From: Sasha Levin Date: Tue, 1 Oct 2019 17:13:38 +0000 (-0400) Subject: fixes for 4.9 X-Git-Tag: v4.4.195~63^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=06bb205eee6164cb714ac44b9939450cf02eacd6;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/acpi-cppc-do-not-require-the-_psd-method.patch b/queue-4.9/acpi-cppc-do-not-require-the-_psd-method.patch new file mode 100644 index 00000000000..2be751d0360 --- /dev/null +++ b/queue-4.9/acpi-cppc-do-not-require-the-_psd-method.patch @@ -0,0 +1,55 @@ +From 4e82860648f039239103b0ae197572db9f1ce17d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 18:21:20 -0600 +Subject: ACPI / CPPC: do not require the _PSD method + +From: Al Stone + +[ Upstream commit 4c4cdc4c63853fee48c02e25c8605fb65a6c9924 ] + +According to the ACPI 6.3 specification, the _PSD method is optional +when using CPPC. The underlying assumption is that each CPU can change +frequency independently from all other CPUs; _PSD is provided to tell +the OS that some processors can NOT do that. + +However, the acpi_get_psd() function returns ENODEV if there is no _PSD +method present, or an ACPI error status if an error occurs when evaluating +_PSD, if present. This makes _PSD mandatory when using CPPC, in violation +of the specification, and only on Linux. + +This has forced some firmware writers to provide a dummy _PSD, even though +it is irrelevant, but only because Linux requires it; other OSPMs follow +the spec. We really do not want to have OS specific ACPI tables, though. + +So, correct acpi_get_psd() so that it does not return an error if there +is no _PSD method present, but does return a failure when the method can +not be executed properly. This allows _PSD to be optional as it should +be. + +Signed-off-by: Al Stone +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index e0ea8f56d2bfd..9ec4618df5338 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -360,8 +360,10 @@ static int acpi_get_psd(struct cpc_desc *cpc_ptr, acpi_handle handle) + union acpi_object *psd = NULL; + struct acpi_psd_package *pdomain; + +- status = acpi_evaluate_object_typed(handle, "_PSD", NULL, &buffer, +- ACPI_TYPE_PACKAGE); ++ status = acpi_evaluate_object_typed(handle, "_PSD", NULL, ++ &buffer, ACPI_TYPE_PACKAGE); ++ if (status == AE_NOT_FOUND) /* _PSD is optional */ ++ return 0; + if (ACPI_FAILURE(status)) + return -ENODEV; + +-- +2.20.1 + diff --git a/queue-4.9/acpi-custom_method-fix-memory-leaks.patch b/queue-4.9/acpi-custom_method-fix-memory-leaks.patch new file mode 100644 index 00000000000..7f424b2eef4 --- /dev/null +++ b/queue-4.9/acpi-custom_method-fix-memory-leaks.patch @@ -0,0 +1,48 @@ +From fb95025183e660f8a8d0233a87dfc026f7f9de39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 00:08:27 -0500 +Subject: ACPI: custom_method: fix memory leaks + +From: Wenwen Wang + +[ Upstream commit 03d1571d9513369c17e6848476763ebbd10ec2cb ] + +In cm_write(), 'buf' is allocated through kzalloc(). In the following +execution, if an error occurs, 'buf' is not deallocated, leading to memory +leaks. To fix this issue, free 'buf' before returning the error. + +Fixes: 526b4af47f44 ("ACPI: Split out custom_method functionality into an own driver") +Signed-off-by: Wenwen Wang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/custom_method.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index c68e72414a67a..435bd0ffc8c02 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -48,8 +48,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + if ((*ppos > max_size) || + (*ppos + count > max_size) || + (*ppos + count < count) || +- (count > uncopied_bytes)) ++ (count > uncopied_bytes)) { ++ kfree(buf); + return -EINVAL; ++ } + + if (copy_from_user(buf + (*ppos), user_buf, count)) { + kfree(buf); +@@ -69,6 +71,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); + } + ++ kfree(buf); + return count; + } + +-- +2.20.1 + diff --git a/queue-4.9/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch b/queue-4.9/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch new file mode 100644 index 00000000000..e5f5f28006b --- /dev/null +++ b/queue-4.9/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch @@ -0,0 +1,41 @@ +From 908bc870560f6e6a3d4b0e548b7be834ca3d8a0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 22:44:19 -0500 +Subject: ACPI / PCI: fix acpi_pci_irq_enable() memory leak + +From: Wenwen Wang + +[ Upstream commit 29b49958cf73b439b17fa29e9a25210809a6c01c ] + +In acpi_pci_irq_enable(), 'entry' is allocated by kzalloc() in +acpi_pci_irq_check_entry() (invoked from acpi_pci_irq_lookup()). However, +it is not deallocated if acpi_pci_irq_valid() returns false, leading to a +memory leak. To fix this issue, free 'entry' before returning 0. + +Fixes: e237a5518425 ("x86/ACPI/PCI: Recognize that Interrupt Line 255 means "not connected"") +Signed-off-by: Wenwen Wang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_irq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c +index c576a6fe4ebb3..94ded9513c73b 100644 +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -462,8 +462,10 @@ int acpi_pci_irq_enable(struct pci_dev *dev) + * No IRQ known to the ACPI subsystem - maybe the BIOS / + * driver reported one, then use it. Exit in any case. + */ +- if (!acpi_pci_irq_valid(dev, pin)) ++ if (!acpi_pci_irq_valid(dev, pin)) { ++ kfree(entry); + return 0; ++ } + + if (acpi_isa_register_gsi(dev)) + dev_warn(&dev->dev, "PCI INT %c: no GSI\n", +-- +2.20.1 + diff --git a/queue-4.9/alsa-hda-flush-interrupts-on-disabling.patch b/queue-4.9/alsa-hda-flush-interrupts-on-disabling.patch new file mode 100644 index 00000000000..4787cef5635 --- /dev/null +++ b/queue-4.9/alsa-hda-flush-interrupts-on-disabling.patch @@ -0,0 +1,77 @@ +From 59f9a886bba5a42b8207b7d1ba81249a0f345a16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jul 2019 12:33:37 +0100 +Subject: ALSA: hda: Flush interrupts on disabling + +From: Chris Wilson + +[ Upstream commit caa8422d01e983782548648e125fd617cadcec3f ] + +I was looking at + +<4> [241.835158] general protection fault: 0000 [#1] PREEMPT SMP PTI +<4> [241.835181] CPU: 1 PID: 214 Comm: kworker/1:3 Tainted: G U 5.2.0-CI-CI_DRM_6509+ #1 +<4> [241.835199] Hardware name: Dell Inc. OptiPlex 745 /0GW726, BIOS 2.3.1 05/21/2007 +<4> [241.835234] Workqueue: events snd_hdac_bus_process_unsol_events [snd_hda_core] +<4> [241.835256] RIP: 0010:input_handle_event+0x16d/0x5e0 +<4> [241.835270] Code: 48 8b 93 58 01 00 00 8b 52 08 89 50 04 8b 83 f8 06 00 00 48 8b 93 00 07 00 00 8d 70 01 48 8d 04 c2 83 e1 08 89 b3 f8 06 00 00 <66> 89 28 66 44 89 60 02 44 89 68 04 8b 93 f8 06 00 00 0f 84 fd fe +<4> [241.835304] RSP: 0018:ffffc9000019fda0 EFLAGS: 00010046 +<4> [241.835317] RAX: 6b6b6b6ec6c6c6c3 RBX: ffff8880290fefc8 RCX: 0000000000000000 +<4> [241.835332] RDX: 000000006b6b6b6b RSI: 000000006b6b6b6c RDI: 0000000000000046 +<4> [241.835347] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000001 +<4> [241.835362] R10: ffffc9000019faa0 R11: 0000000000000000 R12: 0000000000000004 +<4> [241.835377] R13: 0000000000000000 R14: ffff8880290ff1d0 R15: 0000000000000293 +<4> [241.835392] FS: 0000000000000000(0000) GS:ffff88803de80000(0000) knlGS:0000000000000000 +<4> [241.835409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +<4> [241.835422] CR2: 00007ffe9a99e9b7 CR3: 000000002f588000 CR4: 00000000000006e0 +<4> [241.835436] Call Trace: +<4> [241.835449] input_event+0x45/0x70 +<4> [241.835464] snd_jack_report+0xdc/0x100 +<4> [241.835490] snd_hda_jack_report_sync+0x83/0xc0 [snd_hda_codec] +<4> [241.835512] snd_hdac_bus_process_unsol_events+0x5a/0x70 [snd_hda_core] +<4> [241.835530] process_one_work+0x245/0x610 + +which has the hallmarks of a worker queued from interrupt after it was +supposedly cancelled (note the POISON_FREE), and I could not see where +the interrupt would be flushed on shutdown so added the likely suspects. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111174 +Signed-off-by: Chris Wilson +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_controller.c | 2 ++ + sound/pci/hda/hda_intel.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c +index 00c6af2ae1c29..433f3280f7098 100644 +--- a/sound/hda/hdac_controller.c ++++ b/sound/hda/hdac_controller.c +@@ -441,6 +441,8 @@ static void azx_int_disable(struct hdac_bus *bus) + list_for_each_entry(azx_dev, &bus->stream_list, list) + snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); + ++ synchronize_irq(bus->irq); ++ + /* disable SIE for all streams */ + snd_hdac_chip_writeb(bus, INTCTL, 0); + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index f2f1d9fd848c8..3d4ea5fd75bf5 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1239,9 +1239,9 @@ static int azx_free(struct azx *chip) + } + + if (bus->chip_init) { ++ azx_stop_chip(chip); + azx_clear_irq_pending(chip); + azx_stop_all_streams(chip); +- azx_stop_chip(chip); + } + + if (bus->irq >= 0) +-- +2.20.1 + diff --git a/queue-4.9/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch b/queue-4.9/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch new file mode 100644 index 00000000000..150ea5749f8 --- /dev/null +++ b/queue-4.9/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch @@ -0,0 +1,37 @@ +From 3526d43c5613e7b37e43eb8da2f247b8e453e7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 09:58:07 +0200 +Subject: ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 + +From: Takashi Iwai + +[ Upstream commit 051c78af14fcd74a22b5af45548ad9d588247cc7 ] + +Lenovo ThinkCentre M73 and M93 don't seem to have a proper beep +although the driver tries to probe and set up blindly. +Blacklist these machines for suppressing the beep creation. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204635 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 31322aeebcff0..d45c85dcf9d9d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -969,6 +969,9 @@ static const struct snd_pci_quirk beep_white_list[] = { + SND_PCI_QUIRK(0x1043, 0x834a, "EeePC", 1), + SND_PCI_QUIRK(0x1458, 0xa002, "GA-MA790X", 1), + SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1), ++ /* blacklist -- no beep available */ ++ SND_PCI_QUIRK(0x17aa, 0x309e, "Lenovo ThinkCentre M73", 0), ++ SND_PCI_QUIRK(0x17aa, 0x30a3, "Lenovo ThinkCentre M93", 0), + {} + }; + +-- +2.20.1 + diff --git a/queue-4.9/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch b/queue-4.9/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch new file mode 100644 index 00000000000..ee602c805f3 --- /dev/null +++ b/queue-4.9/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch @@ -0,0 +1,44 @@ +From e15f58996a78f1873f2c7fdb6c871c15e48c86bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 11:42:34 +0200 +Subject: ALSA: hda - Show the fatal CORB/RIRB error more clearly + +From: Takashi Iwai + +[ Upstream commit dd65f7e19c6961ba6a69f7c925021b7a270cb950 ] + +The last fallback of CORB/RIRB communication error recovery is to turn +on the single command mode, and this last resort usually means that +something is really screwed up. Instead of a normal dev_err(), show +the error more clearly with dev_WARN() with the caller stack trace. + +Also, show the bus-reset fallback also as an error, too. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_controller.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index 85dbe2420248d..c5e82329348b3 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -866,10 +866,13 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, + */ + if (hbus->allow_bus_reset && !hbus->response_reset && !hbus->in_reset) { + hbus->response_reset = 1; ++ dev_err(chip->card->dev, ++ "No response from codec, resetting bus: last cmd=0x%08x\n", ++ bus->last_cmd[addr]); + return -EAGAIN; /* give a chance to retry */ + } + +- dev_err(chip->card->dev, ++ dev_WARN(chip->card->dev, + "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", + bus->last_cmd[addr]); + chip->single_cmd = 1; +-- +2.20.1 + diff --git a/queue-4.9/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch b/queue-4.9/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch new file mode 100644 index 00000000000..acf75482008 --- /dev/null +++ b/queue-4.9/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch @@ -0,0 +1,55 @@ +From e4ae12de86984b0d2e8c5eaf1bc287122ce99d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 10:14:42 +0800 +Subject: ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in + build_adc_controls() + +From: Jia-Ju Bai + +[ Upstream commit 2127c01b7f63b06a21559f56a8c81a3c6535bd1a ] + +In build_adc_controls(), there is an if statement on line 773 to check +whether ak->adc_info is NULL: + if (! ak->adc_info || + ! ak->adc_info[mixer_ch].switch_name) + +When ak->adc_info is NULL, it is used on line 792: + knew.name = ak->adc_info[mixer_ch].selector_name; + +Thus, a possible null-pointer dereference may occur. + +To fix this bug, referring to lines 773 and 774, ak->adc_info +and ak->adc_info[mixer_ch].selector_name are checked before being used. + +This bug is found by a static analysis tool STCheck written by us. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/i2c/other/ak4xxx-adda.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c +index bf377dc192aa7..d33e02c317129 100644 +--- a/sound/i2c/other/ak4xxx-adda.c ++++ b/sound/i2c/other/ak4xxx-adda.c +@@ -789,11 +789,12 @@ static int build_adc_controls(struct snd_akm4xxx *ak) + return err; + + memset(&knew, 0, sizeof(knew)); +- knew.name = ak->adc_info[mixer_ch].selector_name; +- if (!knew.name) { ++ if (!ak->adc_info || ++ !ak->adc_info[mixer_ch].selector_name) { + knew.name = "Capture Channel"; + knew.index = mixer_ch + ak->idx_offset * 2; +- } ++ } else ++ knew.name = ak->adc_info[mixer_ch].selector_name; + + knew.iface = SNDRV_CTL_ELEM_IFACE_MIXER; + knew.info = ak4xxx_capture_source_info; +-- +2.20.1 + diff --git a/queue-4.9/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch b/queue-4.9/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch new file mode 100644 index 00000000000..680c0bcca5e --- /dev/null +++ b/queue-4.9/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch @@ -0,0 +1,39 @@ +From a37b5c7271033c976d22122887d0a466def77d85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Aug 2019 13:52:14 +0200 +Subject: ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid + +From: Ard van Breemen + +[ Upstream commit 1b34121d9f26d272b0b2334209af6b6fc82d4bf1 ] + +The Linux kernel assumes that get_endpoint(alts,0) and +get_endpoint(alts,1) are eachothers feedback endpoints. +To reassure that validity it will test bsynchaddress to comply with that +assumption. But if the bsyncaddress is 0 (invalid), it will flag that as +a wrong assumption and return an error. +Fix: Skip the test if bSynchAddress is 0. +Note: those with a valid bSynchAddress should have a code quirck added. + +Signed-off-by: Ard van Breemen +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 497bad9f27898..9bc995f9b4e17 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -470,6 +470,7 @@ static int set_sync_endpoint(struct snd_usb_substream *subs, + } + ep = get_endpoint(alts, 1)->bEndpointAddress; + if (get_endpoint(alts, 0)->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE && ++ get_endpoint(alts, 0)->bSynchAddress != 0 && + ((is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress | USB_DIR_IN)) || + (!is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress & ~USB_DIR_IN)))) { + dev_err(&dev->dev, +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch b/queue-4.9/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch new file mode 100644 index 00000000000..87049d4402a --- /dev/null +++ b/queue-4.9/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch @@ -0,0 +1,60 @@ +From fcc16c9c1f522975b1bd88afd87b6cbb1c3e93c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 14:52:42 +0200 +Subject: ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks + +From: Marek Szyprowski + +[ Upstream commit 5b0eeeaa37615df37a9a30929b73e9defe61ca84 ] + +Commit aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply +for Peach boards") assigned LDO10 to Exynos Thermal Measurement Unit, +but it turned out that it supplies also some other critical parts and +board freezes/crashes when it is turned off. + +The mentioned commit made Exynos TMU a consumer of that regulator and in +typical case Exynos TMU driver keeps it enabled from early boot. However +there are such configurations (example is multi_v7_defconfig), in which +some of the regulators are compiled as modules and are not available +from early boot. In such case it may happen that LDO10 is turned off by +regulator core, because it has no consumers yet (in this case consumer +drivers cannot get it, because the supply regulators for it are not yet +available). This in turn causes the board to crash. This patch restores +'always-on' property for the LDO10 regulator. + +Fixes: aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply for Peach boards") +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420-peach-pit.dts | 1 + + arch/arm/boot/dts/exynos5800-peach-pi.dts | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts +index ec4a00f1ce01e..8b754ae8c8f7d 100644 +--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts ++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts +@@ -427,6 +427,7 @@ + regulator-name = "vdd_ldo10"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-state-mem { + regulator-off-in-suspend; + }; +diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts +index 01f466816fea7..1f90df2d7ecd8 100644 +--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts ++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts +@@ -427,6 +427,7 @@ + regulator-name = "vdd_ldo10"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-state-mem { + regulator-off-in-suspend; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch b/queue-4.9/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch new file mode 100644 index 00000000000..c8918df2091 --- /dev/null +++ b/queue-4.9/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch @@ -0,0 +1,79 @@ +From 4acf7a0871d13718f662c0fb2abaf3d9b1821cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 04:12:27 +0100 +Subject: ARM: dts: imx7d: cl-som-imx7: make ethernet work again +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Draszik + +[ Upstream commit 9846a4524ac90b63496580b7ad50674b40d92a8f ] + +Recent changes to the atheros at803x driver caused +ethernet to stop working on this board. +In particular commit 6d4cd041f0af +("net: phy: at803x: disable delay only for RGMII mode") +and commit cd28d1d6e52e +("net: phy: at803x: Disable phy delay for RGMII mode") +fix the AR8031 driver to configure the phy's (RX/TX) +delays as per the 'phy-mode' in the device tree. + +This now prevents ethernet from working on this board. + +It used to work before those commits, because the +AR8031 comes out of reset with RX delay enabled, and +the at803x driver didn't touch the delay configuration +at all when "rgmii" mode was selected, and because +arch/arm/mach-imx/mach-imx7d.c:ar8031_phy_fixup() +unconditionally enables TX delay. + +Since above commits ar8031_phy_fixup() also has no +effect anymore, and the end-result is that all delays +are disabled in the phy, no ethernet. + +Update the device tree to restore functionality. + +Signed-off-by: André Draszik +CC: Ilya Ledvich +CC: Igor Grinberg +CC: Rob Herring +CC: Mark Rutland +CC: Shawn Guo +CC: Sascha Hauer +CC: Pengutronix Kernel Team +CC: Fabio Estevam +CC: NXP Linux Team +CC: devicetree@vger.kernel.org +CC: linux-arm-kernel@lists.infradead.org +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7d-cl-som-imx7.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +index 2051306008534..72d1b8209f5e6 100644 +--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts ++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +@@ -43,7 +43,7 @@ + <&clks IMX7D_ENET1_TIME_ROOT_CLK>; + assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>; + assigned-clock-rates = <0>, <100000000>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <ðphy0>; + fsl,magic-packet; + status = "okay"; +@@ -69,7 +69,7 @@ + <&clks IMX7D_ENET2_TIME_ROOT_CLK>; + assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>; + assigned-clock-rates = <0>, <100000000>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <ðphy1>; + fsl,magic-packet; + status = "okay"; +-- +2.20.1 + diff --git a/queue-4.9/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch b/queue-4.9/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch new file mode 100644 index 00000000000..fe975ab7d36 --- /dev/null +++ b/queue-4.9/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch @@ -0,0 +1,61 @@ +From a8bfe63d62b8452d89dad8fa86d1e9db32fdb572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 18:12:57 +0100 +Subject: arm64: kpti: ensure patched kernel text is fetched from PoU + +From: Mark Rutland + +[ Upstream commit f32c7a8e45105bd0af76872bf6eef0438ff12fb2 ] + +While the MMUs is disabled, I-cache speculation can result in +instructions being fetched from the PoC. During boot we may patch +instructions (e.g. for alternatives and jump labels), and these may be +dirty at the PoU (and stale at the PoC). + +Thus, while the MMU is disabled in the KPTI pagetable fixup code we may +load stale instructions into the I-cache, potentially leading to +subsequent crashes when executing regions of code which have been +modified at runtime. + +Similarly to commit: + + 8ec41987436d566f ("arm64: mm: ensure patched kernel text is fetched from PoU") + +... we can invalidate the I-cache after enabling the MMU to prevent such +issues. + +The KPTI pagetable fixup code itself should be clean to the PoC per the +boot protocol, so no maintenance is required for this code. + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Reviewed-by: James Morse +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/proc.S | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 3ceec224d3d24..3b95e3126eebb 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -263,6 +263,15 @@ skip_pgd: + msr sctlr_el1, x18 + isb + ++ /* ++ * Invalidate the local I-cache so that any instructions fetched ++ * speculatively from the PoC are discarded, since they may have ++ * been dynamically patched at the PoU. ++ */ ++ ic iallu ++ dsb nsh ++ isb ++ + /* Set the flag to zero to indicate that we're all done */ + str wzr, [flag_ptr] + ret +-- +2.20.1 + diff --git a/queue-4.9/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch b/queue-4.9/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch new file mode 100644 index 00000000000..dc071064ab9 --- /dev/null +++ b/queue-4.9/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch @@ -0,0 +1,47 @@ +From a5f23584c2ee8d54a35bcd0a063d6e3bc5e93e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2019 08:55:24 +0300 +Subject: ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is + not set + +From: Peter Ujfalusi + +[ Upstream commit 2ec42f3147e1610716f184b02e65d7f493eed925 ] + +Some tools use the snd_pcm_info_get_name() to try to identify PCMs or for +other purposes. + +Currently it is left empty with the dmaengine-pcm, in this case copy the +pcm->id string as pcm->name. + +For example IGT is using this to find the HDMI PCM for testing audio on it. + +Signed-off-by: Peter Ujfalusi +Reported-by: Arthur She +Link: https://lore.kernel.org/r/20190906055524.7393-1-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-generic-dmaengine-pcm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 6cef3977507ae..67d22b4baeb05 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -312,6 +312,12 @@ static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd) + + if (!dmaengine_pcm_can_report_residue(dev, pcm->chan[i])) + pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE; ++ ++ if (rtd->pcm->streams[i].pcm->name[0] == '\0') { ++ strncpy(rtd->pcm->streams[i].pcm->name, ++ rtd->pcm->streams[i].pcm->id, ++ sizeof(rtd->pcm->streams[i].pcm->name)); ++ } + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.9/asoc-sgtl5000-fix-charge-pump-source-assignment.patch b/queue-4.9/asoc-sgtl5000-fix-charge-pump-source-assignment.patch new file mode 100644 index 00000000000..a091be5411e --- /dev/null +++ b/queue-4.9/asoc-sgtl5000-fix-charge-pump-source-assignment.patch @@ -0,0 +1,55 @@ +From 7658c8faeff3badf6a27420376d887857429fd16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 10:05:37 +0000 +Subject: ASoC: sgtl5000: Fix charge pump source assignment + +From: Oleksandr Suvorov + +[ Upstream commit b6319b061ba279577fd7030a9848fbd6a17151e3 ] + +If VDDA != VDDIO and any of them is greater than 3.1V, charge pump +source can be assigned automatically [1]. + +[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Marcel Ziswiler +Reviewed-by: Igor Opaniuk +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20190719100524.23300-7-oleksandr.suvorov@toradex.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 3dba5550a6659..d81ac4e499aab 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -987,12 +987,17 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) + SGTL5000_INT_OSC_EN); + /* Enable VDDC charge pump */ + ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; +- } else if (vddio >= 3100 && vdda >= 3100) { ++ } else { + ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; +- /* VDDC use VDDIO rail */ +- lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; +- lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << +- SGTL5000_VDDC_MAN_ASSN_SHIFT; ++ /* ++ * if vddio == vdda the source of charge pump should be ++ * assigned manually to VDDIO ++ */ ++ if (vddio == vdda) { ++ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; ++ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << ++ SGTL5000_VDDC_MAN_ASSN_SHIFT; ++ } + } + + snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL, lreg_ctrl); +-- +2.20.1 + diff --git a/queue-4.9/base-soc-export-soc_device_register-unregister-apis.patch b/queue-4.9/base-soc-export-soc_device_register-unregister-apis.patch new file mode 100644 index 00000000000..398c874124e --- /dev/null +++ b/queue-4.9/base-soc-export-soc_device_register-unregister-apis.patch @@ -0,0 +1,47 @@ +From 7e9ece374ee224bd79879a9c9eaf723d9652bcab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 04:05:12 +0530 +Subject: base: soc: Export soc_device_register/unregister APIs + +From: Vinod Koul + +[ Upstream commit f7ccc7a397cf2ef64aebb2f726970b93203858d2 ] + +Qcom Socinfo driver can be built as a module, so +export these two APIs. + +Tested-by: Vinod Koul +Signed-off-by: Vinod Koul +Signed-off-by: Vaishali Thakkar +Reviewed-by: Greg Kroah-Hartman +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/base/soc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/base/soc.c b/drivers/base/soc.c +index b63f23e6ad61b..ddb32c890fa6a 100644 +--- a/drivers/base/soc.c ++++ b/drivers/base/soc.c +@@ -145,6 +145,7 @@ struct soc_device *soc_device_register(struct soc_device_attribute *soc_dev_attr + out1: + return ERR_PTR(ret); + } ++EXPORT_SYMBOL_GPL(soc_device_register); + + /* Ensure soc_dev->attr is freed prior to calling soc_device_unregister. */ + void soc_device_unregister(struct soc_device *soc_dev) +@@ -153,6 +154,7 @@ void soc_device_unregister(struct soc_device *soc_dev) + + device_unregister(&soc_dev->dev); + } ++EXPORT_SYMBOL_GPL(soc_device_unregister); + + static int __init soc_bus_register(void) + { +-- +2.20.1 + diff --git a/queue-4.9/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch b/queue-4.9/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch new file mode 100644 index 00000000000..1b35a6fc488 --- /dev/null +++ b/queue-4.9/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch @@ -0,0 +1,115 @@ +From 8bfc4ac8b65970c0ade969516321025fec00f7f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2019 17:00:33 +0800 +Subject: btrfs: extent-tree: Make sure we only allocate extents from block + groups with the same type + +From: Qu Wenruo + +[ Upstream commit 2a28468e525f3924efed7f29f2bc5a2926e7e19a ] + +[BUG] +With fuzzed image and MIXED_GROUPS super flag, we can hit the following +BUG_ON(): + + kernel BUG at fs/btrfs/delayed-ref.c:491! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 0 PID: 1849 Comm: sync Tainted: G O 5.2.0-custom #27 + RIP: 0010:update_existing_head_ref.cold+0x44/0x46 [btrfs] + Call Trace: + add_delayed_ref_head+0x20c/0x2d0 [btrfs] + btrfs_add_delayed_tree_ref+0x1fc/0x490 [btrfs] + btrfs_free_tree_block+0x123/0x380 [btrfs] + __btrfs_cow_block+0x435/0x500 [btrfs] + btrfs_cow_block+0x110/0x240 [btrfs] + btrfs_search_slot+0x230/0xa00 [btrfs] + ? __lock_acquire+0x105e/0x1e20 + btrfs_insert_empty_items+0x67/0xc0 [btrfs] + alloc_reserved_file_extent+0x9e/0x340 [btrfs] + __btrfs_run_delayed_refs+0x78e/0x1240 [btrfs] + ? kvm_clock_read+0x18/0x30 + ? __sched_clock_gtod_offset+0x21/0x50 + btrfs_run_delayed_refs.part.0+0x4e/0x180 [btrfs] + btrfs_run_delayed_refs+0x23/0x30 [btrfs] + btrfs_commit_transaction+0x53/0x9f0 [btrfs] + btrfs_sync_fs+0x7c/0x1c0 [btrfs] + ? __ia32_sys_fdatasync+0x20/0x20 + sync_fs_one_sb+0x23/0x30 + iterate_supers+0x95/0x100 + ksys_sync+0x62/0xb0 + __ia32_sys_sync+0xe/0x20 + do_syscall_64+0x65/0x240 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +[CAUSE] +This situation is caused by several factors: +- Fuzzed image + The extent tree of this fs missed one backref for extent tree root. + So we can allocated space from that slot. + +- MIXED_BG feature + Super block has MIXED_BG flag. + +- No mixed block groups exists + All block groups are just regular ones. + +This makes data space_info->block_groups[] contains metadata block +groups. And when we reserve space for data, we can use space in +metadata block group. + +Then we hit the following file operations: + +- fallocate + We need to allocate data extents. + find_free_extent() choose to use the metadata block to allocate space + from, and choose the space of extent tree root, since its backref is + missing. + + This generate one delayed ref head with is_data = 1. + +- extent tree update + We need to update extent tree at run_delayed_ref time. + + This generate one delayed ref head with is_data = 0, for the same + bytenr of old extent tree root. + +Then we trigger the BUG_ON(). + +[FIX] +The quick fix here is to check block_group->flags before using it. + +The problem can only happen for MIXED_GROUPS fs. Regular filesystems +won't have space_info with DATA|METADATA flag, and no way to hit the +bug. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203255 +Reported-by: Jungyeon Yoon +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 7938c48c72ff0..f3a2512344743 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -7571,6 +7571,14 @@ static noinline int find_free_extent(struct btrfs_root *orig_root, + */ + if ((flags & extra) && !(block_group->flags & extra)) + goto loop; ++ ++ /* ++ * This block group has different flags than we want. ++ * It's possible that we have MIXED_GROUP flag but no ++ * block group is mixed. Just skip such block group. ++ */ ++ btrfs_release_block_group(block_group, delalloc); ++ continue; + } + + have_block_group: +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch b/queue-4.9/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch new file mode 100644 index 00000000000..c806b827307 --- /dev/null +++ b/queue-4.9/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch @@ -0,0 +1,39 @@ +From 4d7c6d9a8513923776492e877d10f8881a5e9fd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2019 19:15:18 +0200 +Subject: dmaengine: bcm2835: Print error in case setting DMA mask fails + +From: Stefan Wahren + +[ Upstream commit 72503b25ee363827aafffc3e8d872e6a92a7e422 ] + +During enabling of the RPi 4, we found out that the driver doesn't provide +a helpful error message in case setting DMA mask fails. So add one. + +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/1563297318-4900-1-git-send-email-wahrenst@gmx.net +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/bcm2835-dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c +index 6ba53bbd0e161..b984d00bc0558 100644 +--- a/drivers/dma/bcm2835-dma.c ++++ b/drivers/dma/bcm2835-dma.c +@@ -891,8 +891,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev) + pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask; + + rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); +- if (rc) ++ if (rc) { ++ dev_err(&pdev->dev, "Unable to set DMA mask\n"); + return rc; ++ } + + od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL); + if (!od) +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-iop-adma-use-correct-printk-format-strings.patch b/queue-4.9/dmaengine-iop-adma-use-correct-printk-format-strings.patch new file mode 100644 index 00000000000..46ff20a86e0 --- /dev/null +++ b/queue-4.9/dmaengine-iop-adma-use-correct-printk-format-strings.patch @@ -0,0 +1,108 @@ +From fd19f2675ea3adb0869d99f098bc2921d6296523 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 18:33:17 +0200 +Subject: dmaengine: iop-adma: use correct printk format strings + +From: Arnd Bergmann + +[ Upstream commit 00c9755524fbaa28117be774d7c92fddb5ca02f3 ] + +When compile-testing on other architectures, we get lots of warnings +about incorrect format strings, like: + + drivers/dma/iop-adma.c: In function 'iop_adma_alloc_slots': + drivers/dma/iop-adma.c:307:6: warning: format '%x' expects argument of type 'unsigned int', but argument 6 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=] + + drivers/dma/iop-adma.c: In function 'iop_adma_prep_dma_memcpy': +>> drivers/dma/iop-adma.c:518:40: warning: format '%u' expects argument of type 'unsigned int', but argument 5 has type 'size_t {aka long unsigned int}' [-Wformat=] + +Use %zu for printing size_t as required, and cast the dma_addr_t +arguments to 'u64' for printing with %llx. Ideally this should use +the %pad format string, but that requires an lvalue argument that +doesn't work here. + +Link: https://lore.kernel.org/r/20190809163334.489360-3-arnd@arndb.de +Signed-off-by: Arnd Bergmann +Acked-by: Vinod Koul +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/dma/iop-adma.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c +index a410657f7bcd6..012584cf3c17b 100644 +--- a/drivers/dma/iop-adma.c ++++ b/drivers/dma/iop-adma.c +@@ -125,9 +125,9 @@ static void __iop_adma_slot_cleanup(struct iop_adma_chan *iop_chan) + list_for_each_entry_safe(iter, _iter, &iop_chan->chain, + chain_node) { + pr_debug("\tcookie: %d slot: %d busy: %d " +- "this_desc: %#x next_desc: %#x ack: %d\n", ++ "this_desc: %#x next_desc: %#llx ack: %d\n", + iter->async_tx.cookie, iter->idx, busy, +- iter->async_tx.phys, iop_desc_get_next_desc(iter), ++ iter->async_tx.phys, (u64)iop_desc_get_next_desc(iter), + async_tx_test_ack(&iter->async_tx)); + prefetch(_iter); + prefetch(&_iter->async_tx); +@@ -315,9 +315,9 @@ iop_adma_alloc_slots(struct iop_adma_chan *iop_chan, int num_slots, + int i; + dev_dbg(iop_chan->device->common.dev, + "allocated slot: %d " +- "(desc %p phys: %#x) slots_per_op %d\n", ++ "(desc %p phys: %#llx) slots_per_op %d\n", + iter->idx, iter->hw_desc, +- iter->async_tx.phys, slots_per_op); ++ (u64)iter->async_tx.phys, slots_per_op); + + /* pre-ack all but the last descriptor */ + if (num_slots != slots_per_op) +@@ -525,7 +525,7 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest, + return NULL; + BUG_ON(len > IOP_ADMA_MAX_BYTE_COUNT); + +- dev_dbg(iop_chan->device->common.dev, "%s len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s len: %zu\n", + __func__, len); + + spin_lock_bh(&iop_chan->lock); +@@ -558,7 +558,7 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest, + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + + dev_dbg(iop_chan->device->common.dev, +- "%s src_cnt: %d len: %u flags: %lx\n", ++ "%s src_cnt: %d len: %zu flags: %lx\n", + __func__, src_cnt, len, flags); + + spin_lock_bh(&iop_chan->lock); +@@ -591,7 +591,7 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src, + if (unlikely(!len)) + return NULL; + +- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", + __func__, src_cnt, len); + + spin_lock_bh(&iop_chan->lock); +@@ -629,7 +629,7 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src, + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + + dev_dbg(iop_chan->device->common.dev, +- "%s src_cnt: %d len: %u flags: %lx\n", ++ "%s src_cnt: %d len: %zu flags: %lx\n", + __func__, src_cnt, len, flags); + + if (dmaf_p_disabled_continue(flags)) +@@ -692,7 +692,7 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src, + return NULL; + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + +- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", + __func__, src_cnt, len); + + spin_lock_bh(&iop_chan->lock); +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch b/queue-4.9/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch new file mode 100644 index 00000000000..518e1d7fbaf --- /dev/null +++ b/queue-4.9/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch @@ -0,0 +1,50 @@ +From d6fd90b756d94c15bb9344416366d633cc29b222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2019 15:56:14 +0300 +Subject: dmaengine: ti: edma: Do not reset reserved paRAM slots + +From: Peter Ujfalusi + +[ Upstream commit c5dbe60664b3660f5ac5854e21273ea2e7ff698f ] + +Skip resetting paRAM slots marked as reserved as they might be used by +other cores. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20190823125618.8133-2-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/edma.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c +index 57962bff75324..72f31e837b1d5 100644 +--- a/drivers/dma/edma.c ++++ b/drivers/dma/edma.c +@@ -2268,9 +2268,6 @@ static int edma_probe(struct platform_device *pdev) + + ecc->default_queue = info->default_queue; + +- for (i = 0; i < ecc->num_slots; i++) +- edma_write_slot(ecc, i, &dummy_paramset); +- + if (info->rsv) { + /* Set the reserved slots in inuse list */ + rsv_slots = info->rsv->rsv_slots; +@@ -2283,6 +2280,12 @@ static int edma_probe(struct platform_device *pdev) + } + } + ++ for (i = 0; i < ecc->num_slots; i++) { ++ /* Reset only unused - not reserved - paRAM slots */ ++ if (!test_bit(i, ecc->slot_inuse)) ++ edma_write_slot(ecc, i, &dummy_paramset); ++ } ++ + /* Clear the xbar mapped channels in unused list */ + xbar_chans = info->xbar_chans; + if (xbar_chans) { +-- +2.20.1 + diff --git a/queue-4.9/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch b/queue-4.9/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch new file mode 100644 index 00000000000..baa67031b7d --- /dev/null +++ b/queue-4.9/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch @@ -0,0 +1,41 @@ +From b38096bab1f264e185cb3b81ed3582f237cc3f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 21:14:18 +0200 +Subject: drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) + +From: Ahzo + +[ Upstream commit f659bb6dae58c113805f92822e4c16ddd3156b79 ] + +This fixes screen corruption/flickering on 75 Hz displays. + +v2: make print statement debug only (Alex) + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102646 +Reviewed-by: Evan Quan +Signed-off-by: Ahzo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index 3907439417e76..c0db3b57dfe58 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -3739,6 +3739,11 @@ int smu7_program_display_gap(struct pp_hwmgr *hwmgr) + + data->frame_time_x2 = frame_time_in_us * 2 / 100; + ++ if (data->frame_time_x2 < 280) { ++ pr_debug("%s: enforce minimal VBITimeout: %d -> 280\n", __func__, data->frame_time_x2); ++ data->frame_time_x2 = 280; ++ } ++ + display_gap2 = pre_vbi_time_in_us * (ref_clock / 100); + + cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2); +-- +2.20.1 + diff --git a/queue-4.9/e1000e-add-workaround-for-possible-stalled-packet.patch b/queue-4.9/e1000e-add-workaround-for-possible-stalled-packet.patch new file mode 100644 index 00000000000..56883a09fcc --- /dev/null +++ b/queue-4.9/e1000e-add-workaround-for-possible-stalled-packet.patch @@ -0,0 +1,61 @@ +From c00934fac3b03c7e83900573f740e2928d497462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2019 12:55:45 +0800 +Subject: e1000e: add workaround for possible stalled packet + +From: Kai-Heng Feng + +[ Upstream commit e5e9a2ecfe780975820e157b922edee715710b66 ] + +This works around a possible stalled packet issue, which may occur due to +clock recovery from the PCH being too slow, when the LAN is transitioning +from K1 at 1G link speed. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204057 + +Signed-off-by: Kai-Heng Feng +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 10 ++++++++++ + drivers/net/ethernet/intel/e1000e/ich8lan.h | 2 +- + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index dc7d671b903c5..625008e8cb0df 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1447,6 +1447,16 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + else + phy_reg |= 0xFA; + e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg); ++ ++ if (speed == SPEED_1000) { ++ hw->phy.ops.read_reg_locked(hw, HV_PM_CTRL, ++ &phy_reg); ++ ++ phy_reg |= HV_PM_CTRL_K1_CLK_REQ; ++ ++ hw->phy.ops.write_reg_locked(hw, HV_PM_CTRL, ++ phy_reg); ++ } + } + hw->phy.ops.release(hw); + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 67163ca898ba2..6374c8fc76a8d 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -227,7 +227,7 @@ + + /* PHY Power Management Control */ + #define HV_PM_CTRL PHY_REG(770, 17) +-#define HV_PM_CTRL_PLL_STOP_IN_K1_GIGA 0x100 ++#define HV_PM_CTRL_K1_CLK_REQ 0x200 + #define HV_PM_CTRL_K1_ENABLE 0x4000 + + #define I217_PLL_CLOCK_GATE_REG PHY_REG(772, 28) +-- +2.20.1 + diff --git a/queue-4.9/edac-altera-use-the-proper-type-for-the-irq-status-b.patch b/queue-4.9/edac-altera-use-the-proper-type-for-the-irq-status-b.patch new file mode 100644 index 00000000000..82193ab6bd1 --- /dev/null +++ b/queue-4.9/edac-altera-use-the-proper-type-for-the-irq-status-b.patch @@ -0,0 +1,59 @@ +From be82d62c3c6d13b5ef887e5792d6cdfc7bcfa9ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2019 16:47:17 +0300 +Subject: EDAC/altera: Use the proper type for the IRQ status bits + +From: Dan Carpenter + +[ Upstream commit 8faa1cf6ed82f33009f63986c3776cc48af1b7b2 ] + +Smatch complains about the cast of a u32 pointer to unsigned long: + + drivers/edac/altera_edac.c:1878 altr_edac_a10_irq_handler() + warn: passing casted pointer '&irq_status' to 'find_first_bit()' + +This code wouldn't work on a 64 bit big endian system because it would +read past the end of &irq_status. + + [ bp: massage. ] + +Fixes: 13ab8448d2c9 ("EDAC, altera: Add ECC Manager IRQ controller support") +Signed-off-by: Dan Carpenter +Signed-off-by: Borislav Petkov +Reviewed-by: Thor Thayer +Cc: James Morse +Cc: kernel-janitors@vger.kernel.org +Cc: linux-edac +Cc: Mauro Carvalho Chehab +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20190624134717.GA1754@mwanda +Signed-off-by: Sasha Levin +--- + drivers/edac/altera_edac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c +index b0bd0f64d8f21..6037efa94c9ba 100644 +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1651,6 +1651,7 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc) + struct altr_arria10_edac *edac = irq_desc_get_handler_data(desc); + struct irq_chip *chip = irq_desc_get_chip(desc); + int irq = irq_desc_get_irq(desc); ++ unsigned long bits; + + dberr = (irq == edac->db_irq) ? 1 : 0; + sm_offset = dberr ? A10_SYSMGR_ECC_INTSTAT_DERR_OFST : +@@ -1660,7 +1661,8 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc) + + regmap_read(edac->ecc_mgr_map, sm_offset, &irq_status); + +- for_each_set_bit(bit, (unsigned long *)&irq_status, 32) { ++ bits = irq_status; ++ for_each_set_bit(bit, &bits, 32) { + irq = irq_linear_revmap(edac->domain, dberr * 32 + bit); + if (irq) + generic_handle_irq(irq); +-- +2.20.1 + diff --git a/queue-4.9/efi-cper-print-aer-info-of-pcie-fatal-error.patch b/queue-4.9/efi-cper-print-aer-info-of-pcie-fatal-error.patch new file mode 100644 index 00000000000..8dabfc29e62 --- /dev/null +++ b/queue-4.9/efi-cper-print-aer-info-of-pcie-fatal-error.patch @@ -0,0 +1,89 @@ +From 8a3c1a5b0a1c4cbd53a02f3325a587f6f2435eb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 09:43:37 +0800 +Subject: efi: cper: print AER info of PCIe fatal error + +From: Xiaofei Tan + +[ Upstream commit b194a77fcc4001dc40aecdd15d249648e8a436d1 ] + +AER info of PCIe fatal error is not printed in the current driver. +Because APEI driver will panic directly for fatal error, and can't +run to the place of printing AER info. + +An example log is as following: +{763}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 11 +{763}[Hardware Error]: event severity: fatal +{763}[Hardware Error]: Error 0, type: fatal +{763}[Hardware Error]: section_type: PCIe error +{763}[Hardware Error]: port_type: 0, PCIe end point +{763}[Hardware Error]: version: 4.0 +{763}[Hardware Error]: command: 0x0000, status: 0x0010 +{763}[Hardware Error]: device_id: 0000:82:00.0 +{763}[Hardware Error]: slot: 0 +{763}[Hardware Error]: secondary_bus: 0x00 +{763}[Hardware Error]: vendor_id: 0x8086, device_id: 0x10fb +{763}[Hardware Error]: class_code: 000002 +Kernel panic - not syncing: Fatal hardware error! + +This issue was imported by the patch, '37448adfc7ce ("aerdrv: Move +cper_print_aer() call out of interrupt context")'. To fix this issue, +this patch adds print of AER info in cper_print_pcie() for fatal error. + +Here is the example log after this patch applied: +{24}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 10 +{24}[Hardware Error]: event severity: fatal +{24}[Hardware Error]: Error 0, type: fatal +{24}[Hardware Error]: section_type: PCIe error +{24}[Hardware Error]: port_type: 0, PCIe end point +{24}[Hardware Error]: version: 4.0 +{24}[Hardware Error]: command: 0x0546, status: 0x4010 +{24}[Hardware Error]: device_id: 0000:01:00.0 +{24}[Hardware Error]: slot: 0 +{24}[Hardware Error]: secondary_bus: 0x00 +{24}[Hardware Error]: vendor_id: 0x15b3, device_id: 0x1019 +{24}[Hardware Error]: class_code: 000002 +{24}[Hardware Error]: aer_uncor_status: 0x00040000, aer_uncor_mask: 0x00000000 +{24}[Hardware Error]: aer_uncor_severity: 0x00062010 +{24}[Hardware Error]: TLP Header: 000000c0 01010000 00000001 00000000 +Kernel panic - not syncing: Fatal hardware error! + +Fixes: 37448adfc7ce ("aerdrv: Move cper_print_aer() call out of interrupt context") +Signed-off-by: Xiaofei Tan +Reviewed-by: James Morse +[ardb: put parens around terms of && operator] +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index d425374254384..f40f7df4b7344 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -384,6 +384,21 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie, + printk( + "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n", + pfx, pcie->bridge.secondary_status, pcie->bridge.control); ++ ++ /* Fatal errors call __ghes_panic() before AER handler prints this */ ++ if ((pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) && ++ (gdata->error_severity & CPER_SEV_FATAL)) { ++ struct aer_capability_regs *aer; ++ ++ aer = (struct aer_capability_regs *)pcie->aer_info; ++ printk("%saer_uncor_status: 0x%08x, aer_uncor_mask: 0x%08x\n", ++ pfx, aer->uncor_status, aer->uncor_mask); ++ printk("%saer_uncor_severity: 0x%08x\n", ++ pfx, aer->uncor_severity); ++ printk("%sTLP Header: %08x %08x %08x %08x\n", pfx, ++ aer->header_log.dw0, aer->header_log.dw1, ++ aer->header_log.dw2, aer->header_log.dw3); ++ } + } + + static void cper_estatus_print_section( +-- +2.20.1 + diff --git a/queue-4.9/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch b/queue-4.9/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch new file mode 100644 index 00000000000..af50326bfff --- /dev/null +++ b/queue-4.9/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch @@ -0,0 +1,51 @@ +From ea75b006361c28257e1f754d933de13d01fd3c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:01:10 +0300 +Subject: hwmon: (acpi_power_meter) Change log level for 'unsafe software power + cap' + +From: Wang Shenran + +[ Upstream commit 6e4d91aa071810deac2cd052161aefb376ecf04e ] + +At boot time, the acpi_power_meter driver logs the following error level +message: "Ignoring unsafe software power cap". Having read about it from +a few sources, it seems that the error message can be quite misleading. + +While the message can imply that Linux is ignoring the fact that the +system is operating in potentially dangerous conditions, the truth is +the driver found an ACPI_PMC object that supports software power +capping. The driver simply decides not to use it, perhaps because it +doesn't support the object. + +The best solution is probably changing the log level from error to warning. +All sources I have found, regarding the error, have downplayed its +significance. There is not much of a reason for it to be on error level, +while causing potential confusions or misinterpretations. + +Signed-off-by: Wang Shenran +Link: https://lore.kernel.org/r/20190724080110.6952-1-shenran268@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/acpi_power_meter.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c +index 579bdf93be433..e27f7e12c05bb 100644 +--- a/drivers/hwmon/acpi_power_meter.c ++++ b/drivers/hwmon/acpi_power_meter.c +@@ -693,8 +693,8 @@ static int setup_attrs(struct acpi_power_meter_resource *resource) + + if (resource->caps.flags & POWER_METER_CAN_CAP) { + if (!can_cap_in_hardware()) { +- dev_err(&resource->acpi_dev->dev, +- "Ignoring unsafe software power cap!\n"); ++ dev_warn(&resource->acpi_dev->dev, ++ "Ignoring unsafe software power cap!\n"); + goto skip_unsafe_cap; + } + +-- +2.20.1 + diff --git a/queue-4.9/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch b/queue-4.9/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch new file mode 100644 index 00000000000..2593dd5bcca --- /dev/null +++ b/queue-4.9/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch @@ -0,0 +1,54 @@ +From 595096f26d592f7a5efd934ee6fcd83e923d9343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2019 15:46:33 +0800 +Subject: ia64:unwind: fix double free for mod->arch.init_unw_table + +From: chenzefeng + +[ Upstream commit c5e5c48c16422521d363c33cfb0dcf58f88c119b ] + +The function free_module in file kernel/module.c as follow: + +void free_module(struct module *mod) { + ...... + module_arch_cleanup(mod); + ...... + module_arch_freeing_init(mod); + ...... +} + +Both module_arch_cleanup and module_arch_freeing_init function +would free the mod->arch.init_unw_table, which cause double free. + +Here, set mod->arch.init_unw_table = NULL after remove the unwind +table to avoid double free. + +Signed-off-by: chenzefeng +Signed-off-by: Tony Luck +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/module.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c +index d1d945c6bd05f..9fe114620b9d6 100644 +--- a/arch/ia64/kernel/module.c ++++ b/arch/ia64/kernel/module.c +@@ -912,8 +912,12 @@ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mo + void + module_arch_cleanup (struct module *mod) + { +- if (mod->arch.init_unw_table) ++ if (mod->arch.init_unw_table) { + unw_remove_unwind_table(mod->arch.init_unw_table); +- if (mod->arch.core_unw_table) ++ mod->arch.init_unw_table = NULL; ++ } ++ if (mod->arch.core_unw_table) { + unw_remove_unwind_table(mod->arch.core_unw_table); ++ mod->arch.core_unw_table = NULL; ++ } + } +-- +2.20.1 + diff --git a/queue-4.9/iommu-amd-silence-warnings-under-memory-pressure.patch b/queue-4.9/iommu-amd-silence-warnings-under-memory-pressure.patch new file mode 100644 index 00000000000..9ed5b851285 --- /dev/null +++ b/queue-4.9/iommu-amd-silence-warnings-under-memory-pressure.patch @@ -0,0 +1,64 @@ +From 0fb5d35710faee188445bcc3ee07d23a4714f60b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 17:39:43 -0400 +Subject: iommu/amd: Silence warnings under memory pressure + +From: Qian Cai + +[ Upstream commit 3d708895325b78506e8daf00ef31549476e8586a ] + +When running heavy memory pressure workloads, the system is throwing +endless warnings, + +smartpqi 0000:23:00.0: AMD-Vi: IOMMU mapping error in map_sg (io-pages: +5 reason: -12) +Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 +07/10/2019 +swapper/10: page allocation failure: order:0, mode:0xa20(GFP_ATOMIC), +nodemask=(null),cpuset=/,mems_allowed=0,4 +Call Trace: + + dump_stack+0x62/0x9a + warn_alloc.cold.43+0x8a/0x148 + __alloc_pages_nodemask+0x1a5c/0x1bb0 + get_zeroed_page+0x16/0x20 + iommu_map_page+0x477/0x540 + map_sg+0x1ce/0x2f0 + scsi_dma_map+0xc6/0x160 + pqi_raid_submit_scsi_cmd_with_io_request+0x1c3/0x470 [smartpqi] + do_IRQ+0x81/0x170 + common_interrupt+0xf/0xf + + +because the allocation could fail from iommu_map_page(), and the volume +of this call could be huge which may generate a lot of serial console +output and cosumes all CPUs. + +Fix it by silencing the warning in this call site, and there is still a +dev_err() later to notify the failure. + +Signed-off-by: Qian Cai +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index dd7880de7e4e9..e81acb2b6ee7d 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2595,7 +2595,9 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, + + bus_addr = address + s->dma_address + (j << PAGE_SHIFT); + phys_addr = (sg_phys(s) & PAGE_MASK) + (j << PAGE_SHIFT); +- ret = iommu_map_page(domain, bus_addr, phys_addr, PAGE_SIZE, prot, GFP_ATOMIC); ++ ret = iommu_map_page(domain, bus_addr, phys_addr, ++ PAGE_SIZE, prot, ++ GFP_ATOMIC | __GFP_NOWARN); + if (ret) + goto out_unmap; + +-- +2.20.1 + diff --git a/queue-4.9/kprobes-prohibit-probing-on-bug-and-warn-address.patch b/queue-4.9/kprobes-prohibit-probing-on-bug-and-warn-address.patch new file mode 100644 index 00000000000..35c6dd50da4 --- /dev/null +++ b/queue-4.9/kprobes-prohibit-probing-on-bug-and-warn-address.patch @@ -0,0 +1,70 @@ +From 9049797beb49b6154f7319514d8698ae7dbe6c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 20:08:21 +0900 +Subject: kprobes: Prohibit probing on BUG() and WARN() address + +From: Masami Hiramatsu + +[ Upstream commit e336b4027775cb458dc713745e526fa1a1996b2a ] + +Since BUG() and WARN() may use a trap (e.g. UD2 on x86) to +get the address where the BUG() has occurred, kprobes can not +do single-step out-of-line that instruction. So prohibit +probing on such address. + +Without this fix, if someone put a kprobe on WARN(), the +kernel will crash with invalid opcode error instead of +outputing warning message, because kernel can not find +correct bug address. + +Signed-off-by: Masami Hiramatsu +Acked-by: Steven Rostedt (VMware) +Acked-by: Naveen N. Rao +Cc: Anil S Keshavamurthy +Cc: David S . Miller +Cc: Linus Torvalds +Cc: Naveen N . Rao +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/156750890133.19112.3393666300746167111.stgit@devnote2 +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + include/linux/bug.h | 5 +++++ + kernel/kprobes.c | 3 ++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/bug.h b/include/linux/bug.h +index 292d6a10b0c26..0faae96302bda 100644 +--- a/include/linux/bug.h ++++ b/include/linux/bug.h +@@ -114,6 +114,11 @@ int is_valid_bugaddr(unsigned long addr); + + #else /* !CONFIG_GENERIC_BUG */ + ++static inline void *find_bug(unsigned long bugaddr) ++{ ++ return NULL; ++} ++ + static inline enum bug_trap_type report_bug(unsigned long bug_addr, + struct pt_regs *regs) + { +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index e2845dd53b30b..11863e2b01c25 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1454,7 +1454,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + /* Ensure it is not in reserved area nor out of text */ + if (!kernel_text_address((unsigned long) p->addr) || + within_kprobe_blacklist((unsigned long) p->addr) || +- jump_label_text_reserved(p->addr, p->addr)) { ++ jump_label_text_reserved(p->addr, p->addr) || ++ find_bug((unsigned long)p->addr)) { + ret = -EINVAL; + goto out; + } +-- +2.20.1 + diff --git a/queue-4.9/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch b/queue-4.9/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch new file mode 100644 index 00000000000..4c0ad6d28f5 --- /dev/null +++ b/queue-4.9/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch @@ -0,0 +1,43 @@ +From 355f4250fbfe576b70c50bc3ca74ccd1a01bea7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2019 14:56:06 -0700 +Subject: leds: leds-lp5562 allow firmware files up to the maximum length + +From: Nick Stoughton + +[ Upstream commit ed2abfebb041473092b41527903f93390d38afa7 ] + +Firmware files are in ASCII, using 2 hex characters per byte. The +maximum length of a firmware string is therefore + +16 (commands) * 2 (bytes per command) * 2 (characters per byte) = 64 + +Fixes: ff45262a85db ("leds: add new LP5562 LED driver") +Signed-off-by: Nick Stoughton +Acked-by: Pavel Machek +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp5562.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c +index b75333803a637..9f5e4d04efad5 100644 +--- a/drivers/leds/leds-lp5562.c ++++ b/drivers/leds/leds-lp5562.c +@@ -263,7 +263,11 @@ static void lp5562_firmware_loaded(struct lp55xx_chip *chip) + { + const struct firmware *fw = chip->fw; + +- if (fw->size > LP5562_PROGRAM_LENGTH) { ++ /* ++ * the firmware is encoded in ascii hex character, with 2 chars ++ * per byte ++ */ ++ if (fw->size > (LP5562_PROGRAM_LENGTH * 2)) { + dev_err(&chip->cl->dev, "firmware data size overflow: %zu\n", + fw->size); + return; +-- +2.20.1 + diff --git a/queue-4.9/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch b/queue-4.9/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch new file mode 100644 index 00000000000..4a6eda2b7ab --- /dev/null +++ b/queue-4.9/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch @@ -0,0 +1,36 @@ +From fba70ba282d502de4316cdcad25461b2c4fafd55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2019 13:31:38 +0000 +Subject: libertas: Add missing sentinel at end of if_usb.c fw_table + +From: Kevin Easton + +[ Upstream commit 764f3f1ecffc434096e0a2b02f1a6cc964a89df6 ] + +This sentinel tells the firmware loading process when to stop. + +Reported-and-tested-by: syzbot+98156c174c5a2cad9f8f@syzkaller.appspotmail.com +Signed-off-by: Kevin Easton +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index a605d569f663a..9d147b11ee516 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -49,7 +49,8 @@ static const struct lbs_fw_table fw_table[] = { + { MODEL_8388, "libertas/usb8388_v5.bin", NULL }, + { MODEL_8388, "libertas/usb8388.bin", NULL }, + { MODEL_8388, "usb8388.bin", NULL }, +- { MODEL_8682, "libertas/usb8682.bin", NULL } ++ { MODEL_8682, "libertas/usb8682.bin", NULL }, ++ { 0, NULL, NULL } + }; + + static struct usb_device_id if_usb_table[] = { +-- +2.20.1 + diff --git a/queue-4.9/libtraceevent-change-users-plugin-directory.patch b/queue-4.9/libtraceevent-change-users-plugin-directory.patch new file mode 100644 index 00000000000..19b243c35a6 --- /dev/null +++ b/queue-4.9/libtraceevent-change-users-plugin-directory.patch @@ -0,0 +1,70 @@ +From e329a456940ffbbaef403e5b3bbc0889d496a4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 16:43:15 -0400 +Subject: libtraceevent: Change users plugin directory + +From: Tzvetomir Stoyanov + +[ Upstream commit e97fd1383cd77c467d2aed7fa4e596789df83977 ] + +To be compliant with XDG user directory layout, the user's plugin +directory is changed from ~/.traceevent/plugins to +~/.local/lib/traceevent/plugins/ + +Suggested-by: Patrick McLean +Signed-off-by: Tzvetomir Stoyanov +Cc: Andrew Morton +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Patrick McLean +Cc: linux-trace-devel@vger.kernel.org +Link: https://lore.kernel.org/linux-trace-devel/20190313144206.41e75cf8@patrickm/ +Link: http://lore.kernel.org/linux-trace-devel/20190801074959.22023-4-tz.stoyanov@gmail.com +Link: http://lore.kernel.org/lkml/20190805204355.344622683@goodmis.org +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/traceevent/Makefile | 6 +++--- + tools/lib/traceevent/event-plugin.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile +index 7851df1490e0a..cc3315da6dc39 100644 +--- a/tools/lib/traceevent/Makefile ++++ b/tools/lib/traceevent/Makefile +@@ -54,15 +54,15 @@ set_plugin_dir := 1 + + # Set plugin_dir to preffered global plugin location + # If we install under $HOME directory we go under +-# $(HOME)/.traceevent/plugins ++# $(HOME)/.local/lib/traceevent/plugins + # + # We dont set PLUGIN_DIR in case we install under $HOME + # directory, because by default the code looks under: +-# $(HOME)/.traceevent/plugins by default. ++# $(HOME)/.local/lib/traceevent/plugins by default. + # + ifeq ($(plugin_dir),) + ifeq ($(prefix),$(HOME)) +-override plugin_dir = $(HOME)/.traceevent/plugins ++override plugin_dir = $(HOME)/.local/lib/traceevent/plugins + set_plugin_dir := 0 + else + override plugin_dir = $(libdir)/traceevent/plugins +diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c +index a16756ae35267..5fe7889606a23 100644 +--- a/tools/lib/traceevent/event-plugin.c ++++ b/tools/lib/traceevent/event-plugin.c +@@ -30,7 +30,7 @@ + #include "event-parse.h" + #include "event-utils.h" + +-#define LOCAL_PLUGIN_DIR ".traceevent/plugins" ++#define LOCAL_PLUGIN_DIR ".local/lib/traceevent/plugins/" + + static struct registered_plugin_options { + struct registered_plugin_options *next; +-- +2.20.1 + diff --git a/queue-4.9/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch b/queue-4.9/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch new file mode 100644 index 00000000000..9f7fb2b8c09 --- /dev/null +++ b/queue-4.9/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch @@ -0,0 +1,46 @@ +From 5156b34565d3cb96353301e608dbbb5f73a8df5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:09:21 +0200 +Subject: md: don't call spare_active in md_reap_sync_thread if all member + devices can't work + +From: Guoqing Jiang + +[ Upstream commit 0d8ed0e9bf9643f27f4816dca61081784dedb38d ] + +When add one disk to array, the md_reap_sync_thread is responsible +to activate the spare and set In_sync flag for the new member in +spare_active(). + +But if raid1 has one member disk A, and disk B is added to the array. +Then we offline A before all the datas are synchronized from A to B, +obviously B doesn't have the latest data as A, but B is still marked +with In_sync flag. + +So let's not call spare_active under the condition, otherwise B is +still showed with 'U' state which is not correct. + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 765a16dab2e5f..c1c514792457a 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8573,7 +8573,8 @@ void md_reap_sync_thread(struct mddev *mddev) + /* resync has finished, collect result */ + md_unregister_thread(&mddev->sync_thread); + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) && +- !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { ++ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) && ++ mddev->degraded != mddev->raid_disks) { + /* success...*/ + /* activate any spares */ + if (mddev->pers->spare_active(mddev)) { +-- +2.20.1 + diff --git a/queue-4.9/md-don-t-set-in_sync-if-array-is-frozen.patch b/queue-4.9/md-don-t-set-in_sync-if-array-is-frozen.patch new file mode 100644 index 00000000000..33731a5addf --- /dev/null +++ b/queue-4.9/md-don-t-set-in_sync-if-array-is-frozen.patch @@ -0,0 +1,55 @@ +From a69a610a14199d4657c1f5e4a6ef8b2fb96e6187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:09:20 +0200 +Subject: md: don't set In_sync if array is frozen + +From: Guoqing Jiang + +[ Upstream commit 062f5b2ae12a153644c765e7ba3b0f825427be1d ] + +When a disk is added to array, the following path is called in mdadm. + +Manage_subdevs -> sysfs_freeze_array + -> Manage_add + -> sysfs_set_str(&info, NULL, "sync_action","idle") + +Then from kernel side, Manage_add invokes the path (add_new_disk -> +validate_super = super_1_validate) to set In_sync flag. + +Since In_sync means "device is in_sync with rest of array", and the new +added disk need to resync thread to help the synchronization of data. +And md_reap_sync_thread would call spare_active to set In_sync for the +new added disk finally. So don't set In_sync if array is in frozen. + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index c1c514792457a..da8708b65356e 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1662,8 +1662,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) + if (!(le32_to_cpu(sb->feature_map) & + MD_FEATURE_RECOVERY_BITMAP)) + rdev->saved_raid_disk = -1; +- } else +- set_bit(In_sync, &rdev->flags); ++ } else { ++ /* ++ * If the array is FROZEN, then the device can't ++ * be in_sync with rest of array. ++ */ ++ if (!test_bit(MD_RECOVERY_FROZEN, ++ &mddev->recovery)) ++ set_bit(In_sync, &rdev->flags); ++ } + rdev->raid_disk = role; + break; + } +-- +2.20.1 + diff --git a/queue-4.9/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch b/queue-4.9/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch new file mode 100644 index 00000000000..2a2550e96e2 --- /dev/null +++ b/queue-4.9/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch @@ -0,0 +1,78 @@ +From 47c9217816b4144050493f6ba5e6c7e31fa8ad16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 21:12:41 +0800 +Subject: md/raid1: fail run raid1 array when active disk less than one + +From: Yufen Yu + +[ Upstream commit 07f1a6850c5d5a65c917c3165692b5179ac4cb6b ] + +When run test case: + mdadm -CR /dev/md1 -l 1 -n 4 /dev/sd[a-d] --assume-clean --bitmap=internal + mdadm -S /dev/md1 + mdadm -A /dev/md1 /dev/sd[b-c] --run --force + + mdadm --zero /dev/sda + mdadm /dev/md1 -a /dev/sda + + echo offline > /sys/block/sdc/device/state + echo offline > /sys/block/sdb/device/state + sleep 5 + mdadm -S /dev/md1 + + echo running > /sys/block/sdb/device/state + echo running > /sys/block/sdc/device/state + mdadm -A /dev/md1 /dev/sd[a-c] --run --force + +mdadm run fail with kernel message as follow: +[ 172.986064] md: kicking non-fresh sdb from array! +[ 173.004210] md: kicking non-fresh sdc from array! +[ 173.022383] md/raid1:md1: active with 0 out of 4 mirrors +[ 173.022406] md1: failed to create bitmap (-5) + +In fact, when active disk in raid1 array less than one, we +need to return fail in raid1_run(). + +Reviewed-by: NeilBrown +Signed-off-by: Yufen Yu +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 53048bf0b2b81..9892c41de4419 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2960,6 +2960,13 @@ static int raid1_run(struct mddev *mddev) + !test_bit(In_sync, &conf->mirrors[i].rdev->flags) || + test_bit(Faulty, &conf->mirrors[i].rdev->flags)) + mddev->degraded++; ++ /* ++ * RAID1 needs at least one disk in active ++ */ ++ if (conf->raid_disks - mddev->degraded < 1) { ++ ret = -EINVAL; ++ goto abort; ++ } + + if (conf->raid_disks - mddev->degraded == 1) + mddev->recovery_cp = MaxSector; +@@ -2994,8 +3001,12 @@ static int raid1_run(struct mddev *mddev) + ret = md_integrity_register(mddev); + if (ret) { + md_unregister_thread(&mddev->thread); +- raid1_free(mddev, conf); ++ goto abort; + } ++ return 0; ++ ++abort: ++ raid1_free(mddev, conf); + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.9/media-cpia2_usb-fix-memory-leaks.patch b/queue-4.9/media-cpia2_usb-fix-memory-leaks.patch new file mode 100644 index 00000000000..2e9327def1c --- /dev/null +++ b/queue-4.9/media-cpia2_usb-fix-memory-leaks.patch @@ -0,0 +1,39 @@ +From 23eb11dddda9c6d97083eb2016b8e150660bae06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Aug 2019 02:27:46 -0300 +Subject: media: cpia2_usb: fix memory leaks + +From: Wenwen Wang + +[ Upstream commit 1c770f0f52dca1a2323c594f01f5ec6f1dddc97f ] + +In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array(). +However, it is not deallocated if the following allocation for urbs fails. +To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails. + +Signed-off-by: Wenwen Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cpia2/cpia2_usb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c +index 21e5454d260a0..30e27844e0e99 100644 +--- a/drivers/media/usb/cpia2/cpia2_usb.c ++++ b/drivers/media/usb/cpia2/cpia2_usb.c +@@ -690,6 +690,10 @@ static int submit_urbs(struct camera_data *cam) + if (!urb) { + for (j = 0; j < i; j++) + usb_free_urb(cam->sbuf[j].urb); ++ for (j = 0; j < NUM_SBUF; j++) { ++ kfree(cam->sbuf[j].data); ++ cam->sbuf[j].data = NULL; ++ } + return -ENOMEM; + } + +-- +2.20.1 + diff --git a/queue-4.9/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch b/queue-4.9/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch new file mode 100644 index 00000000000..af56e198d1c --- /dev/null +++ b/queue-4.9/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch @@ -0,0 +1,69 @@ +From ffac22a9dbcd2698c75eeff717d5645f84dcbbfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 08:14:53 -0400 +Subject: media: dib0700: fix link error for dibx000_i2c_set_speed + +From: Arnd Bergmann + +[ Upstream commit 765bb8610d305ee488b35d07e2a04ae52fb2df9c ] + +When CONFIG_DVB_DIB9000 is disabled, we can still compile code that +now fails to link against dibx000_i2c_set_speed: + +drivers/media/usb/dvb-usb/dib0700_devices.o: In function `dib01x0_pmu_update.constprop.7': +dib0700_devices.c:(.text.unlikely+0x1c9c): undefined reference to `dibx000_i2c_set_speed' + +The call sites are both through dib01x0_pmu_update(), which gets passed +an 'i2c' pointer from dib9000_get_i2c_master(), which has returned +NULL. Checking this pointer seems to be a good idea anyway, and it avoids +the link failure in most cases. + +Sean Young found another case that is not fixed by that, where certain +gcc versions leave an unused function in place that causes the link error, +but adding an explict IS_ENABLED() check also solves this. + +Fixes: b7f54910ce01 ("V4L/DVB (4647): Added module for DiB0700 based devices") +Signed-off-by: Arnd Bergmann +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dib0700_devices.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c +index 2868766893c85..c7c8fea0f1fa1 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c +@@ -2438,9 +2438,13 @@ static int dib9090_tuner_attach(struct dvb_usb_adapter *adap) + 8, 0x0486, + }; + ++ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) ++ return -ENODEV; + if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &dib9090_dib0090_config) == NULL) + return -ENODEV; + i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); ++ if (!i2c) ++ return -ENODEV; + if (dib01x0_pmu_update(i2c, data_dib190, 10) != 0) + return -ENODEV; + dib0700_set_i2c_speed(adap->dev, 1500); +@@ -2516,10 +2520,14 @@ static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap) + 0, 0x00ef, + 8, 0x0406, + }; ++ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) ++ return -ENODEV; + i2c = dib9000_get_tuner_interface(adap->fe_adap[0].fe); + if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &nim9090md_dib0090_config[0]) == NULL) + return -ENODEV; + i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); ++ if (!i2c) ++ return -ENODEV; + if (dib01x0_pmu_update(i2c, data_dib190, 10) < 0) + return -ENODEV; + +-- +2.20.1 + diff --git a/queue-4.9/media-dvb-core-fix-a-memory-leak-bug.patch b/queue-4.9/media-dvb-core-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..a027875c3d3 --- /dev/null +++ b/queue-4.9/media-dvb-core-fix-a-memory-leak-bug.patch @@ -0,0 +1,42 @@ +From 9dc1b9c03052de735a7280fa6576b07f8013824c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Aug 2019 00:45:40 -0300 +Subject: media: dvb-core: fix a memory leak bug + +From: Wenwen Wang + +[ Upstream commit fcd5ce4b3936242e6679875a4d3c3acfc8743e15 ] + +In dvb_create_media_entity(), 'dvbdev->entity' is allocated through +kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if +kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading +to a memory leak bug. To fix this issue, free 'dvbdev->entity' before +returning -ENOMEM. + +Signed-off-by: Wenwen Wang +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvbdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 75a3f4b57fd4f..a1cc1c1e53182 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -314,8 +314,10 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev, + if (npads) { + dvbdev->pads = kcalloc(npads, sizeof(*dvbdev->pads), + GFP_KERNEL); +- if (!dvbdev->pads) ++ if (!dvbdev->pads) { ++ kfree(dvbdev->entity); + return -ENOMEM; ++ } + } + + switch (type) { +-- +2.20.1 + diff --git a/queue-4.9/media-exynos4-is-fix-leaked-of_node-references.patch b/queue-4.9/media-exynos4-is-fix-leaked-of_node-references.patch new file mode 100644 index 00000000000..84076fd7061 --- /dev/null +++ b/queue-4.9/media-exynos4-is-fix-leaked-of_node-references.patch @@ -0,0 +1,65 @@ +From a643e44252554008695dddc07c1b289f88428838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2019 23:01:15 -0400 +Subject: media: exynos4-is: fix leaked of_node references + +From: Wen Yang + +[ Upstream commit da79bf41a4d170ca93cc8f3881a70d734a071c37 ] + +The call to of_get_child_by_name returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +drivers/media/platform/exynos4-is/fimc-is.c:813:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/fimc-is.c:870:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/fimc-is.c:885:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:545:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 541, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:528:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:534:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-is.c | 1 + + drivers/media/platform/exynos4-is/media-dev.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c +index 7f92144a1de3a..f9456f26ff4fa 100644 +--- a/drivers/media/platform/exynos4-is/fimc-is.c ++++ b/drivers/media/platform/exynos4-is/fimc-is.c +@@ -819,6 +819,7 @@ static int fimc_is_probe(struct platform_device *pdev) + return -ENODEV; + + is->pmu_regs = of_iomap(node, 0); ++ of_node_put(node); + if (!is->pmu_regs) + return -ENOMEM; + +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 1a1154a9dfa49..ef6ccb5b89525 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -494,6 +494,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) + continue; + + ret = fimc_md_parse_port_node(fmd, port, index); ++ of_node_put(port); + if (ret < 0) { + of_node_put(node); + goto rpm_put; +@@ -527,6 +528,7 @@ static int __of_get_csis_id(struct device_node *np) + if (!np) + return -EINVAL; + of_property_read_u32(np, "reg", ®); ++ of_node_put(np); + return reg - FIMC_INPUT_MIPI_CSI2_0; + } + +-- +2.20.1 + diff --git a/queue-4.9/media-gspca-zero-usb_buf-on-error.patch b/queue-4.9/media-gspca-zero-usb_buf-on-error.patch new file mode 100644 index 00000000000..b2b653e0efe --- /dev/null +++ b/queue-4.9/media-gspca-zero-usb_buf-on-error.patch @@ -0,0 +1,279 @@ +From 44ac8f7e3be02be92892f2555a268fe588c84b1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 03:38:13 -0300 +Subject: media: gspca: zero usb_buf on error + +From: Hans Verkuil + +[ Upstream commit 4843a543fad3bf8221cf14e5d5f32d15cee89e84 ] + +If reg_r() fails, then gspca_dev->usb_buf was left uninitialized, +and some drivers used the contents of that buffer in logic. + +This caused several syzbot errors: + +https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d +https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a +https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82 + +I analyzed the gspca drivers and zeroed the buffer where needed. + +Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/konica.c | 5 +++++ + drivers/media/usb/gspca/nw80x.c | 5 +++++ + drivers/media/usb/gspca/ov519.c | 10 ++++++++++ + drivers/media/usb/gspca/ov534.c | 5 +++++ + drivers/media/usb/gspca/ov534_9.c | 1 + + drivers/media/usb/gspca/se401.c | 5 +++++ + drivers/media/usb/gspca/sn9c20x.c | 5 +++++ + drivers/media/usb/gspca/sonixb.c | 5 +++++ + drivers/media/usb/gspca/sonixj.c | 5 +++++ + drivers/media/usb/gspca/spca1528.c | 5 +++++ + drivers/media/usb/gspca/sq930x.c | 5 +++++ + drivers/media/usb/gspca/sunplus.c | 5 +++++ + drivers/media/usb/gspca/vc032x.c | 5 +++++ + drivers/media/usb/gspca/w996Xcf.c | 5 +++++ + 14 files changed, 71 insertions(+) + +diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c +index 78542fff403fc..5a37d32e8fd09 100644 +--- a/drivers/media/usb/gspca/konica.c ++++ b/drivers/media/usb/gspca/konica.c +@@ -127,6 +127,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index) + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, 2); + } + } + +diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c +index 599f755e75b86..7ebeee98dc1bb 100644 +--- a/drivers/media/usb/gspca/nw80x.c ++++ b/drivers/media/usb/gspca/nw80x.c +@@ -1584,6 +1584,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + return; + } + if (len == 1) +diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c +index 965372a5ff2f3..7ac38905080ad 100644 +--- a/drivers/media/usb/gspca/ov519.c ++++ b/drivers/media/usb/gspca/ov519.c +@@ -2087,6 +2087,11 @@ static int reg_r(struct sd *sd, u16 index) + } else { + PERR("reg_r %02x failed %d\n", index, ret); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + + return ret; +@@ -2115,6 +2120,11 @@ static int reg_r8(struct sd *sd, + } else { + PERR("reg_r8 %02x failed %d\n", index, ret); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, 8); + } + + return ret; +diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c +index 9266a5c9abc5d..ba289b4530772 100644 +--- a/drivers/media/usb/gspca/ov534.c ++++ b/drivers/media/usb/gspca/ov534.c +@@ -645,6 +645,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg) + if (ret < 0) { + pr_err("read failed %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + return gspca_dev->usb_buf[0]; + } +diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c +index 47085cf2d7236..f2dca06069355 100644 +--- a/drivers/media/usb/gspca/ov534_9.c ++++ b/drivers/media/usb/gspca/ov534_9.c +@@ -1157,6 +1157,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg) + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ return 0; + } + return gspca_dev->usb_buf[0]; + } +diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c +index 5102cea504710..6adbb0eca71fe 100644 +--- a/drivers/media/usb/gspca/se401.c ++++ b/drivers/media/usb/gspca/se401.c +@@ -115,6 +115,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent) + pr_err("read req failed req %#04x error %d\n", + req, err); + gspca_dev->usb_err = err; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE); + } + } + +diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c +index 10269dad9d201..1a08a7a20114c 100644 +--- a/drivers/media/usb/gspca/sn9c20x.c ++++ b/drivers/media/usb/gspca/sn9c20x.c +@@ -923,6 +923,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length) + if (unlikely(result < 0 || result != length)) { + pr_err("Read register %02x failed %d\n", reg, result); + gspca_dev->usb_err = result; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c +index 6696b2ec34e96..83e98b85ab6a1 100644 +--- a/drivers/media/usb/gspca/sonixb.c ++++ b/drivers/media/usb/gspca/sonixb.c +@@ -466,6 +466,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + dev_err(gspca_dev->v4l2_dev.dev, + "Error reading register %02x: %d\n", value, res); + gspca_dev->usb_err = res; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + } + +diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c +index d49d76ec14212..9ec63f75b8ea4 100644 +--- a/drivers/media/usb/gspca/sonixj.c ++++ b/drivers/media/usb/gspca/sonixj.c +@@ -1174,6 +1174,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c +index f38fd8949609f..ee93bd443df5d 100644 +--- a/drivers/media/usb/gspca/spca1528.c ++++ b/drivers/media/usb/gspca/spca1528.c +@@ -84,6 +84,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c +index e274cf19a3ea2..b236e9dcd4685 100644 +--- a/drivers/media/usb/gspca/sq930x.c ++++ b/drivers/media/usb/gspca/sq930x.c +@@ -438,6 +438,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r %04x failed %d\n", value, ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c +index 46c9f2229a186..cc3e1478c5a09 100644 +--- a/drivers/media/usb/gspca/sunplus.c ++++ b/drivers/media/usb/gspca/sunplus.c +@@ -268,6 +268,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c +index b4efb2fb36fa3..5032b9d7d9bb2 100644 +--- a/drivers/media/usb/gspca/vc032x.c ++++ b/drivers/media/usb/gspca/vc032x.c +@@ -2919,6 +2919,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + static void reg_r(struct gspca_dev *gspca_dev, +diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c +index 896f1b2b91793..948aaae4d47eb 100644 +--- a/drivers/media/usb/gspca/w996Xcf.c ++++ b/drivers/media/usb/gspca/w996Xcf.c +@@ -147,6 +147,11 @@ static int w9968cf_read_sb(struct sd *sd) + } else { + pr_err("Read SB reg [01] failed\n"); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(sd->gspca_dev.usb_buf, 0, 2); + } + + udelay(W9968CF_I2C_BUS_DELAY); +-- +2.20.1 + diff --git a/queue-4.9/media-hdpvr-add-device-num-check-and-handling.patch b/queue-4.9/media-hdpvr-add-device-num-check-and-handling.patch new file mode 100644 index 00000000000..805003e064a --- /dev/null +++ b/queue-4.9/media-hdpvr-add-device-num-check-and-handling.patch @@ -0,0 +1,59 @@ +From ec1cc8cec98b52a54f12b12de7faeea6f8e208d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2019 10:19:46 -0400 +Subject: media: hdpvr: Add device num check and handling + +From: Luke Nowakowski-Krijger + +[ Upstream commit d4a6a9537bc32811486282206ecfb7c53754b74d ] + +Add hdpvr device num check and error handling + +We need to increment the device count atomically before we checkout a +device to make sure that we do not reach the max count, otherwise we get +out-of-bounds errors as reported by syzbot. + +Reported-and-tested-by: syzbot+aac8d0d7205f112045d2@syzkaller.appspotmail.com + +Signed-off-by: Luke Nowakowski-Krijger +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c +index a20b60ac66ca4..7b34108f6587e 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-core.c ++++ b/drivers/media/usb/hdpvr/hdpvr-core.c +@@ -278,6 +278,7 @@ static int hdpvr_probe(struct usb_interface *interface, + #endif + size_t buffer_size; + int i; ++ int dev_num; + int retval = -ENOMEM; + + /* allocate memory for our device state and initialize it */ +@@ -382,8 +383,17 @@ static int hdpvr_probe(struct usb_interface *interface, + } + #endif + ++ dev_num = atomic_inc_return(&dev_nr); ++ if (dev_num >= HDPVR_MAX) { ++ v4l2_err(&dev->v4l2_dev, ++ "max device number reached, device register failed\n"); ++ atomic_dec(&dev_nr); ++ retval = -ENODEV; ++ goto reg_fail; ++ } ++ + retval = hdpvr_register_videodev(dev, &interface->dev, +- video_nr[atomic_inc_return(&dev_nr)]); ++ video_nr[dev_num]); + if (retval < 0) { + v4l2_err(&dev->v4l2_dev, "registering videodev failed\n"); + goto reg_fail; +-- +2.20.1 + diff --git a/queue-4.9/media-hdpvr-add-terminating-0-at-end-of-string.patch b/queue-4.9/media-hdpvr-add-terminating-0-at-end-of-string.patch new file mode 100644 index 00000000000..8fb9d8b7057 --- /dev/null +++ b/queue-4.9/media-hdpvr-add-terminating-0-at-end-of-string.patch @@ -0,0 +1,40 @@ +From 76f841a38b7bcdbef6b8819d746174a052abf8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 10:00:33 -0300 +Subject: media: hdpvr: add terminating 0 at end of string + +From: Hans Verkuil + +[ Upstream commit 8b8900b729e4f31f12ac1127bde137c775c327e6 ] + +dev->usbc_buf was passed as argument for %s, but it was not safeguarded +by a terminating 0. + +This caused this syzbot issue: + +https://syzkaller.appspot.com/bug?extid=79d18aac4bf1770dd050 + +Reported-and-tested-by: syzbot+79d18aac4bf1770dd050@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c +index 7b34108f6587e..99171b912a2d8 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-core.c ++++ b/drivers/media/usb/hdpvr/hdpvr-core.c +@@ -143,6 +143,7 @@ static int device_authorization(struct hdpvr_device *dev) + + dev->fw_ver = dev->usbc_buf[1]; + ++ dev->usbc_buf[46] = '\0'; + v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n", + dev->fw_ver, &dev->usbc_buf[2]); + +-- +2.20.1 + diff --git a/queue-4.9/media-iguanair-add-sanity-checks.patch b/queue-4.9/media-iguanair-add-sanity-checks.patch new file mode 100644 index 00000000000..b1388cb7f6c --- /dev/null +++ b/queue-4.9/media-iguanair-add-sanity-checks.patch @@ -0,0 +1,61 @@ +From a7f05811b9bfb323caab862523253dfae5006a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2019 05:50:44 -0300 +Subject: media: iguanair: add sanity checks + +From: Oliver Neukum + +[ Upstream commit ab1cbdf159beba7395a13ab70bc71180929ca064 ] + +The driver needs to check the endpoint types, too, as opposed +to the number of endpoints. This also requires moving the check earlier. + +Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/iguanair.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c +index 5f634545ddd81..25470395c43f1 100644 +--- a/drivers/media/rc/iguanair.c ++++ b/drivers/media/rc/iguanair.c +@@ -430,6 +430,10 @@ static int iguanair_probe(struct usb_interface *intf, + int ret, pipein, pipeout; + struct usb_host_interface *idesc; + ++ idesc = intf->altsetting; ++ if (idesc->desc.bNumEndpoints < 2) ++ return -ENODEV; ++ + ir = kzalloc(sizeof(*ir), GFP_KERNEL); + rc = rc_allocate_device(); + if (!ir || !rc) { +@@ -444,18 +448,13 @@ static int iguanair_probe(struct usb_interface *intf, + ir->urb_in = usb_alloc_urb(0, GFP_KERNEL); + ir->urb_out = usb_alloc_urb(0, GFP_KERNEL); + +- if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) { ++ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out || ++ !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) || ++ !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) { + ret = -ENOMEM; + goto out; + } + +- idesc = intf->altsetting; +- +- if (idesc->desc.bNumEndpoints < 2) { +- ret = -ENODEV; +- goto out; +- } +- + ir->rc = rc; + ir->dev = &intf->dev; + ir->udev = udev; +-- +2.20.1 + diff --git a/queue-4.9/media-omap3isp-don-t-set-streaming-state-on-random-s.patch b/queue-4.9/media-omap3isp-don-t-set-streaming-state-on-random-s.patch new file mode 100644 index 00000000000..bfc4078d717 --- /dev/null +++ b/queue-4.9/media-omap3isp-don-t-set-streaming-state-on-random-s.patch @@ -0,0 +1,50 @@ +From c5b0066d0b0bb3909ef2848e683f81001969c729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 11:21:27 -0300 +Subject: media: omap3isp: Don't set streaming state on random subdevs + +From: Sakari Ailus + +[ Upstream commit 7ef57be07ac146e70535747797ef4aee0f06e9f9 ] + +The streaming state should be set to the first upstream sub-device only, +not everywhere, for a sub-device driver itself knows how to best control +the streaming state of its own upstream sub-devices. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index a21b12c5c0853..ce651d3ca1b82 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -726,6 +726,10 @@ static int isp_pipeline_enable(struct isp_pipeline *pipe, + s_stream, mode); + pipe->do_propagation = true; + } ++ ++ /* Stop at the first external sub-device. */ ++ if (subdev->dev != isp->dev) ++ break; + } + + return 0; +@@ -840,6 +844,10 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe) + &subdev->entity); + failure = -ETIMEDOUT; + } ++ ++ /* Stop at the first external sub-device. */ ++ if (subdev->dev != isp->dev) ++ break; + } + + return failure; +-- +2.20.1 + diff --git a/queue-4.9/media-omap3isp-set-device-on-omap3isp-subdevs.patch b/queue-4.9/media-omap3isp-set-device-on-omap3isp-subdevs.patch new file mode 100644 index 00000000000..6cebddeaac8 --- /dev/null +++ b/queue-4.9/media-omap3isp-set-device-on-omap3isp-subdevs.patch @@ -0,0 +1,101 @@ +From f5c287fb93318ca71b92ed8f195e32b18f9be606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 11:19:00 -0300 +Subject: media: omap3isp: Set device on omap3isp subdevs + +From: Sakari Ailus + +[ Upstream commit e9eb103f027725053a4b02f93d7f2858b56747ce ] + +The omap3isp driver registered subdevs without the dev field being set. Do +that now. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispccdc.c | 1 + + drivers/media/platform/omap3isp/ispccp2.c | 1 + + drivers/media/platform/omap3isp/ispcsi2.c | 1 + + drivers/media/platform/omap3isp/isppreview.c | 1 + + drivers/media/platform/omap3isp/ispresizer.c | 1 + + drivers/media/platform/omap3isp/ispstat.c | 2 ++ + 6 files changed, 7 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c +index 882310eb45ccf..fe16fbd95221f 100644 +--- a/drivers/media/platform/omap3isp/ispccdc.c ++++ b/drivers/media/platform/omap3isp/ispccdc.c +@@ -2608,6 +2608,7 @@ int omap3isp_ccdc_register_entities(struct isp_ccdc_device *ccdc, + int ret; + + /* Register the subdev and video node. */ ++ ccdc->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &ccdc->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispccp2.c b/drivers/media/platform/omap3isp/ispccp2.c +index ca095238510d5..b64e218eaea6e 100644 +--- a/drivers/media/platform/omap3isp/ispccp2.c ++++ b/drivers/media/platform/omap3isp/ispccp2.c +@@ -1030,6 +1030,7 @@ int omap3isp_ccp2_register_entities(struct isp_ccp2_device *ccp2, + int ret; + + /* Register the subdev and video nodes. */ ++ ccp2->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &ccp2->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispcsi2.c b/drivers/media/platform/omap3isp/ispcsi2.c +index f75a1be29d84a..27a2913363b62 100644 +--- a/drivers/media/platform/omap3isp/ispcsi2.c ++++ b/drivers/media/platform/omap3isp/ispcsi2.c +@@ -1206,6 +1206,7 @@ int omap3isp_csi2_register_entities(struct isp_csi2_device *csi2, + int ret; + + /* Register the subdev and video nodes. */ ++ csi2->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &csi2->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index ac30a0f837801..e981eb2330f18 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -2228,6 +2228,7 @@ int omap3isp_preview_register_entities(struct isp_prev_device *prev, + int ret; + + /* Register the subdev and video nodes. */ ++ prev->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &prev->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispresizer.c b/drivers/media/platform/omap3isp/ispresizer.c +index 0b6a87508584f..2035e3c6a9dee 100644 +--- a/drivers/media/platform/omap3isp/ispresizer.c ++++ b/drivers/media/platform/omap3isp/ispresizer.c +@@ -1684,6 +1684,7 @@ int omap3isp_resizer_register_entities(struct isp_res_device *res, + int ret; + + /* Register the subdev and video nodes. */ ++ res->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &res->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispstat.c b/drivers/media/platform/omap3isp/ispstat.c +index 1b9217d3b1b6a..4a4ae637655ba 100644 +--- a/drivers/media/platform/omap3isp/ispstat.c ++++ b/drivers/media/platform/omap3isp/ispstat.c +@@ -1010,6 +1010,8 @@ void omap3isp_stat_unregister_entities(struct ispstat *stat) + int omap3isp_stat_register_entities(struct ispstat *stat, + struct v4l2_device *vdev) + { ++ stat->subdev.dev = vdev->mdev->dev; ++ + return v4l2_device_register_subdev(vdev, &stat->subdev); + } + +-- +2.20.1 + diff --git a/queue-4.9/media-ov9650-add-a-sanity-check.patch b/queue-4.9/media-ov9650-add-a-sanity-check.patch new file mode 100644 index 00000000000..e235abc3656 --- /dev/null +++ b/queue-4.9/media-ov9650-add-a-sanity-check.patch @@ -0,0 +1,49 @@ +From 4b086524ae95e61b4d4fa91cf1f5d86897cf1abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 11:55:07 -0300 +Subject: media: ov9650: add a sanity check + +From: Mauro Carvalho Chehab + +[ Upstream commit 093347abc7a4e0490e3c962ecbde2dc272a8f708 ] + +As pointed by cppcheck: + + [drivers/media/i2c/ov9650.c:706]: (error) Shifting by a negative value is undefined behaviour + [drivers/media/i2c/ov9650.c:707]: (error) Shifting by a negative value is undefined behaviour + [drivers/media/i2c/ov9650.c:721]: (error) Shifting by a negative value is undefined behaviour + +Prevent mangling with gains with invalid values. + +As pointed by Sylvester, this should never happen in practice, +as min value of V4L2_CID_GAIN control is 16 (gain is always >= 16 +and m is always >= 0), but it is too hard for a static analyzer +to get this, as the logic with validates control min/max is +elsewhere inside V4L2 core. + +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov9650.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c +index 502c72238a4a5..db962e2108adf 100644 +--- a/drivers/media/i2c/ov9650.c ++++ b/drivers/media/i2c/ov9650.c +@@ -708,6 +708,11 @@ static int ov965x_set_gain(struct ov965x *ov965x, int auto_gain) + for (m = 6; m >= 0; m--) + if (gain >= (1 << m) * 16) + break; ++ ++ /* Sanity check: don't adjust the gain with a negative value */ ++ if (m < 0) ++ return -EINVAL; ++ + rgain = (gain - ((1 << m) * 16)) / (1 << m); + rgain |= (((1 << m) - 1) << 4); + +-- +2.20.1 + diff --git a/queue-4.9/media-radio-si470x-kill-urb-on-error.patch b/queue-4.9/media-radio-si470x-kill-urb-on-error.patch new file mode 100644 index 00000000000..995e597828f --- /dev/null +++ b/queue-4.9/media-radio-si470x-kill-urb-on-error.patch @@ -0,0 +1,59 @@ +From 4fd603b5717a9555e604eb1039e5488a3ee52b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 09:40:52 -0300 +Subject: media: radio/si470x: kill urb on error + +From: Hans Verkuil + +[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ] + +In the probe() function radio->int_in_urb was not killed if an +error occurred in the probe sequence. It was also missing in +the disconnect. + +This caused this syzbot issue: + +https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 + +Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index 4b132c29f2900..1d045a8c29e21 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -742,7 +742,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, + /* start radio */ + retval = si470x_start_usb(radio); + if (retval < 0) +- goto err_all; ++ goto err_buf; + + /* set initial frequency */ + si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ +@@ -757,6 +757,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, + + return 0; + err_all: ++ usb_kill_urb(radio->int_in_urb); ++err_buf: + kfree(radio->buffer); + err_ctrl: + v4l2_ctrl_handler_free(&radio->hdl); +@@ -830,6 +832,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) + mutex_lock(&radio->lock); + v4l2_device_disconnect(&radio->v4l2_dev); + video_unregister_device(&radio->videodev); ++ usb_kill_urb(radio->int_in_urb); + usb_set_intfdata(intf, NULL); + mutex_unlock(&radio->lock); + v4l2_device_put(&radio->v4l2_dev); +-- +2.20.1 + diff --git a/queue-4.9/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch b/queue-4.9/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch new file mode 100644 index 00000000000..a10b5bd6e07 --- /dev/null +++ b/queue-4.9/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch @@ -0,0 +1,61 @@ +From 1838991c1d4d17a8ea2202de23fc2210952b2968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 19:05:55 -0300 +Subject: media: saa7134: fix terminology around + saa7134_i2c_eeprom_md7134_gate() + +From: Maciej S. Szmigiero + +[ Upstream commit 9d802222a3405599d6e1984d9324cddf592ea1f4 ] + +saa7134_i2c_eeprom_md7134_gate() function and the associated comment uses +an inverted i2c gate open / closed terminology. +Let's fix this. + +Signed-off-by: Maciej S. Szmigiero +Signed-off-by: Hans Verkuil +[hverkuil-cisco@xs4all.nl: fix alignment checkpatch warning] +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-i2c.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c +index dca0592c5f471..6f93568f56204 100644 +--- a/drivers/media/pci/saa7134/saa7134-i2c.c ++++ b/drivers/media/pci/saa7134/saa7134-i2c.c +@@ -355,7 +355,11 @@ static struct i2c_client saa7134_client_template = { + + /* ----------------------------------------------------------- */ + +-/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */ ++/* ++ * On Medion 7134 reading the SAA7134 chip config EEPROM needs DVB-T ++ * demod i2c gate closed due to an address clash between this EEPROM ++ * and the demod one. ++ */ + static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) + { + u8 subaddr = 0x7, dmdregval; +@@ -372,14 +376,14 @@ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) + + ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2); + if ((ret == 2) && (dmdregval & 0x2)) { +- pr_debug("%s: DVB-T demod i2c gate was left closed\n", ++ pr_debug("%s: DVB-T demod i2c gate was left open\n", + dev->name); + + data[0] = subaddr; + data[1] = (dmdregval & ~0x2); + if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1) +- pr_err("%s: EEPROM i2c gate open failure\n", +- dev->name); ++ pr_err("%s: EEPROM i2c gate close failure\n", ++ dev->name); + } + } + +-- +2.20.1 + diff --git a/queue-4.9/media-saa7146-add-cleanup-in-hexium_attach.patch b/queue-4.9/media-saa7146-add-cleanup-in-hexium_attach.patch new file mode 100644 index 00000000000..82a9605b659 --- /dev/null +++ b/queue-4.9/media-saa7146-add-cleanup-in-hexium_attach.patch @@ -0,0 +1,38 @@ +From c430f0522a0a1d7f716b6e409af393ae3311cbd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Aug 2019 02:40:14 -0300 +Subject: media: saa7146: add cleanup in hexium_attach() + +From: Wenwen Wang + +[ Upstream commit 42e64117d3b4a759013f77bbcf25ab6700e55de7 ] + +If saa7146_register_device() fails, no cleanup is executed, leading to +memory/resource leaks. To fix this issue, perform necessary cleanup work +before returning the error. + +Signed-off-by: Wenwen Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/hexium_gemini.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c +index f5fc8bcbd14b1..be85a2c4318e7 100644 +--- a/drivers/media/pci/saa7146/hexium_gemini.c ++++ b/drivers/media/pci/saa7146/hexium_gemini.c +@@ -304,6 +304,9 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d + ret = saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER); + if (ret < 0) { + pr_err("cannot register capture v4l2 device. skipping.\n"); ++ saa7146_vv_release(dev); ++ i2c_del_adapter(&hexium->i2c_adapter); ++ kfree(hexium); + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.9/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch b/queue-4.9/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch new file mode 100644 index 00000000000..509bf827e16 --- /dev/null +++ b/queue-4.9/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch @@ -0,0 +1,40 @@ +From 2ef2391a700a2a044544e791c08f746fec938d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 12:19:05 -0300 +Subject: media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() + +From: Tomas Bortoli + +[ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ] + +The function at issue does not always initialize each byte allocated +for 'b' and can therefore leak uninitialized memory to a USB device in +the call to usb_bulk_msg() + +Use kzalloc() instead of kmalloc() + +Signed-off-by: Tomas Bortoli +Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c +index 4e7671a3a1e4a..d7397c0d7f869 100644 +--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c ++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c +@@ -278,7 +278,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + + dprintk("%s\n", __func__); + +- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); ++ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); + if (!b) + return -ENOMEM; + +-- +2.20.1 + diff --git a/queue-4.9/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch b/queue-4.9/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch new file mode 100644 index 00000000000..bf0efe6a0e4 --- /dev/null +++ b/queue-4.9/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch @@ -0,0 +1,56 @@ +From 3941b8cb84ce2c027633a67fab7b4df654fa0009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 07:51:14 -0400 +Subject: mmc: sdhci: Fix incorrect switch to HS mode + +From: Al Cooper + +[ Upstream commit c894e33ddc1910e14d6f2a2016f60ab613fd8b37 ] + +When switching from any MMC speed mode that requires 1.8v +(HS200, HS400 and HS400ES) to High Speed (HS) mode, the system +ends up configured for SDR12 with a 50MHz clock which is an illegal +mode. + +This happens because the SDHCI_CTRL_VDD_180 bit in the +SDHCI_HOST_CONTROL2 register is left set and when this bit is +set, the speed mode is controlled by the SDHCI_CTRL_UHS field +in the SDHCI_HOST_CONTROL2 register. The SDHCI_CTRL_UHS field +will end up being set to 0 (SDR12) by sdhci_set_uhs_signaling() +because there is no UHS mode being set. + +The fix is to change sdhci_set_uhs_signaling() to set the +SDHCI_CTRL_UHS field to SDR25 (which is the same as HS) for +any switch to HS mode. + +This was found on a new eMMC controller that does strict checking +of the speed mode and the corresponding clock rate. It caused the +switch to HS400 mode to fail because part of the sequence to switch +to HS400 requires a switch from HS200 to HS before going to HS400. + +Suggested-by: Adrian Hunter +Signed-off-by: Al Cooper +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index df306caba296a..0347742a495a6 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1557,7 +1557,9 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_SD_HS || ++ timing == MMC_TIMING_MMC_HS || ++ timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +-- +2.20.1 + diff --git a/queue-4.9/net-lpc-enet-fix-printk-format-strings.patch b/queue-4.9/net-lpc-enet-fix-printk-format-strings.patch new file mode 100644 index 00000000000..6d6534eae58 --- /dev/null +++ b/queue-4.9/net-lpc-enet-fix-printk-format-strings.patch @@ -0,0 +1,64 @@ +From 3428602ace739f9356b02563c5c0ee83ed372355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 16:40:35 +0200 +Subject: net: lpc-enet: fix printk format strings + +From: Arnd Bergmann + +[ Upstream commit de6f97b2bace0e2eb6c3a86e124d1e652a587b56 ] + +compile-testing this driver on other architectures showed +multiple warnings: + + drivers/net/ethernet/nxp/lpc_eth.c: In function 'lpc_eth_drv_probe': + drivers/net/ethernet/nxp/lpc_eth.c:1337:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'resource_size_t {aka long long unsigned int}' [-Wformat=] + + drivers/net/ethernet/nxp/lpc_eth.c:1342:19: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=] + +Use format strings that work on all architectures. + +Link: https://lore.kernel.org/r/20190809144043.476786-10-arnd@arndb.de +Reported-by: kbuild test robot +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/nxp/lpc_eth.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index 8e13ec84c5381..9fcaf19106335 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -1374,13 +1374,14 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) + pldat->dma_buff_base_p = dma_handle; + + netdev_dbg(ndev, "IO address space :%pR\n", res); +- netdev_dbg(ndev, "IO address size :%d\n", resource_size(res)); ++ netdev_dbg(ndev, "IO address size :%zd\n", ++ (size_t)resource_size(res)); + netdev_dbg(ndev, "IO address (mapped) :0x%p\n", + pldat->net_base); + netdev_dbg(ndev, "IRQ number :%d\n", ndev->irq); +- netdev_dbg(ndev, "DMA buffer size :%d\n", pldat->dma_buff_size); +- netdev_dbg(ndev, "DMA buffer P address :0x%08x\n", +- pldat->dma_buff_base_p); ++ netdev_dbg(ndev, "DMA buffer size :%zd\n", pldat->dma_buff_size); ++ netdev_dbg(ndev, "DMA buffer P address :%pad\n", ++ &pldat->dma_buff_base_p); + netdev_dbg(ndev, "DMA buffer V address :0x%p\n", + pldat->dma_buff_base_v); + +@@ -1427,8 +1428,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) + if (ret) + goto err_out_unregister_netdev; + +- netdev_info(ndev, "LPC mac at 0x%08x irq %d\n", +- res->start, ndev->irq); ++ netdev_info(ndev, "LPC mac at 0x%08lx irq %d\n", ++ (unsigned long)res->start, ndev->irq); + + phydev = ndev->phydev; + +-- +2.20.1 + diff --git a/queue-4.9/nvmet-fix-data-units-read-and-written-counters-in-sm.patch b/queue-4.9/nvmet-fix-data-units-read-and-written-counters-in-sm.patch new file mode 100644 index 00000000000..fcaad83405e --- /dev/null +++ b/queue-4.9/nvmet-fix-data-units-read-and-written-counters-in-sm.patch @@ -0,0 +1,65 @@ +From 2371a19899dcbe4adb5ceec0f575ff13d0fd2b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 02:22:36 +0000 +Subject: nvmet: fix data units read and written counters in SMART log + +From: Tom Wu + +[ Upstream commit 3bec2e3754becebd4c452999adb49bc62c575ea4 ] + +In nvme spec 1.3 there is a definition for data write/read counters +from SMART log, (See section 5.14.1.2): + This value is reported in thousands (i.e., a value of 1 + corresponds to 1000 units of 512 bytes read) and is rounded up. + +However, in nvme target where value is reported with actual units, +but not thousands of units as the spec requires. + +Signed-off-by: Tom Wu +Reviewed-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index cdb7752dcbb79..446f61ba018d7 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -47,9 +47,11 @@ static u16 nvmet_get_smart_log_nsid(struct nvmet_req *req, + } + + host_reads = part_stat_read(ns->bdev->bd_part, ios[READ]); +- data_units_read = part_stat_read(ns->bdev->bd_part, sectors[READ]); ++ data_units_read = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part, ++ sectors[READ]), 1000); + host_writes = part_stat_read(ns->bdev->bd_part, ios[WRITE]); +- data_units_written = part_stat_read(ns->bdev->bd_part, sectors[WRITE]); ++ data_units_written = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part, ++ sectors[WRITE]), 1000); + + put_unaligned_le64(host_reads, &slog->host_reads[0]); + put_unaligned_le64(data_units_read, &slog->data_units_read[0]); +@@ -75,11 +77,11 @@ static u16 nvmet_get_smart_log_all(struct nvmet_req *req, + rcu_read_lock(); + list_for_each_entry_rcu(ns, &ctrl->subsys->namespaces, dev_link) { + host_reads += part_stat_read(ns->bdev->bd_part, ios[READ]); +- data_units_read += +- part_stat_read(ns->bdev->bd_part, sectors[READ]); ++ data_units_read += DIV_ROUND_UP( ++ part_stat_read(ns->bdev->bd_part, sectors[READ]), 1000); + host_writes += part_stat_read(ns->bdev->bd_part, ios[WRITE]); +- data_units_written += +- part_stat_read(ns->bdev->bd_part, sectors[WRITE]); ++ data_units_written += DIV_ROUND_UP( ++ part_stat_read(ns->bdev->bd_part, sectors[WRITE]), 1000); + + } + rcu_read_unlock(); +-- +2.20.1 + diff --git a/queue-4.9/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch b/queue-4.9/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch new file mode 100644 index 00000000000..58f7bee326a --- /dev/null +++ b/queue-4.9/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch @@ -0,0 +1,101 @@ +From 8d9cb3f3bda456c6e8ca6ae3c9bec864893023d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 15:38:35 +0200 +Subject: PM / devfreq: exynos-bus: Correct clock enable sequence + +From: Kamil Konieczny + +[ Upstream commit 2c2b20e0da89c76759ee28c6824413ab2fa3bfc6 ] + +Regulators should be enabled before clocks to avoid h/w hang. This +require change in exynos_bus_probe() to move exynos_bus_parse_of() +after exynos_bus_parent_parse_of() and change in error handling. +Similar change is needed in exynos_bus_exit() where clock should be +disabled before regulators. + +Signed-off-by: Kamil Konieczny +Acked-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/exynos-bus.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/drivers/devfreq/exynos-bus.c b/drivers/devfreq/exynos-bus.c +index 1b21bb60e7975..2c8f41fbe94fb 100644 +--- a/drivers/devfreq/exynos-bus.c ++++ b/drivers/devfreq/exynos-bus.c +@@ -198,11 +198,10 @@ static void exynos_bus_exit(struct device *dev) + if (ret < 0) + dev_warn(dev, "failed to disable the devfreq-event devices\n"); + +- if (bus->regulator) +- regulator_disable(bus->regulator); +- + dev_pm_opp_of_remove_table(dev); + clk_disable_unprepare(bus->clk); ++ if (bus->regulator) ++ regulator_disable(bus->regulator); + } + + /* +@@ -391,6 +390,7 @@ static int exynos_bus_probe(struct platform_device *pdev) + struct exynos_bus *bus; + int ret, max_state; + unsigned long min_freq, max_freq; ++ bool passive = false; + + if (!np) { + dev_err(dev, "failed to find devicetree node\n"); +@@ -404,27 +404,27 @@ static int exynos_bus_probe(struct platform_device *pdev) + bus->dev = &pdev->dev; + platform_set_drvdata(pdev, bus); + +- /* Parse the device-tree to get the resource information */ +- ret = exynos_bus_parse_of(np, bus); +- if (ret < 0) +- return ret; +- + profile = devm_kzalloc(dev, sizeof(*profile), GFP_KERNEL); +- if (!profile) { +- ret = -ENOMEM; +- goto err; +- } ++ if (!profile) ++ return -ENOMEM; + + node = of_parse_phandle(dev->of_node, "devfreq", 0); + if (node) { + of_node_put(node); +- goto passive; ++ passive = true; + } else { + ret = exynos_bus_parent_parse_of(np, bus); ++ if (ret < 0) ++ return ret; + } + ++ /* Parse the device-tree to get the resource information */ ++ ret = exynos_bus_parse_of(np, bus); + if (ret < 0) +- goto err; ++ goto err_reg; ++ ++ if (passive) ++ goto passive; + + /* Initialize the struct profile and governor data for parent device */ + profile->polling_ms = 50; +@@ -514,6 +514,9 @@ static int exynos_bus_probe(struct platform_device *pdev) + err: + dev_pm_opp_of_remove_table(dev); + clk_disable_unprepare(bus->clk); ++err_reg: ++ if (!passive) ++ regulator_disable(bus->regulator); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.9/pm-devfreq-passive-fix-compiler-warning.patch b/queue-4.9/pm-devfreq-passive-fix-compiler-warning.patch new file mode 100644 index 00000000000..e20210deb64 --- /dev/null +++ b/queue-4.9/pm-devfreq-passive-fix-compiler-warning.patch @@ -0,0 +1,35 @@ +From 96ba066340418c88679a0c032b9e858f4049def6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 21:37:37 +0900 +Subject: PM / devfreq: passive: fix compiler warning + +From: MyungJoo Ham + +[ Upstream commit 0465814831a926ce2f83e8f606d067d86745234e ] + +The recent commit of +PM / devfreq: passive: Use non-devm notifiers +had incurred compiler warning, "unused variable 'dev'". + +Reported-by: Stephen Rothwell +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/governor_passive.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index 8e889fd805b58..62c262fc2178d 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -152,7 +152,6 @@ static int devfreq_passive_notifier_call(struct notifier_block *nb, + static int devfreq_passive_event_handler(struct devfreq *devfreq, + unsigned int event, void *data) + { +- struct device *dev = devfreq->dev.parent; + struct devfreq_passive_data *p_data + = (struct devfreq_passive_data *)devfreq->data; + struct devfreq *parent = (struct devfreq *)p_data->parent; +-- +2.20.1 + diff --git a/queue-4.9/pm-devfreq-passive-use-non-devm-notifiers.patch b/queue-4.9/pm-devfreq-passive-use-non-devm-notifiers.patch new file mode 100644 index 00000000000..0a82b0399a9 --- /dev/null +++ b/queue-4.9/pm-devfreq-passive-use-non-devm-notifiers.patch @@ -0,0 +1,69 @@ +From 937c2a8f89800ab1f3915c8129d3929bf01b32aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 19:54:08 +0300 +Subject: PM / devfreq: passive: Use non-devm notifiers + +From: Leonard Crestez + +[ Upstream commit 0ef7c7cce43f6ecc2b96d447e69b2900a9655f7c ] + +The devfreq passive governor registers and unregisters devfreq +transition notifiers on DEVFREQ_GOV_START/GOV_STOP using devm wrappers. + +If devfreq itself is registered with devm then a warning is triggered on +rmmod from devm_devfreq_unregister_notifier. Call stack looks like this: + + devm_devfreq_unregister_notifier+0x30/0x40 + devfreq_passive_event_handler+0x4c/0x88 + devfreq_remove_device.part.8+0x6c/0x9c + devm_devfreq_dev_release+0x18/0x20 + release_nodes+0x1b0/0x220 + devres_release_all+0x78/0x84 + device_release_driver_internal+0x100/0x1c0 + driver_detach+0x4c/0x90 + bus_remove_driver+0x7c/0xd0 + driver_unregister+0x2c/0x58 + platform_driver_unregister+0x10/0x18 + imx_devfreq_platdrv_exit+0x14/0xd40 [imx_devfreq] + +This happens because devres_release_all will first remove all the nodes +into a separate todo list so the nested devres_release from +devm_devfreq_unregister_notifier won't find anything. + +Fix the warning by calling the non-devm APIS for frequency notification. +Using devm wrappers is not actually useful for a governor anyway: it +relies on the devfreq core to correctly match the GOV_START/GOV_STOP +notifications. + +Fixes: 996133119f57 ("PM / devfreq: Add new passive governor") +Signed-off-by: Leonard Crestez +Acked-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/governor_passive.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index 5be96b2249e72..8e889fd805b58 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -168,12 +168,12 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq, + p_data->this = devfreq; + + nb->notifier_call = devfreq_passive_notifier_call; +- ret = devm_devfreq_register_notifier(dev, parent, nb, ++ ret = devfreq_register_notifier(parent, nb, + DEVFREQ_TRANSITION_NOTIFIER); + break; + case DEVFREQ_GOV_STOP: +- devm_devfreq_unregister_notifier(dev, parent, nb, +- DEVFREQ_TRANSITION_NOTIFIER); ++ WARN_ON(devfreq_unregister_notifier(parent, nb, ++ DEVFREQ_TRANSITION_NOTIFIER)); + break; + default: + break; +-- +2.20.1 + diff --git a/queue-4.9/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch b/queue-4.9/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch new file mode 100644 index 00000000000..8de8ae98b93 --- /dev/null +++ b/queue-4.9/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch @@ -0,0 +1,53 @@ +From b2bf465db4ab67cd4c50cf6c926b51fee27e1c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2019 21:26:31 +0800 +Subject: regulator: lm363x: Fix off-by-one n_voltages for lm3632 + ldo_vpos/ldo_vneg + +From: Axel Lin + +[ Upstream commit 1e2cc8c5e0745b545d4974788dc606d678b6e564 ] + +According to the datasheet https://www.ti.com/lit/ds/symlink/lm3632a.pdf +Table 20. VPOS Bias Register Field Descriptions VPOS[5:0] +Sets the Positive Display Bias (LDO) Voltage (50 mV per step) +000000: 4 V +000001: 4.05 V +000010: 4.1 V +.................... +011101: 5.45 V +011110: 5.5 V (Default) +011111: 5.55 V +.................... +100111: 5.95 V +101000: 6 V +Note: Codes 101001 to 111111 map to 6 V + +The LM3632_LDO_VSEL_MAX should be 0b101000 (0x28), so the maximum voltage +can match the datasheet. + +Fixes: 3a8d1a73a037 ("regulator: add LM363X driver") +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20190626132632.32629-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/lm363x-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/lm363x-regulator.c b/drivers/regulator/lm363x-regulator.c +index f53e63301a205..e71117d7217bc 100644 +--- a/drivers/regulator/lm363x-regulator.c ++++ b/drivers/regulator/lm363x-regulator.c +@@ -33,7 +33,7 @@ + + /* LM3632 */ + #define LM3632_BOOST_VSEL_MAX 0x26 +-#define LM3632_LDO_VSEL_MAX 0x29 ++#define LM3632_LDO_VSEL_MAX 0x28 + #define LM3632_VBOOST_MIN 4500000 + #define LM3632_VLDO_MIN 4000000 + +-- +2.20.1 + diff --git a/queue-4.9/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch b/queue-4.9/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch new file mode 100644 index 00000000000..103631755a8 --- /dev/null +++ b/queue-4.9/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch @@ -0,0 +1,56 @@ +From 3fcb3bcb5cfa2190ffd61dd63bb3fc6aec788715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 09:38:17 +0200 +Subject: s390/crypto: xts-aes-s390 fix extra run-time crypto self tests + finding + +From: Harald Freudenberger + +[ Upstream commit 9e323d45ba94262620a073a3f9945ca927c07c71 ] + +With 'extra run-time crypto self tests' enabled, the selftest +for s390-xts fails with + + alg: skcipher: xts-aes-s390 encryption unexpectedly succeeded on + test vector "random: len=0 klen=64"; expected_error=-22, + cfg="random: inplace use_digest nosimd src_divs=[2.61%@+4006, + 84.44%@+21, 1.55%@+13, 4.50%@+344, 4.26%@+21, 2.64%@+27]" + +This special case with nbytes=0 is not handled correctly and this +fix now makes sure that -EINVAL is returned when there is en/decrypt +called with 0 bytes to en/decrypt. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/aes_s390.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 591cbdf615af0..1a906dd7ca7d9 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -572,6 +572,9 @@ static int xts_aes_encrypt(struct blkcipher_desc *desc, + struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + ++ if (!nbytes) ++ return -EINVAL; ++ + if (unlikely(!xts_ctx->fc)) + return xts_fallback_encrypt(desc, dst, src, nbytes); + +@@ -586,6 +589,9 @@ static int xts_aes_decrypt(struct blkcipher_desc *desc, + struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + ++ if (!nbytes) ++ return -EINVAL; ++ + if (unlikely(!xts_ctx->fc)) + return xts_fallback_decrypt(desc, dst, src, nbytes); + +-- +2.20.1 + diff --git a/queue-4.9/sched-core-fix-cpu-controller-for-rt_group_sched.patch b/queue-4.9/sched-core-fix-cpu-controller-for-rt_group_sched.patch new file mode 100644 index 00000000000..15772411b5a --- /dev/null +++ b/queue-4.9/sched-core-fix-cpu-controller-for-rt_group_sched.patch @@ -0,0 +1,84 @@ +From a8cdce55531e4c2ff3065a3a080817a0681151f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 08:34:55 +0200 +Subject: sched/core: Fix CPU controller for !RT_GROUP_SCHED +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juri Lelli + +[ Upstream commit a07db5c0865799ebed1f88be0df50c581fb65029 ] + +On !CONFIG_RT_GROUP_SCHED configurations it is currently not possible to +move RT tasks between cgroups to which CPU controller has been attached; +but it is oddly possible to first move tasks around and then make them +RT (setschedule to FIFO/RR). + +E.g.: + + # mkdir /sys/fs/cgroup/cpu,cpuacct/group1 + # chrt -fp 10 $$ + # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks + bash: echo: write error: Invalid argument + # chrt -op 0 $$ + # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks + # chrt -fp 10 $$ + # cat /sys/fs/cgroup/cpu,cpuacct/group1/tasks + 2345 + 2598 + # chrt -p 2345 + pid 2345's current scheduling policy: SCHED_FIFO + pid 2345's current scheduling priority: 10 + +Also, as Michal noted, it is currently not possible to enable CPU +controller on unified hierarchy with !CONFIG_RT_GROUP_SCHED (if there +are any kernel RT threads in root cgroup, they can't be migrated to the +newly created CPU controller's root in cgroup_update_dfl_csses()). + +Existing code comes with a comment saying the "we don't support RT-tasks +being in separate groups". Such comment is however stale and belongs to +pre-RT_GROUP_SCHED times. Also, it doesn't make much sense for +!RT_GROUP_ SCHED configurations, since checks related to RT bandwidth +are not performed at all in these cases. + +Make moving RT tasks between CPU controller groups viable by removing +special case check for RT (and DEADLINE) tasks. + +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Michal Koutný +Reviewed-by: Daniel Bristot de Oliveira +Acked-by: Tejun Heo +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: lizefan@huawei.com +Cc: longman@redhat.com +Cc: luca.abeni@santannapisa.it +Cc: rostedt@goodmis.org +Link: https://lkml.kernel.org/r/20190719063455.27328-1-juri.lelli@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 3861dd6da91e7..63be0bcfa286d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8474,10 +8474,6 @@ static int cpu_cgroup_can_attach(struct cgroup_taskset *tset) + #ifdef CONFIG_RT_GROUP_SCHED + if (!sched_rt_can_attach(css_tg(css), task)) + return -EINVAL; +-#else +- /* We don't support RT-tasks being in separate groups */ +- if (task->sched_class != &fair_sched_class) +- return -EINVAL; + #endif + /* + * Serialize against wake_up_new_task() such that if its +-- +2.20.1 + diff --git a/queue-4.9/sched-fair-fix-imbalance-due-to-cpu-affinity.patch b/queue-4.9/sched-fair-fix-imbalance-due-to-cpu-affinity.patch new file mode 100644 index 00000000000..3f9e3b984b5 --- /dev/null +++ b/queue-4.9/sched-fair-fix-imbalance-due-to-cpu-affinity.patch @@ -0,0 +1,66 @@ +From 8f7136b28d415c0a4d57502d3afb1af4c8920b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2019 17:47:02 +0200 +Subject: sched/fair: Fix imbalance due to CPU affinity + +From: Vincent Guittot + +[ Upstream commit f6cad8df6b30a5d2bbbd2e698f74b4cafb9fb82b ] + +The load_balance() has a dedicated mecanism to detect when an imbalance +is due to CPU affinity and must be handled at parent level. In this case, +the imbalance field of the parent's sched_group is set. + +The description of sg_imbalanced() gives a typical example of two groups +of 4 CPUs each and 4 tasks each with a cpumask covering 1 CPU of the first +group and 3 CPUs of the second group. Something like: + + { 0 1 2 3 } { 4 5 6 7 } + * * * * + +But the load_balance fails to fix this UC on my octo cores system +made of 2 clusters of quad cores. + +Whereas the load_balance is able to detect that the imbalanced is due to +CPU affinity, it fails to fix it because the imbalance field is cleared +before letting parent level a chance to run. In fact, when the imbalance is +detected, the load_balance reruns without the CPU with pinned tasks. But +there is no other running tasks in the situation described above and +everything looks balanced this time so the imbalance field is immediately +cleared. + +The imbalance field should not be cleared if there is no other task to move +when the imbalance is detected. + +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/1561996022-28829-1-git-send-email-vincent.guittot@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index b314feaf91f46..d8afae1bd5c5e 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7929,9 +7929,10 @@ static int load_balance(int this_cpu, struct rq *this_rq, + out_balanced: + /* + * We reach balance although we may have faced some affinity +- * constraints. Clear the imbalance flag if it was set. ++ * constraints. Clear the imbalance flag only if other tasks got ++ * a chance to move and fix the imbalance. + */ +- if (sd_parent) { ++ if (sd_parent && !(env.flags & LBF_ALL_PINNED)) { + int *group_imbalance = &sd_parent->groups->sgc->imbalance; + + if (*group_imbalance) +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 9b3f85fad08..eef8e7e865f 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -36,3 +36,62 @@ appletalk-enforce-cap_net_raw-for-raw-sockets.patch ax25-enforce-cap_net_raw-for-raw-sockets.patch ieee802154-enforce-cap_net_raw-for-raw-sockets.patch nfc-enforce-cap_net_raw-for-raw-sockets.patch +alsa-hda-flush-interrupts-on-disabling.patch +regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch +asoc-sgtl5000-fix-charge-pump-source-assignment.patch +dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch +leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch +media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch +media-exynos4-is-fix-leaked-of_node-references.patch +media-hdpvr-add-device-num-check-and-handling.patch +sched-fair-fix-imbalance-due-to-cpu-affinity.patch +sched-core-fix-cpu-controller-for-rt_group_sched.patch +x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch +x86-apic-soft-disable-apic-before-initializing-it.patch +alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch +alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch +media-iguanair-add-sanity-checks.patch +base-soc-export-soc_device_register-unregister-apis.patch +alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch +ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch +edac-altera-use-the-proper-type-for-the-irq-status-b.patch +md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch +md-don-t-set-in_sync-if-array-is-frozen.patch +efi-cper-print-aer-info-of-pcie-fatal-error.patch +media-gspca-zero-usb_buf-on-error.patch +dmaengine-iop-adma-use-correct-printk-format-strings.patch +media-omap3isp-don-t-set-streaming-state-on-random-s.patch +net-lpc-enet-fix-printk-format-strings.patch +arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch +media-radio-si470x-kill-urb-on-error.patch +media-hdpvr-add-terminating-0-at-end-of-string.patch +media-dvb-core-fix-a-memory-leak-bug.patch +pm-devfreq-passive-use-non-devm-notifiers.patch +pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch +media-saa7146-add-cleanup-in-hexium_attach.patch +media-cpia2_usb-fix-memory-leaks.patch +media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch +media-ov9650-add-a-sanity-check.patch +acpi-cppc-do-not-require-the-_psd-method.patch +arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch +nvmet-fix-data-units-read-and-written-counters-in-sm.patch +iommu-amd-silence-warnings-under-memory-pressure.patch +libtraceevent-change-users-plugin-directory.patch +arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch +acpi-custom_method-fix-memory-leaks.patch +acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch +hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch +md-raid1-fail-run-raid1-array-when-active-disk-less-.patch +dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch +kprobes-prohibit-probing-on-bug-and-warn-address.patch +s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch +asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch +mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch +libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch +e1000e-add-workaround-for-possible-stalled-packet.patch +drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch +media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch +alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch +btrfs-extent-tree-make-sure-we-only-allocate-extents.patch +media-omap3isp-set-device-on-omap3isp-subdevs.patch +pm-devfreq-passive-fix-compiler-warning.patch diff --git a/queue-4.9/x86-apic-soft-disable-apic-before-initializing-it.patch b/queue-4.9/x86-apic-soft-disable-apic-before-initializing-it.patch new file mode 100644 index 00000000000..5187f7db587 --- /dev/null +++ b/queue-4.9/x86-apic-soft-disable-apic-before-initializing-it.patch @@ -0,0 +1,47 @@ +From b52332d1a88e8a2a2e44ebd578276744e7601351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 20:47:08 +0200 +Subject: x86/apic: Soft disable APIC before initializing it + +From: Thomas Gleixner + +[ Upstream commit 2640da4cccf5cc613bf26f0998b9e340f4b5f69c ] + +If the APIC was already enabled on entry of setup_local_APIC() then +disabling it soft via the SPIV register makes a lot of sense. + +That masks all LVT entries and brings it into a well defined state. + +Otherwise previously enabled LVTs which are not touched in the setup +function stay unmasked and might surprise the just booting kernel. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20190722105219.068290579@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 928ffdc21873c..232350519062b 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1303,6 +1303,14 @@ void setup_local_APIC(void) + return; + } + ++ /* ++ * If this comes from kexec/kcrash the APIC might be enabled in ++ * SPIV. Soft disable it before doing further initialization. ++ */ ++ value = apic_read(APIC_SPIV); ++ value &= ~APIC_SPIV_APIC_ENABLED; ++ apic_write(APIC_SPIV, value); ++ + #ifdef CONFIG_X86_32 + /* Pound the ESR really hard over the head with a big hammer - mbligh */ + if (lapic_is_integrated() && apic->disable_esr) { +-- +2.20.1 + diff --git a/queue-4.9/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch b/queue-4.9/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch new file mode 100644 index 00000000000..1ab71a132a0 --- /dev/null +++ b/queue-4.9/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch @@ -0,0 +1,129 @@ +From 1049b704f2e56726afd3c566a150f83efabdc538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 14:28:13 +0200 +Subject: x86/reboot: Always use NMI fallback when shutdown via reboot vector + IPI fails + +From: Grzegorz Halat + +[ Upstream commit 747d5a1bf293dcb33af755a6d285d41b8c1ea010 ] + +A reboot request sends an IPI via the reboot vector and waits for all other +CPUs to stop. If one or more CPUs are in critical regions with interrupts +disabled then the IPI is not handled on those CPUs and the shutdown hangs +if native_stop_other_cpus() is called with the wait argument set. + +Such a situation can happen when one CPU was stopped within a lock held +section and another CPU is trying to acquire that lock with interrupts +disabled. There are other scenarios which can cause such a lockup as well. + +In theory the shutdown should be attempted by an NMI IPI after the timeout +period elapsed. Though the wait loop after sending the reboot vector IPI +prevents this. It checks the wait request argument and the timeout. If wait +is set, which is true for sys_reboot() then it won't fall through to the +NMI shutdown method after the timeout period has finished. + +This was an oversight when the NMI shutdown mechanism was added to handle +the 'reboot IPI is not working' situation. The mechanism was added to deal +with stuck panic shutdowns, which do not have the wait request set, so the +'wait request' case was probably not considered. + +Remove the wait check from the post reboot vector IPI wait loop and enforce +that the wait loop in the NMI fallback path is invoked even if NMI IPIs are +disabled or the registration of the NMI handler fails. That second wait +loop will then hang if not all CPUs shutdown and the wait argument is set. + +[ tglx: Avoid the hard to parse line break in the NMI fallback path, + add comments and massage the changelog ] + +Fixes: 7d007d21e539 ("x86/reboot: Use NMI to assist in shutting down if IRQ fails") +Signed-off-by: Grzegorz Halat +Signed-off-by: Thomas Gleixner +Cc: Don Zickus +Link: https://lkml.kernel.org/r/20190628122813.15500-1-ghalat@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/smp.c | 46 +++++++++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c +index 2863ad3066921..33ba47c44816b 100644 +--- a/arch/x86/kernel/smp.c ++++ b/arch/x86/kernel/smp.c +@@ -181,6 +181,12 @@ asmlinkage __visible void smp_reboot_interrupt(void) + irq_exit(); + } + ++static int register_stop_handler(void) ++{ ++ return register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, ++ NMI_FLAG_FIRST, "smp_stop"); ++} ++ + static void native_stop_other_cpus(int wait) + { + unsigned long flags; +@@ -214,39 +220,41 @@ static void native_stop_other_cpus(int wait) + apic->send_IPI_allbutself(REBOOT_VECTOR); + + /* +- * Don't wait longer than a second if the caller +- * didn't ask us to wait. ++ * Don't wait longer than a second for IPI completion. The ++ * wait request is not checked here because that would ++ * prevent an NMI shutdown attempt in case that not all ++ * CPUs reach shutdown state. + */ + timeout = USEC_PER_SEC; +- while (num_online_cpus() > 1 && (wait || timeout--)) ++ while (num_online_cpus() > 1 && timeout--) + udelay(1); + } +- +- /* if the REBOOT_VECTOR didn't work, try with the NMI */ +- if ((num_online_cpus() > 1) && (!smp_no_nmi_ipi)) { +- if (register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, +- NMI_FLAG_FIRST, "smp_stop")) +- /* Note: we ignore failures here */ +- /* Hope the REBOOT_IRQ is good enough */ +- goto finish; +- +- /* sync above data before sending IRQ */ +- wmb(); + +- pr_emerg("Shutting down cpus with NMI\n"); ++ /* if the REBOOT_VECTOR didn't work, try with the NMI */ ++ if (num_online_cpus() > 1) { ++ /* ++ * If NMI IPI is enabled, try to register the stop handler ++ * and send the IPI. In any case try to wait for the other ++ * CPUs to stop. ++ */ ++ if (!smp_no_nmi_ipi && !register_stop_handler()) { ++ /* Sync above data before sending IRQ */ ++ wmb(); + +- apic->send_IPI_allbutself(NMI_VECTOR); ++ pr_emerg("Shutting down cpus with NMI\n"); + ++ apic->send_IPI_allbutself(NMI_VECTOR); ++ } + /* +- * Don't wait longer than a 10 ms if the caller +- * didn't ask us to wait. ++ * Don't wait longer than 10 ms if the caller didn't ++ * reqeust it. If wait is true, the machine hangs here if ++ * one or more CPUs do not reach shutdown state. + */ + timeout = USEC_PER_MSEC * 10; + while (num_online_cpus() > 1 && (wait || timeout--)) + udelay(1); + } + +-finish: + local_irq_save(flags); + disable_local_APIC(); + mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); +-- +2.20.1 +