From: Sasha Levin Date: Sun, 7 Mar 2021 23:08:21 +0000 (-0500) Subject: Fixes for 5.11 X-Git-Tag: v5.4.104~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e78047f139e9e210eff863010a2f6051e948082c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.11 Signed-off-by: Sasha Levin --- diff --git a/queue-5.11/alsa-ctxfi-cthw20k2-fix-mask-on-conf-to-allow-4-bits.patch b/queue-5.11/alsa-ctxfi-cthw20k2-fix-mask-on-conf-to-allow-4-bits.patch new file mode 100644 index 00000000000..7ba79d46ab8 --- /dev/null +++ b/queue-5.11/alsa-ctxfi-cthw20k2-fix-mask-on-conf-to-allow-4-bits.patch @@ -0,0 +1,46 @@ +From 2e61471c134332fd85b725db58b7949efa3ae921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Feb 2021 00:15:27 +0000 +Subject: ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits + +From: Colin Ian King + +[ Upstream commit 26a9630c72ebac7c564db305a6aee54a8edde70e ] + +Currently the mask operation on variable conf is just 3 bits so +the switch statement case value of 8 is unreachable dead code. +The function daio_mgr_dao_init can be passed a 4 bit value, +function dao_rsc_init calls it with conf set to: + + conf = (desc->msr & 0x7) | (desc->passthru << 3); + +so clearly when desc->passthru is set to 1 then conf can be +at least 8. + +Fix this by changing the mask to 0xf. + +Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210227001527.1077484-1-colin.king@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ctxfi/cthw20k2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c +index fc1bc18caee9..85d1fc76f59e 100644 +--- a/sound/pci/ctxfi/cthw20k2.c ++++ b/sound/pci/ctxfi/cthw20k2.c +@@ -991,7 +991,7 @@ static int daio_mgr_dao_init(void *blk, unsigned int idx, unsigned int conf) + + if (idx < 4) { + /* S/PDIF output */ +- switch ((conf & 0x7)) { ++ switch ((conf & 0xf)) { + case 1: + set_field(&ctl->txctl[idx], ATXCTL_NUC, 0); + break; +-- +2.30.1 + diff --git a/queue-5.11/alsa-hda-intel-nhlt-verify-config-type.patch b/queue-5.11/alsa-hda-intel-nhlt-verify-config-type.patch new file mode 100644 index 00000000000..662edf59319 --- /dev/null +++ b/queue-5.11/alsa-hda-intel-nhlt-verify-config-type.patch @@ -0,0 +1,143 @@ +From f713686b05974927a1e3f76cf1347c0a001d1375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 18:01:46 -0600 +Subject: ALSA: hda: intel-nhlt: verify config type + +From: Pierre-Louis Bossart + +[ Upstream commit a864e8f159b13babf552aff14a5fbe11abc017e4 ] + +Multiple bug reports report issues with the SOF and SST drivers when +dealing with single microphone cases. + +We currently read the DMIC array information unconditionally but we +don't check that the configuration type is actually a mic array. + +When the DMIC link does not rely on a mic array configuration, the +recommendation is to check the format information to infer the maximum +number of channels, and map this to the number of microphones. + +This leaves a potential for a mismatch between actual microphones +available in hardware and what the ACPI table contains, but we have no +other source of information. + +Note that single microphone configurations can alternatively be +handled with a 'mic array' configuration along with a 'vendor-defined' +geometry. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201251 +BugLink: https://github.com/thesofproject/linux/issues/2725 +Fixes: 7a33ea70e1868 ('ALSA: hda: intel-nhlt: handle NHLT VENDOR_DEFINED DMIC geometry') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20210302000146.1177770-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/intel-nhlt.h | 5 ++++ + sound/hda/intel-nhlt.c | 54 +++++++++++++++++++++++++++++++------- + 2 files changed, 50 insertions(+), 9 deletions(-) + +diff --git a/include/sound/intel-nhlt.h b/include/sound/intel-nhlt.h +index 743c2f442280..d0574805865f 100644 +--- a/include/sound/intel-nhlt.h ++++ b/include/sound/intel-nhlt.h +@@ -112,6 +112,11 @@ struct nhlt_vendor_dmic_array_config { + /* TODO add vendor mic config */ + } __packed; + ++enum { ++ NHLT_CONFIG_TYPE_GENERIC = 0, ++ NHLT_CONFIG_TYPE_MIC_ARRAY = 1 ++}; ++ + enum { + NHLT_MIC_ARRAY_2CH_SMALL = 0xa, + NHLT_MIC_ARRAY_2CH_BIG = 0xb, +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 059aaf04f536..d053beccfaec 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -31,18 +31,44 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + struct nhlt_endpoint *epnt; + struct nhlt_dmic_array_config *cfg; + struct nhlt_vendor_dmic_array_config *cfg_vendor; ++ struct nhlt_fmt *fmt_configs; + unsigned int dmic_geo = 0; +- u8 j; ++ u16 max_ch = 0; ++ u8 i, j; + + if (!nhlt) + return 0; + +- epnt = (struct nhlt_endpoint *)nhlt->desc; ++ for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, ++ epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { + +- for (j = 0; j < nhlt->endpoint_count; j++) { +- if (epnt->linktype == NHLT_LINK_DMIC) { +- cfg = (struct nhlt_dmic_array_config *) +- (epnt->config.caps); ++ if (epnt->linktype != NHLT_LINK_DMIC) ++ continue; ++ ++ cfg = (struct nhlt_dmic_array_config *)(epnt->config.caps); ++ fmt_configs = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); ++ ++ /* find max number of channels based on format_configuration */ ++ if (fmt_configs->fmt_count) { ++ dev_dbg(dev, "%s: found %d format definitions\n", ++ __func__, fmt_configs->fmt_count); ++ ++ for (i = 0; i < fmt_configs->fmt_count; i++) { ++ struct wav_fmt_ext *fmt_ext; ++ ++ fmt_ext = &fmt_configs->fmt_config[i].fmt_ext; ++ ++ if (fmt_ext->fmt.channels > max_ch) ++ max_ch = fmt_ext->fmt.channels; ++ } ++ dev_dbg(dev, "%s: max channels found %d\n", __func__, max_ch); ++ } else { ++ dev_dbg(dev, "%s: No format information found\n", __func__); ++ } ++ ++ if (cfg->device_config.config_type != NHLT_CONFIG_TYPE_MIC_ARRAY) { ++ dmic_geo = max_ch; ++ } else { + switch (cfg->array_type) { + case NHLT_MIC_ARRAY_2CH_SMALL: + case NHLT_MIC_ARRAY_2CH_BIG: +@@ -59,13 +85,23 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + dmic_geo = cfg_vendor->nb_mics; + break; + default: +- dev_warn(dev, "undefined DMIC array_type 0x%0x\n", +- cfg->array_type); ++ dev_warn(dev, "%s: undefined DMIC array_type 0x%0x\n", ++ __func__, cfg->array_type); ++ } ++ ++ if (dmic_geo > 0) { ++ dev_dbg(dev, "%s: Array with %d dmics\n", __func__, dmic_geo); ++ } ++ if (max_ch > dmic_geo) { ++ dev_dbg(dev, "%s: max channels %d exceed dmic number %d\n", ++ __func__, max_ch, dmic_geo); + } + } +- epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length); + } + ++ dev_dbg(dev, "%s: dmic number %d max_ch %d\n", ++ __func__, dmic_geo, max_ch); ++ + return dmic_geo; + } + EXPORT_SYMBOL_GPL(intel_nhlt_get_dmic_geo); +-- +2.30.1 + diff --git a/queue-5.11/alsa-usb-audio-fix-pioneer-djm-devices-urb_control-r.patch b/queue-5.11/alsa-usb-audio-fix-pioneer-djm-devices-urb_control-r.patch new file mode 100644 index 00000000000..b3884d7a360 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-fix-pioneer-djm-devices-urb_control-r.patch @@ -0,0 +1,38 @@ +From c205ae742ab78922a7bde40f5c2e584c53b95b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 15:29:27 +0100 +Subject: ALSA: usb-audio: Fix Pioneer DJM devices URB_CONTROL request + direction to set samplerate + +From: Nicolas MURE + +[ Upstream commit 2c9119001dcb1dc7027257c5d8960d30f5ba58be ] + +This commit only contains the fix about the `URB_CONTROL` request +direction to set the samplerate of Pioneer DJM devices (`URB_CONTROL out`). + +Fixes: 3b85f5fc75d5 ("ALSA: usb-audio: Add DJM450 to Pioneer format quirk") +Signed-off-by: Nicolas MURE +Link: https://lore.kernel.org/r/20210301142927.14552-1-nicolas.mure2019@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 9ba4682ebc48..737b2729c0d3 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1482,7 +1482,7 @@ static int pioneer_djm_set_format_quirk(struct snd_usb_substream *subs, + usb_set_interface(subs->dev, 0, 1); + // we should derive windex from fmt-sync_ep but it's not set + snd_usb_ctl_msg(subs->stream->chip->dev, +- usb_rcvctrlpipe(subs->stream->chip->dev, 0), ++ usb_sndctrlpipe(subs->stream->chip->dev, 0), + 0x01, 0x22, 0x0100, windex, &sr, 0x0003); + return 0; + } +-- +2.30.1 + diff --git a/queue-5.11/btrfs-zoned-use-sector_t-for-zone-sectors.patch b/queue-5.11/btrfs-zoned-use-sector_t-for-zone-sectors.patch new file mode 100644 index 00000000000..59701849bf2 --- /dev/null +++ b/queue-5.11/btrfs-zoned-use-sector_t-for-zone-sectors.patch @@ -0,0 +1,49 @@ +From 173462f296ed37dec347187f993a5a43ce8d4910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 17:55:46 +0900 +Subject: btrfs: zoned: use sector_t for zone sectors + +From: Naohiro Aota + +[ Upstream commit d734492a14a2da6e7bcce8cf66436a9cf4e51ddf ] + +We need to use sector_t for zone_sectors, or it would set the zone size +to zero when the size >= 4GB (= 2^24 sectors) by shifting the +zone_sectors value by SECTOR_SHIFT. We're assuming zones sizes up to +8GiB. + +Fixes: 5b316468983d ("btrfs: get zone information of zoned block devices") +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/zoned.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index c38846659019..2f80de440359 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -152,7 +152,7 @@ int btrfs_get_dev_zone_info(struct btrfs_device *device) + sector_t sector = 0; + struct blk_zone *zones = NULL; + unsigned int i, nreported = 0, nr_zones; +- unsigned int zone_sectors; ++ sector_t zone_sectors; + int ret; + + if (!bdev_is_zoned(bdev)) +@@ -485,7 +485,7 @@ int btrfs_sb_log_location_bdev(struct block_device *bdev, int mirror, int rw, + u64 *bytenr_ret) + { + struct blk_zone zones[BTRFS_NR_SB_LOG_ZONES]; +- unsigned int zone_sectors; ++ sector_t zone_sectors; + u32 sb_zone; + int ret; + u64 zone_size; +-- +2.30.1 + diff --git a/queue-5.11/ftrace-have-recordmcount-use-w8-to-read-relp-r_info-.patch b/queue-5.11/ftrace-have-recordmcount-use-w8-to-read-relp-r_info-.patch new file mode 100644 index 00000000000..227b5409233 --- /dev/null +++ b/queue-5.11/ftrace-have-recordmcount-use-w8-to-read-relp-r_info-.patch @@ -0,0 +1,56 @@ +From c4eaa1b3adc4be537c3cdd463c1adc8049482032 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 13:58:40 +0000 +Subject: ftrace: Have recordmcount use w8 to read relp->r_info in + arm64_is_fake_mcount + +From: Chen Jun + +[ Upstream commit 999340d51174ce4141dd723105d4cef872b13ee9 ] + +On little endian system, Use aarch64_be(gcc v7.3) downloaded from +linaro.org to build image with CONFIG_CPU_BIG_ENDIAN = y, +CONFIG_FTRACE = y, CONFIG_DYNAMIC_FTRACE = y. + +gcc will create symbols of _mcount but recordmcount can not create +mcount_loc for *.o. +aarch64_be-linux-gnu-objdump -r fs/namei.o | grep mcount +00000000000000d0 R_AARCH64_CALL26 _mcount +... +0000000000007190 R_AARCH64_CALL26 _mcount + +The reason is than funciton arm64_is_fake_mcount can not work correctly. +A symbol of _mcount in *.o compiled with big endian compiler likes: +00 00 00 2d 00 00 01 1b +w(rp->r_info) will return 0x2d instead of 0x011b. Because w() takes +uint32_t as parameter, which truncates rp->r_info. + +Use w8() instead w() to read relp->r_info + +Link: https://lkml.kernel.org/r/20210222135840.56250-1-chenjun102@huawei.com + +Fixes: ea0eada45632 ("recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.") +Acked-by: Will Deacon +Signed-off-by: Chen Jun +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + scripts/recordmcount.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index b9c2ee7ab43f..cce12e1971d8 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -438,7 +438,7 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp) + + static int arm64_is_fake_mcount(Elf64_Rel const *rp) + { +- return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26; ++ return ELF64_R_TYPE(w8(rp->r_info)) != R_AARCH64_CALL26; + } + + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. +-- +2.30.1 + diff --git a/queue-5.11/ia64-don-t-call-handle_signal-unless-there-s-actuall.patch b/queue-5.11/ia64-don-t-call-handle_signal-unless-there-s-actuall.patch new file mode 100644 index 00000000000..0f253789ee6 --- /dev/null +++ b/queue-5.11/ia64-don-t-call-handle_signal-unless-there-s-actuall.patch @@ -0,0 +1,46 @@ +From d7094ac2a26656d6cc88929a30d2ee7a347f71ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 17:22:11 -0700 +Subject: ia64: don't call handle_signal() unless there's actually a signal + queued + +From: Jens Axboe + +[ Upstream commit f5f4fc4649ae542b1a25670b17aaf3cbb6187acc ] + +Sergei and John both reported that ia64 failed to boot in 5.11, and it +was related to signals. Turns out the ia64 signal handling is a bit odd, +it doesn't check the return value of get_signal() for whether there's a +signal to deliver or not. With the introduction of TIF_NOTIFY_SIGNAL, +then task_work could trigger it. + +Fix it by only calling handle_signal() if we actually have a real signal +to deliver. This brings it in line with all other archs, too. + +Fixes: b269c229b0e8 ("ia64: add support for TIF_NOTIFY_SIGNAL") +Reported-by: Sergei Trofimovich +Reported-by: John Paul Adrian Glaubitz +Tested-by: Sergei Trofimovich +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/signal.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c +index e67b22fc3c60..c1b299760bf7 100644 +--- a/arch/ia64/kernel/signal.c ++++ b/arch/ia64/kernel/signal.c +@@ -341,7 +341,8 @@ ia64_do_signal (struct sigscratch *scr, long in_syscall) + * need to push through a forced SIGSEGV. + */ + while (1) { +- get_signal(&ksig); ++ if (!get_signal(&ksig)) ++ break; + + /* + * get_signal() may have run a debugger (via notify_parent()) +-- +2.30.1 + diff --git a/queue-5.11/ib-mlx5-add-missing-error-code.patch b/queue-5.11/ib-mlx5-add-missing-error-code.patch new file mode 100644 index 00000000000..ad8aeeda6b2 --- /dev/null +++ b/queue-5.11/ib-mlx5-add-missing-error-code.patch @@ -0,0 +1,40 @@ +From c451e599e0eeb4ca4472e7621504021d7d64961a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 20:23:43 +0800 +Subject: IB/mlx5: Add missing error code + +From: YueHaibing + +[ Upstream commit 3a9b3d4536e0c25bd3906a28c1f584177e49dd0f ] + +Set err to -ENOMEM if kzalloc fails instead of 0. + +Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") +Link: https://lore.kernel.org/r/20210222122343.19720-1-yuehaibing@huawei.com +Signed-off-by: YueHaibing +Acked-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index ff8e17d7f7ca..8161035eb774 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1970,8 +1970,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( + + num_alloc_xa_entries++; + event_sub = kzalloc(sizeof(*event_sub), GFP_KERNEL); +- if (!event_sub) ++ if (!event_sub) { ++ err = -ENOMEM; + goto err; ++ } + + list_add_tail(&event_sub->event_list, &sub_list); + uverbs_uobject_get(&ev_file->uobj); +-- +2.30.1 + diff --git a/queue-5.11/iommu-don-t-use-lazy-flush-for-untrusted-device.patch b/queue-5.11/iommu-don-t-use-lazy-flush-for-untrusted-device.patch new file mode 100644 index 00000000000..a63e49c83b2 --- /dev/null +++ b/queue-5.11/iommu-don-t-use-lazy-flush-for-untrusted-device.patch @@ -0,0 +1,67 @@ +From 20fea533163e9c65a14ceacf50678691f2fb8ac2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 14:14:54 +0800 +Subject: iommu: Don't use lazy flush for untrusted device + +From: Lu Baolu + +[ Upstream commit 82c3cefb9f1652e7470f442ff96c613e8c8ed8f4 ] + +The lazy IOTLB flushing setup leaves a time window, in which the device +can still access some system memory, which has already been unmapped by +the device driver. It's not suitable for untrusted devices. A malicious +device might use this to attack the system by obtaining data that it +shouldn't obtain. + +Fixes: c588072bba6b5 ("iommu/vt-d: Convert intel iommu driver to the iommu ops") +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210225061454.2864009-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 4078358ed66e..00fbc591a142 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -309,6 +309,11 @@ static void iommu_dma_flush_iotlb_all(struct iova_domain *iovad) + domain->ops->flush_iotlb_all(domain); + } + ++static bool dev_is_untrusted(struct device *dev) ++{ ++ return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; ++} ++ + /** + * iommu_dma_init_domain - Initialise a DMA mapping domain + * @domain: IOMMU domain previously prepared by iommu_get_dma_cookie() +@@ -363,8 +368,9 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base, + + init_iova_domain(iovad, 1UL << order, base_pfn); + +- if (!cookie->fq_domain && !iommu_domain_get_attr(domain, +- DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE, &attr) && attr) { ++ if (!cookie->fq_domain && (!dev || !dev_is_untrusted(dev)) && ++ !iommu_domain_get_attr(domain, DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE, &attr) && ++ attr) { + if (init_iova_flush_queue(iovad, iommu_dma_flush_iotlb_all, + iommu_dma_entry_dtor)) + pr_warn("iova flush queue initialization failed\n"); +@@ -521,11 +527,6 @@ static void __iommu_dma_unmap_swiotlb(struct device *dev, dma_addr_t dma_addr, + iova_align(iovad, size), dir, attrs); + } + +-static bool dev_is_untrusted(struct device *dev) +-{ +- return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; +-} +- + static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys, + size_t size, int prot, u64 dma_mask) + { +-- +2.30.1 + diff --git a/queue-5.11/iommu-tegra-smmu-fix-mc-errors-on-tegra124-nyan.patch b/queue-5.11/iommu-tegra-smmu-fix-mc-errors-on-tegra124-nyan.patch new file mode 100644 index 00000000000..25ba0903886 --- /dev/null +++ b/queue-5.11/iommu-tegra-smmu-fix-mc-errors-on-tegra124-nyan.patch @@ -0,0 +1,156 @@ +From 8195402a85f9aafed0ec3d6cb3b96338bf48f9fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 14:07:02 -0800 +Subject: iommu/tegra-smmu: Fix mc errors on tegra124-nyan + +From: Nicolin Chen + +[ Upstream commit 765a9d1d02b2f5996b05f5f65faa8a634adbe763 ] + +Commit 25938c73cd79 ("iommu/tegra-smmu: Rework tegra_smmu_probe_device()") +removed certain hack in the tegra_smmu_probe() by relying on IOMMU core to +of_xlate SMMU's SID per device, so as to get rid of tegra_smmu_find() and +tegra_smmu_configure() that are typically done in the IOMMU core also. + +This approach works for both existing devices that have DT nodes and other +devices (like PCI device) that don't exist in DT, on Tegra210 and Tegra3 +upon testing. However, Page Fault errors are reported on tegra124-Nyan: + + tegra-mc 70019000.memory-controller: display0a: read @0xfe056b40: + EMEM address decode error (SMMU translation error [--S]) + tegra-mc 70019000.memory-controller: display0a: read @0xfe056b40: + Page fault (SMMU translation error [--S]) + +After debugging, I found that the mentioned commit changed some function +callback sequence of tegra-smmu's, resulting in enabling SMMU for display +client before display driver gets initialized. I couldn't reproduce exact +same issue on Tegra210 as Tegra124 (arm-32) differs at arch-level code. + +Actually this Page Fault is a known issue, as on most of Tegra platforms, +display gets enabled by the bootloader for the splash screen feature, so +it keeps filling the framebuffer memory. A proper fix to this issue is to +1:1 linear map the framebuffer memory to IOVA space so the SMMU will have +the same address as the physical address in its page table. Yet, Thierry +has been working on the solution above for a year, and it hasn't merged. + +Therefore, let's partially revert the mentioned commit to fix the errors. + +The reason why we do a partial revert here is that we can still set priv +in ->of_xlate() callback for PCI devices. Meanwhile, devices existing in +DT, like display, will go through tegra_smmu_configure() at the stage of +bus_set_iommu() when SMMU gets probed(), as what it did before we merged +the mentioned commit. + +Once we have the linear map solution for framebuffer memory, this change +can be cleaned away. + +[Big thank to Guillaume who reported and helped debugging/verification] + +Fixes: 25938c73cd79 ("iommu/tegra-smmu: Rework tegra_smmu_probe_device()") +Reported-by: Guillaume Tucker +Signed-off-by: Nicolin Chen +Tested-by: Guillaume Tucker +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20210218220702.1962-1-nicoleotsuka@gmail.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/tegra-smmu.c | 72 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 71 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c +index 4a3f095a1c26..97eb62f667d2 100644 +--- a/drivers/iommu/tegra-smmu.c ++++ b/drivers/iommu/tegra-smmu.c +@@ -798,10 +798,70 @@ static phys_addr_t tegra_smmu_iova_to_phys(struct iommu_domain *domain, + return SMMU_PFN_PHYS(pfn) + SMMU_OFFSET_IN_PAGE(iova); + } + ++static struct tegra_smmu *tegra_smmu_find(struct device_node *np) ++{ ++ struct platform_device *pdev; ++ struct tegra_mc *mc; ++ ++ pdev = of_find_device_by_node(np); ++ if (!pdev) ++ return NULL; ++ ++ mc = platform_get_drvdata(pdev); ++ if (!mc) ++ return NULL; ++ ++ return mc->smmu; ++} ++ ++static int tegra_smmu_configure(struct tegra_smmu *smmu, struct device *dev, ++ struct of_phandle_args *args) ++{ ++ const struct iommu_ops *ops = smmu->iommu.ops; ++ int err; ++ ++ err = iommu_fwspec_init(dev, &dev->of_node->fwnode, ops); ++ if (err < 0) { ++ dev_err(dev, "failed to initialize fwspec: %d\n", err); ++ return err; ++ } ++ ++ err = ops->of_xlate(dev, args); ++ if (err < 0) { ++ dev_err(dev, "failed to parse SW group ID: %d\n", err); ++ iommu_fwspec_free(dev); ++ return err; ++ } ++ ++ return 0; ++} ++ + static struct iommu_device *tegra_smmu_probe_device(struct device *dev) + { +- struct tegra_smmu *smmu = dev_iommu_priv_get(dev); ++ struct device_node *np = dev->of_node; ++ struct tegra_smmu *smmu = NULL; ++ struct of_phandle_args args; ++ unsigned int index = 0; ++ int err; ++ ++ while (of_parse_phandle_with_args(np, "iommus", "#iommu-cells", index, ++ &args) == 0) { ++ smmu = tegra_smmu_find(args.np); ++ if (smmu) { ++ err = tegra_smmu_configure(smmu, dev, &args); ++ of_node_put(args.np); + ++ if (err < 0) ++ return ERR_PTR(err); ++ ++ break; ++ } ++ ++ of_node_put(args.np); ++ index++; ++ } ++ ++ smmu = dev_iommu_priv_get(dev); + if (!smmu) + return ERR_PTR(-ENODEV); + +@@ -1028,6 +1088,16 @@ struct tegra_smmu *tegra_smmu_probe(struct device *dev, + if (!smmu) + return ERR_PTR(-ENOMEM); + ++ /* ++ * This is a bit of a hack. Ideally we'd want to simply return this ++ * value. However the IOMMU registration process will attempt to add ++ * all devices to the IOMMU when bus_set_iommu() is called. In order ++ * not to rely on global variables to track the IOMMU instance, we ++ * set it here so that it can be looked up from the .probe_device() ++ * callback via the IOMMU device's .drvdata field. ++ */ ++ mc->smmu = smmu; ++ + size = BITS_TO_LONGS(soc->num_asids) * sizeof(long); + + smmu->asids = devm_kzalloc(dev, size, GFP_KERNEL); +-- +2.30.1 + diff --git a/queue-5.11/iommu-vt-d-fix-status-code-for-allocate-free-pasid-c.patch b/queue-5.11/iommu-vt-d-fix-status-code-for-allocate-free-pasid-c.patch new file mode 100644 index 00000000000..f5a1304b58f --- /dev/null +++ b/queue-5.11/iommu-vt-d-fix-status-code-for-allocate-free-pasid-c.patch @@ -0,0 +1,45 @@ +From 9589abac0bc85616381a774cf8777245a33f4bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Feb 2021 15:39:09 +0800 +Subject: iommu/vt-d: Fix status code for Allocate/Free PASID command + +From: Zenghui Yu + +[ Upstream commit 444d66a23c1f1e4c4d12aed4812681d0ad835d60 ] + +As per Intel vt-d spec, Rev 3.0 (section 10.4.45 "Virtual Command Response +Register"), the status code of "No PASID available" error in response to +the Allocate PASID command is 2, not 1. The same for "Invalid PASID" error +in response to the Free PASID command. + +We will otherwise see confusing kernel log under the command failure from +guest side. Fix it. + +Fixes: 24f27d32ab6b ("iommu/vt-d: Enlightened PASID allocation") +Signed-off-by: Zenghui Yu +Acked-by: Lu Baolu +Link: https://lore.kernel.org/r/20210227073909.432-1-yuzenghui@huawei.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 97dfcffbf495..444c0bec221a 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -30,8 +30,8 @@ + #define VCMD_VRSP_IP 0x1 + #define VCMD_VRSP_SC(e) (((e) >> 1) & 0x3) + #define VCMD_VRSP_SC_SUCCESS 0 +-#define VCMD_VRSP_SC_NO_PASID_AVAIL 1 +-#define VCMD_VRSP_SC_INVALID_PASID 1 ++#define VCMD_VRSP_SC_NO_PASID_AVAIL 2 ++#define VCMD_VRSP_SC_INVALID_PASID 2 + #define VCMD_VRSP_RESULT_PASID(e) (((e) >> 8) & 0xfffff) + #define VCMD_CMD_OPERAND(e) ((e) << 8) + /* +-- +2.30.1 + diff --git a/queue-5.11/rdma-cm-fix-irq-restore-in-ib_send_cm_sidr_rep.patch b/queue-5.11/rdma-cm-fix-irq-restore-in-ib_send_cm_sidr_rep.patch new file mode 100644 index 00000000000..abdabdf9896 --- /dev/null +++ b/queue-5.11/rdma-cm-fix-irq-restore-in-ib_send_cm_sidr_rep.patch @@ -0,0 +1,84 @@ +From e0a096f4ba85b04ad35a3022f6069c2eac697a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Mar 2021 10:18:44 +0200 +Subject: RDMA/cm: Fix IRQ restore in ib_send_cm_sidr_rep + +From: Saeed Mahameed + +[ Upstream commit 221384df6123747d2a75517dd06cc01752f81518 ] + +ib_send_cm_sidr_rep() { + spin_lock_irqsave() + cm_send_sidr_rep_locked() { + ... + spin_lock_irq() + .... + spin_unlock_irq() <--- this will enable interrupts + } + spin_unlock_irqrestore() +} + +spin_unlock_irqrestore() expects interrupts to be disabled but the +internal spin_unlock_irq() will always enable hard interrupts. + +Fix this by replacing the internal spin_{lock,unlock}_irq() with +irqsave/restore variants. + +It fixes the following kernel trace: + + raw_local_irq_restore() called with IRQs enabled + WARNING: CPU: 2 PID: 20001 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20 + + Call Trace: + _raw_spin_unlock_irqrestore+0x4e/0x50 + ib_send_cm_sidr_rep+0x3a/0x50 [ib_cm] + cma_send_sidr_rep+0xa1/0x160 [rdma_cm] + rdma_accept+0x25e/0x350 [rdma_cm] + ucma_accept+0x132/0x1cc [rdma_ucm] + ucma_write+0xbf/0x140 [rdma_ucm] + vfs_write+0xc1/0x340 + ksys_write+0xb3/0xe0 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 87c4c774cbef ("RDMA/cm: Protect access to remote_sidr_table") +Link: https://lore.kernel.org/r/20210301081844.445823-1-leon@kernel.org +Signed-off-by: Saeed Mahameed +Reviewed-by: Jason Gunthorpe +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index be996dba040c..3d194bb60840 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3651,6 +3651,7 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + struct ib_cm_sidr_rep_param *param) + { + struct ib_mad_send_buf *msg; ++ unsigned long flags; + int ret; + + lockdep_assert_held(&cm_id_priv->lock); +@@ -3676,12 +3677,12 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + return ret; + } + cm_id_priv->id.state = IB_CM_IDLE; +- spin_lock_irq(&cm.lock); ++ spin_lock_irqsave(&cm.lock, flags); + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { + rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); + RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); + } +- spin_unlock_irq(&cm.lock); ++ spin_unlock_irqrestore(&cm.lock, flags); + return 0; + } + +-- +2.30.1 + diff --git a/queue-5.11/rdma-rxe-fix-missing-kconfig-dependency-on-crypto.patch b/queue-5.11/rdma-rxe-fix-missing-kconfig-dependency-on-crypto.patch new file mode 100644 index 00000000000..d56d41330b0 --- /dev/null +++ b/queue-5.11/rdma-rxe-fix-missing-kconfig-dependency-on-crypto.patch @@ -0,0 +1,44 @@ +From 5725698dfb492e121b18bea5c9ab4da2c4c6b921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 18:32:26 -0500 +Subject: RDMA/rxe: Fix missing kconfig dependency on CRYPTO + +From: Julian Braha + +[ Upstream commit 475f23b8c66d2892ad6acbf90ed757cafab13de7 ] + +When RDMA_RXE is enabled and CRYPTO is disabled, Kbuild gives the +following warning: + + WARNING: unmet direct dependencies detected for CRYPTO_CRC32 + Depends on [n]: CRYPTO [=n] + Selected by [y]: + - RDMA_RXE [=y] && (INFINIBAND_USER_ACCESS [=y] || !INFINIBAND_USER_ACCESS [=y]) && INET [=y] && PCI [=y] && INFINIBAND [=y] && INFINIBAND_VIRT_DMA [=y] + +This is because RDMA_RXE selects CRYPTO_CRC32, without depending on or +selecting CRYPTO, despite that config option being subordinate to CRYPTO. + +Fixes: cee2688e3cd6 ("IB/rxe: Offload CRC calculation when possible") +Signed-off-by: Julian Braha +Link: https://lore.kernel.org/r/21525878.NYvzQUHefP@ubuntu-mate-laptop +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig +index 452149066792..06b8dc5093f7 100644 +--- a/drivers/infiniband/sw/rxe/Kconfig ++++ b/drivers/infiniband/sw/rxe/Kconfig +@@ -4,6 +4,7 @@ config RDMA_RXE + depends on INET && PCI && INFINIBAND + depends on INFINIBAND_VIRT_DMA + select NET_UDP_TUNNEL ++ select CRYPTO + select CRYPTO_CRC32 + help + This driver implements the InfiniBand RDMA transport over +-- +2.30.1 + diff --git a/queue-5.11/rsxx-return-efault-if-copy_to_user-fails.patch b/queue-5.11/rsxx-return-efault-if-copy_to_user-fails.patch new file mode 100644 index 00000000000..e8890dfe607 --- /dev/null +++ b/queue-5.11/rsxx-return-efault-if-copy_to_user-fails.patch @@ -0,0 +1,50 @@ +From 03e984b46fc288d13964d61c6a4b93e18740839a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 13:59:12 +0300 +Subject: rsxx: Return -EFAULT if copy_to_user() fails + +From: Dan Carpenter + +[ Upstream commit 77516d25f54912a7baedeeac1b1b828b6f285152 ] + +The copy_to_user() function returns the number of bytes remaining but +we want to return -EFAULT to the user if it can't complete the copy. +The "st" variable only holds zero on success or negative error codes on +failure so the type should be int. + +Fixes: 36f988e978f8 ("rsxx: Adding in debugfs entries.") +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rsxx/core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 63f549889f87..5ac1881396af 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -165,15 +165,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf, + { + struct rsxx_cardinfo *card = file_inode(fp)->i_private; + char *buf; +- ssize_t st; ++ int st; + + buf = kzalloc(cnt, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1); +- if (!st) +- st = copy_to_user(ubuf, buf, cnt); ++ if (!st) { ++ if (copy_to_user(ubuf, buf, cnt)) ++ st = -EFAULT; ++ } + kfree(buf); + if (st) + return st; +-- +2.30.1 + diff --git a/queue-5.11/series b/queue-5.11/series index 503567ed937..5598408fd34 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -27,3 +27,16 @@ drm-amdgpu-disable-vcn-for-navi12-sku.patch drm-amdgpu-only-check-for-s0ix-if-amd_pmc-is-configured.patch drm-amdgpu-fix-parameter-error-of-rreg32_pcie-in-amdgpu_regs_pcie.patch crypto-shash-reduce-minimum-alignment-of-shash_desc-structure.patch +alsa-ctxfi-cthw20k2-fix-mask-on-conf-to-allow-4-bits.patch +alsa-usb-audio-fix-pioneer-djm-devices-urb_control-r.patch +rdma-cm-fix-irq-restore-in-ib_send_cm_sidr_rep.patch +rdma-rxe-fix-missing-kconfig-dependency-on-crypto.patch +ib-mlx5-add-missing-error-code.patch +alsa-hda-intel-nhlt-verify-config-type.patch +ftrace-have-recordmcount-use-w8-to-read-relp-r_info-.patch +ia64-don-t-call-handle_signal-unless-there-s-actuall.patch +rsxx-return-efault-if-copy_to_user-fails.patch +iommu-tegra-smmu-fix-mc-errors-on-tegra124-nyan.patch +iommu-don-t-use-lazy-flush-for-untrusted-device.patch +iommu-vt-d-fix-status-code-for-allocate-free-pasid-c.patch +btrfs-zoned-use-sector_t-for-zone-sectors.patch