c879f07c5a3c3269d7015e upstream. + +Bus 003 Device 009: ID 1e2d:006f +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 ? + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + idVendor 0x1e2d + idProduct 0x006f + bcdDevice 0.00 + iManufacturer 3 Cinterion Wireless Modules + iProduct 2 PLSx3 + iSerial 4 fa3c1419 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 303 + bNumInterfaces 9 + bConfigurationValue 1 + iConfiguration 1 Cinterion Configuration + bmAttributes 0xe0 + Self Powered + Remote Wakeup + MaxPower 500mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 1 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 2 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 3 + CDC Union: + bMasterInterface 2 + bSlaveInterface 3 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 4 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 5 + CDC Union: + bMasterInterface 4 + bSlaveInterface 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 6 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 7 + CDC Union: + bMasterInterface 6 + bSlaveInterface 7 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 7 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 8 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x89 EP 9 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8a EP 10 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x05 EP 5 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 +Device Qualifier (for other device speed): + bLength 10 + bDescriptorType 6 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 ? + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + bNumConfigurations 1 +Device Status: 0x0000 + (Bus Powered) + +Cc: stable@vger.kernel.org +Signed-off-by: Giacinto Cifelli +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20210120045650.10855-1-gciofono@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1325,6 +1325,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ + {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ ++ {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */ + {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ + {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */ + {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ diff --git a/queue-5.10/parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch b/queue-5.10/parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch new file mode 100644 index 00000000000..bafd04d00e3 --- /dev/null +++ b/queue-5.10/parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch @@ -0,0 +1,64 @@ +From 00e35f2b0e8acb88d4e1aa96ff0490e3bfe46580 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 26 Jan 2021 20:16:21 +0100 +Subject: parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES + +From: Helge Deller + +commit 00e35f2b0e8acb88d4e1aa96ff0490e3bfe46580 upstream. + +When building a kernel without module support, the CONFIG_MLONGCALL option +needs to be enabled in order to reach symbols which are outside of a 22-bit +branch. + +This patch changes the autodetection in the Kconfig script to always enable +CONFIG_MLONGCALL when modules are disabled and uses a far call to +preempt_schedule_irq() in intr_do_preempt() to reach the symbol in all cases. + +Signed-off-by: Helge Deller +Reported-by: kernel test robot +Cc: stable@vger.kernel.org # v5.6+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/Kconfig | 5 ++--- + arch/parisc/kernel/entry.S | 13 ++++++++++--- + 2 files changed, 12 insertions(+), 6 deletions(-) + +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -202,9 +202,8 @@ config PREFETCH + depends on PA8X00 || PA7200 + + config MLONGCALLS +- bool "Enable the -mlong-calls compiler option for big kernels" +- default y if !MODULES || UBSAN || FTRACE +- default n ++ def_bool y if !MODULES || UBSAN || FTRACE ++ bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE + depends on PA8X00 + help + If you configure the kernel to include many drivers built-in instead +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -997,10 +997,17 @@ intr_do_preempt: + bb,<,n %r20, 31 - PSW_SM_I, intr_restore + nop + ++ /* ssm PSW_SM_I done later in intr_restore */ ++#ifdef CONFIG_MLONGCALLS ++ ldil L%intr_restore, %r2 ++ load32 preempt_schedule_irq, %r1 ++ bv %r0(%r1) ++ ldo R%intr_restore(%r2), %r2 ++#else ++ ldil L%intr_restore, %r1 + BL preempt_schedule_irq, %r2 +- nop +- +- b,n intr_restore /* ssm PSW_SM_I done by intr_restore */ ++ ldo R%intr_restore(%r1), %r2 ++#endif + #endif /* CONFIG_PREEMPTION */ + + /* diff --git a/queue-5.10/pm-hibernate-flush-swap-writer-after-marking.patch b/queue-5.10/pm-hibernate-flush-swap-writer-after-marking.patch new file mode 100644 index 00000000000..58dc4fba501 --- /dev/null +++ b/queue-5.10/pm-hibernate-flush-swap-writer-after-marking.patch @@ -0,0 +1,39 @@ +From fef9c8d28e28a808274a18fbd8cc2685817fd62a Mon Sep 17 00:00:00 2001 +From: Laurent Badel +Date: Fri, 22 Jan 2021 17:19:41 +0100 +Subject: PM: hibernate: flush swap writer after marking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Badel + +commit fef9c8d28e28a808274a18fbd8cc2685817fd62a upstream. + +Flush the swap writer after, not before, marking the files, to ensure the +signature is properly written. + +Fixes: 6f612af57821 ("PM / Hibernate: Group swap ops") +Signed-off-by: Laurent Badel +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/power/swap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -497,10 +497,10 @@ static int swap_writer_finish(struct swa + unsigned int flags, int error) + { + if (!error) { +- flush_swap_writer(handle); + pr_info("S"); + error = mark_swapfiles(handle, flags); + pr_cont("|\n"); ++ flush_swap_writer(handle); + } + + if (error) diff --git a/queue-5.10/revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch b/queue-5.10/revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch new file mode 100644 index 00000000000..46d0588634c --- /dev/null +++ b/queue-5.10/revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch @@ -0,0 +1,154 @@ +From a119f87b86bcdf14a18ce39a899e97a1e9160f7f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 28 Jan 2021 13:28:59 -0500 +Subject: Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)" + +From: Alex Deucher + +commit a119f87b86bcdf14a18ce39a899e97a1e9160f7f upstream. + +On some boards the rpm interface apparently does not work at all +leading to the fan not spinning or spinning at strange speeds. +Revert this for now to fix 5.10, 5.11. The follow on patch +fixes this properly for 5.12. + +This reverts commit 8d6e65adc25e23fabbc5293b6cd320195c708dca. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1408 +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h | 1 + drivers/gpu/drm/amd/pm/inc/smu_v11_0.h | 3 + + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 9 +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 31 +++++++++++++++- + 7 files changed, 39 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h ++++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h +@@ -575,6 +575,7 @@ struct pptable_funcs { + int (*conv_power_profile_to_pplib_workload)(int power_profile); + uint32_t (*get_fan_control_mode)(struct smu_context *smu); + int (*set_fan_control_mode)(struct smu_context *smu, uint32_t mode); ++ int (*set_fan_speed_percent)(struct smu_context *smu, uint32_t speed); + int (*set_fan_speed_rpm)(struct smu_context *smu, uint32_t speed); + int (*set_xgmi_pstate)(struct smu_context *smu, uint32_t pstate); + int (*gfx_off_control)(struct smu_context *smu, bool enable); +--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h ++++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h +@@ -200,6 +200,9 @@ int + smu_v11_0_set_fan_control_mode(struct smu_context *smu, + uint32_t mode); + ++int ++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed); ++ + int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu, + uint32_t speed); + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -2255,19 +2255,14 @@ int smu_get_fan_speed_percent(struct smu + int smu_set_fan_speed_percent(struct smu_context *smu, uint32_t speed) + { + int ret = 0; +- uint32_t rpm; + + if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled) + return -EOPNOTSUPP; + + mutex_lock(&smu->mutex); + +- if (smu->ppt_funcs->set_fan_speed_rpm) { +- if (speed > 100) +- speed = 100; +- rpm = speed * smu->fan_max_rpm / 100; +- ret = smu->ppt_funcs->set_fan_speed_rpm(smu, rpm); +- } ++ if (smu->ppt_funcs->set_fan_speed_percent) ++ ret = smu->ppt_funcs->set_fan_speed_percent(smu, speed); + + mutex_unlock(&smu->mutex); + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +@@ -2366,6 +2366,7 @@ static const struct pptable_funcs arctur + .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request, + .get_fan_control_mode = smu_v11_0_get_fan_control_mode, + .set_fan_control_mode = smu_v11_0_set_fan_control_mode, ++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent, + .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm, + .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate, + .gfx_off_control = smu_v11_0_gfx_off_control, +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +@@ -2710,6 +2710,7 @@ static const struct pptable_funcs navi10 + .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request, + .get_fan_control_mode = smu_v11_0_get_fan_control_mode, + .set_fan_control_mode = smu_v11_0_set_fan_control_mode, ++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent, + .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm, + .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate, + .gfx_off_control = smu_v11_0_gfx_off_control, +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +@@ -2776,6 +2776,7 @@ static const struct pptable_funcs sienna + .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request, + .get_fan_control_mode = smu_v11_0_get_fan_control_mode, + .set_fan_control_mode = smu_v11_0_set_fan_control_mode, ++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent, + .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm, + .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate, + .gfx_off_control = smu_v11_0_gfx_off_control, +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +@@ -1123,6 +1123,35 @@ smu_v11_0_set_fan_static_mode(struct smu + } + + int ++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed) ++{ ++ struct amdgpu_device *adev = smu->adev; ++ uint32_t duty100, duty; ++ uint64_t tmp64; ++ ++ if (speed > 100) ++ speed = 100; ++ ++ if (smu_v11_0_auto_fan_control(smu, 0)) ++ return -EINVAL; ++ ++ duty100 = REG_GET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL1), ++ CG_FDO_CTRL1, FMAX_DUTY100); ++ if (!duty100) ++ return -EINVAL; ++ ++ tmp64 = (uint64_t)speed * duty100; ++ do_div(tmp64, 100); ++ duty = (uint32_t)tmp64; ++ ++ WREG32_SOC15(THM, 0, mmCG_FDO_CTRL0, ++ REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL0), ++ CG_FDO_CTRL0, FDO_STATIC_DUTY, duty)); ++ ++ return smu_v11_0_set_fan_static_mode(smu, FDO_PWM_MODE_STATIC); ++} ++ ++int + smu_v11_0_set_fan_control_mode(struct smu_context *smu, + uint32_t mode) + { +@@ -1130,7 +1159,7 @@ smu_v11_0_set_fan_control_mode(struct sm + + switch (mode) { + case AMD_FAN_CTRL_NONE: +- ret = smu_v11_0_set_fan_speed_rpm(smu, smu->fan_max_rpm); ++ ret = smu_v11_0_set_fan_speed_percent(smu, 100); + break; + case AMD_FAN_CTRL_MANUAL: + ret = smu_v11_0_auto_fan_control(smu, 0); diff --git a/queue-5.10/s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch b/queue-5.10/s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch new file mode 100644 index 00000000000..b99434b8317 --- /dev/null +++ b/queue-5.10/s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch @@ -0,0 +1,70 @@ +From e82080e1f456467cc185fe65ee69fe9f9bd0b576 Mon Sep 17 00:00:00 2001 +From: Janosch Frank +Date: Wed, 13 Jan 2021 11:56:26 -0500 +Subject: s390: uv: Fix sysfs max number of VCPUs reporting + +From: Janosch Frank + +commit e82080e1f456467cc185fe65ee69fe9f9bd0b576 upstream. + +The number reported by the query is N-1 and I think people reading the +sysfs file would expect N instead. For users creating VMs there's no +actual difference because KVM's limit is currently below the UV's +limit. + +Signed-off-by: Janosch Frank +Fixes: a0f60f8431999 ("s390/protvirt: Add sysfs firmware interface for Ultravisor information") +Cc: stable@vger.kernel.org +Reviewed-by: Claudio Imbrenda +Acked-by: Cornelia Huck +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +diff --git a/arch/s390/boot/uv.c b/arch/s390/boot/uv.c +index a15c033f53ca..87641dd65ccf 100644 +--- a/arch/s390/boot/uv.c ++++ b/arch/s390/boot/uv.c +@@ -35,7 +35,7 @@ void uv_query_info(void) + uv_info.guest_cpu_stor_len = uvcb.cpu_stor_len; + uv_info.max_sec_stor_addr = ALIGN(uvcb.max_guest_stor_addr, PAGE_SIZE); + uv_info.max_num_sec_conf = uvcb.max_num_sec_conf; +- uv_info.max_guest_cpus = uvcb.max_guest_cpus; ++ uv_info.max_guest_cpu_id = uvcb.max_guest_cpu_id; + } + + #ifdef CONFIG_PROTECTED_VIRTUALIZATION_GUEST +diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h +index 0325fc0469b7..7b98d4caee77 100644 +--- a/arch/s390/include/asm/uv.h ++++ b/arch/s390/include/asm/uv.h +@@ -96,7 +96,7 @@ struct uv_cb_qui { + u32 max_num_sec_conf; + u64 max_guest_stor_addr; + u8 reserved88[158 - 136]; +- u16 max_guest_cpus; ++ u16 max_guest_cpu_id; + u8 reserveda0[200 - 160]; + } __packed __aligned(8); + +@@ -273,7 +273,7 @@ struct uv_info { + unsigned long guest_cpu_stor_len; + unsigned long max_sec_stor_addr; + unsigned int max_num_sec_conf; +- unsigned short max_guest_cpus; ++ unsigned short max_guest_cpu_id; + }; + + extern struct uv_info uv_info; +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 883bfed9f5c2..b2d2ad153067 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -368,7 +368,7 @@ static ssize_t uv_query_max_guest_cpus(struct kobject *kobj, + struct kobj_attribute *attr, char *page) + { + return scnprintf(page, PAGE_SIZE, "%d\n", +- uv_info.max_guest_cpus); ++ uv_info.max_guest_cpu_id + 1); + } + + static struct kobj_attribute uv_query_max_guest_cpus_attr = diff --git a/queue-5.10/s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch b/queue-5.10/s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch new file mode 100644 index 00000000000..34c3bd4293c --- /dev/null +++ b/queue-5.10/s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch @@ -0,0 +1,140 @@ +From f21916ec4826766463fe9fb55a5f43d2a365811d Mon Sep 17 00:00:00 2001 +From: Tony Krowiak +Date: Tue, 22 Dec 2020 20:20:13 -0500 +Subject: s390/vfio-ap: clean up vfio_ap resources when KVM pointer invalidated + +From: Tony Krowiak + +commit f21916ec4826766463fe9fb55a5f43d2a365811d upstream. + +The vfio_ap device driver registers a group notifier with VFIO when the +file descriptor for a VFIO mediated device for a KVM guest is opened to +receive notification that the KVM pointer is set (VFIO_GROUP_NOTIFY_SET_KVM +event). When the KVM pointer is set, the vfio_ap driver takes the +following actions: +1. Stashes the KVM pointer in the vfio_ap_mdev struct that holds the state + of the mediated device. +2. Calls the kvm_get_kvm() function to increment its reference counter. +3. Sets the function pointer to the function that handles interception of + the instruction that enables/disables interrupt processing. +4. Sets the masks in the KVM guest's CRYCB to pass AP resources through to + the guest. + +In order to avoid memory leaks, when the notifier is called to receive +notification that the KVM pointer has been set to NULL, the vfio_ap device +driver should reverse the actions taken when the KVM pointer was set. + +Fixes: 258287c994de ("s390: vfio-ap: implement mediated device open callback") +Signed-off-by: Tony Krowiak +Reviewed-by: Halil Pasic +Reviewed-by: Cornelia Huck +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20201223012013.5418-1-akrowiak@linux.ibm.com +Signed-off-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/crypto/vfio_ap_ops.c | 49 +++++++++++++++++++++----------------- + 1 file changed, 28 insertions(+), 21 deletions(-) + +--- a/drivers/s390/crypto/vfio_ap_ops.c ++++ b/drivers/s390/crypto/vfio_ap_ops.c +@@ -1038,19 +1038,14 @@ static int vfio_ap_mdev_set_kvm(struct a + { + struct ap_matrix_mdev *m; + +- mutex_lock(&matrix_dev->lock); +- + list_for_each_entry(m, &matrix_dev->mdev_list, node) { +- if ((m != matrix_mdev) && (m->kvm == kvm)) { +- mutex_unlock(&matrix_dev->lock); ++ if ((m != matrix_mdev) && (m->kvm == kvm)) + return -EPERM; +- } + } + + matrix_mdev->kvm = kvm; + kvm_get_kvm(kvm); + kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook; +- mutex_unlock(&matrix_dev->lock); + + return 0; + } +@@ -1084,35 +1079,52 @@ static int vfio_ap_mdev_iommu_notifier(s + return NOTIFY_DONE; + } + ++static void vfio_ap_mdev_unset_kvm(struct ap_matrix_mdev *matrix_mdev) ++{ ++ kvm_arch_crypto_clear_masks(matrix_mdev->kvm); ++ matrix_mdev->kvm->arch.crypto.pqap_hook = NULL; ++ vfio_ap_mdev_reset_queues(matrix_mdev->mdev); ++ kvm_put_kvm(matrix_mdev->kvm); ++ matrix_mdev->kvm = NULL; ++} ++ + static int vfio_ap_mdev_group_notifier(struct notifier_block *nb, + unsigned long action, void *data) + { +- int ret; ++ int ret, notify_rc = NOTIFY_OK; + struct ap_matrix_mdev *matrix_mdev; + + if (action != VFIO_GROUP_NOTIFY_SET_KVM) + return NOTIFY_OK; + + matrix_mdev = container_of(nb, struct ap_matrix_mdev, group_notifier); ++ mutex_lock(&matrix_dev->lock); + + if (!data) { +- matrix_mdev->kvm = NULL; +- return NOTIFY_OK; ++ if (matrix_mdev->kvm) ++ vfio_ap_mdev_unset_kvm(matrix_mdev); ++ goto notify_done; + } + + ret = vfio_ap_mdev_set_kvm(matrix_mdev, data); +- if (ret) +- return NOTIFY_DONE; ++ if (ret) { ++ notify_rc = NOTIFY_DONE; ++ goto notify_done; ++ } + + /* If there is no CRYCB pointer, then we can't copy the masks */ +- if (!matrix_mdev->kvm->arch.crypto.crycbd) +- return NOTIFY_DONE; ++ if (!matrix_mdev->kvm->arch.crypto.crycbd) { ++ notify_rc = NOTIFY_DONE; ++ goto notify_done; ++ } + + kvm_arch_crypto_set_masks(matrix_mdev->kvm, matrix_mdev->matrix.apm, + matrix_mdev->matrix.aqm, + matrix_mdev->matrix.adm); + +- return NOTIFY_OK; ++notify_done: ++ mutex_unlock(&matrix_dev->lock); ++ return notify_rc; + } + + static struct vfio_ap_queue *vfio_ap_find_queue(int apqn) +@@ -1246,13 +1258,8 @@ static void vfio_ap_mdev_release(struct + struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev); + + mutex_lock(&matrix_dev->lock); +- if (matrix_mdev->kvm) { +- kvm_arch_crypto_clear_masks(matrix_mdev->kvm); +- matrix_mdev->kvm->arch.crypto.pqap_hook = NULL; +- vfio_ap_mdev_reset_queues(mdev); +- kvm_put_kvm(matrix_mdev->kvm); +- matrix_mdev->kvm = NULL; +- } ++ if (matrix_mdev->kvm) ++ vfio_ap_mdev_unset_kvm(matrix_mdev); + mutex_unlock(&matrix_dev->lock); + + vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY, diff --git a/queue-5.10/s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch b/queue-5.10/s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch new file mode 100644 index 00000000000..d31a44c5a6e --- /dev/null +++ b/queue-5.10/s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch @@ -0,0 +1,267 @@ +From 6c12a6384e0c0b96debd88b24028e58f2ebd417b Mon Sep 17 00:00:00 2001 +From: Tony Krowiak +Date: Tue, 22 Dec 2020 20:15:53 -0500 +Subject: s390/vfio-ap: No need to disable IRQ after queue reset + +From: Tony Krowiak + +commit 6c12a6384e0c0b96debd88b24028e58f2ebd417b upstream. + +The queues assigned to a matrix mediated device are currently reset when: + +* The VFIO_DEVICE_RESET ioctl is invoked +* The mdev fd is closed by userspace (QEMU) +* The mdev is removed from sysfs. + +Immediately after the reset of a queue, a call is made to disable +interrupts for the queue. This is entirely unnecessary because the reset of +a queue disables interrupts, so this will be removed. + +Furthermore, vfio_ap_irq_disable() does an unconditional PQAP/AQIC which +can result in a specification exception (when the corresponding facility +is not available), so this is actually a bugfix. + +Signed-off-by: Tony Krowiak +[pasic@linux.ibm.com: minor rework before merging] +Signed-off-by: Halil Pasic +Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel") +Cc: +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/crypto/vfio_ap_drv.c | 6 -- + drivers/s390/crypto/vfio_ap_ops.c | 100 +++++++++++++++++++++------------- + drivers/s390/crypto/vfio_ap_private.h | 12 ++-- + 3 files changed, 69 insertions(+), 49 deletions(-) + +--- a/drivers/s390/crypto/vfio_ap_drv.c ++++ b/drivers/s390/crypto/vfio_ap_drv.c +@@ -71,15 +71,11 @@ static int vfio_ap_queue_dev_probe(struc + static void vfio_ap_queue_dev_remove(struct ap_device *apdev) + { + struct vfio_ap_queue *q; +- int apid, apqi; + + mutex_lock(&matrix_dev->lock); + q = dev_get_drvdata(&apdev->device); ++ vfio_ap_mdev_reset_queue(q, 1); + dev_set_drvdata(&apdev->device, NULL); +- apid = AP_QID_CARD(q->apqn); +- apqi = AP_QID_QUEUE(q->apqn); +- vfio_ap_mdev_reset_queue(apid, apqi, 1); +- vfio_ap_irq_disable(q); + kfree(q); + mutex_unlock(&matrix_dev->lock); + } +--- a/drivers/s390/crypto/vfio_ap_ops.c ++++ b/drivers/s390/crypto/vfio_ap_ops.c +@@ -25,6 +25,7 @@ + #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device" + + static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev); ++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn); + + static int match_apqn(struct device *dev, const void *data) + { +@@ -49,20 +50,15 @@ static struct vfio_ap_queue *vfio_ap_get + int apqn) + { + struct vfio_ap_queue *q; +- struct device *dev; + + if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm)) + return NULL; + if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm)) + return NULL; + +- dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL, +- &apqn, match_apqn); +- if (!dev) +- return NULL; +- q = dev_get_drvdata(dev); +- q->matrix_mdev = matrix_mdev; +- put_device(dev); ++ q = vfio_ap_find_queue(apqn); ++ if (q) ++ q->matrix_mdev = matrix_mdev; + + return q; + } +@@ -119,13 +115,18 @@ static void vfio_ap_wait_for_irqclear(in + */ + static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q) + { +- if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev) ++ if (!q) ++ return; ++ if (q->saved_isc != VFIO_AP_ISC_INVALID && ++ !WARN_ON(!(q->matrix_mdev && q->matrix_mdev->kvm))) { + kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc); +- if (q->saved_pfn && q->matrix_mdev) ++ q->saved_isc = VFIO_AP_ISC_INVALID; ++ } ++ if (q->saved_pfn && !WARN_ON(!q->matrix_mdev)) { + vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev), + &q->saved_pfn, 1); +- q->saved_pfn = 0; +- q->saved_isc = VFIO_AP_ISC_INVALID; ++ q->saved_pfn = 0; ++ } + } + + /** +@@ -144,7 +145,7 @@ static void vfio_ap_free_aqic_resources( + * Returns if ap_aqic function failed with invalid, deconfigured or + * checkstopped AP. + */ +-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q) ++static struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q) + { + struct ap_qirq_ctrl aqic_gisa = {}; + struct ap_queue_status status; +@@ -1114,48 +1115,70 @@ static int vfio_ap_mdev_group_notifier(s + return NOTIFY_OK; + } + +-static void vfio_ap_irq_disable_apqn(int apqn) ++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn) + { + struct device *dev; +- struct vfio_ap_queue *q; ++ struct vfio_ap_queue *q = NULL; + + dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL, + &apqn, match_apqn); + if (dev) { + q = dev_get_drvdata(dev); +- vfio_ap_irq_disable(q); + put_device(dev); + } ++ ++ return q; + } + +-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi, ++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q, + unsigned int retry) + { + struct ap_queue_status status; ++ int ret; + int retry2 = 2; +- int apqn = AP_MKQID(apid, apqi); + +- do { +- status = ap_zapq(apqn); +- switch (status.response_code) { +- case AP_RESPONSE_NORMAL: +- while (!status.queue_empty && retry2--) { +- msleep(20); +- status = ap_tapq(apqn, NULL); +- } +- WARN_ON_ONCE(retry2 <= 0); +- return 0; +- case AP_RESPONSE_RESET_IN_PROGRESS: +- case AP_RESPONSE_BUSY: ++ if (!q) ++ return 0; ++ ++retry_zapq: ++ status = ap_zapq(q->apqn); ++ switch (status.response_code) { ++ case AP_RESPONSE_NORMAL: ++ ret = 0; ++ break; ++ case AP_RESPONSE_RESET_IN_PROGRESS: ++ if (retry--) { + msleep(20); +- break; +- default: +- /* things are really broken, give up */ +- return -EIO; ++ goto retry_zapq; + } +- } while (retry--); ++ ret = -EBUSY; ++ break; ++ case AP_RESPONSE_Q_NOT_AVAIL: ++ case AP_RESPONSE_DECONFIGURED: ++ case AP_RESPONSE_CHECKSTOPPED: ++ WARN_ON_ONCE(status.irq_enabled); ++ ret = -EBUSY; ++ goto free_resources; ++ default: ++ /* things are really broken, give up */ ++ WARN(true, "PQAP/ZAPQ completed with invalid rc (%x)\n", ++ status.response_code); ++ return -EIO; ++ } ++ ++ /* wait for the reset to take effect */ ++ while (retry2--) { ++ if (status.queue_empty && !status.irq_enabled) ++ break; ++ msleep(20); ++ status = ap_tapq(q->apqn, NULL); ++ } ++ WARN_ON_ONCE(retry2 <= 0); + +- return -EBUSY; ++free_resources: ++ vfio_ap_free_aqic_resources(q); ++ ++ return ret; + } + + static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev) +@@ -1163,13 +1186,15 @@ static int vfio_ap_mdev_reset_queues(str + int ret; + int rc = 0; + unsigned long apid, apqi; ++ struct vfio_ap_queue *q; + struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev); + + for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, + matrix_mdev->matrix.apm_max + 1) { + for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, + matrix_mdev->matrix.aqm_max + 1) { +- ret = vfio_ap_mdev_reset_queue(apid, apqi, 1); ++ q = vfio_ap_find_queue(AP_MKQID(apid, apqi)); ++ ret = vfio_ap_mdev_reset_queue(q, 1); + /* + * Regardless whether a queue turns out to be busy, or + * is not operational, we need to continue resetting +@@ -1177,7 +1202,6 @@ static int vfio_ap_mdev_reset_queues(str + */ + if (ret) + rc = ret; +- vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi)); + } + } + +--- a/drivers/s390/crypto/vfio_ap_private.h ++++ b/drivers/s390/crypto/vfio_ap_private.h +@@ -88,11 +88,6 @@ struct ap_matrix_mdev { + struct mdev_device *mdev; + }; + +-extern int vfio_ap_mdev_register(void); +-extern void vfio_ap_mdev_unregister(void); +-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi, +- unsigned int retry); +- + struct vfio_ap_queue { + struct ap_matrix_mdev *matrix_mdev; + unsigned long saved_pfn; +@@ -100,5 +95,10 @@ struct vfio_ap_queue { + #define VFIO_AP_ISC_INVALID 0xff + unsigned char saved_isc; + }; +-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q); ++ ++int vfio_ap_mdev_register(void); ++void vfio_ap_mdev_unregister(void); ++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q, ++ unsigned int retry); ++ + #endif /* _VFIO_AP_PRIVATE_H_ */ diff --git a/queue-5.10/series b/queue-5.10/series index 3cca0e88cec..2e4ed9ac167 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -6,3 +6,27 @@ acpi-thermal-do-not-call-acpi_thermal_check-directly.patch kernel-kexec-remove-the-lock-operation-of-system_transition_mutex.patch alsa-hda-realtek-enable-headset-of-asus-b1400cepe-with-alc256.patch alsa-hda-via-apply-the-workaround-generically-for-clevo-machines.patch +parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch +media-cec-add-stm32-driver.patch +media-cedrus-fix-h264-decoding.patch +media-hantro-fix-reset_raw_fmt-initialization.patch +media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch +media-rc-ite-cir-fix-min_timeout-calculation.patch +media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch +arm-dts-tbs2910-rename-mmc-node-aliases.patch +arm-dts-ux500-reserve-memory-carveouts.patch +arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch +wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch +x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch +asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch +revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch +drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch +drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch +drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch +drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch +bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch +net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch +s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch +s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch +s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch +pm-hibernate-flush-swap-writer-after-marking.patch diff --git a/queue-5.10/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch b/queue-5.10/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch new file mode 100644 index 00000000000..47f585ab9b1 --- /dev/null +++ b/queue-5.10/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch @@ -0,0 +1,50 @@ +From 5122565188bae59d507d90a9a9fd2fd6107f4439 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 21 Jan 2021 17:16:22 +0100 +Subject: wext: fix NULL-ptr-dereference with cfg80211's lack of commit() + +From: Johannes Berg + +commit 5122565188bae59d507d90a9a9fd2fd6107f4439 upstream. + +Since cfg80211 doesn't implement commit, we never really cared about +that code there (and it's configured out w/o CONFIG_WIRELESS_EXT). +After all, since it has no commit, it shouldn't return -EIWCOMMIT to +indicate commit is needed. + +However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_ +happen if e.g. we try to change the frequency but we're already in +the process of connecting to some network, and drivers could return +that value (or even cfg80211 itself might). + +This then causes us to crash because dev->wireless_handlers is NULL +but we try to check dev->wireless_handlers->standard[0]. + +Fix this by also checking dev->wireless_handlers. Also simplify the +code a little bit. + +Cc: stable@vger.kernel.org +Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com +Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/wext-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/wireless/wext-core.c ++++ b/net/wireless/wext-core.c +@@ -896,8 +896,9 @@ out: + int call_commit_handler(struct net_device *dev) + { + #ifdef CONFIG_WIRELESS_EXT +- if ((netif_running(dev)) && +- (dev->wireless_handlers->standard[0] != NULL)) ++ if (netif_running(dev) && ++ dev->wireless_handlers && ++ dev->wireless_handlers->standard[0]) + /* Call the commit handler on the driver */ + return dev->wireless_handlers->standard[0](dev, NULL, + NULL, NULL); diff --git a/queue-5.10/x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch b/queue-5.10/x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch new file mode 100644 index 00000000000..ea0ebf69b25 --- /dev/null +++ b/queue-5.10/x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch @@ -0,0 +1,132 @@ +From 2e92493637a09547734f92c62a2471f6f0cb9a2c Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Mon, 25 Jan 2021 14:42:07 +0100 +Subject: x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled + +From: Juergen Gross + +commit 2e92493637a09547734f92c62a2471f6f0cb9a2c upstream. + +When booting a kernel which has been built with CONFIG_AMD_MEM_ENCRYPT +enabled as a Xen pv guest a warning is issued for each processor: + +[ 5.964347] ------------[ cut here ]------------ +[ 5.968314] WARNING: CPU: 0 PID: 1 at /home/gross/linux/head/arch/x86/xen/enlighten_pv.c:660 get_trap_addr+0x59/0x90 +[ 5.972321] Modules linked in: +[ 5.976313] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.11.0-rc5-default #75 +[ 5.980313] Hardware name: Dell Inc. OptiPlex 9020/0PC5F7, BIOS A05 12/05/2013 +[ 5.984313] RIP: e030:get_trap_addr+0x59/0x90 +[ 5.988313] Code: 42 10 83 f0 01 85 f6 74 04 84 c0 75 1d b8 01 00 00 00 c3 48 3d 00 80 83 82 72 08 48 3d 20 81 83 82 72 0c b8 01 00 00 00 eb db <0f> 0b 31 c0 c3 48 2d 00 80 83 82 48 ba 72 1c c7 71 1c c7 71 1c 48 +[ 5.992313] RSP: e02b:ffffc90040033d38 EFLAGS: 00010202 +[ 5.996313] RAX: 0000000000000001 RBX: ffffffff82a141d0 RCX: ffffffff8222ec38 +[ 6.000312] RDX: ffffffff8222ec38 RSI: 0000000000000005 RDI: ffffc90040033d40 +[ 6.004313] RBP: ffff8881003984a0 R08: 0000000000000007 R09: ffff888100398000 +[ 6.008312] R10: 0000000000000007 R11: ffffc90040246000 R12: ffff8884082182a8 +[ 6.012313] R13: 0000000000000100 R14: 000000000000001d R15: ffff8881003982d0 +[ 6.016316] FS: 0000000000000000(0000) GS:ffff888408200000(0000) knlGS:0000000000000000 +[ 6.020313] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 6.024313] CR2: ffffc900020ef000 CR3: 000000000220a000 CR4: 0000000000050660 +[ 6.028314] Call Trace: +[ 6.032313] cvt_gate_to_trap.part.7+0x3f/0x90 +[ 6.036313] ? asm_exc_double_fault+0x30/0x30 +[ 6.040313] xen_convert_trap_info+0x87/0xd0 +[ 6.044313] xen_pv_cpu_up+0x17a/0x450 +[ 6.048313] bringup_cpu+0x2b/0xc0 +[ 6.052313] ? cpus_read_trylock+0x50/0x50 +[ 6.056313] cpuhp_invoke_callback+0x80/0x4c0 +[ 6.060313] _cpu_up+0xa7/0x140 +[ 6.064313] cpu_up+0x98/0xd0 +[ 6.068313] bringup_nonboot_cpus+0x4f/0x60 +[ 6.072313] smp_init+0x26/0x79 +[ 6.076313] kernel_init_freeable+0x103/0x258 +[ 6.080313] ? rest_init+0xd0/0xd0 +[ 6.084313] kernel_init+0xa/0x110 +[ 6.088313] ret_from_fork+0x1f/0x30 +[ 6.092313] ---[ end trace be9ecf17dceeb4f3 ]--- + +Reason is that there is no Xen pv trap entry for X86_TRAP_VC. + +Fix that by adding a generic trap handler for unknown traps and wire all +unknown bare metal handlers to this generic handler, which will just +crash the system in case such a trap will ever happen. + +Fixes: 0786138c78e793 ("x86/sev-es: Add a Runtime #VC Exception Handler") +Cc: # v5.10 +Signed-off-by: Juergen Gross +Reviewed-by: Andrew Cooper +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/idtentry.h | 1 + + arch/x86/xen/enlighten_pv.c | 15 ++++++++++++++- + arch/x86/xen/xen-asm.S | 1 + + 3 files changed, 16 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/idtentry.h ++++ b/arch/x86/include/asm/idtentry.h +@@ -616,6 +616,7 @@ DECLARE_IDTENTRY_VC(X86_TRAP_VC, exc_vmm + + #ifdef CONFIG_XEN_PV + DECLARE_IDTENTRY_XENCB(X86_TRAP_OTHER, exc_xen_hypervisor_callback); ++DECLARE_IDTENTRY_RAW(X86_TRAP_OTHER, exc_xen_unknown_trap); + #endif + + /* Device interrupts common/spurious */ +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -583,6 +583,13 @@ DEFINE_IDTENTRY_RAW(xenpv_exc_debug) + exc_debug(regs); + } + ++DEFINE_IDTENTRY_RAW(exc_xen_unknown_trap) ++{ ++ /* This should never happen and there is no way to handle it. */ ++ pr_err("Unknown trap in Xen PV mode."); ++ BUG(); ++} ++ + struct trap_array_entry { + void (*orig)(void); + void (*xen)(void); +@@ -631,6 +638,7 @@ static bool __ref get_trap_addr(void **a + { + unsigned int nr; + bool ist_okay = false; ++ bool found = false; + + /* + * Replace trap handler addresses by Xen specific ones. +@@ -645,6 +653,7 @@ static bool __ref get_trap_addr(void **a + if (*addr == entry->orig) { + *addr = entry->xen; + ist_okay = entry->ist_okay; ++ found = true; + break; + } + } +@@ -655,9 +664,13 @@ static bool __ref get_trap_addr(void **a + nr = (*addr - (void *)early_idt_handler_array[0]) / + EARLY_IDT_HANDLER_SIZE; + *addr = (void *)xen_early_idt_handler_array[nr]; ++ found = true; + } + +- if (WARN_ON(ist != 0 && !ist_okay)) ++ if (!found) ++ *addr = (void *)xen_asm_exc_xen_unknown_trap; ++ ++ if (WARN_ON(found && ist != 0 && !ist_okay)) + return false; + + return true; +--- a/arch/x86/xen/xen-asm.S ++++ b/arch/x86/xen/xen-asm.S +@@ -178,6 +178,7 @@ xen_pv_trap asm_exc_simd_coprocessor_err + #ifdef CONFIG_IA32_EMULATION + xen_pv_trap entry_INT80_compat + #endif ++xen_pv_trap asm_exc_xen_unknown_trap + xen_pv_trap asm_exc_xen_hypervisor_callback + + __INIT