From: Greg Kroah-Hartman Date: Mon, 6 Jan 2020 12:22:02 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.14.163~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=20cca3dbd202532b59f233bdceb3158b779794c4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-realtek-add-headset-mic-no-shutup-for-alc283.patch alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch alsa-usb-audio-fix-set_format-altsetting-sanity-check.patch alsa-usb-audio-set-the-interface-format-after-resume-on-dell-wd19.patch drm-sun4i-hdmi-remove-duplicate-cleanup-calls.patch media-cec-avoid-decrementing-transmit_queue_sz-if-it-is-0.patch media-cec-cec-2.0-only-bcast-messages-were-ignored.patch media-cec-check-transmit_in_progress-not-transmitting.patch media-pulse8-cec-fix-lost-cec_transmit_attempt_done-call.patch mips-avoid-vdso-abi-breakage-due-to-global-register-variable.patch --- diff --git a/queue-4.19/alsa-hda-realtek-add-headset-mic-no-shutup-for-alc283.patch b/queue-4.19/alsa-hda-realtek-add-headset-mic-no-shutup-for-alc283.patch new file mode 100644 index 00000000000..0831f24dd84 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-headset-mic-no-shutup-for-alc283.patch @@ -0,0 +1,32 @@ +From 66c5d718e5a6f80153b5e8d6ad8ba8e9c3320839 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Mon, 9 Dec 2019 15:56:15 +0800 +Subject: ALSA: hda/realtek - Add headset Mic no shutup for ALC283 + +From: Kailang Yang + +commit 66c5d718e5a6f80153b5e8d6ad8ba8e9c3320839 upstream. + +Chrome machine had humming noise from external speaker plugin at +codec D3 state. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/2692449396954c6c968f5b75e2660358@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -513,6 +513,7 @@ static void alc_shutup_pins(struct hda_c + struct alc_spec *spec = codec->spec; + + switch (codec->core.vendor_id) { ++ case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: + case 0x10ec0298: diff --git a/queue-4.19/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch b/queue-4.19/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch new file mode 100644 index 00000000000..8d2b2caafa0 --- /dev/null +++ b/queue-4.19/alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch @@ -0,0 +1,64 @@ +From 0aec96f5897ac16ad9945f531b4bef9a2edd2ebd Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 18 Dec 2019 20:26:06 +0100 +Subject: ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code + +From: Takashi Iwai + +commit 0aec96f5897ac16ad9945f531b4bef9a2edd2ebd upstream. + +Jia-Ju Bai reported a possible sleep-in-atomic scenario in the ice1724 +driver with Infrasonic Quartet support code: namely, ice->set_rate +callback gets called inside ice->reg_lock spinlock, while the callback +in quartet.c holds ice->gpio_mutex. + +This patch fixes the invalid call: it simply moves the calls of +ice->set_rate and ice->set_mclk callbacks outside the spinlock. + +Reported-by: Jia-Ju Bai +Cc: +Link: https://lore.kernel.org/r/5d43135e-73b9-a46a-2155-9e91d0dcdf83@gmail.com +Link: https://lore.kernel.org/r/20191218192606.12866-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/ice1724.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/pci/ice1712/ice1724.c ++++ b/sound/pci/ice1712/ice1724.c +@@ -661,6 +661,7 @@ static int snd_vt1724_set_pro_rate(struc + unsigned long flags; + unsigned char mclk_change; + unsigned int i, old_rate; ++ bool call_set_rate = false; + + if (rate > ice->hw_rates->list[ice->hw_rates->count - 1]) + return -EINVAL; +@@ -684,7 +685,7 @@ static int snd_vt1724_set_pro_rate(struc + * setting clock rate for internal clock mode */ + old_rate = ice->get_rate(ice); + if (force || (old_rate != rate)) +- ice->set_rate(ice, rate); ++ call_set_rate = true; + else if (rate == ice->cur_rate) { + spin_unlock_irqrestore(&ice->reg_lock, flags); + return 0; +@@ -692,12 +693,14 @@ static int snd_vt1724_set_pro_rate(struc + } + + ice->cur_rate = rate; ++ spin_unlock_irqrestore(&ice->reg_lock, flags); ++ ++ if (call_set_rate) ++ ice->set_rate(ice, rate); + + /* setting master clock */ + mclk_change = ice->set_mclk(ice, rate); + +- spin_unlock_irqrestore(&ice->reg_lock, flags); +- + if (mclk_change && ice->gpio.i2s_mclk_changed) + ice->gpio.i2s_mclk_changed(ice); + if (ice->gpio.set_pro_rate) diff --git a/queue-4.19/alsa-usb-audio-fix-set_format-altsetting-sanity-check.patch b/queue-4.19/alsa-usb-audio-fix-set_format-altsetting-sanity-check.patch new file mode 100644 index 00000000000..6c9184791de --- /dev/null +++ b/queue-4.19/alsa-usb-audio-fix-set_format-altsetting-sanity-check.patch @@ -0,0 +1,42 @@ +From 0141254b0a74b37aa7eb13d42a56adba84d51c73 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 20 Dec 2019 10:31:34 +0100 +Subject: ALSA: usb-audio: fix set_format altsetting sanity check + +From: Johan Hovold + +commit 0141254b0a74b37aa7eb13d42a56adba84d51c73 upstream. + +Make sure to check the return value of usb_altnum_to_altsetting() to +avoid dereferencing a NULL pointer when the requested alternate settings +is missing. + +The format altsetting number may come from a quirk table and there does +not seem to be any other validation of it (the corresponding index is +checked however). + +Fixes: b099b9693d23 ("ALSA: usb-audio: Avoid superfluous usb_set_interface() calls") +Cc: stable # 4.18 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191220093134.1248-1-johan@kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/pcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -513,9 +513,9 @@ static int set_format(struct snd_usb_sub + if (WARN_ON(!iface)) + return -EINVAL; + alts = usb_altnum_to_altsetting(iface, fmt->altsetting); +- altsd = get_iface_desc(alts); +- if (WARN_ON(altsd->bAlternateSetting != fmt->altsetting)) ++ if (WARN_ON(!alts)) + return -EINVAL; ++ altsd = get_iface_desc(alts); + + if (fmt == subs->cur_audiofmt) + return 0; diff --git a/queue-4.19/alsa-usb-audio-set-the-interface-format-after-resume-on-dell-wd19.patch b/queue-4.19/alsa-usb-audio-set-the-interface-format-after-resume-on-dell-wd19.patch new file mode 100644 index 00000000000..b536f8506ef --- /dev/null +++ b/queue-4.19/alsa-usb-audio-set-the-interface-format-after-resume-on-dell-wd19.patch @@ -0,0 +1,161 @@ +From 92adc96f8eecd9522a907c197cc3d62e405539fe Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Wed, 18 Dec 2019 21:26:50 +0800 +Subject: ALSA: usb-audio: set the interface format after resume on Dell WD19 + +From: Hui Wang + +commit 92adc96f8eecd9522a907c197cc3d62e405539fe upstream. + +Recently we found the headset-mic on the Dell Dock WD19 doesn't work +anymore after s3 (s2i or deep), this problem could be workarounded by +closing (pcm_close) the app and then reopening (pcm_open) the app, so +this bug is not easy to be detected by users. + +When problem happens, retire_capture_urb() could still be called +periodically, but the size of captured data is always 0, it could be +a firmware bug on the dock. Anyway I found after resuming, the +snd_usb_pcm_prepare() will be called, and if we forcibly run +set_format() to set the interface and its endpoint, the capture +size will be normal again. This problem and workaound also apply to +playback. + +To fix it in the kernel, add a quirk to let set_format() run +forcibly once after resume. + +Signed-off-by: Hui Wang +Cc: +Link: https://lore.kernel.org/r/20191218132650.6303-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.h | 1 + + sound/usb/pcm.c | 21 +++++++++++++++++++-- + sound/usb/quirks-table.h | 3 ++- + sound/usb/quirks.c | 11 +++++++++++ + sound/usb/usbaudio.h | 3 ++- + 5 files changed, 35 insertions(+), 4 deletions(-) + +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -142,6 +142,7 @@ struct snd_usb_substream { + struct snd_usb_endpoint *sync_endpoint; + unsigned long flags; + bool need_setup_ep; /* (re)configure EP at prepare? */ ++ bool need_setup_fmt; /* (re)configure fmt after resume? */ + unsigned int speed; /* USB_SPEED_XXX */ + + u64 formats; /* format bitmasks (all or'ed) */ +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -517,11 +517,11 @@ static int set_format(struct snd_usb_sub + return -EINVAL; + altsd = get_iface_desc(alts); + +- if (fmt == subs->cur_audiofmt) ++ if (fmt == subs->cur_audiofmt && !subs->need_setup_fmt) + return 0; + + /* close the old interface */ +- if (subs->interface >= 0 && subs->interface != fmt->iface) { ++ if (subs->interface >= 0 && (subs->interface != fmt->iface || subs->need_setup_fmt)) { + if (!subs->stream->chip->keep_iface) { + err = usb_set_interface(subs->dev, subs->interface, 0); + if (err < 0) { +@@ -535,6 +535,9 @@ static int set_format(struct snd_usb_sub + subs->altset_idx = 0; + } + ++ if (subs->need_setup_fmt) ++ subs->need_setup_fmt = false; ++ + /* set interface */ + if (iface->cur_altsetting != alts) { + err = snd_usb_select_mode_quirk(subs, fmt); +@@ -1722,6 +1725,13 @@ static int snd_usb_substream_playback_tr + subs->data_endpoint->retire_data_urb = retire_playback_urb; + subs->running = 0; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +@@ -1754,6 +1764,13 @@ static int snd_usb_substream_capture_tri + subs->data_endpoint->retire_data_urb = retire_capture_urb; + subs->running = 1; + return 0; ++ case SNDRV_PCM_TRIGGER_SUSPEND: ++ if (subs->stream->chip->setup_fmt_after_resume_quirk) { ++ stop_endpoints(subs, true); ++ subs->need_setup_fmt = true; ++ return 0; ++ } ++ break; + } + + return -EINVAL; +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3400,7 +3400,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge + .vendor_name = "Dell", + .product_name = "WD19 Dock", + .profile_name = "Dell-WD15-Dock", +- .ifnum = QUIRK_NO_INTERFACE ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_SETUP_FMT_AFTER_RESUME + } + }, + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -519,6 +519,16 @@ static int create_standard_mixer_quirk(s + return snd_usb_create_mixer(chip, quirk->ifnum, 0); + } + ++ ++static int setup_fmt_after_resume_quirk(struct snd_usb_audio *chip, ++ struct usb_interface *iface, ++ struct usb_driver *driver, ++ const struct snd_usb_audio_quirk *quirk) ++{ ++ chip->setup_fmt_after_resume_quirk = 1; ++ return 1; /* Continue with creating streams and mixer */ ++} ++ + /* + * audio-interface quirks + * +@@ -557,6 +567,7 @@ int snd_usb_create_quirk(struct snd_usb_ + [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk, + [QUIRK_AUDIO_ALIGN_TRANSFER] = create_align_transfer_quirk, + [QUIRK_AUDIO_STANDARD_MIXER] = create_standard_mixer_quirk, ++ [QUIRK_SETUP_FMT_AFTER_RESUME] = setup_fmt_after_resume_quirk, + }; + + if (quirk->type < QUIRK_TYPE_COUNT) { +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -44,7 +44,7 @@ struct snd_usb_audio { + wait_queue_head_t shutdown_wait; + unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */ + unsigned int tx_length_quirk:1; /* Put length specifier in transfers */ +- ++ unsigned int setup_fmt_after_resume_quirk:1; /* setup the format to interface after resume */ + int num_interfaces; + int num_suspended_intf; + int sample_rate_read_error; +@@ -107,6 +107,7 @@ enum quirk_type { + QUIRK_AUDIO_EDIROL_UAXX, + QUIRK_AUDIO_ALIGN_TRANSFER, + QUIRK_AUDIO_STANDARD_MIXER, ++ QUIRK_SETUP_FMT_AFTER_RESUME, + + QUIRK_TYPE_COUNT + }; diff --git a/queue-4.19/drm-sun4i-hdmi-remove-duplicate-cleanup-calls.patch b/queue-4.19/drm-sun4i-hdmi-remove-duplicate-cleanup-calls.patch new file mode 100644 index 00000000000..b5a28767ff0 --- /dev/null +++ b/queue-4.19/drm-sun4i-hdmi-remove-duplicate-cleanup-calls.patch @@ -0,0 +1,38 @@ +From 57177d214ee0816c4436c23d6c933ccb32c571f1 Mon Sep 17 00:00:00 2001 +From: Stefan Mavrodiev +Date: Tue, 17 Dec 2019 14:46:32 +0200 +Subject: drm/sun4i: hdmi: Remove duplicate cleanup calls + +From: Stefan Mavrodiev + +commit 57177d214ee0816c4436c23d6c933ccb32c571f1 upstream. + +When the HDMI unbinds drm_connector_cleanup() and drm_encoder_cleanup() +are called. This also happens when the connector and the encoder are +destroyed. This double call triggers a NULL pointer exception. + +The patch fixes this by removing the cleanup calls in the unbind +function. + +Cc: +Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") +Signed-off-by: Stefan Mavrodiev +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20191217124632.20820-1-stefan@olimex.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -651,8 +651,6 @@ static void sun4i_hdmi_unbind(struct dev + struct sun4i_hdmi *hdmi = dev_get_drvdata(dev); + + cec_unregister_adapter(hdmi->cec_adap); +- drm_connector_cleanup(&hdmi->connector); +- drm_encoder_cleanup(&hdmi->encoder); + i2c_del_adapter(hdmi->i2c); + clk_disable_unprepare(hdmi->mod_clk); + clk_disable_unprepare(hdmi->bus_clk); diff --git a/queue-4.19/media-cec-avoid-decrementing-transmit_queue_sz-if-it-is-0.patch b/queue-4.19/media-cec-avoid-decrementing-transmit_queue_sz-if-it-is-0.patch new file mode 100644 index 00000000000..51dc596d5b7 --- /dev/null +++ b/queue-4.19/media-cec-avoid-decrementing-transmit_queue_sz-if-it-is-0.patch @@ -0,0 +1,63 @@ +From 95c29d46ab2a517e4c26d0a07300edca6768db17 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sat, 7 Dec 2019 23:48:09 +0100 +Subject: media: cec: avoid decrementing transmit_queue_sz if it is 0 + +From: Hans Verkuil + +commit 95c29d46ab2a517e4c26d0a07300edca6768db17 upstream. + +WARN if transmit_queue_sz is 0 but do not decrement it. +The CEC adapter will become unresponsive if it goes below +0 since then it thinks there are 4 billion messages in the +queue. + +Obviously this should not happen, but a driver bug could +cause this. + +Signed-off-by: Hans Verkuil +Cc: # for v4.12 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/cec/cec-adap.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -365,7 +365,8 @@ static void cec_data_cancel(struct cec_d + } else { + list_del_init(&data->list); + if (!(data->msg.tx_status & CEC_TX_STATUS_OK)) +- data->adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ data->adap->transmit_queue_sz--; + } + + if (data->msg.tx_status & CEC_TX_STATUS_OK) { +@@ -417,6 +418,14 @@ static void cec_flush(struct cec_adapter + * need to do anything special in that case. + */ + } ++ /* ++ * If something went wrong and this counter isn't what it should ++ * be, then this will reset it back to 0. Warn if it is not 0, ++ * since it indicates a bug, either in this framework or in a ++ * CEC driver. ++ */ ++ if (WARN_ON(adap->transmit_queue_sz)) ++ adap->transmit_queue_sz = 0; + } + + /* +@@ -507,7 +516,8 @@ int cec_thread_func(void *_adap) + data = list_first_entry(&adap->transmit_queue, + struct cec_data, list); + list_del_init(&data->list); +- adap->transmit_queue_sz--; ++ if (!WARN_ON(!data->adap->transmit_queue_sz)) ++ adap->transmit_queue_sz--; + + /* Make this the current transmitting message */ + adap->transmitting = data; diff --git a/queue-4.19/media-cec-cec-2.0-only-bcast-messages-were-ignored.patch b/queue-4.19/media-cec-cec-2.0-only-bcast-messages-were-ignored.patch new file mode 100644 index 00000000000..cfdc6581abb --- /dev/null +++ b/queue-4.19/media-cec-cec-2.0-only-bcast-messages-were-ignored.patch @@ -0,0 +1,41 @@ +From cec935ce69fc386f13959578deb40963ebbb85c3 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 4 Dec 2019 08:52:08 +0100 +Subject: media: cec: CEC 2.0-only bcast messages were ignored + +From: Hans Verkuil + +commit cec935ce69fc386f13959578deb40963ebbb85c3 upstream. + +Some messages are allowed to be a broadcast message in CEC 2.0 +only, and should be ignored by CEC 1.4 devices. + +Unfortunately, the check was wrong, causing such messages to be +marked as invalid under CEC 2.0. + +Signed-off-by: Hans Verkuil +Cc: # for v4.10 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/cec/cec-adap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1038,11 +1038,11 @@ void cec_received_msg_ts(struct cec_adap + valid_la = false; + else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED)) + valid_la = false; +- else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4)) ++ else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST)) + valid_la = false; + else if (cec_msg_is_broadcast(msg) && +- adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 && +- !(dir_fl & BCAST2_0)) ++ adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 && ++ !(dir_fl & BCAST1_4)) + valid_la = false; + } + if (valid_la && min_len) { diff --git a/queue-4.19/media-cec-check-transmit_in_progress-not-transmitting.patch b/queue-4.19/media-cec-check-transmit_in_progress-not-transmitting.patch new file mode 100644 index 00000000000..b1792471f0c --- /dev/null +++ b/queue-4.19/media-cec-check-transmit_in_progress-not-transmitting.patch @@ -0,0 +1,82 @@ +From ac479b51f3f4aaa852b5d3f00ecfb9290230cf64 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 11 Dec 2019 12:47:57 +0100 +Subject: media: cec: check 'transmit_in_progress', not 'transmitting' + +From: Hans Verkuil + +commit ac479b51f3f4aaa852b5d3f00ecfb9290230cf64 upstream. + +Currently wait_event_interruptible_timeout is called in cec_thread_func() +when adap->transmitting is set. But if the adapter is unconfigured +while transmitting, then adap->transmitting is set to NULL. But the +hardware is still actually transmitting the message, and that's +indicated by adap->transmit_in_progress and we should wait until that +is finished or times out before transmitting new messages. + +As the original commit says: adap->transmitting is the userspace view, +adap->transmit_in_progress reflects the hardware state. + +However, if adap->transmitting is NULL and adap->transmit_in_progress +is true, then wait_event_interruptible is called (no timeout), which +can get stuck indefinitely if the CEC driver is flaky and never marks +the transmit-in-progress as 'done'. + +So test against transmit_in_progress when deciding whether to use +the timeout variant or not, instead of testing against adap->transmitting. + +Signed-off-by: Hans Verkuil +Fixes: 32804fcb612b ("media: cec: keep track of outstanding transmits") +Cc: # for v4.19 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/cec/cec-adap.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -450,7 +450,7 @@ int cec_thread_func(void *_adap) + bool timeout = false; + u8 attempts; + +- if (adap->transmitting) { ++ if (adap->transmit_in_progress) { + int err; + + /* +@@ -485,7 +485,7 @@ int cec_thread_func(void *_adap) + goto unlock; + } + +- if (adap->transmitting && timeout) { ++ if (adap->transmit_in_progress && timeout) { + /* + * If we timeout, then log that. Normally this does + * not happen and it is an indication of a faulty CEC +@@ -494,14 +494,18 @@ int cec_thread_func(void *_adap) + * so much traffic on the bus that the adapter was + * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s). + */ +- pr_warn("cec-%s: message %*ph timed out\n", adap->name, +- adap->transmitting->msg.len, +- adap->transmitting->msg.msg); ++ if (adap->transmitting) { ++ pr_warn("cec-%s: message %*ph timed out\n", adap->name, ++ adap->transmitting->msg.len, ++ adap->transmitting->msg.msg); ++ /* Just give up on this. */ ++ cec_data_cancel(adap->transmitting, ++ CEC_TX_STATUS_TIMEOUT); ++ } else { ++ pr_warn("cec-%s: transmit timed out\n", adap->name); ++ } + adap->transmit_in_progress = false; + adap->tx_timeouts++; +- /* Just give up on this. */ +- cec_data_cancel(adap->transmitting, +- CEC_TX_STATUS_TIMEOUT); + goto unlock; + } + diff --git a/queue-4.19/media-pulse8-cec-fix-lost-cec_transmit_attempt_done-call.patch b/queue-4.19/media-pulse8-cec-fix-lost-cec_transmit_attempt_done-call.patch new file mode 100644 index 00000000000..0c71da43f0f --- /dev/null +++ b/queue-4.19/media-pulse8-cec-fix-lost-cec_transmit_attempt_done-call.patch @@ -0,0 +1,81 @@ +From e5a52a1d15c79bb48a430fb263852263ec1d3f11 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sat, 7 Dec 2019 23:43:23 +0100 +Subject: media: pulse8-cec: fix lost cec_transmit_attempt_done() call + +From: Hans Verkuil + +commit e5a52a1d15c79bb48a430fb263852263ec1d3f11 upstream. + +The periodic PING command could interfere with the result of +a CEC transmit, causing a lost cec_transmit_attempt_done() +call. + +Signed-off-by: Hans Verkuil +Cc: # for v4.10 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/pulse8-cec/pulse8-cec.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -121,6 +121,7 @@ struct pulse8 { + unsigned int vers; + struct completion cmd_done; + struct work_struct work; ++ u8 work_result; + struct delayed_work ping_eeprom_work; + struct cec_msg rx_msg; + u8 data[DATA_SIZE]; +@@ -142,8 +143,10 @@ static void pulse8_irq_work_handler(stru + { + struct pulse8 *pulse8 = + container_of(work, struct pulse8, work); ++ u8 result = pulse8->work_result; + +- switch (pulse8->data[0] & 0x3f) { ++ pulse8->work_result = 0; ++ switch (result & 0x3f) { + case MSGCODE_FRAME_DATA: + cec_received_msg(pulse8->adap, &pulse8->rx_msg); + break; +@@ -177,12 +180,12 @@ static irqreturn_t pulse8_interrupt(stru + pulse8->escape = false; + } else if (data == MSGEND) { + struct cec_msg *msg = &pulse8->rx_msg; ++ u8 msgcode = pulse8->buf[0]; + + if (debug) + dev_info(pulse8->dev, "received: %*ph\n", + pulse8->idx, pulse8->buf); +- pulse8->data[0] = pulse8->buf[0]; +- switch (pulse8->buf[0] & 0x3f) { ++ switch (msgcode & 0x3f) { + case MSGCODE_FRAME_START: + msg->len = 1; + msg->msg[0] = pulse8->buf[1]; +@@ -191,14 +194,20 @@ static irqreturn_t pulse8_interrupt(stru + if (msg->len == CEC_MAX_MSG_SIZE) + break; + msg->msg[msg->len++] = pulse8->buf[1]; +- if (pulse8->buf[0] & MSGCODE_FRAME_EOM) ++ if (msgcode & MSGCODE_FRAME_EOM) { ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); ++ break; ++ } + break; + case MSGCODE_TRANSMIT_SUCCEEDED: + case MSGCODE_TRANSMIT_FAILED_LINE: + case MSGCODE_TRANSMIT_FAILED_ACK: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: + case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: ++ WARN_ON(pulse8->work_result); ++ pulse8->work_result = msgcode; + schedule_work(&pulse8->work); + break; + case MSGCODE_HIGH_ERROR: diff --git a/queue-4.19/mips-avoid-vdso-abi-breakage-due-to-global-register-variable.patch b/queue-4.19/mips-avoid-vdso-abi-breakage-due-to-global-register-variable.patch new file mode 100644 index 00000000000..327eda871b7 --- /dev/null +++ b/queue-4.19/mips-avoid-vdso-abi-breakage-due-to-global-register-variable.patch @@ -0,0 +1,97 @@ +From bbcc5672b0063b0e9d65dc8787a4f09c3b5bb5cc Mon Sep 17 00:00:00 2001 +From: Paul Burton +Date: Wed, 1 Jan 2020 20:50:38 -0800 +Subject: MIPS: Avoid VDSO ABI breakage due to global register variable + +From: Paul Burton + +commit bbcc5672b0063b0e9d65dc8787a4f09c3b5bb5cc upstream. + +Declaring __current_thread_info as a global register variable has the +effect of preventing GCC from saving & restoring its value in cases +where the ABI would typically do so. + +To quote GCC documentation: + +> If the register is a call-saved register, call ABI is affected: the +> register will not be restored in function epilogue sequences after the +> variable has been assigned. Therefore, functions cannot safely return +> to callers that assume standard ABI. + +When our position independent VDSO is built for the n32 or n64 ABIs all +functions it exposes should be preserving the value of $gp/$28 for their +caller, but in the presence of the __current_thread_info global register +variable GCC stops doing so & simply clobbers $gp/$28 when calculating +the address of the GOT. + +In cases where the VDSO returns success this problem will typically be +masked by the caller in libc returning & restoring $gp/$28 itself, but +that is by no means guaranteed. In cases where the VDSO returns an error +libc will typically contain a fallback path which will now fail +(typically with a bad memory access) if it attempts anything which +relies upon the value of $gp/$28 - eg. accessing anything via the GOT. + +One fix for this would be to move the declaration of +__current_thread_info inside the current_thread_info() function, +demoting it from global register variable to local register variable & +avoiding inadvertently creating a non-standard calling ABI for the VDSO. +Unfortunately this causes issues for clang, which doesn't support local +register variables as pointed out by commit fe92da0f355e ("MIPS: Changed +current_thread_info() to an equivalent supported by both clang and GCC") +which introduced the global register variable before we had a VDSO to +worry about. + +Instead, fix this by continuing to use the global register variable for +the kernel proper but declare __current_thread_info as a simple extern +variable when building the VDSO. It should never be referenced, and will +cause a link error if it is. This resolves the calling convention issue +for the VDSO without having any impact upon the build of the kernel +itself for either clang or gcc. + +Signed-off-by: Paul Burton +Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") +Reported-by: Jason A. Donenfeld +Reviewed-by: Jason A. Donenfeld +Tested-by: Jason A. Donenfeld +Cc: Arnd Bergmann +Cc: Christian Brauner +Cc: Vincenzo Frascino +Cc: # v4.4+ +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/thread_info.h | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/arch/mips/include/asm/thread_info.h ++++ b/arch/mips/include/asm/thread_info.h +@@ -49,8 +49,26 @@ struct thread_info { + .addr_limit = KERNEL_DS, \ + } + +-/* How to get the thread information struct from C. */ ++/* ++ * A pointer to the struct thread_info for the currently executing thread is ++ * held in register $28/$gp. ++ * ++ * We declare __current_thread_info as a global register variable rather than a ++ * local register variable within current_thread_info() because clang doesn't ++ * support explicit local register variables. ++ * ++ * When building the VDSO we take care not to declare the global register ++ * variable because this causes GCC to not preserve the value of $28/$gp in ++ * functions that change its value (which is common in the PIC VDSO when ++ * accessing the GOT). Since the VDSO shouldn't be accessing ++ * __current_thread_info anyway we declare it extern in order to cause a link ++ * failure if it's referenced. ++ */ ++#ifdef __VDSO__ ++extern struct thread_info *__current_thread_info; ++#else + register struct thread_info *__current_thread_info __asm__("$28"); ++#endif + + static inline struct thread_info *current_thread_info(void) + { diff --git a/queue-4.19/series b/queue-4.19/series index 1eaecf93ca9..0f9567491a5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -39,3 +39,13 @@ xfs-fix-mount-failure-crash-on-invalid-iclog-memory-.patch taskstats-fix-data-race.patch drm-limit-to-int_max-in-create_blob-ioctl.patch netfilter-nft_tproxy-fix-port-selector-on-big-endian.patch +alsa-ice1724-fix-sleep-in-atomic-in-infrasonic-quartet-support-code.patch +alsa-usb-audio-fix-set_format-altsetting-sanity-check.patch +alsa-usb-audio-set-the-interface-format-after-resume-on-dell-wd19.patch +alsa-hda-realtek-add-headset-mic-no-shutup-for-alc283.patch +drm-sun4i-hdmi-remove-duplicate-cleanup-calls.patch +mips-avoid-vdso-abi-breakage-due-to-global-register-variable.patch +media-pulse8-cec-fix-lost-cec_transmit_attempt_done-call.patch +media-cec-cec-2.0-only-bcast-messages-were-ignored.patch +media-cec-avoid-decrementing-transmit_queue_sz-if-it-is-0.patch +media-cec-check-transmit_in_progress-not-transmitting.patch