From: Sasha Levin Date: Sun, 22 Dec 2019 02:37:22 +0000 (-0500) Subject: fixes for 4.19 X-Git-Tag: v4.14.161~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e108178b4084da2bb7de63429c19563b848fbc5;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch b/queue-4.19/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch new file mode 100644 index 00000000000..6936ca0c7b4 --- /dev/null +++ b/queue-4.19/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch @@ -0,0 +1,55 @@ +From b15492c001f219956f34c68890f189634980921c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2019 22:24:34 +0200 +Subject: ACPI: button: Add DMI quirk for Medion Akoya E2215T + +From: Hans de Goede + +[ Upstream commit 932e1ba486117de2fcea3df27ad8218ad6c11470 ] + +The Medion Akoya E2215T's ACPI _LID implementation is quite broken: + + 1. For notifications it uses an ActiveLow Edge GpioInt, rather then + an ActiveBoth one, meaning that the device is only notified when the + lid is closed, not when it is opened. + +2. Matching with this its _LID method simply always returns 0 (closed) + + In order for the Linux LID code to work properly with this implementation, + the lid_init_state selection needs to be set to ACPI_BUTTON_LID_INIT_OPEN. + +This commit adds a DMI quirk for this. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/button.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index a19ff3977ac4..870eb5c7516a 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -91,6 +91,17 @@ static const struct dmi_system_id lid_blacklst[] = { + DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"), + }, + }, ++ { ++ /* ++ * Medion Akoya E2215T, notification of the LID device only ++ * happens on close, not on open and _LID always returns closed. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"), ++ }, ++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN, ++ }, + {} + }; + +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch b/queue-4.19/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch new file mode 100644 index 00000000000..1a0411e2961 --- /dev/null +++ b/queue-4.19/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch @@ -0,0 +1,92 @@ +From ee4201b1242db3004ba3211f5096ab686d4ab16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 15:40:09 +0200 +Subject: ALSA: hda/hdmi - implement mst_no_extra_pcms flag + +From: Kai Vehmanen + +[ Upstream commit 2a2edfbbfee47947dd05f5860c66c0e80ee5e09d ] + +To support the DP-MST multiple streams via single connector feature, +the HDMI driver was extended with the concept of backup PCMs. See +commit 9152085defb6 ("ALSA: hda - add DP MST audio support"). + +This implementation works fine with snd_hda_intel.c as PCM topology +is fully managed within the single driver. + +When the HDA codec driver is used from ASoC components, the concept +of backup PCMs no longer fits. For ASoC topologies, the physical +HDMI converters are presented as backend DAIs and these should match +with hardware capabilities. The ASoC topology may define arbitrary +PCMs (i.e. frontend DAIs) and have processing elements before eventual +routing to the HDMI BE DAIs. With backup PCMs, the link between +FE and BE DAIs would become dynamic and change when monitors are +(un)plugged. This would lead to modifying the topology every time +hotplug events happen, which is not currently possible in ASoC and +there does not seem to be any obvious benefits from this design. + +To overcome above problems and enable the HDMI driver to be used +from ASoC, this patch adds a new mode (mst_no_extra_pcms flags) to +patch_hdmi.c. In this mode, the codec driver does not assume +the backup PCMs to be created. + +Signed-off-by: Kai Vehmanen +Reviewed-by: Takashi Iwai +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20191029134017.18901-2-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_codec.h | 1 + + sound/pci/hda/patch_hdmi.c | 19 ++++++++++++++----- + 2 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h +index 2003403ce1c8..199927694aef 100644 +--- a/sound/pci/hda/hda_codec.h ++++ b/sound/pci/hda/hda_codec.h +@@ -262,6 +262,7 @@ struct hda_codec { + unsigned int force_pin_prefix:1; /* Add location prefix */ + unsigned int link_down_at_suspend:1; /* link down at runtime suspend */ + unsigned int relaxed_resume:1; /* don't resume forcibly for jack */ ++ unsigned int mst_no_extra_pcms:1; /* no backup PCMs for DP-MST */ + + #ifdef CONFIG_PM + unsigned long power_on_acct; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index c827a2a89cc3..9d5e3c8d62b9 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2063,15 +2063,24 @@ static bool is_hdmi_pcm_attached(struct hdac_device *hdac, int pcm_idx) + static int generic_hdmi_build_pcms(struct hda_codec *codec) + { + struct hdmi_spec *spec = codec->spec; +- int idx; ++ int idx, pcm_num; + + /* + * for non-mst mode, pcm number is the same as before +- * for DP MST mode, pcm number is (nid number + dev_num - 1) +- * dev_num is the device entry number in a pin +- * ++ * for DP MST mode without extra PCM, pcm number is same ++ * for DP MST mode with extra PCMs, pcm number is ++ * (nid number + dev_num - 1) ++ * dev_num is the device entry number in a pin + */ +- for (idx = 0; idx < spec->num_nids + spec->dev_num - 1; idx++) { ++ ++ if (codec->mst_no_extra_pcms) ++ pcm_num = spec->num_nids; ++ else ++ pcm_num = spec->num_nids + spec->dev_num - 1; ++ ++ codec_dbg(codec, "hdmi: pcm_num set to %d\n", pcm_num); ++ ++ for (idx = 0; idx < pcm_num; idx++) { + struct hda_pcm *info; + struct hda_pcm_stream *pstr; + +-- +2.20.1 + diff --git a/queue-4.19/alsa-timer-limit-max-amount-of-slave-instances.patch b/queue-4.19/alsa-timer-limit-max-amount-of-slave-instances.patch new file mode 100644 index 00000000000..48a176f7870 --- /dev/null +++ b/queue-4.19/alsa-timer-limit-max-amount-of-slave-instances.patch @@ -0,0 +1,70 @@ +From b147e45dcb84f6e0ed08794c55f65e61177a7a2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 16:42:57 +0100 +Subject: ALSA: timer: Limit max amount of slave instances + +From: Takashi Iwai + +[ Upstream commit fdea53fe5de532969a332d6e5e727f2ad8bf084d ] + +The fuzzer tries to open the timer instances as much as possible, and +this may cause a system hiccup easily. We've already introduced the +cap for the max number of available instances for the h/w timers, and +we should put such a limit also to the slave timers, too. + +This patch introduces the limit to the multiple opened slave timers. +The upper limit is hard-coded to 1000 for now, which should suffice +for any practical usages up to now. + +Link: https://lore.kernel.org/r/20191106154257.5853-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/timer.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 86a31e69fc7d..b5dc51030316 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -88,6 +88,9 @@ static LIST_HEAD(snd_timer_slave_list); + /* lock for slave active lists */ + static DEFINE_SPINLOCK(slave_active_lock); + ++#define MAX_SLAVE_INSTANCES 1000 ++static int num_slaves; ++ + static DEFINE_MUTEX(register_mutex); + + static int snd_timer_free(struct snd_timer *timer); +@@ -266,6 +269,10 @@ int snd_timer_open(struct snd_timer_instance **ti, + err = -EINVAL; + goto unlock; + } ++ if (num_slaves >= MAX_SLAVE_INSTANCES) { ++ err = -EBUSY; ++ goto unlock; ++ } + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { + err = -ENOMEM; +@@ -275,6 +282,7 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = tid->device; + timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; + list_add_tail(&timeri->open_list, &snd_timer_slave_list); ++ num_slaves++; + err = snd_timer_check_slave(timeri); + if (err < 0) { + snd_timer_close_locked(timeri, &card_dev_to_put); +@@ -364,6 +372,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, + struct snd_timer_instance *slave, *tmp; + + list_del(&timeri->open_list); ++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) ++ num_slaves--; + + /* force to stop the timer */ + snd_timer_stop(timeri); +-- +2.20.1 + diff --git a/queue-4.19/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch b/queue-4.19/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch new file mode 100644 index 00000000000..3519dfbbe95 --- /dev/null +++ b/queue-4.19/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch @@ -0,0 +1,73 @@ +From 4b4578eaa0b843b907f4c843f0f1fce16636f12e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2019 19:31:21 +0800 +Subject: arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() + +From: Yunfeng Ye + +[ Upstream commit bfcef4ab1d7ee8921bc322109b1692036cc6cbe0 ] + +In cases like suspend-to-disk and suspend-to-ram, a large number of CPU +cores need to be shut down. At present, the CPU hotplug operation is +serialised, and the CPU cores can only be shut down one by one. In this +process, if PSCI affinity_info() does not return LEVEL_OFF quickly, +cpu_psci_cpu_kill() needs to wait for 10ms. If hundreds of CPU cores +need to be shut down, it will take a long time. + +Normally, there is no need to wait 10ms in cpu_psci_cpu_kill(). So +change the wait interval from 10 ms to max 1 ms and use usleep_range() +instead of msleep() for more accurate timer. + +In addition, reducing the time interval will increase the messages +output, so remove the "Retry ..." message, instead, track time and +output to the the sucessful message. + +Signed-off-by: Yunfeng Ye +Reviewed-by: Sudeep Holla +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/psci.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c +index e8edbf13302a..3856d51c645b 100644 +--- a/arch/arm64/kernel/psci.c ++++ b/arch/arm64/kernel/psci.c +@@ -84,7 +84,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) + + static int cpu_psci_cpu_kill(unsigned int cpu) + { +- int err, i; ++ int err; ++ unsigned long start, end; + + if (!psci_ops.affinity_info) + return 0; +@@ -94,16 +95,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) + * while it is dying. So, try again a few times. + */ + +- for (i = 0; i < 10; i++) { ++ start = jiffies; ++ end = start + msecs_to_jiffies(100); ++ do { + err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); + if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { +- pr_info("CPU%d killed.\n", cpu); ++ pr_info("CPU%d killed (polled %d ms)\n", cpu, ++ jiffies_to_msecs(jiffies - start)); + return 0; + } + +- msleep(10); +- pr_info("Retrying again to check for CPU kill\n"); +- } ++ usleep_range(100, 1000); ++ } while (time_before(jiffies, end)); + + pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", + cpu, err); +-- +2.20.1 + diff --git a/queue-4.19/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch b/queue-4.19/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch new file mode 100644 index 00000000000..e3ca0265b34 --- /dev/null +++ b/queue-4.19/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch @@ -0,0 +1,51 @@ +From 04e406038827c168e7e15d4add54e2d9e15d2178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2019 15:51:38 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 + 2-in-1 + +From: Hans de Goede + +[ Upstream commit 0bb887709eb16bdc4b5baddd8337abf3de72917f ] + +When the Acer Switch 10 SW5-012 quirk was added we did not have +jack-detection support yet; and the builtin microphone selection of +the original quirk is wrong too. + +Fix the microphone-input quirk and add jack-detection info so that the +internal-microphone and headphone/set jack on the Switch 10 work properly. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20191119145138.59162-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index b6dc524830b2..6acd5dd599dc 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -414,10 +414,12 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), + }, +- .driver_data = (void *)(BYT_RT5640_IN1_MAP | +- BYT_RT5640_MCLK_EN | +- BYT_RT5640_SSP0_AIF1), +- ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), + }, + { + .matches = { +-- +2.20.1 + diff --git a/queue-4.19/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch b/queue-4.19/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch new file mode 100644 index 00000000000..b642e16854d --- /dev/null +++ b/queue-4.19/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch @@ -0,0 +1,40 @@ +From f3f353c5c26ae67d379e223a92358bbbff36ea18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 00:29:40 +0800 +Subject: ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint + +From: Yu-Hsuan Hsu + +[ Upstream commit e2db787bdcb4f2722ecf410168f0583764634e45 ] + +On KBL platform, the microphone is attached to external codec(rt5514) +instead of PCH. However, TDM slot between PCH and codec is 16 bits only. +In order to avoid setting wrong format, we should add a constraint to +force to use 16 bits format forever. + +Signed-off-by: Yu-Hsuan Hsu +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190923162940.199580-1-yuhsuan@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index b8a03f58ac8c..f36e33a14728 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -423,6 +423,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + dmic_constraints); + ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); ++ + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch b/queue-4.19/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch new file mode 100644 index 00000000000..54272204842 --- /dev/null +++ b/queue-4.19/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch @@ -0,0 +1,43 @@ +From 91c7044c72072b1d72b1bfa63bb306d86ce1c433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 17:13:30 -0800 +Subject: ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile + +From: Ben Zhang + +[ Upstream commit eabf424f7b60246c76dcb0ea6f1e83ef9abbeaa6 ] + +The codec dies when RT5677_PWR_ANLG2(MX-64h) is set to 0xACE1 +while it's streaming audio over SPI. The DSP firmware turns +on PLL2 (MX-64 bit 8) when SPI streaming starts. However regmap +does not believe that register can change by itself. When +BST1 (bit 15) is turned on with regmap_update_bits(), it doesn't +read the register first before write, so PLL2 power bit is +cleared by accident. + +Marking MX-64h as volatile in regmap solved the issue. + +Signed-off-by: Ben Zhang +Signed-off-by: Curtis Malainey +Link: https://lore.kernel.org/r/20191106011335.223061-6-cujomalainey@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5677.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 9b7a1833d331..71b7b881df39 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -297,6 +297,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) + case RT5677_I2C_MASTER_CTRL7: + case RT5677_I2C_MASTER_CTRL8: + case RT5677_HAP_GENE_CTRL2: ++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ + case RT5677_PWR_DSP_ST: + case RT5677_PRIV_DATA: + case RT5677_ASRC_22: +-- +2.20.1 + diff --git a/queue-4.19/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch b/queue-4.19/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch new file mode 100644 index 00000000000..45863c4c4a9 --- /dev/null +++ b/queue-4.19/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch @@ -0,0 +1,53 @@ +From 3a839a18ffa28d5634e806592fb0b4e84e846612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 15:36:33 +0800 +Subject: ASoC: wm2200: add missed operations in remove and probe failure + +From: Chuhong Yuan + +[ Upstream commit 2dab09be49a1e7a4dd13cb47d3a1441a2ef33a87 ] + +This driver misses calls to pm_runtime_disable and regulator_bulk_disable +in remove and a call to free_irq in probe failure. +Add the calls to fix it. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20191118073633.28237-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm2200.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c +index deff65161504..0a3b746fb909 100644 +--- a/sound/soc/codecs/wm2200.c ++++ b/sound/soc/codecs/wm2200.c +@@ -2413,6 +2413,8 @@ static int wm2200_i2c_probe(struct i2c_client *i2c, + + err_pm_runtime: + pm_runtime_disable(&i2c->dev); ++ if (i2c->irq) ++ free_irq(i2c->irq, wm2200); + err_reset: + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); +@@ -2429,12 +2431,15 @@ static int wm2200_i2c_remove(struct i2c_client *i2c) + { + struct wm2200_priv *wm2200 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm2200); + if (wm2200->pdata.reset) + gpio_set_value_cansleep(wm2200->pdata.reset, 0); + if (wm2200->pdata.ldo_ena) + gpio_set_value_cansleep(wm2200->pdata.ldo_ena, 0); ++ regulator_bulk_disable(ARRAY_SIZE(wm2200->core_supplies), ++ wm2200->core_supplies); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-wm5100-add-missed-pm_runtime_disable.patch b/queue-4.19/asoc-wm5100-add-missed-pm_runtime_disable.patch new file mode 100644 index 00000000000..c30befd14fe --- /dev/null +++ b/queue-4.19/asoc-wm5100-add-missed-pm_runtime_disable.patch @@ -0,0 +1,45 @@ +From 121590896f43181e5cfb0cde4adf48a06639394d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 15:37:07 +0800 +Subject: ASoC: wm5100: add missed pm_runtime_disable + +From: Chuhong Yuan + +[ Upstream commit b1176bbb70866f24099cd2720283c7219fb4a81c ] + +The driver forgets to call pm_runtime_disable in remove and +probe failure. +Add the calls to fix it. + +Signed-off-by: Chuhong Yuan +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20191118073707.28298-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm5100.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c +index ba89d9d711f7..b793701aafcd 100644 +--- a/sound/soc/codecs/wm5100.c ++++ b/sound/soc/codecs/wm5100.c +@@ -2620,6 +2620,7 @@ static int wm5100_i2c_probe(struct i2c_client *i2c, + return ret; + + err_reset: ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +@@ -2643,6 +2644,7 @@ static int wm5100_i2c_remove(struct i2c_client *i2c) + { + struct wm5100_priv *wm5100 = i2c_get_clientdata(i2c); + ++ pm_runtime_disable(&i2c->dev); + if (i2c->irq) + free_irq(i2c->irq, wm5100); + wm5100_free_gpio(i2c); +-- +2.20.1 + diff --git a/queue-4.19/asoc-wm8904-fix-regcache-handling.patch b/queue-4.19/asoc-wm8904-fix-regcache-handling.patch new file mode 100644 index 00000000000..89a62d2ffbc --- /dev/null +++ b/queue-4.19/asoc-wm8904-fix-regcache-handling.patch @@ -0,0 +1,41 @@ +From 16ac4336b1f35259a8539abf2bdc81fb0af98a89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 23:36:29 +0100 +Subject: ASoC: wm8904: fix regcache handling + +From: Michael Walle + +[ Upstream commit e9149b8c00d25dbaef1aa174fc604bed207e576d ] + +The current code assumes that the power is turned off in +SND_SOC_BIAS_OFF. If there are no actual regulator the codec isn't +turned off and the registers are not reset to their default values but +the regcache is still marked as dirty. Thus a value might not be written +to the hardware if it is set to the default value. Do a software reset +before turning off the power to make sure the registers are always reset +to their default states. + +Signed-off-by: Michael Walle +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20191112223629.21867-1-michael@walle.cc +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8904.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c +index 1965635ec07c..d14e851b9160 100644 +--- a/sound/soc/codecs/wm8904.c ++++ b/sound/soc/codecs/wm8904.c +@@ -1902,6 +1902,7 @@ static int wm8904_set_bias_level(struct snd_soc_component *component, + snd_soc_component_update_bits(component, WM8904_BIAS_CONTROL_0, + WM8904_BIAS_ENA, 0); + ++ snd_soc_component_write(component, WM8904_SW_RESET_AND_ID, 0); + regcache_cache_only(wm8904->regmap, true); + regcache_mark_dirty(wm8904->regmap); + +-- +2.20.1 + diff --git a/queue-4.19/ath10k-correct-error-handling-of-dma_map_single.patch b/queue-4.19/ath10k-correct-error-handling-of-dma_map_single.patch new file mode 100644 index 00000000000..fe708b07d3d --- /dev/null +++ b/queue-4.19/ath10k-correct-error-handling-of-dma_map_single.patch @@ -0,0 +1,44 @@ +From 6563bb536166097ad44bf58b396eac7424cd199d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 11:28:17 -0700 +Subject: ath10k: Correct error handling of dma_map_single() + +From: Bjorn Andersson + +[ Upstream commit d43810b2c1808ac865aa1a2a2c291644bf95345c ] + +The return value of dma_map_single() should be checked for errors using +dma_mapping_error() and the skb has been dequeued so it needs to be +freed. + +This was found when enabling CONFIG_DMA_API_DEBUG and it warned about the +missing dma_mapping_error() call. + +Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over wmi") +Reported-by: Niklas Cassel +Signed-off-by: Bjorn Andersson +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 174e0ce31c42..448e3a8c33a6 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3844,8 +3844,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work) + ar->running_fw->fw_file.fw_features)) { + paddr = dma_map_single(ar->dev, skb->data, + skb->len, DMA_TO_DEVICE); +- if (!paddr) ++ if (dma_mapping_error(ar->dev, paddr)) { ++ ieee80211_free_txskb(ar->hw, skb); + continue; ++ } + ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr); + if (ret) { + ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n", +-- +2.20.1 + diff --git a/queue-4.19/ath10k-fix-backtrace-on-coredump.patch b/queue-4.19/ath10k-fix-backtrace-on-coredump.patch new file mode 100644 index 00000000000..f2d8eb2ade3 --- /dev/null +++ b/queue-4.19/ath10k-fix-backtrace-on-coredump.patch @@ -0,0 +1,74 @@ +From 32aecff3b5ccb39f3e908156c6b9457d4670fd79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 19:07:01 +0530 +Subject: ath10k: fix backtrace on coredump + +From: Anilkumar Kolli + +[ Upstream commit d98ddae85a4a57124f87960047b1b6419312147f ] + +In a multiradio board with one QCA9984 and one AR9987 +after enabling the crashdump with module parameter +coredump_mask=7, below backtrace is seen. + +vmalloc: allocation failure: 0 bytes + kworker/u4:0: page allocation failure: order:0, mode:0x80d2 + CPU: 0 PID: 6 Comm: kworker/u4:0 Not tainted 3.14.77 #130 + Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] + (unwind_backtrace) from [] (show_stack+0x10/0x14) + (dump_stack+0x80/0xa0) + (warn_alloc_failed+0xd0/0xfc) + (__vmalloc_node_range+0x1b4/0x1d8) + (__vmalloc_node+0x34/0x40) + (vzalloc+0x24/0x30) + (ath10k_coredump_register+0x6c/0x88 [ath10k_core]) + (ath10k_core_register_work+0x350/0xb34 [ath10k_core]) + (process_one_work+0x20c/0x32c) + (worker_thread+0x228/0x360) + +This is due to ath10k_hw_mem_layout is not defined for AR9987. +For coredump undefined hw ramdump_size is 0. +Check for the ramdump_size before allocation memory. + +Tested on: AR9987, QCA9984 +FW version: 10.4-3.9.0.2-00044 + +Signed-off-by: Anilkumar Kolli +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/coredump.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c +index 4d28063052fe..385b84f24322 100644 +--- a/drivers/net/wireless/ath/ath10k/coredump.c ++++ b/drivers/net/wireless/ath/ath10k/coredump.c +@@ -1105,9 +1105,11 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar) + dump_tlv = (struct ath10k_tlv_dump_data *)(buf + sofar); + dump_tlv->type = cpu_to_le32(ATH10K_FW_CRASH_DUMP_RAM_DATA); + dump_tlv->tlv_len = cpu_to_le32(crash_data->ramdump_buf_len); +- memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, +- crash_data->ramdump_buf_len); +- sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ if (crash_data->ramdump_buf_len) { ++ memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf, ++ crash_data->ramdump_buf_len); ++ sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len; ++ } + } + + spin_unlock_bh(&ar->data_lock); +@@ -1154,6 +1156,9 @@ int ath10k_coredump_register(struct ath10k *ar) + if (test_bit(ATH10K_FW_CRASH_DUMP_RAM_DATA, &ath10k_coredump_mask)) { + crash_data->ramdump_buf_len = ath10k_coredump_get_ramdump_size(ar); + ++ if (!crash_data->ramdump_buf_len) ++ return 0; ++ + crash_data->ramdump_buf = vzalloc(crash_data->ramdump_buf_len); + if (!crash_data->ramdump_buf) + return -ENOMEM; +-- +2.20.1 + diff --git a/queue-4.19/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch b/queue-4.19/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch new file mode 100644 index 00000000000..9d366f84f81 --- /dev/null +++ b/queue-4.19/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch @@ -0,0 +1,42 @@ +From bcd886005b66dfd471518b32aeff7b89c8b0a1a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 20:04:37 +0200 +Subject: ath10k: fix get invalid tx rate for Mesh metric + +From: Miaoqing Pan + +[ Upstream commit 05a11003a56507023f18d3249a4d4d119c0a3e9c ] + +ath10k does not provide transmit rate info per MSDU +in tx completion, mark that as -1 so mac80211 +will ignore the rates. This fixes mac80211 update Mesh +link metric with invalid transmit rate info. + +Tested HW: QCA9984 +Tested FW: 10.4-3.9.0.2-00035 + +Signed-off-by: Hou Bao Hou +Signed-off-by: Anilkumar Kolli +Signed-off-by: Miaoqing Pan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/txrx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index 6f62ddc0494c..6c47e4b6aa6c 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -101,6 +101,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + info = IEEE80211_SKB_CB(msdu); + memset(&info->status, 0, sizeof(info->status)); ++ info->status.rates[0].idx = -1; ++ + trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); + + if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) +-- +2.20.1 + diff --git a/queue-4.19/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch b/queue-4.19/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch new file mode 100644 index 00000000000..30512ddd0ac --- /dev/null +++ b/queue-4.19/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch @@ -0,0 +1,120 @@ +From 2f268a61473aa3efe8a2069588f74d1171c61045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Oct 2017 17:03:12 -0700 +Subject: ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq + +From: Ben Greear + +[ Upstream commit cc6df017e55764ffef9819dd9554053182535ffd ] + +Offchannel management frames were failing: + +[18099.253732] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780 +[18102.293686] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780 +[18105.333653] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780 +[18108.373712] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780 +[18111.413687] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e36c0 +[18114.453726] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3f00 +[18117.493773] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e36c0 +[18120.533631] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3f00 + +This bug appears to have been added between 4.0 (which works for us), +and 4.4, which does not work. + +I think this is because the tx-offchannel logic gets in a loop when +ath10k_mac_tx_frm_has_freq(ar) is false, so pkt is never actually +sent to the firmware for transmit. + +This patch fixes the problem on 4.9 for me, and now HS20 clients +can work again with my firmware. + +Antonio: tested with 10.4-3.5.3-00057 on QCA4019 and QCA9888 + +Signed-off-by: Ben Greear +Tested-by: Antonio Quartulli +[kvalo@codeaurora.org: improve commit log, remove unneeded parenthesis] +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 613ca74f1b28..174e0ce31c42 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3651,7 +3651,7 @@ static int ath10k_mac_tx(struct ath10k *ar, + struct ieee80211_vif *vif, + enum ath10k_hw_txrx_mode txmode, + enum ath10k_mac_tx_path txpath, +- struct sk_buff *skb) ++ struct sk_buff *skb, bool noque_offchan) + { + struct ieee80211_hw *hw = ar->hw; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +@@ -3679,10 +3679,10 @@ static int ath10k_mac_tx(struct ath10k *ar, + } + } + +- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { ++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { + if (!ath10k_mac_tx_frm_has_freq(ar)) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", ++ skb, skb->len); + + skb_queue_tail(&ar->offchan_tx_queue, skb); + ieee80211_queue_work(hw, &ar->offchan_tx_work); +@@ -3744,8 +3744,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + + mutex_lock(&ar->conf_mutex); + +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", ++ skb, skb->len); + + hdr = (struct ieee80211_hdr *)skb->data; + peer_addr = ieee80211_get_DA(hdr); +@@ -3791,7 +3791,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) + txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); + txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); + if (ret) { + ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", + ret); +@@ -3801,8 +3801,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + time_left = + wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); + if (time_left == 0) +- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", +- skb); ++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", ++ skb, skb->len); + + if (!peer && tmp_peer_created) { + ret = ath10k_peer_delete(ar, vdev_id, peer_addr); +@@ -3998,7 +3998,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (unlikely(ret)) { + ath10k_warn(ar, "failed to push frame: %d\n", ret); + +@@ -4280,7 +4280,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (ret) { + ath10k_warn(ar, "failed to transmit frame: %d\n", ret); + if (is_htt) { +-- +2.20.1 + diff --git a/queue-4.19/bcache-fix-deadlock-in-bcache_allocator.patch b/queue-4.19/bcache-fix-deadlock-in-bcache_allocator.patch new file mode 100644 index 00000000000..e8907c884f9 --- /dev/null +++ b/queue-4.19/bcache-fix-deadlock-in-bcache_allocator.patch @@ -0,0 +1,156 @@ +From 3e963642e4230d67f7be0e780204a52c45cf8220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 16:03:21 +0800 +Subject: bcache: fix deadlock in bcache_allocator + +From: Andrea Righi + +[ Upstream commit 84c529aea182939e68f618ed9813740c9165c7eb ] + +bcache_allocator can call the following: + + bch_allocator_thread() + -> bch_prio_write() + -> bch_bucket_alloc() + -> wait on &ca->set->bucket_wait + +But the wake up event on bucket_wait is supposed to come from +bch_allocator_thread() itself => deadlock: + +[ 1158.490744] INFO: task bcache_allocato:15861 blocked for more than 10 seconds. +[ 1158.495929] Not tainted 5.3.0-050300rc3-generic #201908042232 +[ 1158.500653] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1158.504413] bcache_allocato D 0 15861 2 0x80004000 +[ 1158.504419] Call Trace: +[ 1158.504429] __schedule+0x2a8/0x670 +[ 1158.504432] schedule+0x2d/0x90 +[ 1158.504448] bch_bucket_alloc+0xe5/0x370 [bcache] +[ 1158.504453] ? wait_woken+0x80/0x80 +[ 1158.504466] bch_prio_write+0x1dc/0x390 [bcache] +[ 1158.504476] bch_allocator_thread+0x233/0x490 [bcache] +[ 1158.504491] kthread+0x121/0x140 +[ 1158.504503] ? invalidate_buckets+0x890/0x890 [bcache] +[ 1158.504506] ? kthread_park+0xb0/0xb0 +[ 1158.504510] ret_from_fork+0x35/0x40 + +Fix by making the call to bch_prio_write() non-blocking, so that +bch_allocator_thread() never waits on itself. + +Moreover, make sure to wake up the garbage collector thread when +bch_prio_write() is failing to allocate buckets. + +BugLink: https://bugs.launchpad.net/bugs/1784665 +BugLink: https://bugs.launchpad.net/bugs/1796292 +Signed-off-by: Andrea Righi +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/alloc.c | 5 ++++- + drivers/md/bcache/bcache.h | 2 +- + drivers/md/bcache/super.c | 27 +++++++++++++++++++++------ + 3 files changed, 26 insertions(+), 8 deletions(-) + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 9c3beb1e382b..46794cac167e 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -377,7 +377,10 @@ retry_invalidate: + if (!fifo_full(&ca->free_inc)) + goto retry_invalidate; + +- bch_prio_write(ca); ++ if (bch_prio_write(ca, false) < 0) { ++ ca->invalidate_needs_gc = 1; ++ wake_up_gc(ca->set); ++ } + } + } + out: +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 83f0b91aeb90..4677b18ac281 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -959,7 +959,7 @@ bool bch_cached_dev_error(struct cached_dev *dc); + __printf(2, 3) + bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...); + +-void bch_prio_write(struct cache *ca); ++int bch_prio_write(struct cache *ca, bool wait); + void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent); + + extern struct workqueue_struct *bcache_wq; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 2d60bcdb5b9c..c45d9ad01077 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -525,12 +525,29 @@ static void prio_io(struct cache *ca, uint64_t bucket, int op, + closure_sync(cl); + } + +-void bch_prio_write(struct cache *ca) ++int bch_prio_write(struct cache *ca, bool wait) + { + int i; + struct bucket *b; + struct closure cl; + ++ pr_debug("free_prio=%zu, free_none=%zu, free_inc=%zu", ++ fifo_used(&ca->free[RESERVE_PRIO]), ++ fifo_used(&ca->free[RESERVE_NONE]), ++ fifo_used(&ca->free_inc)); ++ ++ /* ++ * Pre-check if there are enough free buckets. In the non-blocking ++ * scenario it's better to fail early rather than starting to allocate ++ * buckets and do a cleanup later in case of failure. ++ */ ++ if (!wait) { ++ size_t avail = fifo_used(&ca->free[RESERVE_PRIO]) + ++ fifo_used(&ca->free[RESERVE_NONE]); ++ if (prio_buckets(ca) > avail) ++ return -ENOMEM; ++ } ++ + closure_init_stack(&cl); + + lockdep_assert_held(&ca->set->bucket_lock); +@@ -540,9 +557,6 @@ void bch_prio_write(struct cache *ca) + atomic_long_add(ca->sb.bucket_size * prio_buckets(ca), + &ca->meta_sectors_written); + +- //pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free), +- // fifo_used(&ca->free_inc), fifo_used(&ca->unused)); +- + for (i = prio_buckets(ca) - 1; i >= 0; --i) { + long bucket; + struct prio_set *p = ca->disk_buckets; +@@ -560,7 +574,7 @@ void bch_prio_write(struct cache *ca) + p->magic = pset_magic(&ca->sb); + p->csum = bch_crc64(&p->magic, bucket_bytes(ca) - 8); + +- bucket = bch_bucket_alloc(ca, RESERVE_PRIO, true); ++ bucket = bch_bucket_alloc(ca, RESERVE_PRIO, wait); + BUG_ON(bucket == -1); + + mutex_unlock(&ca->set->bucket_lock); +@@ -589,6 +603,7 @@ void bch_prio_write(struct cache *ca) + + ca->prio_last_buckets[i] = ca->prio_buckets[i]; + } ++ return 0; + } + + static void prio_read(struct cache *ca, uint64_t bucket) +@@ -1884,7 +1899,7 @@ static int run_cache_set(struct cache_set *c) + + mutex_lock(&c->bucket_lock); + for_each_cache(ca, c, i) +- bch_prio_write(ca); ++ bch_prio_write(ca, true); + mutex_unlock(&c->bucket_lock); + + err = "cannot allocate new UUID bucket"; +-- +2.20.1 + diff --git a/queue-4.19/bcache-fix-static-checker-warning-in-bcache_device_f.patch b/queue-4.19/bcache-fix-static-checker-warning-in-bcache_device_f.patch new file mode 100644 index 00000000000..82cf2abf6a3 --- /dev/null +++ b/queue-4.19/bcache-fix-static-checker-warning-in-bcache_device_f.patch @@ -0,0 +1,99 @@ +From cd9b57e56a0ab1a9bf47560231638188cfcae34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 16:03:17 +0800 +Subject: bcache: fix static checker warning in bcache_device_free() + +From: Coly Li + +[ Upstream commit 2d8869518a525c9bce5f5268419df9dfbe3dfdeb ] + +Commit cafe56359144 ("bcache: A block layer cache") leads to the +following static checker warning: + + ./drivers/md/bcache/super.c:770 bcache_device_free() + warn: variable dereferenced before check 'd->disk' (see line 766) + +drivers/md/bcache/super.c + 762 static void bcache_device_free(struct bcache_device *d) + 763 { + 764 lockdep_assert_held(&bch_register_lock); + 765 + 766 pr_info("%s stopped", d->disk->disk_name); + ^^^^^^^^^ +Unchecked dereference. + + 767 + 768 if (d->c) + 769 bcache_device_detach(d); + 770 if (d->disk && d->disk->flags & GENHD_FL_UP) + ^^^^^^^ +Check too late. + + 771 del_gendisk(d->disk); + 772 if (d->disk && d->disk->queue) + 773 blk_cleanup_queue(d->disk->queue); + 774 if (d->disk) { + 775 ida_simple_remove(&bcache_device_idx, + 776 first_minor_to_idx(d->disk->first_minor)); + 777 put_disk(d->disk); + 778 } + 779 + +It is not 100% sure that the gendisk struct of bcache device will always +be there, the warning makes sense when there is problem in block core. + +This patch tries to remove the static checking warning by checking +d->disk to avoid NULL pointer deferences. + +Reported-by: Dan Carpenter +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/super.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 14d381cc6d74..2d60bcdb5b9c 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -747,20 +747,28 @@ static inline int idx_to_first_minor(int idx) + + static void bcache_device_free(struct bcache_device *d) + { ++ struct gendisk *disk = d->disk; ++ + lockdep_assert_held(&bch_register_lock); + +- pr_info("%s stopped", d->disk->disk_name); ++ if (disk) ++ pr_info("%s stopped", disk->disk_name); ++ else ++ pr_err("bcache device (NULL gendisk) stopped"); + + if (d->c) + bcache_device_detach(d); +- if (d->disk && d->disk->flags & GENHD_FL_UP) +- del_gendisk(d->disk); +- if (d->disk && d->disk->queue) +- blk_cleanup_queue(d->disk->queue); +- if (d->disk) { ++ ++ if (disk) { ++ if (disk->flags & GENHD_FL_UP) ++ del_gendisk(disk); ++ ++ if (disk->queue) ++ blk_cleanup_queue(disk->queue); ++ + ida_simple_remove(&bcache_device_idx, +- first_minor_to_idx(d->disk->first_minor)); +- put_disk(d->disk); ++ first_minor_to_idx(disk->first_minor)); ++ put_disk(disk); + } + + bioset_exit(&d->bio_split); +-- +2.20.1 + diff --git a/queue-4.19/block-fix-writeback-throttling-w-1-compiler-warnings.patch b/queue-4.19/block-fix-writeback-throttling-w-1-compiler-warnings.patch new file mode 100644 index 00000000000..d8baa5e7474 --- /dev/null +++ b/queue-4.19/block-fix-writeback-throttling-w-1-compiler-warnings.patch @@ -0,0 +1,128 @@ +From a60cc9e6fee431409d815f77eb5b232447072868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 16:00:41 -0700 +Subject: block: Fix writeback throttling W=1 compiler warnings + +From: Bart Van Assche + +[ Upstream commit 1d200e9d6f635ae894993a7d0f1b9e0b6e522e3b ] + +Fix the following compiler warnings: + +In file included from ./include/linux/bitmap.h:9, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/cpumask.h:5, + from ./arch/x86/include/asm/msr.h:11, + from ./arch/x86/include/asm/processor.h:21, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:38, + from ./arch/x86/include/asm/preempt.h:7, + from ./include/linux/preempt.h:78, + from ./include/linux/spinlock.h:51, + from ./include/linux/mmzone.h:8, + from ./include/linux/gfp.h:6, + from ./include/linux/mm.h:10, + from ./include/linux/bvec.h:13, + from ./include/linux/blk_types.h:10, + from block/blk-wbt.c:23: +In function 'strncpy', + inlined from 'perf_trace_wbt_stat' at ./include/trace/events/wbt.h:15:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'perf_trace_wbt_lat' at ./include/trace/events/wbt.h:58:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'perf_trace_wbt_step' at ./include/trace/events/wbt.h:87:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'perf_trace_wbt_timer' at ./include/trace/events/wbt.h:126:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'trace_event_raw_event_wbt_stat' at ./include/trace/events/wbt.h:15:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'trace_event_raw_event_wbt_lat' at ./include/trace/events/wbt.h:58:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'trace_event_raw_event_wbt_timer' at ./include/trace/events/wbt.h:126:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In function 'strncpy', + inlined from 'trace_event_raw_event_wbt_step' at ./include/trace/events/wbt.h:87:1: +./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation] + return __builtin_strncpy(p, q, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism"; v4.10). +Signed-off-by: Bart Van Assche +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/trace/events/wbt.h | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h +index b048694070e2..37342a13c9cb 100644 +--- a/include/trace/events/wbt.h ++++ b/include/trace/events/wbt.h +@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->rmean = stat[0].mean; + __entry->rmin = stat[0].min; + __entry->rmax = stat[0].max; +@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->lat = div_u64(lat, 1000); + ), + +@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->msg = msg; + __entry->step = step; + __entry->window = div_u64(window, 1000); +@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->status = status; + __entry->step = step; + __entry->inflight = inflight; +-- +2.20.1 + diff --git a/queue-4.19/bluetooth-fix-advertising-duplicated-flags.patch b/queue-4.19/bluetooth-fix-advertising-duplicated-flags.patch new file mode 100644 index 00000000000..921d0094242 --- /dev/null +++ b/queue-4.19/bluetooth-fix-advertising-duplicated-flags.patch @@ -0,0 +1,60 @@ +From 23c7bc7cafd9b9e75c77fa8bd3b8e647a1d01166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2019 23:58:15 +0200 +Subject: Bluetooth: Fix advertising duplicated flags + +From: Luiz Augusto von Dentz + +[ Upstream commit 6012b9346d8959194c239fd60a62dfec98d43048 ] + +Instances may have flags set as part of its data in which case the code +should not attempt to add it again otherwise it can cause duplication: + +< HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 35 + Handle: 0x00 + Operation: Complete extended advertising data (0x03) + Fragment preference: Minimize fragmentation (0x01) + Data length: 0x06 + Flags: 0x04 + BR/EDR Not Supported + Flags: 0x06 + LE General Discoverable Mode + BR/EDR Not Supported + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Johan Hedberg +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_request.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 9448ebd3780a..a8ddd211e94c 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1258,6 +1258,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + + instance_flags = get_adv_instance_flags(hdev, instance); + ++ /* If instance already has the flags set skip adding it once ++ * again. ++ */ ++ if (adv_instance && eir_get_data(adv_instance->adv_data, ++ adv_instance->adv_data_len, EIR_FLAGS, ++ NULL)) ++ goto skip_flags; ++ + /* The Add Advertising command allows userspace to set both the general + * and limited discoverable flags. + */ +@@ -1290,6 +1298,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + } + } + ++skip_flags: + if (adv_instance) { + memcpy(ptr, adv_instance->adv_data, + adv_instance->adv_data_len); +-- +2.20.1 + diff --git a/queue-4.19/bluetooth-hci_core-fix-init-for-hci_user_channel.patch b/queue-4.19/bluetooth-hci_core-fix-init-for-hci_user_channel.patch new file mode 100644 index 00000000000..d6e26329d5d --- /dev/null +++ b/queue-4.19/bluetooth-hci_core-fix-init-for-hci_user_channel.patch @@ -0,0 +1,52 @@ +From 418c933f63052fad10acddc2c6bd225498701541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 20:20:39 -0700 +Subject: Bluetooth: hci_core: fix init for HCI_USER_CHANNEL + +From: Mattijs Korpershoek + +[ Upstream commit eb8c101e28496888a0dcfe16ab86a1bee369e820 ] + +During the setup() stage, HCI device drivers expect the chip to +acknowledge its setup() completion via vendor specific frames. + +If userspace opens() such HCI device in HCI_USER_CHANNEL [1] mode, +the vendor specific frames are never tranmitted to the driver, as +they are filtered in hci_rx_work(). + +Allow HCI devices which operate in HCI_USER_CHANNEL mode to receive +frames if the HCI device is is HCI_INIT state. + +[1] https://www.spinics.net/lists/linux-bluetooth/msg37345.html + +Fixes: 23500189d7e0 ("Bluetooth: Introduce new HCI socket channel for user operation") +Signed-off-by: Mattijs Korpershoek +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index e0de9a609265..e03faca84919 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -4330,7 +4330,14 @@ static void hci_rx_work(struct work_struct *work) + hci_send_to_sock(hdev, skb); + } + +- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } +-- +2.20.1 + diff --git a/queue-4.19/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch b/queue-4.19/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch new file mode 100644 index 00000000000..efa7f90be15 --- /dev/null +++ b/queue-4.19/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch @@ -0,0 +1,48 @@ +From 81985ca9a71f8780fc274918b8f7fb6170374b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 12:39:43 +0100 +Subject: Bluetooth: missed cpu_to_le16 conversion in hci_init4_req + +From: Ben Dooks (Codethink) + +[ Upstream commit 727ea61a5028f8ac96f75ab34cb1b56e63fd9227 ] + +It looks like in hci_init4_req() the request is being +initialised from cpu-endian data but the packet is specified +to be little-endian. This causes an warning from sparse due +to __le16 to u16 conversion. + +Fix this by using cpu_to_le16() on the two fields in the packet. + +net/bluetooth/hci_core.c:845:27: warning: incorrect type in assignment (different base types) +net/bluetooth/hci_core.c:845:27: expected restricted __le16 [usertype] tx_len +net/bluetooth/hci_core.c:845:27: got unsigned short [usertype] le_max_tx_len +net/bluetooth/hci_core.c:846:28: warning: incorrect type in assignment (different base types) +net/bluetooth/hci_core.c:846:28: expected restricted __le16 [usertype] tx_time +net/bluetooth/hci_core.c:846:28: got unsigned short [usertype] le_max_tx_time + +Signed-off-by: Ben Dooks +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 5afd67ef797a..e0de9a609265 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -841,8 +841,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) + if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { + struct hci_cp_le_write_def_data_len cp; + +- cp.tx_len = hdev->le_max_tx_len; +- cp.tx_time = hdev->le_max_tx_time; ++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); ++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); + hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); + } + +-- +2.20.1 + diff --git a/queue-4.19/bluetooth-workaround-directed-advertising-bug-in-bro.patch b/queue-4.19/bluetooth-workaround-directed-advertising-bug-in-bro.patch new file mode 100644 index 00000000000..39a19fb2145 --- /dev/null +++ b/queue-4.19/bluetooth-workaround-directed-advertising-bug-in-bro.patch @@ -0,0 +1,63 @@ +From 733c412bcb3a9a5a0e5f886b2579a524395eff87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 14:22:43 +0200 +Subject: Bluetooth: Workaround directed advertising bug in Broadcom + controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Szymon Janc + +[ Upstream commit 4c371bb95cf06ded80df0e6139fdd77cee1d9a94 ] + +It appears that some Broadcom controllers (eg BCM20702A0) reject LE Set +Advertising Parameters command if advertising intervals provided are not +within range for undirected and low duty directed advertising. + +Workaround this bug by populating min and max intervals with 'valid' +values. + +< HCI Command: LE Set Advertising Parameters (0x08|0x0006) plen 15 + Min advertising interval: 0.000 msec (0x0000) + Max advertising interval: 0.000 msec (0x0000) + Type: Connectable directed - ADV_DIRECT_IND (high duty cycle) (0x01) + Own address type: Public (0x00) + Direct address type: Random (0x01) + Direct address: E2:F0:7B:9F:DC:F4 (Static) + Channel map: 37, 38, 39 (0x07) + Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00) +> HCI Event: Command Complete (0x0e) plen 4 + LE Set Advertising Parameters (0x08|0x0006) ncmd 1 + Status: Invalid HCI Command Parameters (0x12) + +Signed-off-by: Szymon Janc +Tested-by: Sören Beye +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 15d1cb5aee18..f5c27065ad44 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -931,6 +931,14 @@ static void hci_req_directed_advertising(struct hci_request *req, + return; + + memset(&cp, 0, sizeof(cp)); ++ ++ /* Some controllers might reject command if intervals are not ++ * within range for undirected advertising. ++ * BCM20702A0 is known to be affected by this. ++ */ ++ cp.min_interval = cpu_to_le16(0x0020); ++ cp.max_interval = cpu_to_le16(0x0020); ++ + cp.type = LE_ADV_DIRECT_IND; + cp.own_address_type = own_addr_type; + cp.direct_addr_type = conn->dst_type; +-- +2.20.1 + diff --git a/queue-4.19/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch b/queue-4.19/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch new file mode 100644 index 00000000000..aaac8e660da --- /dev/null +++ b/queue-4.19/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch @@ -0,0 +1,54 @@ +From 4052a98864b25f9e80f4f41552e618e8a3d0b1b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 21:51:11 -0800 +Subject: bnx2x: Fix PF-VF communication over multi-cos queues. + +From: Manish Chopra + +[ Upstream commit dc5a3d79c345871439ffe72550b604fcde9770e1 ] + +PF driver doesn't enable tx-switching for all cos queues/clients, +which causes packets drop from PF to VF. Fix this by enabling +tx-switching on all cos queues/clients. + +Signed-off-by: Manish Chopra +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 62da46537734..ab60f4f9cc24 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -2394,15 +2394,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) + /* send the ramrod on all the queues of the PF */ + for_each_eth_queue(bp, i) { + struct bnx2x_fastpath *fp = &bp->fp[i]; ++ int tx_idx; + + /* Set the appropriate Queue object */ + q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; + +- /* Update the Queue state */ +- rc = bnx2x_queue_state_change(bp, &q_params); +- if (rc) { +- BNX2X_ERR("Failed to configure Tx switching\n"); +- return rc; ++ for (tx_idx = FIRST_TX_COS_INDEX; ++ tx_idx < fp->max_cos; tx_idx++) { ++ q_params.params.update.cid_index = tx_idx; ++ ++ /* Update the Queue state */ ++ rc = bnx2x_queue_state_change(bp, &q_params); ++ if (rc) { ++ BNX2X_ERR("Failed to configure Tx switching\n"); ++ return rc; ++ } + } + } + +-- +2.20.1 + diff --git a/queue-4.19/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch b/queue-4.19/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch new file mode 100644 index 00000000000..dcbd43f5e5a --- /dev/null +++ b/queue-4.19/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch @@ -0,0 +1,151 @@ +From f4f62e7674b311fbe73346c9a1bbd50ded88e608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2019 10:12:23 -0700 +Subject: bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() + +From: Song Liu + +[ Upstream commit eac9153f2b584c702cea02c1f1a57d85aa9aea42 ] + +bpf stackmap with build-id lookup (BPF_F_STACK_BUILD_ID) can trigger A-A +deadlock on rq_lock(): + +rcu: INFO: rcu_sched detected stalls on CPUs/tasks: +[...] +Call Trace: + try_to_wake_up+0x1ad/0x590 + wake_up_q+0x54/0x80 + rwsem_wake+0x8a/0xb0 + bpf_get_stack+0x13c/0x150 + bpf_prog_fbdaf42eded9fe46_on_event+0x5e3/0x1000 + bpf_overflow_handler+0x60/0x100 + __perf_event_overflow+0x4f/0xf0 + perf_swevent_overflow+0x99/0xc0 + ___perf_sw_event+0xe7/0x120 + __schedule+0x47d/0x620 + schedule+0x29/0x90 + futex_wait_queue_me+0xb9/0x110 + futex_wait+0x139/0x230 + do_futex+0x2ac/0xa50 + __x64_sys_futex+0x13c/0x180 + do_syscall_64+0x42/0x100 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +This can be reproduced by: +1. Start a multi-thread program that does parallel mmap() and malloc(); +2. taskset the program to 2 CPUs; +3. Attach bpf program to trace_sched_switch and gather stackmap with + build-id, e.g. with trace.py from bcc tools: + trace.py -U -p -s t:sched:sched_switch + +A sample reproducer is attached at the end. + +This could also trigger deadlock with other locks that are nested with +rq_lock. + +Fix this by checking whether irqs are disabled. Since rq_lock and all +other nested locks are irq safe, it is safe to do up_read() when irqs are +not disable. If the irqs are disabled, postpone up_read() in irq_work. + +Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address") +Signed-off-by: Song Liu +Signed-off-by: Alexei Starovoitov +Cc: Peter Zijlstra +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20191014171223.357174-1-songliubraving@fb.com + +Reproducer: +============================ 8< ============================ + +char *filename; + +void *worker(void *p) +{ + void *ptr; + int fd; + char *pptr; + + fd = open(filename, O_RDONLY); + if (fd < 0) + return NULL; + while (1) { + struct timespec ts = {0, 1000 + rand() % 2000}; + + ptr = mmap(NULL, 4096 * 64, PROT_READ, MAP_PRIVATE, fd, 0); + usleep(1); + if (ptr == MAP_FAILED) { + printf("failed to mmap\n"); + break; + } + munmap(ptr, 4096 * 64); + usleep(1); + pptr = malloc(1); + usleep(1); + pptr[0] = 1; + usleep(1); + free(pptr); + usleep(1); + nanosleep(&ts, NULL); + } + close(fd); + return NULL; +} + +int main(int argc, char *argv[]) +{ + void *ptr; + int i; + pthread_t threads[THREAD_COUNT]; + + if (argc < 2) + return 0; + + filename = argv[1]; + + for (i = 0; i < THREAD_COUNT; i++) { + if (pthread_create(threads + i, NULL, worker, NULL)) { + fprintf(stderr, "Error creating thread\n"); + return 0; + } + } + + for (i = 0; i < THREAD_COUNT; i++) + pthread_join(threads[i], NULL); + return 0; +} +============================ 8< ============================ + +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 7cb7a7f98a37..55fff5e6d983 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -292,7 +292,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + bool irq_work_busy = false; + struct stack_map_irq_work *work = NULL; + +- if (in_nmi()) { ++ if (irqs_disabled()) { + work = this_cpu_ptr(&up_read_work); + if (work->irq_work.flags & IRQ_WORK_BUSY) + /* cannot queue more up_read, fallback */ +@@ -300,8 +300,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + } + + /* +- * We cannot do up_read() in nmi context. To do build_id lookup +- * in nmi context, we need to run up_read() in irq_work. We use ++ * We cannot do up_read() when the irq is disabled, because of ++ * risk to deadlock with rq_lock. To do build_id lookup when the ++ * irqs are disabled, we need to run up_read() in irq_work. We use + * a percpu variable to do the irq_work. If the irq_work is + * already used by another lookup, we fall back to report ips. + * +-- +2.20.1 + diff --git a/queue-4.19/brcmfmac-remove-monitor-interface-when-detaching.patch b/queue-4.19/brcmfmac-remove-monitor-interface-when-detaching.patch new file mode 100644 index 00000000000..6325d5aba54 --- /dev/null +++ b/queue-4.19/brcmfmac-remove-monitor-interface-when-detaching.patch @@ -0,0 +1,42 @@ +From e2f00ead5f440ac57c51bbc312d51541dc18d4e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 13:38:55 +0100 +Subject: brcmfmac: remove monitor interface when detaching +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 4f61563da075bc8faefddfd5f8fc0cc14c49650a ] + +This fixes a minor WARNING in the cfg80211: +[ 130.658034] ------------[ cut here ]------------ +[ 130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211] + +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 0f56be13c7ad..584e05fdca6a 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1246,6 +1246,11 @@ void brcmf_detach(struct device *dev) + + brcmf_proto_detach_pre_delif(drvr); + ++ if (drvr->mon_if) { ++ brcmf_net_detach(drvr->mon_if->ndev, false); ++ drvr->mon_if = NULL; ++ } ++ + /* make sure primary interface removed last */ + for (i = BRCMF_MAX_IFS-1; i > -1; i--) + brcmf_remove_interface(drvr->iflist[i], false); +-- +2.20.1 + diff --git a/queue-4.19/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch b/queue-4.19/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch new file mode 100644 index 00000000000..ef0e15a1eee --- /dev/null +++ b/queue-4.19/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch @@ -0,0 +1,54 @@ +From eba3a7b4ed4ff7deee1596b840589749012148a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 11:30:54 -0700 +Subject: btrfs: don't prematurely free work in end_workqueue_fn() + +From: Omar Sandoval + +[ Upstream commit 9be490f1e15c34193b1aae17da58e14dd9f55a95 ] + +Currently, end_workqueue_fn() frees the end_io_wq entry (which embeds +the work item) and then calls bio_endio(). This is another potential +instance of the bug in "btrfs: don't prematurely free work in +run_ordered_work()". + +In particular, the endio call may depend on other work items. For +example, btrfs_end_dio_bio() can call btrfs_subio_endio_read() -> +__btrfs_correct_data_nocsum() -> dio_read_error() -> +submit_dio_repair_bio(), which submits a bio that is also completed +through a end_workqueue_fn() work item. However, +__btrfs_correct_data_nocsum() waits for the newly submitted bio to +complete, thus it depends on another work item. + +This example currently usually works because we use different workqueue +helper functions for BTRFS_WQ_ENDIO_DATA and BTRFS_WQ_ENDIO_DIO_REPAIR. +However, it may deadlock with stacked filesystems and is fragile +overall. The proper fix is to free the work item at the very end of the +work function, so let's do that. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/disk-io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 96296dc7d2ea..e12c37f457e0 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1660,8 +1660,8 @@ static void end_workqueue_fn(struct btrfs_work *work) + bio->bi_status = end_io_wq->status; + bio->bi_private = end_io_wq->private; + bio->bi_end_io = end_io_wq->end_io; +- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + bio_endio(bio); ++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + } + + static int cleaner_kthread(void *arg) +-- +2.20.1 + diff --git a/queue-4.19/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch b/queue-4.19/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch new file mode 100644 index 00000000000..2b02810943b --- /dev/null +++ b/queue-4.19/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch @@ -0,0 +1,66 @@ +From 0d97c1c33b0b142b596e2cdffcd5a97fa655443d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 11:30:55 -0700 +Subject: btrfs: don't prematurely free work in reada_start_machine_worker() + +From: Omar Sandoval + +[ Upstream commit e732fe95e4cad35fc1df278c23a32903341b08b3 ] + +Currently, reada_start_machine_worker() frees the reada_machine_work and +then calls __reada_start_machine() to do readahead. This is another +potential instance of the bug in "btrfs: don't prematurely free work in +run_ordered_work()". + +There _might_ already be a deadlock here: reada_start_machine_worker() +can depend on itself through stacked filesystems (__read_start_machine() +-> reada_start_machine_dev() -> reada_tree_block_flagged() -> +read_extent_buffer_pages() -> submit_one_bio() -> +btree_submit_bio_hook() -> btrfs_map_bio() -> submit_stripe_bio() -> +submit_bio() onto a loop device can trigger readahead on the lower +filesystem). + +Either way, let's fix it by freeing the work at the end. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/reada.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index 859274e38417..4c81ffe12385 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -720,21 +720,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) + static void reada_start_machine_worker(struct btrfs_work *work) + { + struct reada_machine_work *rmw; +- struct btrfs_fs_info *fs_info; + int old_ioprio; + + rmw = container_of(work, struct reada_machine_work, work); +- fs_info = rmw->fs_info; +- +- kfree(rmw); + + old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), + task_nice_ioprio(current)); + set_task_ioprio(current, BTRFS_IOPRIO_READA); +- __reada_start_machine(fs_info); ++ __reada_start_machine(rmw->fs_info); + set_task_ioprio(current, old_ioprio); + +- atomic_dec(&fs_info->reada_works_cnt); ++ atomic_dec(&rmw->fs_info->reada_works_cnt); ++ ++ kfree(rmw); + } + + static void __reada_start_machine(struct btrfs_fs_info *fs_info) +-- +2.20.1 + diff --git a/queue-4.19/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch b/queue-4.19/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch new file mode 100644 index 00000000000..388dcf5eee3 --- /dev/null +++ b/queue-4.19/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch @@ -0,0 +1,154 @@ +From e24ee0b37868f2e2b000272ae4b312d765d53d93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 11:30:53 -0700 +Subject: btrfs: don't prematurely free work in run_ordered_work() + +From: Omar Sandoval + +[ Upstream commit c495dcd6fbe1dce51811a76bb85b4675f6494938 ] + +We hit the following very strange deadlock on a system with Btrfs on a +loop device backed by another Btrfs filesystem: + +1. The top (loop device) filesystem queues an async_cow work item from + cow_file_range_async(). We'll call this work X. +2. Worker thread A starts work X (normal_work_helper()). +3. Worker thread A executes the ordered work for the top filesystem + (run_ordered_work()). +4. Worker thread A finishes the ordered work for work X and frees X + (work->ordered_free()). +5. Worker thread A executes another ordered work and gets blocked on I/O + to the bottom filesystem (still in run_ordered_work()). +6. Meanwhile, the bottom filesystem allocates and queues an async_cow + work item which happens to be the recently-freed X. +7. The workqueue code sees that X is already being executed by worker + thread A, so it schedules X to be executed _after_ worker thread A + finishes (see the find_worker_executing_work() call in + process_one_work()). + +Now, the top filesystem is waiting for I/O on the bottom filesystem, but +the bottom filesystem is waiting for the top filesystem to finish, so we +deadlock. + +This happens because we are breaking the workqueue assumption that a +work item cannot be recycled while it still depends on other work. Fix +it by waiting to free the work item until we are done with all of the +related ordered work. + +P.S.: + +One might ask why the workqueue code doesn't try to detect a recycled +work item. It actually does try by checking whether the work item has +the same work function (find_worker_executing_work()), but in our case +the function is the same. This is the only key that the workqueue code +has available to compare, short of adding an additional, layer-violating +"custom key". Considering that we're the only ones that have ever hit +this, we should just play by the rules. + +Unfortunately, we haven't been able to create a minimal reproducer other +than our full container setup using a compress-force=zstd filesystem on +top of another compress-force=zstd filesystem. + +Suggested-by: Tejun Heo +Reviewed-by: Johannes Thumshirn +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/async-thread.c | 56 ++++++++++++++++++++++++++++++++--------- + 1 file changed, 44 insertions(+), 12 deletions(-) + +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index d522494698fa..02e4e903dfe9 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -252,16 +252,17 @@ out: + } + } + +-static void run_ordered_work(struct __btrfs_workqueue *wq) ++static void run_ordered_work(struct __btrfs_workqueue *wq, ++ struct btrfs_work *self) + { + struct list_head *list = &wq->ordered_list; + struct btrfs_work *work; + spinlock_t *lock = &wq->list_lock; + unsigned long flags; ++ void *wtag; ++ bool free_self = false; + + while (1) { +- void *wtag; +- + spin_lock_irqsave(lock, flags); + if (list_empty(list)) + break; +@@ -287,16 +288,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) + list_del(&work->ordered_list); + spin_unlock_irqrestore(lock, flags); + +- /* +- * We don't want to call the ordered free functions with the +- * lock held though. Save the work as tag for the trace event, +- * because the callback could free the structure. +- */ +- wtag = work; +- work->ordered_free(work); +- trace_btrfs_all_work_done(wq->fs_info, wtag); ++ if (work == self) { ++ /* ++ * This is the work item that the worker is currently ++ * executing. ++ * ++ * The kernel workqueue code guarantees non-reentrancy ++ * of work items. I.e., if a work item with the same ++ * address and work function is queued twice, the second ++ * execution is blocked until the first one finishes. A ++ * work item may be freed and recycled with the same ++ * work function; the workqueue code assumes that the ++ * original work item cannot depend on the recycled work ++ * item in that case (see find_worker_executing_work()). ++ * ++ * Note that the work of one Btrfs filesystem may depend ++ * on the work of another Btrfs filesystem via, e.g., a ++ * loop device. Therefore, we must not allow the current ++ * work item to be recycled until we are really done, ++ * otherwise we break the above assumption and can ++ * deadlock. ++ */ ++ free_self = true; ++ } else { ++ /* ++ * We don't want to call the ordered free functions with ++ * the lock held though. Save the work as tag for the ++ * trace event, because the callback could free the ++ * structure. ++ */ ++ wtag = work; ++ work->ordered_free(work); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + spin_unlock_irqrestore(lock, flags); ++ ++ if (free_self) { ++ wtag = self; ++ self->ordered_free(self); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + + static void normal_work_helper(struct btrfs_work *work) +@@ -324,7 +356,7 @@ static void normal_work_helper(struct btrfs_work *work) + work->func(work); + if (need_order) { + set_bit(WORK_DONE_BIT, &work->flags); +- run_ordered_work(wq); ++ run_ordered_work(wq, work); + } + if (!need_order) + trace_btrfs_all_work_done(wq->fs_info, wtag); +-- +2.20.1 + diff --git a/queue-4.19/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch b/queue-4.19/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch new file mode 100644 index 00000000000..7abac34dadf --- /dev/null +++ b/queue-4.19/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch @@ -0,0 +1,47 @@ +From 72ab7b7dc171eca297b25c30866d4bd041f378ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 11:30:56 -0700 +Subject: btrfs: don't prematurely free work in scrub_missing_raid56_worker() + +From: Omar Sandoval + +[ Upstream commit 57d4f0b863272ba04ba85f86bfdc0f976f0af91c ] + +Currently, scrub_missing_raid56_worker() puts and potentially frees +sblock (which embeds the work item) and then submits a bio through +scrub_wr_submit(). This is another potential instance of the bug in +"btrfs: don't prematurely free work in run_ordered_work()". Fix it by +dropping the reference after we submit the bio. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/scrub.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 916c39770467..6b6008db3e03 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2145,14 +2145,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) + scrub_write_block_to_dev_replace(sblock); + } + +- scrub_block_put(sblock); +- + if (sctx->is_dev_replace && sctx->flush_all_writes) { + mutex_lock(&sctx->wr_lock); + scrub_wr_submit(sctx); + mutex_unlock(&sctx->wr_lock); + } + ++ scrub_block_put(sblock); + scrub_pending_bio_dec(sctx); + } + +-- +2.20.1 + diff --git a/queue-4.19/cpufreq-register-drivers-only-after-cpu-devices-have.patch b/queue-4.19/cpufreq-register-drivers-only-after-cpu-devices-have.patch new file mode 100644 index 00000000000..537c8d13c1c --- /dev/null +++ b/queue-4.19/cpufreq-register-drivers-only-after-cpu-devices-have.patch @@ -0,0 +1,69 @@ +From 135570d24d4a81fb19d1f69304c55fd269cff623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 09:06:17 +0530 +Subject: cpufreq: Register drivers only after CPU devices have been registered + +From: Viresh Kumar + +[ Upstream commit 46770be0cf94149ca48be87719bda1d951066644 ] + +The cpufreq core heavily depends on the availability of the struct +device for CPUs and if they aren't available at the time cpufreq driver +is registered, we will never succeed in making cpufreq work. + +This happens due to following sequence of events: + +- cpufreq_register_driver() + - subsys_interface_register() + - return 0; //successful registration of driver + +... at a later point of time + +- register_cpu(); + - device_register(); + - bus_probe_device(); + - sif->add_dev(); + - cpufreq_add_dev(); + - get_cpu_device(); //FAILS + - per_cpu(cpu_sys_devices, num) = &cpu->dev; //used by get_cpu_device() + - return 0; //CPU registered successfully + +Because the per-cpu variable cpu_sys_devices is set only after the CPU +device is regsitered, cpufreq will never be able to get it when +cpufreq_add_dev() is called. + +This patch avoids this failure by making sure device structure of at +least CPU0 is available when the cpufreq driver is registered, else +return -EPROBE_DEFER. + +Reported-by: Bjorn Andersson +Co-developed-by: Amit Kucheria +Signed-off-by: Viresh Kumar +Tested-by: Amit Kucheria +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 9d8d64f706e0..e35c397b1259 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2480,6 +2480,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (cpufreq_disabled()) + return -ENODEV; + ++ /* ++ * The cpufreq core depends heavily on the availability of device ++ * structure, make sure they are available before proceeding further. ++ */ ++ if (!get_cpu_device(0)) ++ return -EPROBE_DEFER; ++ + if (!driver_data || !driver_data->verify || !driver_data->init || + !(driver_data->setpolicy || driver_data->target_index || + driver_data->target) || +-- +2.20.1 + diff --git a/queue-4.19/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch b/queue-4.19/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch new file mode 100644 index 00000000000..56305fe0120 --- /dev/null +++ b/queue-4.19/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch @@ -0,0 +1,138 @@ +From 1aeaca1f6c0a9384d34611e270e464fb46af0356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 15:39:07 +0800 +Subject: crypto: atmel - Fix authenc support when it is set to m + +From: Herbert Xu + +[ Upstream commit 1520c72596dde7f22b8bd6bed3ef7df2b8b7ef39 ] + +As it is if CONFIG_CRYPTO_DEV_ATMEL_AUTHENC is set to m it is in +effect disabled. This patch fixes it by using IS_ENABLED instead +of ifdef. + +Fixes: 89a82ef87e01 ("crypto: atmel-authenc - add support to...") +Signed-off-by: Herbert Xu +Reviewed-by: Tudor Ambarus +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/atmel-aes.c | 18 +++++++++--------- + drivers/crypto/atmel-authenc.h | 2 +- + drivers/crypto/atmel-sha.c | 2 +- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index f662914d87b8..53a78035381d 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -148,7 +148,7 @@ struct atmel_aes_xts_ctx { + u32 key2[AES_KEYSIZE_256 / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_ctx { + struct atmel_aes_base_ctx base; + struct atmel_sha_authenc_ctx *auth; +@@ -160,7 +160,7 @@ struct atmel_aes_reqctx { + u32 lastc[AES_BLOCK_SIZE / sizeof(u32)]; + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + struct atmel_aes_authenc_reqctx { + struct atmel_aes_reqctx base; + +@@ -489,7 +489,7 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd) + return (dd->flags & AES_FLAGS_ENCRYPT); + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err); + #endif + +@@ -518,7 +518,7 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd) + + static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err) + { +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->ctx->is_aead) + atmel_aes_authenc_complete(dd, err); + #endif +@@ -1983,7 +1983,7 @@ static struct crypto_alg aes_xts_alg = { + } + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc aead functions */ + + static int atmel_aes_authenc_start(struct atmel_aes_dev *dd); +@@ -2470,7 +2470,7 @@ static void atmel_aes_unregister_algs(struct atmel_aes_dev *dd) + { + int i; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) + crypto_unregister_aead(&aes_authenc_algs[i]); +@@ -2517,7 +2517,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + goto err_aes_xts_alg; + } + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (dd->caps.has_authenc) { + for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) { + err = crypto_register_aead(&aes_authenc_algs[i]); +@@ -2529,7 +2529,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd) + + return 0; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* i = ARRAY_SIZE(aes_authenc_algs); */ + err_aes_authenc_alg: + for (j = 0; j < i; j++) +@@ -2720,7 +2720,7 @@ static int atmel_aes_probe(struct platform_device *pdev) + + atmel_aes_get_cap(aes_dd); + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + if (aes_dd->caps.has_authenc && !atmel_sha_authenc_is_ready()) { + err = -EPROBE_DEFER; + goto iclk_unprepare; +diff --git a/drivers/crypto/atmel-authenc.h b/drivers/crypto/atmel-authenc.h +index 2a60d1224143..7f6742d35dd5 100644 +--- a/drivers/crypto/atmel-authenc.h ++++ b/drivers/crypto/atmel-authenc.h +@@ -23,7 +23,7 @@ + #ifndef __ATMEL_AUTHENC_H__ + #define __ATMEL_AUTHENC_H__ + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + + #include + #include +diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c +index 8a19df2fba6a..ef125d4be8fc 100644 +--- a/drivers/crypto/atmel-sha.c ++++ b/drivers/crypto/atmel-sha.c +@@ -2215,7 +2215,7 @@ static struct ahash_alg sha_hmac_algs[] = { + }, + }; + +-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC ++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC) + /* authenc functions */ + + static int atmel_sha_authenc_init2(struct atmel_sha_dev *dd); +-- +2.20.1 + diff --git a/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch b/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch new file mode 100644 index 00000000000..e99ba19b9e8 --- /dev/null +++ b/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch @@ -0,0 +1,61 @@ +From bd5c368da20fd917a9b7ff14857bc8d12a289069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 11:49:06 +0100 +Subject: crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c + +From: Corentin Labbe + +[ Upstream commit a7126603d46fe8f01aeedf589e071c6aaa6c6c39 ] + +If you try to compile this driver on a 64-bit platform then you +will get warnings because it mixes size_t with unsigned int which +only works on 32-bit. + +This patch fixes all of the warnings on sun4i-ss-hash.c. +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +index f6936bb3b7be..1a724263761b 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +@@ -276,8 +276,8 @@ static int sun4i_hash(struct ahash_request *areq) + */ + while (op->len < 64 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, end - i, +- 64 - op->len); ++ in_r = min(end - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +@@ -297,8 +297,8 @@ static int sun4i_hash(struct ahash_request *areq) + } + if (mi.length - in_i > 3 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- ((mi.length - in_i) / 4) * 4); ++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); ++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); + /* how many bytes we can write in the device*/ + todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); + writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); +@@ -324,8 +324,8 @@ static int sun4i_hash(struct ahash_request *areq) + if ((areq->nbytes - i) < 64) { + while (i < areq->nbytes && in_i < mi.length && op->len < 64) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- 64 - op->len); ++ in_r = min(areq->nbytes - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +-- +2.20.1 + diff --git a/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch b/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch new file mode 100644 index 00000000000..644a9d1946c --- /dev/null +++ b/queue-4.19/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch @@ -0,0 +1,102 @@ +From 24ee0ef6cf8b8d2c454e2cc1c4fcebc7a1b24b3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 10:38:34 +0800 +Subject: crypto: sun4i-ss - Fix 64-bit size_t warnings + +From: Herbert Xu + +[ Upstream commit d6e9da21ee8246b5e556b3b153401ab045adb986 ] + +If you try to compile this driver on a 64-bit platform then you +will get warnings because it mixes size_t with unsigned int which +only works on 32-bit. + +This patch fixes all of the warnings. + +Signed-off-by: Herbert Xu +Acked-by: Corentin Labbe +Tested-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 5cf64746731a..22e491857925 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -81,7 +81,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + oi = 0; + oo = 0; + do { +- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo) { + ileft -= todo; + writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +@@ -96,7 +97,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + +- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + oleft -= todo; + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); +@@ -220,7 +222,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * todo is the number of consecutive 4byte word that we + * can read from current SG + */ +- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft / 4); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo && !ob) { + writesl(ss->base + SS_RXFIFO, mi.addr + oi, + todo); +@@ -234,8 +237,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * we need to be able to write all buf in one + * pass, so it is why we min() with rx_cnt + */ +- todo = min3(rx_cnt * 4 - ob, ileft, +- mi.length - oi); ++ todo = min(rx_cnt * 4 - ob, ileft); ++ todo = min_t(size_t, todo, mi.length - oi); + memcpy(buf + ob, mi.addr + oi, todo); + ileft -= todo; + oi += todo; +@@ -255,7 +258,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", ++ dev_dbg(ss->dev, ++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", + mode, + oi, mi.length, ileft, areq->cryptlen, rx_cnt, + oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); +@@ -263,7 +267,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + if (!tx_cnt) + continue; + /* todo in 4bytes word */ +- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft / 4); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; +@@ -287,7 +292,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * no more than remaining buffer + * no need to test against oleft + */ +- todo = min(mo.length - oo, obl - obo); ++ todo = min_t(size_t, ++ mo.length - oo, obl - obo); + memcpy(mo.addr + oo, bufo + obo, todo); + oleft -= todo; + obo += todo; +-- +2.20.1 + diff --git a/queue-4.19/crypto-virtio-deal-with-unsupported-input-sizes.patch b/queue-4.19/crypto-virtio-deal-with-unsupported-input-sizes.patch new file mode 100644 index 00000000000..4c1a4846825 --- /dev/null +++ b/queue-4.19/crypto-virtio-deal-with-unsupported-input-sizes.patch @@ -0,0 +1,67 @@ +From 48ba09e88cfd21781df9850eae177a29c7ac445e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Nov 2019 18:09:27 +0100 +Subject: crypto: virtio - deal with unsupported input sizes + +From: Ard Biesheuvel + +[ Upstream commit 19c5da7d4a2662e85ea67d2d81df57e038fde3ab ] + +Return -EINVAL for input sizes that are not a multiple of the AES +block size, since they are not supported by our CBC chaining mode. + +While at it, remove the pr_err() that reports unsupported key sizes +being used: we shouldn't spam the kernel log with that. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: Gonglei +Cc: virtualization@lists.linux-foundation.org +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 2c573d1aaa64..523b712770ac 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -117,8 +117,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -498,6 +496,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +@@ -518,6 +521,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +-- +2.20.1 + diff --git a/queue-4.19/crypto-vmx-avoid-weird-build-failures.patch b/queue-4.19/crypto-vmx-avoid-weird-build-failures.patch new file mode 100644 index 00000000000..ab65b6dbf89 --- /dev/null +++ b/queue-4.19/crypto-vmx-avoid-weird-build-failures.patch @@ -0,0 +1,67 @@ +From d2bc3f8cc29b8715b3932479ea709f85b9351752 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 22:27:38 +1100 +Subject: crypto: vmx - Avoid weird build failures + +From: Michael Ellerman + +[ Upstream commit 4ee812f6143d78d8ba1399671d78c8d78bf2817c ] + +In the vmx crypto Makefile we assign to a variable called TARGET and +pass that to the aesp8-ppc.pl and ghashp8-ppc.pl scripts. + +The variable is meant to describe what flavour of powerpc we're +building for, eg. either 32 or 64-bit, and big or little endian. + +Unfortunately TARGET is a fairly common name for a make variable, and +if it happens that TARGET is specified as a command line parameter to +make, the value specified on the command line will override our value. + +In particular this can happen if the kernel Makefile is driven by an +external Makefile that uses TARGET for something. + +This leads to weird build failures, eg: + nonsense at /build/linux/drivers/crypto/vmx/ghashp8-ppc.pl line 45. + /linux/drivers/crypto/vmx/Makefile:20: recipe for target 'drivers/crypto/vmx/ghashp8-ppc.S' failed + +Which shows that we passed an empty value for $(TARGET) to the perl +script, confirmed with make V=1: + + perl /linux/drivers/crypto/vmx/ghashp8-ppc.pl > drivers/crypto/vmx/ghashp8-ppc.S + +We can avoid this confusion by using override, to tell make that we +don't want anything to override our variable, even a value specified +on the command line. We can also use a less common name, given the +script calls it "flavour", let's use that. + +Signed-off-by: Michael Ellerman +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/vmx/Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile +index cab32cfec9c4..709670d2b553 100644 +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + + ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) +-TARGET := linux-ppc64le ++override flavour := linux-ppc64le + else +-TARGET := linux-ppc64 ++override flavour := linux-ppc64 + endif + + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) ++ cmd_perl = $(PERL) $(<) $(flavour) > $(@) + + targets += aesp8-ppc.S ghashp8-ppc.S + +-- +2.20.1 + diff --git a/queue-4.19/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch b/queue-4.19/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch new file mode 100644 index 00000000000..6f813777949 --- /dev/null +++ b/queue-4.19/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch @@ -0,0 +1,65 @@ +From 9577b60ee4a4b3b5816d5464f652cbb5c2f9aaa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 20:20:23 -0400 +Subject: drm/amd/display: Fix dongle_caps containing stale information. + +From: David Galiffi + +[ Upstream commit dd998291dbe92106d8c4a7581c409b356928d711 ] + +[WHY] + +During detection: +function: get_active_converter_info populates link->dpcd_caps.dongle_caps +only when dpcd_rev >= DPCD_REV_11 and DWN_STRM_PORTX_TYPE is +DOWN_STREAM_DETAILED_HDMI or DOWN_STREAM_DETAILED_DP_PLUS_PLUS. +Otherwise, it is not cleared, and stale information remains. + +During mode validation: +function: dp_active_dongle_validate_timing reads +link->dpcd_caps.dongle_caps->dongle_type to determine the maximum +pixel clock to support. This information is now stale and no longer +valid. + +[HOW] +dp_active_dongle_validate_timing should be using +link->dpcd_caps->dongle_type instead. + +Signed-off-by: David Galiffi +Reviewed-by: Jun Lei +Acked-by: Bhawanpreet Lakha +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 2 +- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 23a7ef97afdd..c6f7c1344a9b 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1950,7 +1950,7 @@ static bool dp_active_dongle_validate_timing( + break; + } + +- if (dongle_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || ++ if (dpcd_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER || + dongle_caps->extendedCapValid == false) + return true; + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 05840f5bddd5..122249da03ab 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2172,6 +2172,7 @@ static void get_active_converter_info( + uint8_t data, struct dc_link *link) + { + union dp_downstream_port_present ds_port = { .byte = data }; ++ memset(&link->dpcd_caps.dongle_caps, 0, sizeof(link->dpcd_caps.dongle_caps)); + + /* decode converter info*/ + if (!ds_port.fields.PORT_PRESENT) { +-- +2.20.1 + diff --git a/queue-4.19/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch b/queue-4.19/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch new file mode 100644 index 00000000000..f4b6f2328b8 --- /dev/null +++ b/queue-4.19/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch @@ -0,0 +1,45 @@ +From 0f40e61276cd5232f857e30eca5065b1107af913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 16:20:06 +0800 +Subject: drm/amdgpu: disallow direct upload save restore list from gfx driver + +From: Hawking Zhang + +[ Upstream commit 58f46d4b65021083ef4b4d49c6e2c58e5783f626 ] + +Direct uploading save/restore list via mmio register writes breaks the security +policy. Instead, the driver should pass s&r list to psp. + +For all the ASICs that use rlc v2_1 headers, the driver actually upload s&r list +twice, in non-psp ucode front door loading phase and gfx pg initialization phase. +The latter is not allowed. + +VG12 is the only exception where the driver still keeps legacy approach for S&R +list uploading. In theory, this can be elimnated if we have valid srcntl ucode +for VG12. + +Signed-off-by: Hawking Zhang +Reviewed-by: Candice Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 782411649816..28794b1b15c1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2187,7 +2187,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev) + * And it's needed by gfxoff feature. + */ + if (adev->gfx.rlc.is_rlc_v2_1) { +- gfx_v9_1_init_rlc_save_restore_list(adev); ++ if (adev->asic_type == CHIP_VEGA12) ++ gfx_v9_1_init_rlc_save_restore_list(adev); + gfx_v9_0_enable_save_restore_machine(adev); + } + +-- +2.20.1 + diff --git a/queue-4.19/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch b/queue-4.19/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch new file mode 100644 index 00000000000..51d52a17750 --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch @@ -0,0 +1,42 @@ +From dc18cfddaf262d4f511cafe13e0a5af1d8d1a52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 10:53:54 +1100 +Subject: drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 + +From: Sam Bobroff + +[ Upstream commit 3d0e3ce52ce3eb4b9de3caf9c38dbb5a4d3e13c3 ] + +The INTERRUPT_CNTL2 register expects a valid DMA address, but is +currently set with a GPU MC address. This can cause problems on +systems that detect the resulting DMA read from an invalid address +(found on a Power8 guest). + +Instead, use the DMA address of the dummy page because it will always +be safe. + +Fixes: 27ae10641e9c ("drm/amdgpu: add interupt handler implementation for si v3") +Signed-off-by: Sam Bobroff +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/si_ih.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/si_ih.c b/drivers/gpu/drm/amd/amdgpu/si_ih.c +index 60dad63098a2..e40a3fbc3e76 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_ih.c +@@ -62,7 +62,8 @@ static int si_ih_irq_init(struct amdgpu_device *adev) + u64 wptr_off; + + si_ih_disable_interrupts(adev); +- WREG32(INTERRUPT_CNTL2, adev->irq.ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, adev->dummy_page_addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE; + interrupt_cntl &= ~IH_REQ_NONSNOOP_EN; +-- +2.20.1 + diff --git a/queue-4.19/drm-amdgpu-fix-potential-double-drop-fence-reference.patch b/queue-4.19/drm-amdgpu-fix-potential-double-drop-fence-reference.patch new file mode 100644 index 00000000000..d23e96a0dea --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-potential-double-drop-fence-reference.patch @@ -0,0 +1,48 @@ +From 806773cf878b637d8e115b772d3065f1bb9f996e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 17:14:45 +0800 +Subject: drm/amdgpu: fix potential double drop fence reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pan Bian + +[ Upstream commit 946ab8db6953535a3a88c957db8328beacdfed9d ] + +The object fence is not set to NULL after its reference is dropped. As a +result, its reference may be dropped again if error occurs after that, +which may lead to a use after free bug. To avoid the issue, fence is +explicitly set to NULL after dropping its reference. + +Acked-by: Christian König +Signed-off-by: Pan Bian +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_test.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +index 8904e62dca7a..41d3142ef3cf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(vram_obj, &vram_map); + if (r) { +@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(gtt_obj[i], >t_map); + if (r) { +-- +2.20.1 + diff --git a/queue-4.19/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch b/queue-4.19/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch new file mode 100644 index 00000000000..0b8a46bacd3 --- /dev/null +++ b/queue-4.19/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch @@ -0,0 +1,67 @@ +From 5b492cbdb7b57ab3825fc602f0d747abda77a5c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2019 13:57:32 +0200 +Subject: drm/amdgpu: grab the id mgr lock while accessing passid_mapping +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 6817bf283b2b851095825ec7f0e9f10398e09125 ] + +Need to make sure that we actually dropping the right fence. +Could be done with RCU as well, but to complicated for a fix. + +Signed-off-by: Christian König +Reviewed-by: Chunming Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 49fe5084c53d..69fb90d9c485 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -700,10 +700,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + id->oa_base != job->oa_base || + id->oa_size != job->oa_size); + bool vm_flush_needed = job->vm_needs_flush; +- bool pasid_mapping_needed = id->pasid != job->pasid || +- !id->pasid_mapping || +- !dma_fence_is_signaled(id->pasid_mapping); + struct dma_fence *fence = NULL; ++ bool pasid_mapping_needed; + unsigned patch_offset = 0; + int r; + +@@ -713,6 +711,12 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + pasid_mapping_needed = true; + } + ++ mutex_lock(&id_mgr->lock); ++ if (id->pasid != job->pasid || !id->pasid_mapping || ++ !dma_fence_is_signaled(id->pasid_mapping)) ++ pasid_mapping_needed = true; ++ mutex_unlock(&id_mgr->lock); ++ + gds_switch_needed &= !!ring->funcs->emit_gds_switch; + vm_flush_needed &= !!ring->funcs->emit_vm_flush && + job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET; +@@ -752,9 +756,11 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_ + } + + if (pasid_mapping_needed) { ++ mutex_lock(&id_mgr->lock); + id->pasid = job->pasid; + dma_fence_put(id->pasid_mapping); + id->pasid_mapping = dma_fence_get(fence); ++ mutex_unlock(&id_mgr->lock); + } + dma_fence_put(fence); + +-- +2.20.1 + diff --git a/queue-4.19/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch b/queue-4.19/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch new file mode 100644 index 00000000000..80bf9dd5861 --- /dev/null +++ b/queue-4.19/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch @@ -0,0 +1,44 @@ +From e601f4851132fefbd28c96cfde08e53477ca996d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 22:00:31 +0530 +Subject: drm/amdkfd: fix a potential NULL pointer dereference (v2) + +From: Allen Pais + +[ Upstream commit 81de29d842ccb776c0f77aa3e2b11b07fff0c0e2 ] + +alloc_workqueue is not checked for errors and as a result, +a potential NULL dereference could occur. + +v2 (Felix Kuehling): +* Fix compile error (kfifo_free instead of fifo_free) +* Return proper error code + +Signed-off-by: Allen Pais +Reviewed-by: Felix Kuehling +Signed-off-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +index c56ac47cd318..bc47f6a44456 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +@@ -62,6 +62,11 @@ int kfd_interrupt_init(struct kfd_dev *kfd) + } + + kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1); ++ if (unlikely(!kfd->ih_wq)) { ++ kfifo_free(&kfd->ih_fifo); ++ dev_err(kfd_chardev(), "Failed to allocate KFD IH workqueue\n"); ++ return -ENOMEM; ++ } + spin_lock_init(&kfd->interrupt_lock); + + INIT_WORK(&kfd->interrupt_work, interrupt_wq); +-- +2.20.1 + diff --git a/queue-4.19/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch b/queue-4.19/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch new file mode 100644 index 00000000000..1945639e149 --- /dev/null +++ b/queue-4.19/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch @@ -0,0 +1,50 @@ +From 50ac210e8d93902ebe14ea6b96cb619767059d4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2019 20:48:46 -0400 +Subject: drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings + +From: Brian Masney + +[ Upstream commit 2708e876272d89bbbff811d12834adbeef85f022 ] + +Silence two warning messages that occur due to -EPROBE_DEFER errors to +help cleanup the system boot log. + +Signed-off-by: Brian Masney +Reviewed-by: Linus Walleij +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190815004854.19860-4-masneyb@onstation.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix-anx78xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c +index f8433c93f463..cc820e9aea1d 100644 +--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c ++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c +@@ -725,7 +725,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx) + /* 1.0V digital core power regulator */ + pdata->dvdd10 = devm_regulator_get(dev, "dvdd10"); + if (IS_ERR(pdata->dvdd10)) { +- DRM_ERROR("DVDD10 regulator not found\n"); ++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) ++ DRM_ERROR("DVDD10 regulator not found\n"); ++ + return PTR_ERR(pdata->dvdd10); + } + +@@ -1341,7 +1343,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, + + err = anx78xx_init_pdata(anx78xx); + if (err) { +- DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ if (err != -EPROBE_DEFER) ++ DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ + return err; + } + +-- +2.20.1 + diff --git a/queue-4.19/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch b/queue-4.19/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch new file mode 100644 index 00000000000..3a0ff60e43f --- /dev/null +++ b/queue-4.19/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch @@ -0,0 +1,61 @@ +From 9f7077114e070b65fef3dfa03c83c7b116b57bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 12:44:06 -0700 +Subject: drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C + controller + +From: Matthias Kaehlcke + +[ Upstream commit bee447e224b2645911c5d06e35dc90d8433fcef6 ] + +The DDC/CI protocol involves sending a multi-byte request to the +display via I2C, which is typically followed by a multi-byte +response. The internal I2C controller only allows single byte +reads/writes or reads of 8 sequential bytes, hence DDC/CI is not +supported when the internal I2C controller is used. The I2C +transfers complete without errors, however the data in the response +is garbage. Abort transfers to/from slave address 0x37 (DDC) with +-EOPNOTSUPP, to make it evident that the communication is failing. + +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Douglas Anderson +Reviewed-by: Sean Paul +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20191002124354.v2.1.I709dfec496f5f0b44a7b61dcd4937924da8d8382@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 5971976284bf..fb396d550275 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -39,6 +39,7 @@ + + #include + ++#define DDC_CI_ADDR 0x37 + #define DDC_SEGMENT_ADDR 0x30 + + #define HDMI_EDID_LEN 512 +@@ -320,6 +321,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, + u8 addr = msgs[0].addr; + int i, ret = 0; + ++ if (addr == DDC_CI_ADDR) ++ /* ++ * The internal I2C controller does not support the multi-byte ++ * read and write operations needed for DDC/CI. ++ * TOFIX: Blacklist the DDC/CI address until we filter out ++ * unsupported I2C operations. ++ */ ++ return -EOPNOTSUPP; ++ + dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); + + for (i = 0; i < num; i++) { +-- +2.20.1 + diff --git a/queue-4.19/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch b/queue-4.19/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch new file mode 100644 index 00000000000..d6730f04445 --- /dev/null +++ b/queue-4.19/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch @@ -0,0 +1,47 @@ +From 0f0b4f0cc6cad9f916f3f17e84f0ac522f120ea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2019 18:21:45 +0800 +Subject: drm/bridge: dw-hdmi: Restore audio when setting a mode + +From: Daniel Kurtz + +[ Upstream commit fadfee3f9d8f114435a8a3e9f83a227600d89de7 ] + +When setting a new display mode, dw_hdmi_setup() calls +dw_hdmi_enable_video_path(), which disables all hdmi clocks, including +the audio clock. + +We should only (re-)enable the audio clock if audio was already enabled +when setting the new mode. + +Without this patch, on RK3288, there will be HDMI audio on some monitors +if i2s was played to headphone when the monitor was plugged. +ACER H277HU and ASUS PB278 are two of the monitors showing this issue. + +Signed-off-by: Cheng-Yi Chiang +Signed-off-by: Daniel Kurtz +Signed-off-by: Yakir Yang +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20191008102145.55134-1-cychiang@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index fb396d550275..2a0a1654d3ce 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -1757,7 +1757,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + + /* HDMI Initialization Step E - Configure audio */ + hdmi_clk_regenerator_update_pixel_clock(hdmi); +- hdmi_enable_audio_clk(hdmi, true); ++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); + } + + /* not for DVI mode */ +-- +2.20.1 + diff --git a/queue-4.19/drm-drm_vblank-change-einval-by-the-correct-errno.patch b/queue-4.19/drm-drm_vblank-change-einval-by-the-correct-errno.patch new file mode 100644 index 00000000000..11a507b5f53 --- /dev/null +++ b/queue-4.19/drm-drm_vblank-change-einval-by-the-correct-errno.patch @@ -0,0 +1,115 @@ +From c40c0e8c2911f4f369fb0f20008c91d43feef9e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 11:05:16 -0300 +Subject: drm/drm_vblank: Change EINVAL by the correct errno +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rodrigo Siqueira + +[ Upstream commit aed6105b28b10613f16c0bfe97525fe5a23338df ] + +For historical reasons, the function drm_wait_vblank_ioctl always return +-EINVAL if something gets wrong. This scenario limits the flexibility +for the userspace to make detailed verification of any problem and take +some action. In particular, the validation of “if (!dev->irq_enabled)” +in the drm_wait_vblank_ioctl is responsible for checking if the driver +support vblank or not. If the driver does not support VBlank, the +function drm_wait_vblank_ioctl returns EINVAL, which does not represent +the real issue; this patch changes this behavior by return EOPNOTSUPP. +Additionally, drm_crtc_get_sequence_ioctl and +drm_crtc_queue_sequence_ioctl, also returns EINVAL if vblank is not +supported; this patch also changes the return value to EOPNOTSUPP in +these functions. Lastly, these functions are invoked by libdrm, which is +used by many compositors; because of this, it is important to check if +this change breaks any compositor. In this sense, the following projects +were examined: + +* Drm-hwcomposer +* Kwin +* Sway +* Wlroots +* Wayland +* Weston +* Mutter +* Xorg (67 different drivers) + +For each repository the verification happened in three steps: + +* Update the main branch +* Look for any occurrence of "drmCrtcQueueSequence", + "drmCrtcGetSequence", and "drmWaitVBlank" with the command git grep -n + "STRING". +* Look in the git history of the project with the command +git log -S + +None of the above projects validate the use of EINVAL when using +drmWaitVBlank(), which make safe, at least for these projects, to change +the return values. On the other hand, mesa and xserver project uses +drmCrtcQueueSequence() and drmCrtcGetSequence(); this change is harmless +for both projects. + +Change since V5 (Pekka Paalanen): + - Check if the change also affects Mutter + +Change since V4 (Daniel): + - Also return EOPNOTSUPP in drm_crtc_[get|queue]_sequence_ioctl + +Change since V3: + - Return EINVAL for _DRM_VBLANK_SIGNAL (Daniel) + +Change since V2: + Daniel Vetter and Chris Wilson + - Replace ENOTTY by EOPNOTSUPP + - Return EINVAL if the parameters are wrong + +Cc: Keith Packard +Cc: Maarten Lankhorst +Cc: Ville Syrjälä +Cc: Chris Wilson +Cc: Daniel Vetter +Cc: Pekka Paalanen +Signed-off-by: Rodrigo Siqueira +Reviewed-by: Daniel Vetter +Acked-by: Pekka Paalanen +Link: https://patchwork.freedesktop.org/patch/msgid/20191002140516.adeyj3htylimmlmg@smtp.gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_vblank.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c +index d1859bcc7ccb..33a72a84361e 100644 +--- a/drivers/gpu/drm/drm_vblank.c ++++ b/drivers/gpu/drm/drm_vblank.c +@@ -1572,7 +1572,7 @@ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data, + unsigned int flags, pipe, high_pipe; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + if (vblwait->request.type & _DRM_VBLANK_SIGNAL) + return -EINVAL; +@@ -1813,7 +1813,7 @@ int drm_crtc_get_sequence_ioctl(struct drm_device *dev, void *data, + return -EINVAL; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, get_seq->crtc_id); + if (!crtc) +@@ -1871,7 +1871,7 @@ int drm_crtc_queue_sequence_ioctl(struct drm_device *dev, void *data, + return -EINVAL; + + if (!dev->irq_enabled) +- return -EINVAL; ++ return -EOPNOTSUPP; + + crtc = drm_crtc_find(dev, file_priv, queue_seq->crtc_id); + if (!crtc) +-- +2.20.1 + diff --git a/queue-4.19/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch b/queue-4.19/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch new file mode 100644 index 00000000000..77dd177efea --- /dev/null +++ b/queue-4.19/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch @@ -0,0 +1,44 @@ +From 0201adb6bc392f590297aa8a9ca9424f7f4c97a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 23:41:50 -0500 +Subject: drm/gma500: fix memory disclosures due to uninitialized bytes + +From: Kangjie Lu + +[ Upstream commit ec3b7b6eb8c90b52f61adff11b6db7a8db34de19 ] + +"clock" may be copied to "best_clock". Initializing best_clock +is not sufficient. The fix initializes clock as well to avoid +memory disclosures and informaiton leaks. + +Signed-off-by: Kangjie Lu +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20191018044150.1899-1-kjlu@umn.edu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/oaktrail_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c +index 1b7fd6a9d8a5..f73a02a2a5b3 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c ++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c +@@ -139,6 +139,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, + s32 freq_error, min_error = 100000; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.n = limit->n.min; clock.n <= limit->n.max; +@@ -195,6 +196,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, + int err = target; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; +-- +2.20.1 + diff --git a/queue-4.19/drm-mst-fix-query_payload-ack-reply-struct.patch b/queue-4.19/drm-mst-fix-query_payload-ack-reply-struct.patch new file mode 100644 index 00000000000..8e5157cec3a --- /dev/null +++ b/queue-4.19/drm-mst-fix-query_payload-ack-reply-struct.patch @@ -0,0 +1,47 @@ +From c308d38144cfaaeb1b30f801b6c1743530a12245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 12:52:19 -0400 +Subject: drm: mst: Fix query_payload ack reply struct + +From: Sean Paul + +[ Upstream commit 268de6530aa18fe5773062367fd119f0045f6e88 ] + +Spec says[1] Allocated_PBN is 16 bits + +[1]- DisplayPort 1.2 Spec, Section 2.11.9.8, Table 2-98 + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: Lyude Paul +Cc: Todd Previte +Cc: Dave Airlie +Cc: Maarten Lankhorst +Cc: Maxime Ripard +Cc: Sean Paul +Cc: David Airlie +Cc: Daniel Vetter +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Lyude Paul +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20190829165223.129662-1-sean@poorly.run +Signed-off-by: Sasha Levin +--- + include/drm/drm_dp_mst_helper.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index 7f78d26a0766..0f7439f0bb2f 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -313,7 +313,7 @@ struct drm_dp_resource_status_notify { + + struct drm_dp_query_payload_ack_reply { + u8 port_number; +- u8 allocated_pbn; ++ u16 allocated_pbn; + }; + + struct drm_dp_sideband_msg_req_body { +-- +2.20.1 + diff --git a/queue-4.19/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch b/queue-4.19/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch new file mode 100644 index 00000000000..b27f2f85c8a --- /dev/null +++ b/queue-4.19/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch @@ -0,0 +1,49 @@ +From 53234f30f781111714b91bcf500c0bce76c3fb24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2019 22:32:42 +0300 +Subject: drm/panel: Add missing drm_panel_init() in panel drivers + +From: Laurent Pinchart + +[ Upstream commit 65abbda8ed7ca48c8807d6b04a77431b438fa659 ] + +Panels must be initialised with drm_panel_init(). Add the missing +function call in the panel-raspberrypi-touchscreen.c and +panel-sitronix-st7789v.c drivers. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20190823193245.23876-2-laurent.pinchart@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 + + drivers/gpu/drm/panel/panel-sitronix-st7789v.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +index 9a2cb8aeab3a..aab6a70ece7f 100644 +--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c ++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c +@@ -427,6 +427,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c, + return PTR_ERR(ts->dsi); + } + ++ drm_panel_init(&ts->base); + ts->base.dev = dev; + ts->base.funcs = &rpi_touchscreen_funcs; + +diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +index 74284e5afc5d..89fa17877b33 100644 +--- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c ++++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c +@@ -380,6 +380,7 @@ static int st7789v_probe(struct spi_device *spi) + spi_set_drvdata(spi, ctx); + ctx->spi = spi; + ++ drm_panel_init(&ctx->panel); + ctx->panel.dev = &spi->dev; + ctx->panel.funcs = &st7789v_drm_funcs; + +-- +2.20.1 + diff --git a/queue-4.19/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch b/queue-4.19/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch new file mode 100644 index 00000000000..5b761623e0d --- /dev/null +++ b/queue-4.19/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch @@ -0,0 +1,40 @@ +From 9b9889ed403b3c18443b00add3b557df9c956723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 17:06:17 +0200 +Subject: drm/tegra: sor: Use correct SOR index on Tegra210 + +From: Thierry Reding + +[ Upstream commit 24e64f86da40e68c5f58af08796110f147b12193 ] + +The device tree bindings for the Tegra210 SOR don't require the +controller instance to be defined, since the instance can be derived +from the compatible string. The index is never used on Tegra210, so we +got away with it not getting set. However, subsequent patches will +change that, so make sure the proper index is used. + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/sor.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index d7fe9f15def1..89cb70da2bfe 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -2922,6 +2922,11 @@ static int tegra_sor_parse_dt(struct tegra_sor *sor) + * earlier + */ + sor->pad = TEGRA_IO_PAD_HDMI_DP0 + sor->index; ++ } else { ++ if (sor->soc->supports_edp) ++ sor->index = 0; ++ else ++ sor->index = 1; + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.19/edac-ghes-fix-grain-calculation.patch b/queue-4.19/edac-ghes-fix-grain-calculation.patch new file mode 100644 index 00000000000..2864b57157b --- /dev/null +++ b/queue-4.19/edac-ghes-fix-grain-calculation.patch @@ -0,0 +1,95 @@ +From 7f4389ecd11b3b9e52921dd04f7d1c9616086aa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 09:33:23 +0000 +Subject: EDAC/ghes: Fix grain calculation + +From: Robert Richter + +[ Upstream commit 7088e29e0423d3195e09079b4f849ec4837e5a75 ] + +The current code to convert a physical address mask to a grain +(defined as granularity in bytes) is: + + e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); + +This is broken in several ways: + +1) It calculates to wrong grain values. E.g., a physical address mask +of ~0xfff should give a grain of 0x1000. Without considering +PAGE_MASK, there is an off-by-one. Things are worse when also +filtering it with ~PAGE_MASK. This will calculate to a grain with the +upper bits set. In the example it even calculates to ~0. + +2) The grain does not depend on and is unrelated to the kernel's +page-size. The page-size only matters when unmapping memory in +memory_failure(). Smaller grains are wrongly rounded up to the +page-size, on architectures with a configurable page-size (e.g. arm64) +this could round up to the even bigger page-size of the hypervisor. + +Fix this with: + + e->grain = ~mem_err->physical_addr_mask + 1; + +The grain_bits are defined as: + + grain = 1 << grain_bits; + +Change also the grain_bits calculation accordingly, it is the same +formula as in edac_mc.c now and the code can be unified. + +The value in ->physical_addr_mask coming from firmware is assumed to +be contiguous, but this is not sanity-checked. However, in case the +mask is non-contiguous, a conversion to grain_bits effectively +converts the grain bit mask to a power of 2 by rounding it up. + +Suggested-by: James Morse +Signed-off-by: Robert Richter +Signed-off-by: Borislav Petkov +Reviewed-by: Mauro Carvalho Chehab +Cc: "linux-edac@vger.kernel.org" +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20191106093239.25517-11-rrichter@marvell.com +Signed-off-by: Sasha Levin +--- + drivers/edac/ghes_edac.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 574bce603337..78c339da19b5 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -210,6 +210,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + /* Cleans the error report buffer */ + memset(e, 0, sizeof (*e)); + e->error_count = 1; ++ e->grain = 1; + strcpy(e->label, "unknown label"); + e->msg = pvt->msg; + e->other_detail = pvt->other_detail; +@@ -305,7 +306,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + + /* Error grain */ + if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) +- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); ++ e->grain = ~mem_err->physical_addr_mask + 1; + + /* Memory error location, mapped on e->location */ + p = e->location; +@@ -412,8 +413,13 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) + if (p > pvt->other_detail) + *(p - 1) = '\0'; + ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); ++ + /* Generate the trace event */ +- grain_bits = fls_long(e->grain); + snprintf(pvt->detail_location, sizeof(pvt->detail_location), + "APEI location: %s %s", e->location, e->other_detail); + trace_mc_event(type, e->msg, e->label, e->error_count, +-- +2.20.1 + diff --git a/queue-4.19/extcon-sm5502-reset-registers-during-initialization.patch b/queue-4.19/extcon-sm5502-reset-registers-during-initialization.patch new file mode 100644 index 00000000000..c4e1647c2ae --- /dev/null +++ b/queue-4.19/extcon-sm5502-reset-registers-during-initialization.patch @@ -0,0 +1,63 @@ +From 27548f50e39c0788dc95be8b3069953a10bdde4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 17:47:20 +0200 +Subject: extcon: sm5502: Reset registers during initialization + +From: Stephan Gerhold + +[ Upstream commit 6942635032cfd3e003e980d2dfa4e6323a3ce145 ] + +On some devices (e.g. Samsung Galaxy A5 (2015)), the bootloader +seems to keep interrupts enabled for SM5502 when booting Linux. +Changing the cable state (i.e. plugging in a cable) - until the driver +is loaded - will therefore produce an interrupt that is never read. + +In this situation, the cable state will be stuck forever on the +initial state because SM5502 stops sending interrupts. +This can be avoided by clearing those pending interrupts after +the driver has been loaded. + +One way to do this is to reset all registers to default state +by writing to SM5502_REG_RESET. This ensures that we start from +a clean state, with all interrupts disabled. + +Suggested-by: Chanwoo Choi +Signed-off-by: Stephan Gerhold +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-sm5502.c | 4 ++++ + drivers/extcon/extcon-sm5502.h | 2 ++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index 0cfb5a3efdf6..2efcd94f74fc 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -69,6 +69,10 @@ struct sm5502_muic_info { + /* Default value of SM5502 register to bring up MUIC device. */ + static struct reg_data sm5502_reg_data[] = { + { ++ .reg = SM5502_REG_RESET, ++ .val = SM5502_REG_RESET_MASK, ++ .invert = true, ++ }, { + .reg = SM5502_REG_CONTROL, + .val = SM5502_REG_CONTROL_MASK_INT_MASK, + .invert = false, +diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h +index 974b53222f56..12f8b01e5753 100644 +--- a/drivers/extcon/extcon-sm5502.h ++++ b/drivers/extcon/extcon-sm5502.h +@@ -241,6 +241,8 @@ enum sm5502_reg { + #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART < +Date: Wed, 20 Nov 2019 11:57:12 +0200 +Subject: fbtft: Make sure string is NULL terminated +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 21f585480deb4bcf0d92b08879c35d066dfee030 ] + +New GCC warns about inappropriate use of strncpy(): + +drivers/staging/fbtft/fbtft-core.c: In function ‘fbtft_framebuffer_alloc’: +drivers/staging/fbtft/fbtft-core.c:665:2: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation] + 665 | strncpy(info->fix.id, dev->driver->name, 16); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Later on the copy is being used with the assumption to be NULL terminated. +Make sure string is NULL terminated by switching to snprintf(). + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20191120095716.26628-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fbtft-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index 16fcf633e60f..3fe4738720ea 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -771,7 +771,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, + fbdefio->deferred_io = fbtft_deferred_io; + fb_deferred_io_init(info); + +- strncpy(info->fix.id, dev->driver->name, 16); ++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; + info->fix.visual = FB_VISUAL_TRUECOLOR; + info->fix.xpanstep = 0; +-- +2.20.1 + diff --git a/queue-4.19/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch b/queue-4.19/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch new file mode 100644 index 00000000000..648b29f226e --- /dev/null +++ b/queue-4.19/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch @@ -0,0 +1,110 @@ +From 68d2f8cfdc7fcc5189723ed52c16cf41a8e04b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 15:49:39 +1030 +Subject: fsi: core: Fix small accesses and unaligned offsets via sysfs + +From: Andrew Jeffery + +[ Upstream commit 9f4c2b516b4f031e3cd0e45957f4150b3c1a083d ] + +Subtracting the offset delta from four-byte alignment lead to wrapping +of the requested length where `count` is less than `off`. Generalise the +length handling to enable and optimise aligned access sizes for all +offset and size combinations. The new formula produces the following +results for given offset and count values: + + offset count | length + --------------+------- + 0 1 | 1 + 0 2 | 2 + 0 3 | 2 + 0 4 | 4 + 0 5 | 4 + 1 1 | 1 + 1 2 | 1 + 1 3 | 1 + 1 4 | 1 + 1 5 | 1 + 2 1 | 1 + 2 2 | 2 + 2 3 | 2 + 2 4 | 2 + 2 5 | 2 + 3 1 | 1 + 3 2 | 1 + 3 3 | 1 + 3 4 | 1 + 3 5 | 1 + +We might need something like this for the cfam chardevs as well, for +example we don't currently implement any alignment restrictions / +handling in the hardware master driver. + +Signed-off-by: Andrew Jeffery +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20191108051945.7109-6-joel@jms.id.au +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-core.c | 31 +++++++++++++++++++++++++++---- + 1 file changed, 27 insertions(+), 4 deletions(-) + +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 2c31563fdcae..c6fa9b393e84 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -552,6 +552,31 @@ static int fsi_slave_scan(struct fsi_slave *slave) + return 0; + } + ++static unsigned long aligned_access_size(size_t offset, size_t count) ++{ ++ unsigned long offset_unit, count_unit; ++ ++ /* Criteria: ++ * ++ * 1. Access size must be less than or equal to the maximum access ++ * width or the highest power-of-two factor of offset ++ * 2. Access size must be less than or equal to the amount specified by ++ * count ++ * ++ * The access width is optimal if we can calculate 1 to be strictly ++ * equal while still satisfying 2. ++ */ ++ ++ /* Find 1 by the bottom bit of offset (with a 4 byte access cap) */ ++ offset_unit = BIT(__builtin_ctzl(offset | 4)); ++ ++ /* Find 2 by the top bit of count */ ++ count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count)); ++ ++ /* Constrain the maximum access width to the minimum of both criteria */ ++ return BIT(__builtin_ctzl(offset_unit | count_unit)); ++} ++ + static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + struct kobject *kobj, struct bin_attribute *attr, char *buf, + loff_t off, size_t count) +@@ -567,8 +592,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += read_len) { +- read_len = min_t(size_t, count, 4); +- read_len -= off & 0x3; ++ read_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_read(slave, off, buf + total_len, read_len); + if (rc) +@@ -595,8 +619,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += write_len) { +- write_len = min_t(size_t, count, 4); +- write_len -= off & 0x3; ++ write_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_write(slave, off, buf + total_len, write_len); + if (rc) +-- +2.20.1 + diff --git a/queue-4.19/gpu-host1x-allocate-gather-copy-for-host1x.patch b/queue-4.19/gpu-host1x-allocate-gather-copy-for-host1x.patch new file mode 100644 index 00000000000..7be85b929d9 --- /dev/null +++ b/queue-4.19/gpu-host1x-allocate-gather-copy-for-host1x.patch @@ -0,0 +1,75 @@ +From 96714f72566852a83fac36ba7f4c1438865dbce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 13:37:12 +0100 +Subject: gpu: host1x: Allocate gather copy for host1x + +From: Thierry Reding + +[ Upstream commit b78e70c04c149299bd210759d7c7af7c86b89ca8 ] + +Currently when the gather buffers are copied, they are copied to a +buffer that is allocated for the host1x client that wants to execute the +command streams in the buffers. However, the gather buffers will be read +by the host1x device, which causes SMMU faults if the DMA API is backed +by an IOMMU. + +Fix this by allocating the gather buffer copy for the host1x device, +which makes sure that it will be mapped into the host1x's IOVA space if +the DMA API is backed by an IOMMU. + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/job.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index 527a1cddb14f..916b2355e11a 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -447,7 +447,8 @@ out: + return err; + } + +-static inline int copy_gathers(struct host1x_job *job, struct device *dev) ++static inline int copy_gathers(struct device *host, struct host1x_job *job, ++ struct device *dev) + { + struct host1x_firewall fw; + size_t size = 0; +@@ -470,12 +471,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) + * Try a non-blocking allocation from a higher priority pools first, + * as awaiting for the allocation here is a major performance hit. + */ +- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, + GFP_NOWAIT); + + /* the higher priority allocation failed, try the generic-blocking */ + if (!job->gather_copy_mapped) +- job->gather_copy_mapped = dma_alloc_wc(dev, size, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, + &job->gather_copy, + GFP_KERNEL); + if (!job->gather_copy_mapped) +@@ -523,7 +524,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) + goto out; + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { +- err = copy_gathers(job, dev); ++ err = copy_gathers(host->dev, job, dev); + if (err) + goto out; + } +@@ -584,7 +585,7 @@ void host1x_job_unpin(struct host1x_job *job) + job->num_unpins = 0; + + if (job->gather_copy_size) +- dma_free_wc(job->channel->dev, job->gather_copy_size, ++ dma_free_wc(host->dev, job->gather_copy_size, + job->gather_copy_mapped, job->gather_copy); + } + EXPORT_SYMBOL(host1x_job_unpin); +-- +2.20.1 + diff --git a/queue-4.19/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch b/queue-4.19/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch new file mode 100644 index 00000000000..f2d825c37f6 --- /dev/null +++ b/queue-4.19/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch @@ -0,0 +1,50 @@ +From aac21477669eda5985ad93e1cdda72c0b9f6f9ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Sep 2019 14:02:56 -0700 +Subject: hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not + idled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit eaecce12f5f0d2c35d278e41e1bc4522393861ab ] + +When unloading omap3-rom-rng, we'll get the following: + +WARNING: CPU: 0 PID: 100 at drivers/clk/clk.c:948 clk_core_disable + +This is because the clock may be already disabled by omap3_rom_rng_idle(). +Let's fix the issue by checking for rng_idle on exit. + +Cc: Aaro Koskinen +Cc: Adam Ford +Cc: Pali Rohár +Cc: Sebastian Reichel +Cc: Tero Kristo +Fixes: 1c6b7c2108bd ("hwrng: OMAP3 ROM Random Number Generator support") +Signed-off-by: Tony Lindgren +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/omap3-rom-rng.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c +index 38b719017186..648e39ce6bd9 100644 +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) + { + cancel_delayed_work_sync(&idle_work); + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/i40e-initialize-itrn-registers-with-correct-values.patch b/queue-4.19/i40e-initialize-itrn-registers-with-correct-values.patch new file mode 100644 index 00000000000..43cca440939 --- /dev/null +++ b/queue-4.19/i40e-initialize-itrn-registers-with-correct-values.patch @@ -0,0 +1,82 @@ +From c52d72b9ae0873f0b56222acc1fee7a3ee770af3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 02:17:21 -0700 +Subject: i40e: initialize ITRN registers with correct values + +From: Nicholas Nunley + +[ Upstream commit 998e5166e604fd37afe94352f7b8c2d816b11049 ] + +Since commit 92418fb14750 ("i40e/i40evf: Use usec value instead of reg +value for ITR defines") the driver tracks the interrupt throttling +intervals in single usec units, although the actual ITRN/ITR0 registers are +programmed in 2 usec units. Most register programming flows in the driver +correctly handle the conversion, although it is currently not applied when +the registers are initialized to their default values. Most of the time +this doesn't present a problem since the default values are usually +immediately overwritten through the standard adaptive throttling mechanism, +or updated manually by the user, but if adaptive throttling is disabled and +the interval values are left alone then the incorrect value will persist. + +Since the intended default interval of 50 usecs (vs. 100 usecs as +programmed) performs better for most traffic workloads, this can lead to +performance regressions. + +This patch adds the correct conversion when writing the initial values to +the ITRN registers. + +Signed-off-by: Nicholas Nunley +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 1a66373184d6..23b31b2ff5cc 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3441,14 +3441,14 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi) + q_vector->rx.target_itr = + ITR_TO_REG(vsi->rx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1), +- q_vector->rx.target_itr); ++ q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = + ITR_TO_REG(vsi->tx_rings[i]->itr_setting); + wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1), +- q_vector->tx.target_itr); ++ q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + wr32(hw, I40E_PFINT_RATEN(vector - 1), +@@ -3553,11 +3553,11 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi) + /* set the ITR configuration */ + q_vector->rx.next_update = jiffies + 1; + q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + q_vector->tx.next_update = jiffies + 1; + q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting); +- wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr); ++ wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + + i40e_enable_misc_int_causes(pf); +@@ -10735,7 +10735,7 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf) + + /* associate no queues to the misc vector */ + wr32(hw, I40E_PFINT_LNKLST0, I40E_QUEUE_END_OF_LIST); +- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K); ++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K >> 1); + + i40e_flush(hw); + +-- +2.20.1 + diff --git a/queue-4.19/ib-iser-bound-protection_sg-size-by-data_sg-size.patch b/queue-4.19/ib-iser-bound-protection_sg-size-by-data_sg-size.patch new file mode 100644 index 00000000000..196ca2efa32 --- /dev/null +++ b/queue-4.19/ib-iser-bound-protection_sg-size-by-data_sg-size.patch @@ -0,0 +1,40 @@ +From 9a52bd7c0b363063c28a3c37453cfbadd0b8fcc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 00:03:47 +0300 +Subject: IB/iser: bound protection_sg size by data_sg size + +From: Max Gurtovoy + +[ Upstream commit 7718cf03c3ce4b6ebd90107643ccd01c952a1fce ] + +In case we don't set the sg_prot_tablesize, the scsi layer assign the +default size (65535 entries). We should limit this size since we should +take into consideration the underlaying device capability. This cap is +considered when calculating the sg_tablesize. Otherwise, for example, +we can get that /sys/block/sdb/queue/max_segments is 128 and +/sys/block/sdb/queue/max_integrity_segments is 65535. + +Link: https://lore.kernel.org/r/1569359027-10987-1-git-send-email-maxg@mellanox.com +Signed-off-by: Max Gurtovoy +Reviewed-by: Sagi Grimberg +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 3fecd87c9f2b..b4e0ae024575 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -646,6 +646,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, + if (ib_conn->pi_support) { + u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap; + ++ shost->sg_prot_tablesize = shost->sg_tablesize; + scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | + SHOST_DIX_GUARD_CRC); +-- +2.20.1 + diff --git a/queue-4.19/ice-delay-less.patch b/queue-4.19/ice-delay-less.patch new file mode 100644 index 00000000000..6e7d3966c20 --- /dev/null +++ b/queue-4.19/ice-delay-less.patch @@ -0,0 +1,60 @@ +From 8a07f9ad154f74cac83fb3162494485c3a598211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 02:05:36 -0800 +Subject: ice: delay less + +From: Mitch Williams + +[ Upstream commit 88bb432a55de8ae62106305083a8bfbb23b01ad2 ] + +Shorten the delay for SQ responses, but increase the number of loops. +Max delay time is unchanged, but some operations complete much more +quickly. + +In the process, add a new define to make the delay count and delay time +more explicit. Add comments to make things more explicit. + +This fixes a problem with VF resets failing on with many VFs. + +Signed-off-by: Mitch Williams +Signed-off-by: Tony Nguyen +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_controlq.c | 2 +- + drivers/net/ethernet/intel/ice/ice_controlq.h | 5 +++-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c +index 89f18fe18fe3..921cc0c9a30d 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -911,7 +911,7 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq, + if (ice_sq_done(hw, cq)) + break; + +- mdelay(1); ++ udelay(ICE_CTL_Q_SQ_CMD_USEC); + total_delay++; + } while (total_delay < cq->sq_cmd_timeout); + +diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h +index ea02b89243e2..0f2cdb06e6ef 100644 +--- a/drivers/net/ethernet/intel/ice/ice_controlq.h ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h +@@ -30,8 +30,9 @@ enum ice_ctl_q { + ICE_CTL_Q_ADMIN, + }; + +-/* Control Queue default settings */ +-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 250 /* msecs */ ++/* Control Queue timeout settings - max delay 250ms */ ++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */ ++#define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */ + + struct ice_ctl_q_ring { + void *dma_head; /* Virtual address to dma head */ +-- +2.20.1 + diff --git a/queue-4.19/iio-adc-max1027-reset-the-device-at-probe-time.patch b/queue-4.19/iio-adc-max1027-reset-the-device-at-probe-time.patch new file mode 100644 index 00000000000..84ff6a4e2bc --- /dev/null +++ b/queue-4.19/iio-adc-max1027-reset-the-device-at-probe-time.patch @@ -0,0 +1,42 @@ +From 5328b8968a47d8037f1313989d918f024fb84009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 16:43:42 +0200 +Subject: iio: adc: max1027: Reset the device at probe time + +From: Miquel Raynal + +[ Upstream commit db033831b4f5589f9fcbadb837614a7c4eac0308 ] + +All the registers are configured by the driver, let's reset the chip +at probe time, avoiding any conflict with a possible earlier +configuration. + +Signed-off-by: Miquel Raynal +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/max1027.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c +index 311c1a89c329..0939eb0384f1 100644 +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -460,6 +460,14 @@ static int max1027_probe(struct spi_device *spi) + goto fail_dev_register; + } + ++ /* Internal reset */ ++ st->reg = MAX1027_RST_REG; ++ ret = spi_write(st->spi, &st->reg, 1); ++ if (ret < 0) { ++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); ++ return ret; ++ } ++ + /* Disable averaging */ + st->reg = MAX1027_AVG_REG; + ret = spi_write(st->spi, &st->reg, 1); +-- +2.20.1 + diff --git a/queue-4.19/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch b/queue-4.19/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch new file mode 100644 index 00000000000..f548fdcb548 --- /dev/null +++ b/queue-4.19/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch @@ -0,0 +1,76 @@ +From 03d41f975765873d06dc11c872c3a1a4811de6b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 11:47:21 +0200 +Subject: iio: dac: ad5446: Add support for new AD5600 DAC + +From: Stefan Popa + +[ Upstream commit 6376cbe549fffb378403cee78efd26b8a2c8e450 ] + +The AD5600 is a single channel, 16-bit resolution, voltage output digital +to analog converter (DAC). The AD5600 uses a 3-wire SPI interface. It is +part of the AD5541 family of DACs. + +The ad5446 IIO driver implements support for some of these DACs (in the +AD5441 family), so the change is a simple entry in this driver. + +Link: https://www.analog.com/media/en/technical-documentation/data-sheets/AD5600.pdf + +Signed-off-by: Stefan Popa +Signed-off-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/Kconfig | 4 ++-- + drivers/iio/dac/ad5446.c | 6 ++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig +index 80beb64e9e0c..69f4cfa6494b 100644 +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -59,8 +59,8 @@ config AD5446 + help + Say yes here to build support for Analog Devices AD5300, AD5301, AD5310, + AD5311, AD5320, AD5321, AD5444, AD5446, AD5450, AD5451, AD5452, AD5453, +- AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5601, AD5602, AD5611, AD5612, +- AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs ++ AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5600, AD5601, AD5602, AD5611, ++ AD5612, AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs + as well as Texas Instruments DAC081S101, DAC101S101, DAC121S101. + + To compile this driver as a module, choose M here: the +diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c +index fd26a4272fc5..d3ce5def4f65 100644 +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -328,6 +328,7 @@ enum ad5446_supported_spi_device_ids { + ID_AD5541A, + ID_AD5512A, + ID_AD5553, ++ ID_AD5600, + ID_AD5601, + ID_AD5611, + ID_AD5621, +@@ -382,6 +383,10 @@ static const struct ad5446_chip_info ad5446_spi_chip_info[] = { + .channel = AD5446_CHANNEL(14, 16, 0), + .write = ad5446_write, + }, ++ [ID_AD5600] = { ++ .channel = AD5446_CHANNEL(16, 16, 0), ++ .write = ad5446_write, ++ }, + [ID_AD5601] = { + .channel = AD5446_CHANNEL_POWERDOWN(8, 16, 6), + .write = ad5446_write, +@@ -449,6 +454,7 @@ static const struct spi_device_id ad5446_spi_ids[] = { + {"ad5542a", ID_AD5541A}, /* ad5541a and ad5542a are compatible */ + {"ad5543", ID_AD5541A}, /* ad5541a and ad5543 are compatible */ + {"ad5553", ID_AD5553}, ++ {"ad5600", ID_AD5600}, + {"ad5601", ID_AD5601}, + {"ad5611", ID_AD5611}, + {"ad5621", ID_AD5621}, +-- +2.20.1 + diff --git a/queue-4.19/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch b/queue-4.19/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch new file mode 100644 index 00000000000..5ab18a62cc6 --- /dev/null +++ b/queue-4.19/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch @@ -0,0 +1,95 @@ +From d9faad36624c2470ee750c1d2d70cc1d13ffea41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 11:26:34 +0300 +Subject: iio: dln2-adc: fix iio_triggered_buffer_postenable() position + +From: Alexandru Ardelean + +[ Upstream commit a7bddfe2dfce1d8859422124abe1964e0ecd386e ] + +The iio_triggered_buffer_postenable() hook should be called first to +attach the poll function. The iio_triggered_buffer_predisable() hook is +called last (as is it should). + +This change moves iio_triggered_buffer_postenable() to be called first. It +adds iio_triggered_buffer_predisable() on the error paths of the postenable +hook. +For the predisable hook, some code-paths have been changed to make sure +that the iio_triggered_buffer_predisable() hook gets called in case there +is an error before it. + +Signed-off-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/dln2-adc.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c +index c64c6675cae6..4ab052d76d9f 100644 +--- a/drivers/iio/adc/dln2-adc.c ++++ b/drivers/iio/adc/dln2-adc.c +@@ -527,6 +527,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + u16 conflict; + unsigned int trigger_chan; + ++ ret = iio_triggered_buffer_postenable(indio_dev); ++ if (ret) ++ return ret; ++ + mutex_lock(&dln2->mutex); + + /* Enable ADC */ +@@ -540,6 +544,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + (int)conflict); + ret = -EBUSY; + } ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + +@@ -553,6 +558,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + if (ret < 0) { + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + } else { +@@ -560,12 +566,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + } + +- return iio_triggered_buffer_postenable(indio_dev); ++ return 0; + } + + static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + { +- int ret; ++ int ret, ret2; + struct dln2_adc *dln2 = iio_priv(indio_dev); + + mutex_lock(&dln2->mutex); +@@ -580,12 +586,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + ret = dln2_adc_set_port_enabled(dln2, false, NULL); + + mutex_unlock(&dln2->mutex); +- if (ret < 0) { ++ if (ret < 0) + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); +- return ret; +- } + +- return iio_triggered_buffer_predisable(indio_dev); ++ ret2 = iio_triggered_buffer_predisable(indio_dev); ++ if (ret == 0) ++ ret = ret2; ++ ++ return ret; + } + + static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { +-- +2.20.1 + diff --git a/queue-4.19/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch b/queue-4.19/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch new file mode 100644 index 00000000000..517d2b5c939 --- /dev/null +++ b/queue-4.19/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch @@ -0,0 +1,55 @@ +From 6c29d4ec1ce2db3ca567daa7654007532000347e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2019 22:24:13 +0200 +Subject: iio: light: bh1750: Resolve compiler warning and make code more + readable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczynski + +[ Upstream commit f552fde983d378e7339f9ea74a25f918563bf0d3 ] + +Separate the declaration of struct bh1750_chip_info from definition +of bh1750_chip_info_tbl[] in a single statement as it makes the code +hard to read, and with the extra newline it makes it look as if the +bh1750_chip_info_tbl[] had no explicit type. + +This change also resolves the following compiler warning about the +unusual position of the static keyword that can be seen when building +with warnings enabled (W=1): + +drivers/iio/light/bh1750.c:64:1: warning: + ‘static’ is not at beginning of declaration [-Wold-style-declaration] + +Related to commit 3a11fbb037a1 ("iio: light: add support for ROHM +BH1710/BH1715/BH1721/BH1750/BH1751 ambient light sensors"). + +Signed-off-by: Krzysztof Wilczynski +Acked-by: Uwe Kleine-König +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/bh1750.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c +index a814828e69f5..5f5d54ce882b 100644 +--- a/drivers/iio/light/bh1750.c ++++ b/drivers/iio/light/bh1750.c +@@ -62,9 +62,9 @@ struct bh1750_chip_info { + + u16 int_time_low_mask; + u16 int_time_high_mask; +-} ++}; + +-static const bh1750_chip_info_tbl[] = { ++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { + [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, + [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, + [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, +-- +2.20.1 + diff --git a/queue-4.19/ipmi-don-t-allow-device-module-unload-when-in-use.patch b/queue-4.19/ipmi-don-t-allow-device-module-unload-when-in-use.patch new file mode 100644 index 00000000000..b21ea4c4df3 --- /dev/null +++ b/queue-4.19/ipmi-don-t-allow-device-module-unload-when-in-use.patch @@ -0,0 +1,136 @@ +From 988d6d512d926e4e40dfdc6757b5faa3bcedb6df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2019 10:35:56 -0500 +Subject: ipmi: Don't allow device module unload when in use + +From: Corey Minyard + +[ Upstream commit cbb79863fc3175ed5ac506465948b02a893a8235 ] + +If something has the IPMI driver open, don't allow the device +module to be unloaded. Before it would unload and the user would +get errors on use. + +This change is made on user request, and it makes it consistent +with the I2C driver, which has the same behavior. + +It does change things a little bit with respect to kernel users. +If the ACPI or IPMI watchdog (or any other kernel user) has +created a user, then the device module cannot be unloaded. Before +it could be unloaded, + +This does not affect hot-plug. If the device goes away (it's on +something removable that is removed or is hot-removed via sysfs) +then it still behaves as it did before. + +Reported-by: tony camuso +Signed-off-by: Corey Minyard +Tested-by: tony camuso +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 23 ++++++++++++++++------- + include/linux/ipmi_smi.h | 12 ++++++++---- + 2 files changed, 24 insertions(+), 11 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 84c17f936c09..91f2d9219489 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -447,6 +447,8 @@ enum ipmi_stat_indexes { + + #define IPMI_IPMB_NUM_SEQ 64 + struct ipmi_smi { ++ struct module *owner; ++ + /* What interface number are we? */ + int intf_num; + +@@ -1139,6 +1141,11 @@ int ipmi_create_user(unsigned int if_num, + if (rv) + goto out_kfree; + ++ if (!try_module_get(intf->owner)) { ++ rv = -ENODEV; ++ goto out_kfree; ++ } ++ + /* Note that each existing user holds a refcount to the interface. */ + kref_get(&intf->refcount); + +@@ -1269,6 +1276,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user) + } + + kref_put(&intf->refcount, intf_free); ++ module_put(intf->owner); + } + + int ipmi_destroy_user(struct ipmi_user *user) +@@ -2384,7 +2392,7 @@ static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc) + * been recently fetched, this will just use the cached data. Otherwise + * it will run a new fetch. + * +- * Except for the first time this is called (in ipmi_register_smi()), ++ * Except for the first time this is called (in ipmi_add_smi()), + * this will always return good data; + */ + static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, +@@ -3304,10 +3312,11 @@ static void redo_bmc_reg(struct work_struct *work) + kref_put(&intf->refcount, intf_free); + } + +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *si_dev, +- unsigned char slave_addr) ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *si_dev, ++ unsigned char slave_addr) + { + int i, j; + int rv; +@@ -3333,7 +3342,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + return rv; + } + +- ++ intf->owner = owner; + intf->bmc = &intf->tmp_bmc; + INIT_LIST_HEAD(&intf->bmc->intfs); + mutex_init(&intf->bmc->dyn_mutex); +@@ -3440,7 +3449,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + + return rv; + } +-EXPORT_SYMBOL(ipmi_register_smi); ++EXPORT_SYMBOL(ipmi_add_smi); + + static void deliver_smi_err_response(struct ipmi_smi *intf, + struct ipmi_smi_msg *msg, +diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h +index 7d5fd38d5282..1995ce146789 100644 +--- a/include/linux/ipmi_smi.h ++++ b/include/linux/ipmi_smi.h +@@ -211,10 +211,14 @@ static inline int ipmi_demangle_device_id(uint8_t netfn, uint8_t cmd, + * is called, and the lower layer must get the interface from that + * call. + */ +-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, +- void *send_info, +- struct device *dev, +- unsigned char slave_addr); ++int ipmi_add_smi(struct module *owner, ++ const struct ipmi_smi_handlers *handlers, ++ void *send_info, ++ struct device *dev, ++ unsigned char slave_addr); ++ ++#define ipmi_register_smi(handlers, send_info, dev, slave_addr) \ ++ ipmi_add_smi(THIS_MODULE, handlers, send_info, dev, slave_addr) + + /* + * Remove a low-level interface from the IPMI driver. This will +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-check-kasprintf-return-value.patch b/queue-4.19/iwlwifi-check-kasprintf-return-value.patch new file mode 100644 index 00000000000..4401d6a1a36 --- /dev/null +++ b/queue-4.19/iwlwifi-check-kasprintf-return-value.patch @@ -0,0 +1,52 @@ +From 010560ef2a1acff8dd450810db561167958d25d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 14:50:32 +0100 +Subject: iwlwifi: check kasprintf() return value + +From: Johannes Berg + +[ Upstream commit 5974fbb5e10b018fdbe3c3b81cb4cc54e1105ab9 ] + +kasprintf() can fail, we should check the return value. + +Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger") +Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/dvm/led.c | 3 +++ + drivers/net/wireless/intel/iwlwifi/mvm/led.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +index 1bbd17ada974..20e16c423990 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +@@ -185,6 +185,9 @@ void iwl_leds_init(struct iwl_priv *priv) + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +index b27269504a62..072f80c90ce4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +@@ -131,6 +131,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch b/queue-4.19/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch new file mode 100644 index 00000000000..677790680d7 --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch @@ -0,0 +1,50 @@ +From 43f6938608986b4ed468f26d06333afed34d2114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 09:28:02 +0200 +Subject: iwlwifi: mvm: fix unaligned read of rx_pkt_status + +From: Wang Xuerui + +[ Upstream commit c5aaa8be29b25dfe1731e9a8b19fd91b7b789ee3 ] + +This is present since the introduction of iwlmvm. +Example stack trace on MIPS: + +[] iwl_mvm_rx_rx_mpdu+0xa8/0xb88 [iwlmvm] +[] iwl_pcie_rx_handle+0x420/0xc48 [iwlwifi] + +Tested with a Wireless AC 7265 for ~6 months, confirmed to fix the +problem. No other unaligned accesses are spotted yet. + +Signed-off-by: Wang Xuerui +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index bfb163419c67..e6a67bc02209 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -62,6 +62,7 @@ + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *****************************************************************************/ ++#include + #include + #include + #include "iwl-trans.h" +@@ -360,7 +361,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; + hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); + len = le16_to_cpu(rx_res->byte_count); +- rx_pkt_status = le32_to_cpup((__le32 *) ++ rx_pkt_status = get_unaligned_le32((__le32 *) + (pkt->data + sizeof(*rx_res) + len)); + + /* Dont use dev_alloc_skb(), we'll have enough headroom once +-- +2.20.1 + diff --git a/queue-4.19/ixgbe-protect-tx-timestamping-from-api-misuse.patch b/queue-4.19/ixgbe-protect-tx-timestamping-from-api-misuse.patch new file mode 100644 index 00000000000..09a5e51ce62 --- /dev/null +++ b/queue-4.19/ixgbe-protect-tx-timestamping-from-api-misuse.patch @@ -0,0 +1,46 @@ +From 82228541463a04647a1a47062099bbb3a3b86868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2019 08:20:03 -0700 +Subject: ixgbe: protect TX timestamping from API misuse + +From: Manjunath Patil + +[ Upstream commit 07066d9dc3d2326fbad8f7b0cb0120cff7b7dedb ] + +HW timestamping can only be requested for a packet if the NIC is first +setup via ioctl(SIOCSHWTSTAMP). If this step was skipped, then the ixgbe +driver still allowed TX packets to request HW timestamping. In this +situation, we see 'clearing Tx Timestamp hang' noise in the log. + +Fix this by checking that the NIC is configured for HW TX timestamping +before accepting a HW TX timestamping request. + +Similar-to: + commit 26bd4e2db06b ("igb: protect TX timestamping from API misuse") + commit 0a6f2f05a2f5 ("igb: Fix a test with HWTSTAMP_TX_ON") + +Signed-off-by: Manjunath Patil +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index b45a6e2ed8d1..de65ca1e6558 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8551,7 +8551,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + adapter->ptp_clock) { +- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && ++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, + &adapter->state)) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IXGBE_TX_FLAGS_TSTAMP; +-- +2.20.1 + diff --git a/queue-4.19/libata-ensure-ata_port-probe-has-completed-before-de.patch b/queue-4.19/libata-ensure-ata_port-probe-has-completed-before-de.patch new file mode 100644 index 00000000000..e1482e920c8 --- /dev/null +++ b/queue-4.19/libata-ensure-ata_port-probe-has-completed-before-de.patch @@ -0,0 +1,95 @@ +From 63e6d8652565c52993eccc67b6ba447459c1145d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 18:19:52 +0800 +Subject: libata: Ensure ata_port probe has completed before detach + +From: John Garry + +[ Upstream commit 130f4caf145c3562108b245a576db30b916199d2 ] + +With CONFIG_DEBUG_TEST_DRIVER_REMOVE set, we may find the following WARN: + +[ 23.452574] ------------[ cut here ]------------ +[ 23.457190] WARNING: CPU: 59 PID: 1 at drivers/ata/libata-core.c:6676 ata_host_detach+0x15c/0x168 +[ 23.466047] Modules linked in: +[ 23.469092] CPU: 59 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc1-00010-g5b83fd27752b-dirty #296 +[ 23.477776] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019 +[ 23.486286] pstate: a0c00009 (NzCv daif +PAN +UAO) +[ 23.491065] pc : ata_host_detach+0x15c/0x168 +[ 23.495322] lr : ata_host_detach+0x88/0x168 +[ 23.499491] sp : ffff800011cabb50 +[ 23.502792] x29: ffff800011cabb50 x28: 0000000000000007 +[ 23.508091] x27: ffff80001137f068 x26: ffff8000112c0c28 +[ 23.513390] x25: 0000000000003848 x24: ffff0023ea185300 +[ 23.518689] x23: 0000000000000001 x22: 00000000000014c0 +[ 23.523987] x21: 0000000000013740 x20: ffff0023bdc20000 +[ 23.529286] x19: 0000000000000000 x18: 0000000000000004 +[ 23.534584] x17: 0000000000000001 x16: 00000000000000f0 +[ 23.539883] x15: ffff0023eac13790 x14: ffff0023eb76c408 +[ 23.545181] x13: 0000000000000000 x12: ffff0023eac13790 +[ 23.550480] x11: ffff0023eb76c228 x10: 0000000000000000 +[ 23.555779] x9 : ffff0023eac13798 x8 : 0000000040000000 +[ 23.561077] x7 : 0000000000000002 x6 : 0000000000000001 +[ 23.566376] x5 : 0000000000000002 x4 : 0000000000000000 +[ 23.571674] x3 : ffff0023bf08a0bc x2 : 0000000000000000 +[ 23.576972] x1 : 3099674201f72700 x0 : 0000000000400284 +[ 23.582272] Call trace: +[ 23.584706] ata_host_detach+0x15c/0x168 +[ 23.588616] ata_pci_remove_one+0x10/0x18 +[ 23.592615] ahci_remove_one+0x20/0x40 +[ 23.596356] pci_device_remove+0x3c/0xe0 +[ 23.600267] really_probe+0xdc/0x3e0 +[ 23.603830] driver_probe_device+0x58/0x100 +[ 23.608000] device_driver_attach+0x6c/0x90 +[ 23.612169] __driver_attach+0x84/0xc8 +[ 23.615908] bus_for_each_dev+0x74/0xc8 +[ 23.619730] driver_attach+0x20/0x28 +[ 23.623292] bus_add_driver+0x148/0x1f0 +[ 23.627115] driver_register+0x60/0x110 +[ 23.630938] __pci_register_driver+0x40/0x48 +[ 23.635199] ahci_pci_driver_init+0x20/0x28 +[ 23.639372] do_one_initcall+0x5c/0x1b0 +[ 23.643199] kernel_init_freeable+0x1a4/0x24c +[ 23.647546] kernel_init+0x10/0x108 +[ 23.651023] ret_from_fork+0x10/0x18 +[ 23.654590] ---[ end trace 634a14b675b71c13 ]--- + +With KASAN also enabled, we may also get many use-after-free reports. + +The issue is that when CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, we may +attempt to detach the ata_port before it has been probed. + +This is because the ata_ports are async probed, meaning that there is no +guarantee that the ata_port has probed prior to detach. When the ata_port +does probe in this scenario, we get all sorts of issues as the detach may +have already happened. + +Fix by ensuring synchronisation with async_synchronize_full(). We could +alternatively use the cookie returned from the ata_port probe +async_schedule() call, but that means managing the cookie, so more +complicated. + +Signed-off-by: John Garry +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 133fed8e4a8b..85ee6c35d8e0 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6726,6 +6726,9 @@ void ata_host_detach(struct ata_host *host) + { + int i; + ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_full(); ++ + for (i = 0; i < host->n_ports; i++) + ata_port_detach(host->ports[i]); + +-- +2.20.1 + diff --git a/queue-4.19/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch b/queue-4.19/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch new file mode 100644 index 00000000000..0aca1cf8293 --- /dev/null +++ b/queue-4.19/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch @@ -0,0 +1,68 @@ +From 7b418a1856522571cbe4d2d13a412538c76cee80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2019 12:09:37 +0100 +Subject: libbpf: Fix error handling in bpf_map__reuse_fd() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit d1b4574a4b86565325ef2e545eda8dfc9aa07c60 ] + +bpf_map__reuse_fd() was calling close() in the error path before returning +an error value based on errno. However, close can change errno, so that can +lead to potentially misleading error messages. Instead, explicitly store +errno in the err variable before each goto. + +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/157269297769.394725.12634985106772698611.stgit@toke.dk +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index a62be78fc07b..249fa8d7376e 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1073,16 +1073,22 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + return -errno; + + new_fd = open("/", O_RDONLY | O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_free_new_name; ++ } + + new_fd = dup3(fd, new_fd, O_CLOEXEC); +- if (new_fd < 0) ++ if (new_fd < 0) { ++ err = -errno; + goto err_close_new_fd; ++ } + + err = zclose(map->fd); +- if (err) ++ if (err) { ++ err = -errno; + goto err_close_new_fd; ++ } + free(map->name); + + map->fd = new_fd; +@@ -1101,7 +1107,7 @@ err_close_new_fd: + close(new_fd); + err_free_new_name: + free(new_name); +- return -errno; ++ return err; + } + + static int +-- +2.20.1 + diff --git a/queue-4.19/libertas-fix-a-potential-null-pointer-dereference.patch b/queue-4.19/libertas-fix-a-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..9b53cd793ff --- /dev/null +++ b/queue-4.19/libertas-fix-a-potential-null-pointer-dereference.patch @@ -0,0 +1,45 @@ +From 709520a11bec56896492f3a341a0d2c3509610c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 22:05:00 +0530 +Subject: libertas: fix a potential NULL pointer dereference + +From: Allen Pais + +[ Upstream commit 7da413a18583baaf35dd4a8eb414fa410367d7f2 ] + +alloc_workqueue is not checked for errors and as a result, +a potential NULL dereference could occur. + +Signed-off-by: Allen Pais +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_sdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 39bf85d0ade0..c7f8a29d2606 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1183,6 +1183,10 @@ static int if_sdio_probe(struct sdio_func *func, + + spin_lock_init(&card->lock); + card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); ++ if (unlikely(!card->workqueue)) { ++ ret = -ENOMEM; ++ goto err_queue; ++ } + INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); + init_waitqueue_head(&card->pwron_waitq); + +@@ -1234,6 +1238,7 @@ err_activate_card: + lbs_remove_card(priv); + free: + destroy_workqueue(card->workqueue); ++err_queue: + while (card->packets) { + packet = card->packets; + card->packets = card->packets->next; +-- +2.20.1 + diff --git a/queue-4.19/libsubcmd-use-o0-with-debug-1.patch b/queue-4.19/libsubcmd-use-o0-with-debug-1.patch new file mode 100644 index 00000000000..5fccccac456 --- /dev/null +++ b/queue-4.19/libsubcmd-use-o0-with-debug-1.patch @@ -0,0 +1,46 @@ +From 58ce6b2d2382d0f15d07540594ffae11896f7d32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 11:34:01 +0000 +Subject: libsubcmd: Use -O0 with DEBUG=1 + +From: James Clark + +[ Upstream commit 22bd8f1b5a1dd168ba4eba27cb17643a11012f5d ] + +When a 'make DEBUG=1' build is done, the command parser is still built +with -O6 and is hard to step through, fix it making it use -O0 in that +case. + +Signed-off-by: James Clark +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Josh Poimboeuf +Cc: Namhyung Kim +Cc: nd +Link: http://lore.kernel.org/lkml/20191028113340.4282-1-james.clark@arm.com +[ split from a larger patch ] +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index 5b2cd5e58df0..5dbb0dde208c 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) + endif + endif + +-ifeq ($(CC_NO_CLANG), 0) ++ifeq ($(DEBUG),1) ++ CFLAGS += -O0 ++else ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 + else + CFLAGS += -O6 +-- +2.20.1 + diff --git a/queue-4.19/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch b/queue-4.19/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch new file mode 100644 index 00000000000..45b28648c0e --- /dev/null +++ b/queue-4.19/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch @@ -0,0 +1,55 @@ +From 329ce67cd7acbc53d1f108aa6232d24f776298a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 20:44:15 -0500 +Subject: libtraceevent: Fix memory leakage in copy_filter_type + +From: Hewenliang + +[ Upstream commit 10992af6bf46a2048ad964985a5b77464e5563b1 ] + +It is necessary to free the memory that we have allocated when error occurs. + +Fixes: ef3072cd1d5c ("tools lib traceevent: Get rid of die in add_filter_type()") +Signed-off-by: Hewenliang +Reviewed-by: Steven Rostedt (VMware) +Cc: Tzvetomir Stoyanov +Link: http://lore.kernel.org/lkml/20191119014415.57210-1-hewenliang4@huawei.com +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/traceevent/parse-filter.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index e76154c02ee7..2700f1f17876 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1475,8 +1475,10 @@ static int copy_filter_type(struct event_filter *filter, + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1485,8 +1487,11 @@ static int copy_filter_type(struct event_filter *filter, + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + +-- +2.20.1 + diff --git a/queue-4.19/loop-fix-no-unmap-write-zeroes-request-behavior.patch b/queue-4.19/loop-fix-no-unmap-write-zeroes-request-behavior.patch new file mode 100644 index 00000000000..14d9d31f964 --- /dev/null +++ b/queue-4.19/loop-fix-no-unmap-write-zeroes-request-behavior.patch @@ -0,0 +1,83 @@ +From d11b82faede4a11fb4c38cc9f6db89eda2780788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 20:29:48 -0700 +Subject: loop: fix no-unmap write-zeroes request behavior + +From: Darrick J. Wong + +[ Upstream commit efcfec579f6139528c9e6925eca2bc4a36da65c6 ] + +Currently, if the loop device receives a WRITE_ZEROES request, it asks +the underlying filesystem to punch out the range. This behavior is +correct if unmapping is allowed. However, a NOUNMAP request means that +the caller doesn't want us to free the storage backing the range, so +punching out the range is incorrect behavior. + +To satisfy a NOUNMAP | WRITE_ZEROES request, loop should ask the +underlying filesystem to FALLOC_FL_ZERO_RANGE, which is (according to +the fallocate documentation) required to ensure that the entire range is +backed by real storage, which suffices for our purposes. + +Fixes: 19372e2769179dd ("loop: implement REQ_OP_WRITE_ZEROES") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 126c2c514673..9cd231a27328 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -416,18 +416,20 @@ out_free_page: + return ret; + } + +-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) ++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, ++ int mode) + { + /* +- * We use punch hole to reclaim the free space used by the +- * image a.k.a. discard. However we do not support discard if +- * encryption is enabled, because it may give an attacker +- * useful information. ++ * We use fallocate to manipulate the space mappings used by the image ++ * a.k.a. discard/zerorange. However we do not support this if ++ * encryption is enabled, because it may give an attacker useful ++ * information. + */ + struct file *file = lo->lo_backing_file; +- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + int ret; + ++ mode |= FALLOC_FL_KEEP_SIZE; ++ + if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { + ret = -EOPNOTSUPP; + goto out; +@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +- case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- return lo_discard(lo, rq, pos); ++ /* ++ * If the caller doesn't want deallocation, call zeroout to ++ * write zeroes the range. Otherwise, punch them out. ++ */ ++ return lo_fallocate(lo, rq, pos, ++ (rq->cmd_flags & REQ_NOUNMAP) ? ++ FALLOC_FL_ZERO_RANGE : ++ FALLOC_FL_PUNCH_HOLE); ++ case REQ_OP_DISCARD: ++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (lo->transfer) + return lo_write_transfer(lo, rq, pos); +-- +2.20.1 + diff --git a/queue-4.19/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch b/queue-4.19/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch new file mode 100644 index 00000000000..da6f79fea46 --- /dev/null +++ b/queue-4.19/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch @@ -0,0 +1,50 @@ +From bdc75fd678be9ce651f0aea94e3ccc5d21fd24dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 21:35:38 -0800 +Subject: mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED + +From: Thomas Pedersen + +[ Upstream commit 08a5bdde3812993cb8eb7aa9124703df0de28e4b ] + +Commit 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing") +let STAs send QoS Null frames as PS triggers if the AP was +a QoS STA. However, the mac80211 PS stack relies on an +interface flag IEEE80211_STA_NULLFUNC_ACKED for +determining trigger frame ACK, which was not being set for +acked non-QoS Null frames. The effect is an inability to +trigger hardware sleep via IEEE80211_CONF_PS since the QoS +Null frame was seemingly never acked. + +This bug only applies to drivers which set both +IEEE80211_HW_REPORTS_TX_ACK_STATUS and +IEEE80211_HW_PS_NULLFUNC_STACK. + +Detect the acked QoS Null frame to restore STA power save. + +Fixes: 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing") +Signed-off-by: Thomas Pedersen +Link: https://lore.kernel.org/r/20191119053538.25979-4-thomas@adapt-ip.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/status.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index 534a604b75c2..f895c656407b 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -867,7 +867,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, + I802_DEBUG_INC(local->dot11FailedCount); + } + +- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && ++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && ++ ieee80211_has_pm(fc) && + ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && + !(info->flags & IEEE80211_TX_CTL_INJECTED) && + local->ps_sdata && !(local->scanning)) { +-- +2.20.1 + diff --git a/queue-4.19/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch b/queue-4.19/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch new file mode 100644 index 00000000000..e9ce6d2d3cc --- /dev/null +++ b/queue-4.19/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch @@ -0,0 +1,101 @@ +From 160cc14e2b869a1877e11eb7deb51794022fed3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 13:53:50 +0200 +Subject: md/bitmap: avoid race window between md_bitmap_resize and + bitmap_file_clear_bit + +From: Guoqing Jiang + +[ Upstream commit fadcbd2901a0f7c8721f3bdb69eac95c272dc8ed ] + +We need to move "spin_lock_irq(&bitmap->counts.lock)" before unmap previous +storage, otherwise panic like belows could happen as follows. + +[ 902.353802] sdl: detected capacity change from 1077936128 to 3221225472 +[ 902.616948] general protection fault: 0000 [#1] SMP +[snip] +[ 902.618588] CPU: 12 PID: 33698 Comm: md0_raid1 Tainted: G O 4.14.144-1-pserver #4.14.144-1.1~deb10 +[ 902.618870] Hardware name: Supermicro SBA-7142G-T4/BHQGE, BIOS 3.00 10/24/2012 +[ 902.619120] task: ffff9ae1860fc600 task.stack: ffffb52e4c704000 +[ 902.619301] RIP: 0010:bitmap_file_clear_bit+0x90/0xd0 [md_mod] +[ 902.619464] RSP: 0018:ffffb52e4c707d28 EFLAGS: 00010087 +[ 902.619626] RAX: ffe8008b0d061000 RBX: ffff9ad078c87300 RCX: 0000000000000000 +[ 902.619792] RDX: ffff9ad986341868 RSI: 0000000000000803 RDI: ffff9ad078c87300 +[ 902.619986] RBP: ffff9ad0ed7a8000 R08: 0000000000000000 R09: 0000000000000000 +[ 902.620154] R10: ffffb52e4c707ec0 R11: ffff9ad987d1ed44 R12: ffff9ad0ed7a8360 +[ 902.620320] R13: 0000000000000003 R14: 0000000000060000 R15: 0000000000000800 +[ 902.620487] FS: 0000000000000000(0000) GS:ffff9ad987d00000(0000) knlGS:0000000000000000 +[ 902.620738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 902.620901] CR2: 000055ff12aecec0 CR3: 0000001005207000 CR4: 00000000000406e0 +[ 902.621068] Call Trace: +[ 902.621256] bitmap_daemon_work+0x2dd/0x360 [md_mod] +[ 902.621429] ? find_pers+0x70/0x70 [md_mod] +[ 902.621597] md_check_recovery+0x51/0x540 [md_mod] +[ 902.621762] raid1d+0x5c/0xeb0 [raid1] +[ 902.621939] ? try_to_del_timer_sync+0x4d/0x80 +[ 902.622102] ? del_timer_sync+0x35/0x40 +[ 902.622265] ? schedule_timeout+0x177/0x360 +[ 902.622453] ? call_timer_fn+0x130/0x130 +[ 902.622623] ? find_pers+0x70/0x70 [md_mod] +[ 902.622794] ? md_thread+0x94/0x150 [md_mod] +[ 902.622959] md_thread+0x94/0x150 [md_mod] +[ 902.623121] ? wait_woken+0x80/0x80 +[ 902.623280] kthread+0x119/0x130 +[ 902.623437] ? kthread_create_on_node+0x60/0x60 +[ 902.623600] ret_from_fork+0x22/0x40 +[ 902.624225] RIP: bitmap_file_clear_bit+0x90/0xd0 [md_mod] RSP: ffffb52e4c707d28 + +Because mdadm was running on another cpu to do resize, so bitmap_resize was +called to replace bitmap as below shows. + +PID: 38801 TASK: ffff9ad074a90e00 CPU: 0 COMMAND: "mdadm" + [exception RIP: queued_spin_lock_slowpath+56] + [snip] +-- -- + #5 [ffffb52e60f17c58] queued_spin_lock_slowpath at ffffffff9c0b27b8 + #6 [ffffb52e60f17c58] bitmap_resize at ffffffffc0399877 [md_mod] + #7 [ffffb52e60f17d30] raid1_resize at ffffffffc0285bf9 [raid1] + #8 [ffffb52e60f17d50] update_size at ffffffffc038a31a [md_mod] + #9 [ffffb52e60f17d70] md_ioctl at ffffffffc0395ca4 [md_mod] + +And the procedure to keep resize bitmap safe is allocate new storage +space, then quiesce, copy bits, replace bitmap, and re-start. + +However the daemon (bitmap_daemon_work) could happen even the array is +quiesced, which means when bitmap_file_clear_bit is triggered by raid1d, +then it thinks it should be fine to access store->filemap since +counts->lock is held, but resize could change the storage without the +protection of the lock. + +Cc: Jack Wang +Cc: NeilBrown +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 2fc8c113977f..fd8607124bdb 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2132,6 +2132,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + memcpy(page_address(store.sb_page), + page_address(bitmap->storage.sb_page), + sizeof(bitmap_super_t)); ++ spin_lock_irq(&bitmap->counts.lock); + md_bitmap_file_unmap(&bitmap->storage); + bitmap->storage = store; + +@@ -2147,7 +2148,6 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + blocks = min(old_counts.chunks << old_counts.chunkshift, + chunks << chunkshift); + +- spin_lock_irq(&bitmap->counts.lock); + /* For cluster raid, need to pre-allocate bitmap */ + if (mddev_is_clustered(bitmap->mddev)) { + unsigned long page; +-- +2.20.1 + diff --git a/queue-4.19/media-am437x-vpfe-setting-std-to-current-value-is-no.patch b/queue-4.19/media-am437x-vpfe-setting-std-to-current-value-is-no.patch new file mode 100644 index 00000000000..23fbb31ee6d --- /dev/null +++ b/queue-4.19/media-am437x-vpfe-setting-std-to-current-value-is-no.patch @@ -0,0 +1,40 @@ +From 5b65a6f132f6edc0ef73f0f1e5a1f7ce769e6704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 14:05:48 -0300 +Subject: media: am437x-vpfe: Setting STD to current value is not an error + +From: Benoit Parrot + +[ Upstream commit 13aa21cfe92ce9ebb51824029d89f19c33f81419 ] + +VIDIOC_S_STD should not return an error if the value is identical +to the current one. +This error was highlighted by the v4l2-compliance test. + +Signed-off-by: Benoit Parrot +Acked-by: Lad Prabhakar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/am437x/am437x-vpfe.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index b05738a95e55..809320decdeb 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1848,6 +1848,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id) + if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD)) + return -ENODATA; + ++ /* if trying to set the same std then nothing to do */ ++ if (vpfe_standards[vpfe->std_index].std_id == std_id) ++ return 0; ++ + /* If streaming is started, return error */ + if (vb2_is_busy(&vpfe->buffer_queue)) { + vpfe_err(vpfe, "%s device busy\n", __func__); +-- +2.20.1 + diff --git a/queue-4.19/media-cec-funcs.h-add-status_req-checks.patch b/queue-4.19/media-cec-funcs.h-add-status_req-checks.patch new file mode 100644 index 00000000000..63280f30ba5 --- /dev/null +++ b/queue-4.19/media-cec-funcs.h-add-status_req-checks.patch @@ -0,0 +1,54 @@ +From d7b7196e8738441c38126cccb7e83fe34093c3bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 04:56:38 -0300 +Subject: media: cec-funcs.h: add status_req checks + +From: Hans Verkuil + +[ Upstream commit 9b211f9c5a0b67afc435b86f75d78273b97db1c5 ] + +The CEC_MSG_GIVE_DECK_STATUS and CEC_MSG_GIVE_TUNER_DEVICE_STATUS commands +both have a status_req argument: ON, OFF, ONCE. If ON or ONCE, then the +follower will reply with a STATUS message. Either once or whenever the +status changes (status_req == ON). + +If status_req == OFF, then it will stop sending continuous status updates, +but the follower will *not* send a STATUS message in that case. + +This means that if status_req == OFF, then msg->reply should be 0 as well +since no reply is expected in that case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/uapi/linux/cec-funcs.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h +index 8997d5068c08..4511b85c84df 100644 +--- a/include/uapi/linux/cec-funcs.h ++++ b/include/uapi/linux/cec-funcs.h +@@ -923,7 +923,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_DECK_STATUS : 0; + } + + static inline void cec_ops_give_deck_status(const struct cec_msg *msg, +@@ -1027,7 +1028,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_TUNER_DEVICE_STATUS : 0; + } + + static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg, +-- +2.20.1 + diff --git a/queue-4.19/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch b/queue-4.19/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch new file mode 100644 index 00000000000..7c022e353f1 --- /dev/null +++ b/queue-4.19/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch @@ -0,0 +1,76 @@ +From 027685fc357f3e8dff0885873a5c0070ab0a389d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Sep 2019 04:41:23 -0300 +Subject: media: cx88: Fix some error handling path in 'cx8800_initdev()' + +From: Christophe JAILLET + +[ Upstream commit e1444e9b0424c70def6352580762d660af50e03f ] + +A call to 'pci_disable_device()' is missing in the error handling path. +In some cases, a call to 'free_irq()' may also be missing. + +Reorder the error handling path, add some new labels and fix the 2 issues +mentionned above. + +This way, the error handling path in more in line with 'cx8800_finidev()' +(i.e. the remove function) + +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx88/cx88-video.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c +index 7b113bad70d2..248fb3b6833c 100644 +--- a/drivers/media/pci/cx88/cx88-video.c ++++ b/drivers/media/pci/cx88/cx88-video.c +@@ -1312,7 +1312,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + core = cx88_core_get(dev->pci); + if (!core) { + err = -EINVAL; +- goto fail_free; ++ goto fail_disable; + } + dev->core = core; + +@@ -1358,7 +1358,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->audio_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + } +@@ -1372,7 +1372,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->video_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + if (vc->id == V4L2_CID_CHROMA_AGC) +@@ -1535,11 +1535,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + + fail_unreg: + cx8800_unregister_video(dev); +- free_irq(pci_dev->irq, dev); + mutex_unlock(&core->lock); ++fail_irq: ++ free_irq(pci_dev->irq, dev); + fail_core: + core->v4ldev = NULL; + cx88_core_put(core, dev->pci); ++fail_disable: ++ pci_disable_device(pci_dev); + fail_free: + kfree(dev); + return err; +-- +2.20.1 + diff --git a/queue-4.19/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch b/queue-4.19/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch new file mode 100644 index 00000000000..facee2b80af --- /dev/null +++ b/queue-4.19/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch @@ -0,0 +1,46 @@ +From 92ad673d09a2352e3f0881cd651f2f760d051acb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 06:49:04 -0300 +Subject: media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() + +From: Yang Yingliang + +[ Upstream commit 649cd16c438f51d4cd777e71ca1f47f6e0c5e65d ] + +If usb_set_interface() failed, iface->cur_altsetting will +not be assigned and it will be used in flexcop_usb_transfer_init() +It may lead a NULL pointer dereference. + +Check usb_set_interface() return value in flexcop_usb_init() +and return failed to avoid using this NULL pointer. + +Signed-off-by: Yang Yingliang +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/b2c2/flexcop-usb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index ac4fddfd0a43..f1807c16438d 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -503,7 +503,13 @@ urb_error: + static int flexcop_usb_init(struct flexcop_usb *fc_usb) + { + /* use the alternate setting with the larges buffer */ +- usb_set_interface(fc_usb->udev,0,1); ++ int ret = usb_set_interface(fc_usb->udev, 0, 1); ++ ++ if (ret) { ++ err("set interface failed."); ++ return ret; ++ } ++ + switch (fc_usb->udev->speed) { + case USB_SPEED_LOW: + err("cannot handle USB speed because it is too slow."); +-- +2.20.1 + diff --git a/queue-4.19/media-i2c-ov2659-fix-missing-720p-register-config.patch b/queue-4.19/media-i2c-ov2659-fix-missing-720p-register-config.patch new file mode 100644 index 00000000000..a87000843df --- /dev/null +++ b/queue-4.19/media-i2c-ov2659-fix-missing-720p-register-config.patch @@ -0,0 +1,48 @@ +From 1293d3bc8b7973fccc8fb0644bb9a7c6fbb952ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:06:43 -0300 +Subject: media: i2c: ov2659: Fix missing 720p register config + +From: Benoit Parrot + +[ Upstream commit 9d669fbfca20e6035ead814e55d9ef1a6b500540 ] + +The initial registers sequence is only loaded at probe +time. Afterward only the resolution and format specific +register are modified. Care must be taken to make sure +registers modified by one resolution setting are reverted +back when another resolution is programmed. + +This was not done properly for the 720p case. + +Signed-off-by: Benoit Parrot +Acked-by: Lad, Prabhakar +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2659.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index ca079996c7ce..4b6be3b0fd52 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = { + { REG_TIMING_YINC, 0x11 }, + { REG_TIMING_VERT_FORMAT, 0x80 }, + { REG_TIMING_HORIZ_FORMAT, 0x00 }, ++ { 0x370a, 0x12 }, + { 0x3a03, 0xe8 }, + { 0x3a09, 0x6f }, + { 0x3a0b, 0x5d }, + { 0x3a15, 0x9a }, ++ { REG_VFIFO_READ_START_H, 0x00 }, ++ { REG_VFIFO_READ_START_L, 0x80 }, ++ { REG_ISP_CTRL02, 0x00 }, + { REG_NULL, 0x00 }, + }; + +-- +2.20.1 + diff --git a/queue-4.19/media-i2c-ov2659-fix-s_stream-return-value.patch b/queue-4.19/media-i2c-ov2659-fix-s_stream-return-value.patch new file mode 100644 index 00000000000..a0b99c00f95 --- /dev/null +++ b/queue-4.19/media-i2c-ov2659-fix-s_stream-return-value.patch @@ -0,0 +1,49 @@ +From bdc71013590996e367418f201710661be9a2cf6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:06:40 -0300 +Subject: media: i2c: ov2659: fix s_stream return value + +From: Benoit Parrot + +[ Upstream commit 85c4043f1d403c222d481dfc91846227d66663fb ] + +In ov2659_s_stream() return value for invoked function should be checked +and propagated. + +Signed-off-by: Benoit Parrot +Acked-by: Lad, Prabhakar +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2659.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index e6a8b5669b9c..ca079996c7ce 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -1203,11 +1203,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on) + goto unlock; + } + +- ov2659_set_pixel_clock(ov2659); +- ov2659_set_frame_size(ov2659); +- ov2659_set_format(ov2659); +- ov2659_set_streaming(ov2659, 1); +- ov2659->streaming = on; ++ ret = ov2659_set_pixel_clock(ov2659); ++ if (!ret) ++ ret = ov2659_set_frame_size(ov2659); ++ if (!ret) ++ ret = ov2659_set_format(ov2659); ++ if (!ret) { ++ ov2659_set_streaming(ov2659, 1); ++ ov2659->streaming = on; ++ } + + unlock: + mutex_unlock(&ov2659->lock); +-- +2.20.1 + diff --git a/queue-4.19/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch b/queue-4.19/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch new file mode 100644 index 00000000000..89ace16db0d --- /dev/null +++ b/queue-4.19/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch @@ -0,0 +1,93 @@ +From 70f26e2f578ea31656d79549d285fe4fb5c6c1fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 17:11:38 -0300 +Subject: media: ov6650: Fix crop rectangle alignment not passed back + +From: Janusz Krzysztofik + +[ Upstream commit 7b188d6ba27a131e7934a51a14ece331c0491f18 ] + +Commit 4f996594ceaf ("[media] v4l2: make vidioc_s_crop const") +introduced a writable copy of constified user requested crop rectangle +in order to be able to perform hardware alignments on it. Later +on, commit 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video +ops") replaced s_crop() video operation using that const argument with +set_selection() pad operation which had a corresponding argument not +constified, however the original behavior of the driver was not +restored. Since that time, any hardware alignment applied on a user +requested crop rectangle is not passed back to the user calling +.set_selection() as it should be. + +Fix the issue by dropping the copy and replacing all references to it +with references to the crop rectangle embedded in the user argument. + +Fixes: 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video ops") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov6650.c | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index edded869d792..e3433a4fc473 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -469,38 +469,37 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov6650 *priv = to_ov6650(client); +- struct v4l2_rect rect = sel->r; + int ret; + + if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE || + sel->target != V4L2_SEL_TGT_CROP) + return -EINVAL; + +- v4l_bound_align_image(&rect.width, 2, W_CIF, 1, +- &rect.height, 2, H_CIF, 1, 0); +- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1, +- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1, +- &rect.top, DEF_VSTRT << 1, +- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1, +- 0); ++ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1, ++ &sel->r.height, 2, H_CIF, 1, 0); ++ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1, ++ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1, ++ &sel->r.top, DEF_VSTRT << 1, ++ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height, ++ 1, 0); + +- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1); ++ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); + if (!ret) { +- priv->rect.left = rect.left; ++ priv->rect.left = sel->r.left; + ret = ov6650_reg_write(client, REG_HSTOP, +- (rect.left + rect.width) >> 1); ++ (sel->r.left + sel->r.width) >> 1); + } + if (!ret) { +- priv->rect.width = rect.width; +- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1); ++ priv->rect.width = sel->r.width; ++ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); + } + if (!ret) { +- priv->rect.top = rect.top; ++ priv->rect.top = sel->r.top; + ret = ov6650_reg_write(client, REG_VSTOP, +- (rect.top + rect.height) >> 1); ++ (sel->r.top + sel->r.height) >> 1); + } + if (!ret) +- priv->rect.height = rect.height; ++ priv->rect.height = sel->r.height; + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.19/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch b/queue-4.19/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch new file mode 100644 index 00000000000..7bd723f7018 --- /dev/null +++ b/queue-4.19/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch @@ -0,0 +1,58 @@ +From a7529a5819579f140df222124bf08eae6b6adf60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 17:11:44 -0300 +Subject: media: ov6650: Fix stored crop rectangle not in sync with hardware + +From: Janusz Krzysztofik + +[ Upstream commit 1463b371aff0682c70141f7521db13cc4bbf3016 ] + +The driver stores crop rectangle settings supposed to be in line with +hardware state in a device private structure. Since the driver initial +submission, crop rectangle width and height settings are not updated +correctly when rectangle offset settings are applied on hardware. If +an error occurs while the device is updated, the stored settings my no +longer reflect hardware state and consecutive calls to .get_selection() +as well as .get/set_fmt() may return incorrect information. That in +turn may affect ability of a bridge device to use correct DMA transfer +settings if such incorrect informamtion on active frame format returned +by .get/set_fmt() is used. + +Assuming a failed update of the device means its actual settings haven't +changed, update crop rectangle width and height settings stored in the +device private structure correctly while the rectangle offset is +successfully applied on hardware so the stored values always reflect +actual hardware state to the extent possible. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov6650.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index 60109442a072..c5aadd8dd23f 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -485,6 +485,7 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + + ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); + if (!ret) { ++ priv->rect.width += priv->rect.left - sel->r.left; + priv->rect.left = sel->r.left; + ret = ov6650_reg_write(client, REG_HSTOP, + (sel->r.left + sel->r.width) >> 1); +@@ -494,6 +495,7 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); + } + if (!ret) { ++ priv->rect.height += priv->rect.top - sel->r.top; + priv->rect.top = sel->r.top; + ret = ov6650_reg_write(client, REG_VSTOP, + (sel->r.top + sel->r.height) >> 1); +-- +2.20.1 + diff --git a/queue-4.19/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch b/queue-4.19/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch new file mode 100644 index 00000000000..f4a4706d724 --- /dev/null +++ b/queue-4.19/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch @@ -0,0 +1,71 @@ +From fad598bcc96726e3fa2dd23b356d749d7a155303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 17:11:43 -0300 +Subject: media: ov6650: Fix stored frame format not in sync with hardware + +From: Janusz Krzysztofik + +[ Upstream commit 3143b459de4cdcce67b36827476c966e93c1cf01 ] + +The driver stores frame format settings supposed to be in line with +hardware state in a device private structure. Since the driver initial +submission, those settings are updated before they are actually applied +on hardware. If an error occurs on device update, the stored settings +my not reflect hardware state anymore and consecutive calls to +.get_fmt() may return incorrect information. That in turn may affect +ability of a bridge device to use correct DMA transfer settings if such +incorrect informmation on active frame format returned by .get_fmt() is +used. + +Assuming a failed device update means its state hasn't changed, update +frame format related settings stored in the device private structure +only after they are successfully applied so the stored values always +reflect hardware state as closely as possible. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov6650.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index e3433a4fc473..60109442a072 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -613,7 +613,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); + return -EINVAL; + } +- priv->code = code; + + if (code == MEDIA_BUS_FMT_Y8_1X8 || + code == MEDIA_BUS_FMT_SBGGR8_1X8) { +@@ -639,7 +638,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_dbg(&client->dev, "max resolution: CIF\n"); + coma_mask |= COMA_QCIF; + } +- priv->half_scale = half_scale; + + clkrc = CLKRC_12MHz; + mclk = 12000000; +@@ -657,8 +655,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); + if (!ret) + ret = ov6650_reg_write(client, REG_CLKRC, clkrc); +- if (!ret) ++ if (!ret) { ++ priv->half_scale = half_scale; ++ + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); ++ } ++ if (!ret) ++ priv->code = code; + + if (!ret) { + mf->colorspace = priv->colorspace; +-- +2.20.1 + diff --git a/queue-4.19/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch b/queue-4.19/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch new file mode 100644 index 00000000000..d26b670e899 --- /dev/null +++ b/queue-4.19/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch @@ -0,0 +1,60 @@ +From b8e8ccbbcd40a436fb5b16c8c2f8bdc405e07b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 12:11:14 +0100 +Subject: media: pvrusb2: Fix oops on tear-down when radio support is not + present + +From: Mike Isely + +[ Upstream commit 7f404ae9cf2a285f73b3c18ab9303d54b7a3d8e1 ] + +In some device configurations there's no radio or radio support in the +driver. That's OK, as the driver sets itself up accordingly. However +on tear-down in these caes it's still trying to tear down radio +related context when there isn't anything there, leading to +dereferences through a null pointer and chaos follows. + +How this bug survived unfixed for 11 years in the pvrusb2 driver is a +mystery to me. + +[hverkuil: fix two checkpatch warnings] + +Signed-off-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +index e53a80b589a1..04d334152eae 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +@@ -916,8 +916,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) + pvr2_v4l2_dev_disassociate_parent(vp->dev_video); + pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); + if (!list_empty(&vp->dev_video->devbase.fh_list) || +- !list_empty(&vp->dev_radio->devbase.fh_list)) ++ (vp->dev_radio && ++ !list_empty(&vp->dev_radio->devbase.fh_list))) { ++ pvr2_trace(PVR2_TRACE_STRUCT, ++ "pvr2_v4l2 internal_check exit-empty id=%p", vp); + return; ++ } + pvr2_v4l2_destroy_no_lock(vp); + } + +@@ -953,7 +957,8 @@ static int pvr2_v4l2_release(struct file *file) + kfree(fhp); + if (vp->channel.mc_head->disconnect_flag && + list_empty(&vp->dev_video->devbase.fh_list) && +- list_empty(&vp->dev_radio->devbase.fh_list)) { ++ (!vp->dev_radio || ++ list_empty(&vp->dev_radio->devbase.fh_list))) { + pvr2_v4l2_destroy_no_lock(vp); + } + return 0; +-- +2.20.1 + diff --git a/queue-4.19/media-rcar_drif-fix-a-memory-disclosure.patch b/queue-4.19/media-rcar_drif-fix-a-memory-disclosure.patch new file mode 100644 index 00000000000..5c81578dac3 --- /dev/null +++ b/queue-4.19/media-rcar_drif-fix-a-memory-disclosure.patch @@ -0,0 +1,37 @@ +From 0318d1c864b08ef7b17b297a2c675e708af1bb67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2019 01:47:00 -0300 +Subject: media: rcar_drif: fix a memory disclosure + +From: Kangjie Lu + +[ Upstream commit d39083234c60519724c6ed59509a2129fd2aed41 ] + +"f->fmt.sdr.reserved" is uninitialized. As other peer drivers +like msi2500 and airspy do, the fix initializes it to avoid +memory disclosures. + +Signed-off-by: Kangjie Lu +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_drif.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 81413ab52475..b677d014e7ba 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + ++ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +-- +2.20.1 + diff --git a/queue-4.19/media-si470x-i2c-add-missed-operations-in-remove.patch b/queue-4.19/media-si470x-i2c-add-missed-operations-in-remove.patch new file mode 100644 index 00000000000..a16a1bd3555 --- /dev/null +++ b/queue-4.19/media-si470x-i2c-add-missed-operations-in-remove.patch @@ -0,0 +1,37 @@ +From 546e6de878398e9a8f5925eb6035c1daeb0f1e8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2019 07:28:15 +0100 +Subject: media: si470x-i2c: add missed operations in remove + +From: Chuhong Yuan + +[ Upstream commit 2df200ab234a86836a8879a05a8007d6b884eb14 ] + +The driver misses calling v4l2_ctrl_handler_free and +v4l2_device_unregister in remove like what is done in probe failure. +Add the calls to fix it. + +Signed-off-by: Chuhong Yuan +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index e3b3ecd14a4d..ae7540b765e1 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -485,6 +485,8 @@ static int si470x_i2c_remove(struct i2c_client *client) + video_unregister_device(&radio->videodev); + kfree(radio); + ++ v4l2_ctrl_handler_free(&radio->hdl); ++ v4l2_device_unregister(&radio->v4l2_dev); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-smiapp-register-sensor-after-enabling-runtime-.patch b/queue-4.19/media-smiapp-register-sensor-after-enabling-runtime-.patch new file mode 100644 index 00000000000..78a214d5423 --- /dev/null +++ b/queue-4.19/media-smiapp-register-sensor-after-enabling-runtime-.patch @@ -0,0 +1,57 @@ +From 230dd4afd63d318531942c8bf2ecf2b4399d8339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 08:16:02 -0300 +Subject: media: smiapp: Register sensor after enabling runtime PM on the + device + +From: Sakari Ailus + +[ Upstream commit 90c9e4a4dba9f4de331372e745fb1991c1faa598 ] + +Earlier it was possible that the parts of the driver that assumed runtime +PM was enabled were being called before runtime PM was enabled in the +driver's probe function. So enable runtime PM before registering the +sub-device. + +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/smiapp/smiapp-core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c +index 1236683da8f7..4731e1c72f96 100644 +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -3108,19 +3108,23 @@ static int smiapp_probe(struct i2c_client *client, + if (rval < 0) + goto out_media_entity_cleanup; + +- rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd); +- if (rval < 0) +- goto out_media_entity_cleanup; +- + pm_runtime_set_active(&client->dev); + pm_runtime_get_noresume(&client->dev); + pm_runtime_enable(&client->dev); ++ ++ rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd); ++ if (rval < 0) ++ goto out_disable_runtime_pm; ++ + pm_runtime_set_autosuspend_delay(&client->dev, 1000); + pm_runtime_use_autosuspend(&client->dev); + pm_runtime_put_autosuspend(&client->dev); + + return 0; + ++out_disable_runtime_pm: ++ pm_runtime_disable(&client->dev); ++ + out_media_entity_cleanup: + media_entity_cleanup(&sensor->src->sd.entity); + +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch b/queue-4.19/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch new file mode 100644 index 00000000000..29c2fff6ac2 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch @@ -0,0 +1,127 @@ +From d791e9c61db827d79ae71a069792edf6a114e115 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:10:01 -0300 +Subject: media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort + cases + +From: Benoit Parrot + +[ Upstream commit cf6acb73b050e98b5cc435fae0e8ae0157520410 ] + +v4l2-compliance fails with this message: + + fail: v4l2-test-buffers.cpp(691): ret == 0 + fail: v4l2-test-buffers.cpp(974): captureBufs(node, q, m2m_q, +frame_count, true) + test MMAP: FAIL + +This caused the following Kernel Warning: + +WARNING: CPU: 0 PID: 961 at +drivers/media/v4l2-core/videobuf2-core.c:1658 +__vb2_queue_cancel+0x174/0x1d8 +... +CPU: 0 PID: 961 Comm: v4l2-compliance Not tainted +4.14.62-01720-g20ecd717e87a #6 +Hardware name: Generic DRA72X (Flattened Device Tree) +Backtrace: +[] (dump_backtrace) from [] (show_stack+0x18/0x1c) + r7:00000009 r6:60070013 r5:00000000 r4:c1053824 +[] (show_stack) from [] (dump_stack+0x90/0xa4) +[] (dump_stack) from [] (__warn+0xec/0x104) + r7:00000009 r6:c0c0ad50 r5:00000000 r4:00000000 +[] (__warn) from [] (warn_slowpath_null+0x28/0x30) + r9:00000008 r8:00000000 r7:eced4808 r6:edbc9bac r5:eced4844 +r4:eced4808 +[] (warn_slowpath_null) from [] +(__vb2_queue_cancel+0x174/0x1d8) +[] (__vb2_queue_cancel) from [] +(vb2_core_queue_release+0x20/0x40) + r10:ecc7bd70 r9:00000008 r8:00000000 r7:edb73010 r6:edbc9bac +r5:eced4844 + r4:eced4808 r3:00000004 +[] (vb2_core_queue_release) from [] +(vb2_queue_release+0x10/0x14) + r5:edbc9810 r4:eced4800 +[] (vb2_queue_release) from [] +(v4l2_m2m_ctx_release+0x1c/0x30) +[] (v4l2_m2m_ctx_release) from [] +(vpe_release+0x74/0xb0 [ti_vpe]) + r5:edbc9810 r4:ed67a400 +[] (vpe_release [ti_vpe]) from [] +(v4l2_release+0x3c/0x80) + r7:edb73010 r6:ed176aa0 r5:edbc9868 r4:ed5119c0 +[] (v4l2_release) from [] (__fput+0x8c/0x1dc) + r5:ecc7bd70 r4:ed5119c0 +[] (__fput) from [] (____fput+0x10/0x14) + r10:00000000 r9:ed5119c0 r8:ece392d0 r7:c1059544 r6:ece38d80 +r5:ece392b4 + r4:00000000 +[] (____fput) from [] (task_work_run+0x98/0xb8) +[] (task_work_run) from [] (do_exit+0x170/0xa80) + r9:ece351fc r8:00000000 r7:ecde3f58 r6:ffffe000 r5:ece351c0 +r4:ece38d80 +[] (do_exit) from [] (do_group_exit+0x48/0xc4) + r7:000000f8 +[] (do_group_exit) from [] +(__wake_up_parent+0x0/0x28) + r7:000000f8 r6:b6c6a798 r5:00000001 r4:00000001 +[] (SyS_exit_group) from [] +(ret_fast_syscall+0x0/0x4c) + +These warnings are caused by buffers which not properly cleaned +up/release during an abort use case. + +In the abort cases the VPDMA desc buffers would still be mapped and the +in-flight VB2 buffers would not be released properly causing a kernel +warning from being generated by the videobuf2-core level. + +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 54f0d9d3cc49..52d5aebe0fb8 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -1418,9 +1418,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + /* the previous dst mv buffer becomes the next src mv buffer */ + ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector; + +- if (ctx->aborting) +- goto finished; +- + s_vb = ctx->src_vbs[0]; + d_vb = ctx->dst_vb; + +@@ -1485,6 +1482,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + ctx->src_vbs[0] = NULL; + ctx->dst_vb = NULL; + ++ if (ctx->aborting) ++ goto finished; ++ + ctx->bufs_completed++; + if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) { + device_run(ctx); +@@ -2383,6 +2383,12 @@ static int vpe_release(struct file *file) + + mutex_lock(&dev->dev_mutex); + free_mv_buffers(ctx); ++ ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v); ++ + vpdma_free_desc_list(&ctx->desc_list); + vpdma_free_desc_buf(&ctx->mmr_adb); + +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch new file mode 100644 index 00000000000..c06a2250834 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch @@ -0,0 +1,51 @@ +From bd476c758c979868ac6f5633e80a5683502402c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:10:00 -0300 +Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure about frame + sequence number + +From: Benoit Parrot + +[ Upstream commit 2444846c0dbfa4ead21b621e4300ec32c90fbf38 ] + +v4l2-compliance fails with this message: + + fail: v4l2-test-buffers.cpp(294): \ + (int)g_sequence() < seq.last_seq + 1 + fail: v4l2-test-buffers.cpp(740): \ + buf.check(m2m_q, last_m2m_seq) + fail: v4l2-test-buffers.cpp(974): \ + captureBufs(node, q, m2m_q, frame_count, true) + test MMAP: FAIL + +The driver is failing to update the source frame sequence number in the +vb2 buffer object. Only the destination frame sequence was being +updated. + +This is only a reporting issue if the user space app actually cares +about the frame sequence number. But it is fixed nonetheless. + +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 76d699e94b00..15f0b0bb89c0 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -1431,6 +1431,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + d_vb->timecode = s_vb->timecode; + + d_vb->sequence = ctx->sequence; ++ s_vb->sequence = ctx->sequence; + + d_q_data = &ctx->q_data[Q_DATA_DST]; + if (d_q_data->flags & Q_IS_INTERLACED) { +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-17386 b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-17386 new file mode 100644 index 00000000000..8263a265c32 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-17386 @@ -0,0 +1,65 @@ +From 04491eef9d6d41be838c30b959f4f2f43a575d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:09:59 -0300 +Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid + sizeimage + +From: Benoit Parrot + +[ Upstream commit 0bac73adea4df8d34048b38f6ff24dc3e73e90b6 ] + +v4l2-compliance fails with this message: + + fail: v4l2-test-formats.cpp(463): !pfmt.sizeimage + fail: v4l2-test-formats.cpp(736): \ + Video Capture Multiplanar is valid, \ + but TRY_FMT failed to return a format + test VIDIOC_TRY_FMT: FAIL + +This failure is causd by the driver failing to handle out range +'bytesperline' values from user space applications. + +VPDMA hardware is limited to 64k line stride (16 bytes aligned, so 65520 +bytes). So make sure the provided or calculated 'bytesperline' is +smaller than the maximum value. + +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpdma.h | 1 + + drivers/media/platform/ti-vpe/vpe.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h +index 7e611501c291..f29074c84915 100644 +--- a/drivers/media/platform/ti-vpe/vpdma.h ++++ b/drivers/media/platform/ti-vpe/vpdma.h +@@ -60,6 +60,7 @@ struct vpdma_data_format { + * line stride of source and dest + * buffers should be 16 byte aligned + */ ++#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */ + #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */ + #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */ + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 52d5aebe0fb8..a285b9db7ee8 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -1685,6 +1685,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + if (stride > plane_fmt->bytesperline) + plane_fmt->bytesperline = stride; + ++ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline, ++ stride, ++ VPDMA_MAX_STRIDE); ++ + plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline, + VPDMA_STRIDE_ALIGN); + +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch new file mode 100644 index 00000000000..d2624e5f1a7 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch @@ -0,0 +1,62 @@ +From b3c7a122639107efcceaded9a5891503da411d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:09:56 -0300 +Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel + panic + +From: Benoit Parrot + +[ Upstream commit a37980ac5be29b83da67bf7d571c6bd9f90f8e45 ] + +v4l2-compliance fails with this message: + + warn: v4l2-test-formats.cpp(717): \ + TRY_FMT cannot handle an invalid pixelformat. + test VIDIOC_TRY_FMT: FAIL + +This causes the following kernel panic: + +Unable to handle kernel paging request at virtual address 56595561 +pgd = ecd80e00 +*pgd=00000000 +Internal error: Oops: 205 [#1] PREEMPT SMP ARM +... +CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \ + 4.14.62-01715-gc8cd67f49a19 #1 +Hardware name: Generic DRA72X (Flattened Device Tree) +task: ece44d80 task.stack: ecc6e000 +PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe] +LR is at 0x8 + +Because the driver fails to properly check the 'num_planes' values for +proper ranges it ends up accessing out of bound data causing the kernel +panic. + +Since this driver only handle single or dual plane pixel format, make +sure the provided value does not exceed 2 planes. + +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index ca9095b80309..54f0d9d3cc49 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -1646,7 +1646,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + &pix->height, MIN_H, MAX_H, H_ALIGN, + S_ALIGN); + +- if (!pix->num_planes) ++ if (!pix->num_planes || pix->num_planes > 2) + pix->num_planes = fmt->coplanar ? 2 : 1; + else if (pix->num_planes > 1 && !fmt->coplanar) + pix->num_planes = 1; +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch new file mode 100644 index 00000000000..d318468eba1 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch @@ -0,0 +1,82 @@ +From b7d6318ff0a136be786f3a7023605d657fbc9d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:09:57 -0300 +Subject: media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel + format + +From: Benoit Parrot + +[ Upstream commit 06bec72b250b2cb3ba96fa45c2b8e0fb83745517 ] + +v4l2-compliance warns with this message: + + warn: v4l2-test-formats.cpp(717): \ + TRY_FMT cannot handle an invalid pixelformat. + warn: v4l2-test-formats.cpp(718): \ + This may or may not be a problem. For more information see: + warn: v4l2-test-formats.cpp(719): \ + http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html + ... + test VIDIOC_TRY_FMT: FAIL + +We need to make sure that the returns a valid pixel format in all +instance. Based on the v4l2 framework convention drivers must return a +valid pixel format when the requested pixel format is either invalid or +not supported. + +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 69c0e14cccb1..76d699e94b00 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -352,20 +352,25 @@ enum { + }; + + /* find our format description corresponding to the passed v4l2_format */ +-static struct vpe_fmt *find_format(struct v4l2_format *f) ++static struct vpe_fmt *__find_format(u32 fourcc) + { + struct vpe_fmt *fmt; + unsigned int k; + + for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) { + fmt = &vpe_formats[k]; +- if (fmt->fourcc == f->fmt.pix.pixelformat) ++ if (fmt->fourcc == fourcc) + return fmt; + } + + return NULL; + } + ++static struct vpe_fmt *find_format(struct v4l2_format *f) ++{ ++ return __find_format(f->fmt.pix.pixelformat); ++} ++ + /* + * there is one vpe_dev structure in the driver, it is shared by + * all instances. +@@ -1591,9 +1596,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + unsigned int stride = 0; + + if (!fmt || !(fmt->types & type)) { +- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n", ++ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n", + pix->pixelformat); +- return -EINVAL; ++ fmt = __find_format(V4L2_PIX_FMT_YUYV); + } + + if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch b/queue-4.19/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch new file mode 100644 index 00000000000..1e2126db71b --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch @@ -0,0 +1,105 @@ +From 19f2518a8b292561316fe4ab12bdae7bfb68ddd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:09:50 -0300 +Subject: media: ti-vpe: vpe: Fix Motion Vector vpdma stride + +From: Benoit Parrot + +[ Upstream commit 102af9b9922f658f705a4b0deaccabac409131bf ] + +commit 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user +specified stride") and commit da4414eaed15 ("[media] media: ti-vpe: vpdma: +add support for user specified stride") resulted in the Motion Vector +stride to be the same as the image stride. + +This caused memory corruption in the output image as mentioned in +commit 00db969964c8 ("[media] media: ti-vpe: vpe: Fix line stride +for output motion vector"). + +Fixes: 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user specified stride") +Fixes: da4414eaed15 ("[media] media: ti-vpe: vpdma: add support for user specified stride") +Signed-off-by: Benoit Parrot +Acked-by: Nikhil Devshatwar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index d70871d0ad2d..69c0e14cccb1 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -1027,11 +1027,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_OUT) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; + q_data = &ctx->q_data[Q_DATA_SRC]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1058,6 +1061,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + } + + if (q_data->flags & Q_DATA_FRAME_1D) +@@ -1069,7 +1073,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + MAX_W, MAX_H); + + vpdma_add_out_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, ++ stride, &q_data->c_rect, + vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1, + MAX_OUT_HEIGHT_REG1, p_data->channel, flags); + } +@@ -1088,10 +1092,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_IN) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1118,6 +1125,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + + if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) { + /* +@@ -1153,10 +1161,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12) + frame_height /= 2; + +- vpdma_add_in_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, +- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width, +- frame_height, 0, 0); ++ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride, ++ &q_data->c_rect, vpdma_fmt, dma_addr, ++ p_data->channel, field, flags, frame_width, ++ frame_height, 0, 0); + } + + /* +-- +2.20.1 + diff --git a/queue-4.19/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch b/queue-4.19/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch new file mode 100644 index 00000000000..b79786587d2 --- /dev/null +++ b/queue-4.19/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch @@ -0,0 +1,53 @@ +From f8ae0b4bb07772bd369210b4512fc814cb45403d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 12:09:58 -0300 +Subject: media: ti-vpe: vpe: Make sure YUYV is set as default format + +From: Benoit Parrot + +[ Upstream commit e20b248051ca0f90d84b4d9378e4780bc31f16c6 ] + +v4l2-compliance fails with this message: + + fail: v4l2-test-formats.cpp(672): \ + Video Capture Multiplanar: TRY_FMT(G_FMT) != G_FMT + fail: v4l2-test-formats.cpp(672): \ + Video Output Multiplanar: TRY_FMT(G_FMT) != G_FMT + ... + test VIDIOC_TRY_FMT: FAIL + +The default pixel format was setup as pointing to a specific offset in +the vpe_formats table assuming it was pointing to the V4L2_PIX_FMT_YUYV +entry. This became false after the addition on the NV21 format (see +above commid-id) + +So instead of hard-coding an offset which might change over time we need +to use a lookup helper instead so we know the default will always be what +we intended. + +Signed-off-by: Benoit Parrot +Fixes: 40cc823f7005 ("media: ti-vpe: Add support for NV21 format") +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 15f0b0bb89c0..ca9095b80309 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -2305,7 +2305,7 @@ static int vpe_open(struct file *file) + v4l2_ctrl_handler_setup(hdl); + + s_q_data = &ctx->q_data[Q_DATA_SRC]; +- s_q_data->fmt = &vpe_formats[2]; ++ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV); + s_q_data->width = 1920; + s_q_data->height = 1080; + s_q_data->nplanes = 1; +-- +2.20.1 + diff --git a/queue-4.19/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch b/queue-4.19/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch new file mode 100644 index 00000000000..5e9ec19d395 --- /dev/null +++ b/queue-4.19/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch @@ -0,0 +1,87 @@ +From 99ea739ee5f90eb14acf36bd0dbe69aac78ffc86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 04:51:40 -0300 +Subject: media: v4l2-core: fix touch support in v4l_g_fmt + +From: Vandana BN + +[ Upstream commit 545b618cfb5cadacd00c25066b9a36540e5ca9e9 ] + +v4l_s_fmt, for VFL_TYPE_TOUCH, sets unneeded members of +the v4l2_pix_format structure to default values.This was +missing in v4l_g_fmt, which would lead to failures in +v4l2-compliance tests. + +Signed-off-by: Vandana BN +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-ioctl.c | 33 +++++++++++++++------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index a4d3e94a400c..7675b645db2e 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -1415,10 +1415,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops, + return ret; + } + ++static void v4l_pix_format_touch(struct v4l2_pix_format *p) ++{ ++ /* ++ * The v4l2_pix_format structure contains fields that make no sense for ++ * touch. Set them to default values in this case. ++ */ ++ ++ p->field = V4L2_FIELD_NONE; ++ p->colorspace = V4L2_COLORSPACE_RAW; ++ p->flags = 0; ++ p->ycbcr_enc = 0; ++ p->quantization = 0; ++ p->xfer_func = 0; ++} ++ + static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { + struct v4l2_format *p = arg; ++ struct video_device *vfd = video_devdata(file); + int ret = check_fmt(file, p->type); + + if (ret) +@@ -1456,6 +1472,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg); + /* just in case the driver zeroed it again */ + p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC; ++ if (vfd->vfl_type == VFL_TYPE_TOUCH) ++ v4l_pix_format_touch(&p->fmt.pix); + return ret; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg); +@@ -1491,21 +1509,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + return -EINVAL; + } + +-static void v4l_pix_format_touch(struct v4l2_pix_format *p) +-{ +- /* +- * The v4l2_pix_format structure contains fields that make no sense for +- * touch. Set them to default values in this case. +- */ +- +- p->field = V4L2_FIELD_NONE; +- p->colorspace = V4L2_COLORSPACE_RAW; +- p->flags = 0; +- p->ycbcr_enc = 0; +- p->quantization = 0; +- p->xfer_func = 0; +-} +- + static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { +-- +2.20.1 + diff --git a/queue-4.19/media-venus-core-fix-msm8996-frequency-table.patch b/queue-4.19/media-venus-core-fix-msm8996-frequency-table.patch new file mode 100644 index 00000000000..dab373d3870 --- /dev/null +++ b/queue-4.19/media-venus-core-fix-msm8996-frequency-table.patch @@ -0,0 +1,62 @@ +From 91d40ecae3cd9e1299e813af7924846df2dc2055 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2019 11:45:59 -0300 +Subject: media: venus: core: Fix msm8996 frequency table + +From: Loic Poulain + +[ Upstream commit c690435ed07901737e5c007a65ec59f53b33eb71 ] + +In downstream driver, there are two frequency tables defined, +one for the encoder and one for the decoder: + +/* Encoders / +<972000 490000000 0x55555555>, / 4k UHD @ 30 / +<489600 320000000 0x55555555>, / 1080p @ 60 / +<244800 150000000 0x55555555>, / 1080p @ 30 / +<108000 75000000 0x55555555>, / 720p @ 30 */ + +/* Decoders / +<1944000 490000000 0xffffffff>, / 4k UHD @ 60 / +< 972000 320000000 0xffffffff>, / 4k UHD @ 30 / +< 489600 150000000 0xffffffff>, / 1080p @ 60 / +< 244800 75000000 0xffffffff>; / 1080p @ 30 */ + +It shows that encoder always needs a higher clock than decoder. + +In current venus driver, the unified frequency table is aligned +with the downstream decoder table which causes performance issues +in encoding scenarios. Fix that by aligning frequency table on +worst case (encoding). + +Signed-off-by: Loic Poulain +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index 5b8350e87e75..60069869596c 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -430,10 +430,11 @@ static const struct venus_resources msm8916_res = { + }; + + static const struct freq_tbl msm8996_freq_table[] = { +- { 1944000, 490000000 }, /* 4k UHD @ 60 */ +- { 972000, 320000000 }, /* 4k UHD @ 30 */ +- { 489600, 150000000 }, /* 1080p @ 60 */ +- { 244800, 75000000 }, /* 1080p @ 30 */ ++ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 972000, 520000000 }, /* 4k UHD @ 30 */ ++ { 489600, 346666667 }, /* 1080p @ 60 */ ++ { 244800, 150000000 }, /* 1080p @ 30 */ ++ { 108000, 75000000 }, /* 720p @ 30 */ + }; + + static const struct reg_val msm8996_reg_preset[] = { +-- +2.20.1 + diff --git a/queue-4.19/media-venus-fix-occasionally-failures-to-suspend.patch b/queue-4.19/media-venus-fix-occasionally-failures-to-suspend.patch new file mode 100644 index 00000000000..fdc132c2b43 --- /dev/null +++ b/queue-4.19/media-venus-fix-occasionally-failures-to-suspend.patch @@ -0,0 +1,57 @@ +From 90ebb573cd6c4db902dd43b96e477279f0174648 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2019 09:02:26 -0300 +Subject: media: venus: Fix occasionally failures to suspend + +From: Stanimir Varbanov + +[ Upstream commit 8dbebb2bd01e6f36e9a215dcde99ace70408f2c8 ] + +Failure to suspend (venus_suspend_3xx) happens when the system +is fresh booted and loading venus driver. This happens once and +after reload the venus driver modules the problem disrepair. + +Fix the failure by skipping the check for WFI and IDLE bits if +PC_READY is on in control status register. + +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c +index 124085556b94..fbcc67c10993 100644 +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -1484,6 +1484,7 @@ static int venus_suspend_3xx(struct venus_core *core) + { + struct venus_hfi_device *hdev = to_hfi_priv(core); + struct device *dev = core->dev; ++ u32 ctrl_status; + bool val; + int ret; + +@@ -1499,6 +1500,10 @@ static int venus_suspend_3xx(struct venus_core *core) + return -EINVAL; + } + ++ ctrl_status = venus_readl(hdev, CPU_CS_SCIACMDARG0); ++ if (ctrl_status & CPU_CS_SCIACMDARG0_PC_READY) ++ goto power_off; ++ + /* + * Power collapse sequence for Venus 3xx and 4xx versions: + * 1. Check for ARM9 and video core to be idle by checking WFI bit +@@ -1523,6 +1528,7 @@ static int venus_suspend_3xx(struct venus_core *core) + if (ret) + return ret; + ++power_off: + mutex_lock(&hdev->lock); + + ret = venus_power_off(hdev); +-- +2.20.1 + diff --git a/queue-4.19/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch b/queue-4.19/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch new file mode 100644 index 00000000000..cf94980ef26 --- /dev/null +++ b/queue-4.19/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch @@ -0,0 +1,81 @@ +From c7423021e2043c7d5c5e8a52d4eed8df1ddad9c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2019 18:21:31 +0200 +Subject: mips: fix build when "48 bits virtual memory" is enabled + +From: Mike Rapoport + +[ Upstream commit 3ed6751bb8fa89c3014399bb0414348499ee202a ] + +With CONFIG_MIPS_VA_BITS_48=y the build fails miserably: + + CC arch/mips/kernel/asm-offsets.s +In file included from arch/mips/include/asm/pgtable.h:644, + from include/linux/mm.h:99, + from arch/mips/kernel/asm-offsets.c:15: +include/asm-generic/pgtable.h:16:2: error: #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED + #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED + ^~~~~ +include/asm-generic/pgtable.h:390:28: error: unknown type name 'p4d_t'; did you mean 'pmd_t'? + static inline int p4d_same(p4d_t p4d_a, p4d_t p4d_b) + ^~~~~ + pmd_t + +[ ... more such errors ... ] + +scripts/Makefile.build:99: recipe for target 'arch/mips/kernel/asm-offsets.s' failed +make[2]: *** [arch/mips/kernel/asm-offsets.s] Error 1 + +This happens because when CONFIG_MIPS_VA_BITS_48 enables 4th level of the +page tables, but neither pgtable-nop4d.h nor 5level-fixup.h are included to +cope with the 5th level. + +Replace #ifdef conditions around includes of the pgtable-nop{m,u}d.h with +explicit CONFIG_PGTABLE_LEVELS and add include of 5level-fixup.h for the +case when CONFIG_PGTABLE_LEVELS==4 + +Signed-off-by: Mike Rapoport +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: linux-mm@kvack.org +Cc: Mike Rapoport +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/pgtable-64.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h +index 93a9dce31f25..813dfe5f45a5 100644 +--- a/arch/mips/include/asm/pgtable-64.h ++++ b/arch/mips/include/asm/pgtable-64.h +@@ -18,10 +18,12 @@ + #include + + #define __ARCH_USE_5LEVEL_HACK +-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) ++#if CONFIG_PGTABLE_LEVELS == 2 + #include +-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) ++#elif CONFIG_PGTABLE_LEVELS == 3 + #include ++#else ++#include + #endif + + /* +@@ -216,6 +218,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) + return pgd_val(pgd); + } + ++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) ++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) ++ + static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) + { + return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); +-- +2.20.1 + diff --git a/queue-4.19/mips-syscall-emit-loongson3-sync-workarounds-within-.patch b/queue-4.19/mips-syscall-emit-loongson3-sync-workarounds-within-.patch new file mode 100644 index 00000000000..38280c3fb91 --- /dev/null +++ b/queue-4.19/mips-syscall-emit-loongson3-sync-workarounds-within-.patch @@ -0,0 +1,48 @@ +From edc63f1ff5e828662df8a3321739532490464c55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 21:53:39 +0000 +Subject: MIPS: syscall: Emit Loongson3 sync workarounds within asm + +From: Paul Burton + +[ Upstream commit e84957e6ae043bb83ad6ae7e949a1ce97b6bbfef ] + +Generate the sync instructions required to workaround Loongson3 LL/SC +errata within inline asm blocks, which feels a little safer than doing +it from C where strictly speaking the compiler would be well within its +rights to insert a memory access between the separate asm statements we +previously had, containing sync & ll instructions respectively. + +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Huacai Chen +Cc: Jiaxun Yang +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/syscall.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c +index 69c17b549fd3..10990434bf94 100644 +--- a/arch/mips/kernel/syscall.c ++++ b/arch/mips/kernel/syscall.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -135,6 +136,7 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new) + " .set "MIPS_ISA_ARCH_LEVEL" \n" + " li %[err], 0 \n" + "1: \n" ++ " " __SYNC(full, loongson3_war) " \n" + user_ll("%[old]", "(%[addr])") + " move %[tmp], %[new] \n" + "2: \n" +-- +2.20.1 + diff --git a/queue-4.19/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch b/queue-4.19/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch new file mode 100644 index 00000000000..479bc9d5e31 --- /dev/null +++ b/queue-4.19/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch @@ -0,0 +1,73 @@ +From 326baa168b0efd11819f1d2f12ef5b2e76254b46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 14:44:30 +0100 +Subject: mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests + +From: Eugeniu Rosca + +[ Upstream commit c91843463e9e821dc3b48fe37e3155fa38299f6e ] + +Isolated initially to renesas_sdhi_internal_dmac [1], Ulf suggested +adding MMC_CAP_ERASE to the TMIO mmc core: + +On Fri, Nov 15, 2019 at 10:27:25AM +0100, Ulf Hansson wrote: + -- snip -- + This test and due to the discussions with Wolfram and you in this + thread, I would actually suggest that you enable MMC_CAP_ERASE for all + tmio variants, rather than just for this particular one. + + In other words, set the cap in tmio_mmc_host_probe() should be fine, + as it seems none of the tmio variants supports HW busy detection at + this point. + -- snip -- + +Testing on R-Car H3ULCB-KF doesn't reveal any issues (v5.4-rc7): + +root@rcar-gen3:~# lsblk +NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT +mmcblk0 179:0 0 59.2G 0 disk <--- eMMC +mmcblk0boot0 179:8 0 4M 1 disk +mmcblk0boot1 179:16 0 4M 1 disk +mmcblk1 179:24 0 30G 0 disk <--- SD card + +root@rcar-gen3:~# time blkdiscard /dev/mmcblk0 +real 0m8.659s +user 0m0.001s +sys 0m1.920s + +root@rcar-gen3:~# time blkdiscard /dev/mmcblk1 +real 0m1.176s +user 0m0.001s +sys 0m0.124s + +[1] https://lore.kernel.org/linux-renesas-soc/20191112134808.23546-1-erosca@de.adit-jv.com/ + +Cc: Wolfram Sang +Cc: Masahiro Yamada +Cc: Andrew Gabbasov +Originally-by: Harish Jenny K N +Suggested-by: Ulf Hansson +Signed-off-by: Eugeniu Rosca +Reviewed-by: Wolfram Sang +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/tmio_mmc_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 35630ccbe9e5..33c9ca8f14a9 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -1267,7 +1267,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) + return ret; + } + +- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; ++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; + mmc->caps2 |= pdata->capabilities2; + mmc->max_segs = pdata->max_segs ? : 32; + mmc->max_blk_size = 512; +-- +2.20.1 + diff --git a/queue-4.19/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch b/queue-4.19/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch new file mode 100644 index 00000000000..45ce1c6c3d6 --- /dev/null +++ b/queue-4.19/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch @@ -0,0 +1,42 @@ +From bdb1900d277835fccbfe87819964b1808860719e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 15:16:48 -0500 +Subject: mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring + +From: Navid Emamdoost + +[ Upstream commit d10dcb615c8e29d403a24d35f8310a7a53e3050c ] + +In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be +released if mwifiex_map_pci_memory() fails. The release for skb and +card->evtbd_ring_vbase is added. + +Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines") +Signed-off-by: Navid Emamdoost +Acked-by: Ganapathi Bhat +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 3fe81b2a929a..918c69936540 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -691,8 +691,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); ++ kfree(card->evtbd_ring_vbase); + return -1; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +-- +2.20.1 + diff --git a/queue-4.19/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch b/queue-4.19/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch new file mode 100644 index 00000000000..d35ac27ed67 --- /dev/null +++ b/queue-4.19/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch @@ -0,0 +1,43 @@ +From 717c1184a5999b4f48e7db204de2d3331c1cd11f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2019 10:21:39 +0800 +Subject: net: dsa: LAN9303: select REGMAP when LAN9303 enable + +From: Mao Wenan + +[ Upstream commit b6989d248a2d13f02895bae1a9321b3bbccc0283 ] + +When NET_DSA_SMSC_LAN9303=y and NET_DSA_SMSC_LAN9303_MDIO=y, +below errors can be seen: +drivers/net/dsa/lan9303_mdio.c:87:23: error: REGMAP_ENDIAN_LITTLE +undeclared here (not in a function) + .reg_format_endian = REGMAP_ENDIAN_LITTLE, +drivers/net/dsa/lan9303_mdio.c:93:3: error: const struct regmap_config +has no member named reg_read + .reg_read = lan9303_mdio_read, + +It should select REGMAP in config NET_DSA_SMSC_LAN9303. + +Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support") +Signed-off-by: Mao Wenan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig +index d3ce1e4cb4d3..dbfb6ad80fac 100644 +--- a/drivers/net/dsa/Kconfig ++++ b/drivers/net/dsa/Kconfig +@@ -66,6 +66,7 @@ config NET_DSA_REALTEK_SMI + config NET_DSA_SMSC_LAN9303 + tristate + select NET_DSA_TAG_LAN9303 ++ select REGMAP + ---help--- + This enables support for the SMSC/Microchip LAN9303 3 port ethernet + switch chips. +-- +2.20.1 + diff --git a/queue-4.19/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch b/queue-4.19/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch new file mode 100644 index 00000000000..bc132170fab --- /dev/null +++ b/queue-4.19/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch @@ -0,0 +1,42 @@ +From 18ceb2866276e00f7927b8066c0730e150bd1658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 00:19:13 +0200 +Subject: net: ethernet: ti: ale: clean ale tbl on init and intf restart + +From: Grygorii Strashko + +[ Upstream commit 7fe579dfb90fcdf0c7722f33c772d5f0d1bc7cb6 ] + +Clean CPSW ALE on init and intf restart (up/down) to avoid reading obsolete +or garbage entries from ALE table. + +Signed-off-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpsw_ale.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c +index 5766225a4ce1..c245629a38c7 100644 +--- a/drivers/net/ethernet/ti/cpsw_ale.c ++++ b/drivers/net/ethernet/ti/cpsw_ale.c +@@ -793,6 +793,7 @@ EXPORT_SYMBOL_GPL(cpsw_ale_start); + void cpsw_ale_stop(struct cpsw_ale *ale) + { + del_timer_sync(&ale->timer); ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0); + } + EXPORT_SYMBOL_GPL(cpsw_ale_stop); +@@ -877,6 +878,7 @@ struct cpsw_ale *cpsw_ale_create(struct cpsw_ale_params *params) + ALE_UNKNOWNVLAN_FORCE_UNTAG_EGRESS; + } + ++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1); + return ale; + } + EXPORT_SYMBOL_GPL(cpsw_ale_create); +-- +2.20.1 + diff --git a/queue-4.19/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch b/queue-4.19/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch new file mode 100644 index 00000000000..1007334d8fa --- /dev/null +++ b/queue-4.19/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch @@ -0,0 +1,41 @@ +From 99595f21230a83e0091289eed1dfb762fc6102a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 19:23:17 +0800 +Subject: net: hns3: add struct netdev_queue debug info for TX timeout + +From: Yunsheng Lin + +[ Upstream commit 647522a5ef6401dcdb8ec417421e43fb21910167 ] + +When there is a TX timeout, we can tell if the driver or stack +has stopped the queue by looking at state field, and when has +the last packet transmited by looking at trans_start field. + +So this patch prints these two field in the +hns3_get_tx_timeo_queue_info(). + +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 0788e78747d9..1aaf6e2a3b39 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1474,6 +1474,9 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev) + time_after(jiffies, + (trans_start + ndev->watchdog_timeo))) { + timeout_queue = i; ++ netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n", ++ q->state, ++ jiffies_to_msecs(jiffies - trans_start)); + break; + } + } +-- +2.20.1 + diff --git a/queue-4.19/net-phy-dp83867-enable-robust-auto-mdix.patch b/queue-4.19/net-phy-dp83867-enable-robust-auto-mdix.patch new file mode 100644 index 00000000000..9c8d5b344c9 --- /dev/null +++ b/queue-4.19/net-phy-dp83867-enable-robust-auto-mdix.patch @@ -0,0 +1,69 @@ +From c00daf9618cd0d449e2c3787b168a2f4eb2914c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 17:48:45 +0300 +Subject: net: phy: dp83867: enable robust auto-mdix + +From: Grygorii Strashko + +[ Upstream commit 5a7f08c2abb0efc9d17aff2fc75d6d3b85e622e4 ] + +The link detection timeouts can be observed (or link might not be detected +at all) when dp83867 PHY is configured in manual mode (speed/duplex). + +CFG3[9] Robust Auto-MDIX option allows to significantly improve link detection +in case dp83867 is configured in manual mode and reduce link detection +time. +As per DM: "If link partners are configured to operational modes that are +not supported by normal Auto MDI/MDIX mode (like Auto-Neg versus Force +100Base-TX or Force 100Base-TX versus Force 100Base-TX), this Robust Auto +MDI/MDIX mode allows MDI/MDIX resolution and prevents deadlock." + +Hence, enable this option by default as there are no known reasons +not to do so. + +Signed-off-by: Grygorii Strashko +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83867.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index eeadfde15940..879096d3ff41 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -86,6 +86,10 @@ + #define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK (0x1f << 8) + #define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT 8 + ++/* CFG3 bits */ ++#define DP83867_CFG3_INT_OE BIT(7) ++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) ++ + /* CFG4 bits */ + #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) + +@@ -331,12 +335,13 @@ static int dp83867_config_init(struct phy_device *phydev) + return ret; + } + ++ val = phy_read(phydev, DP83867_CFG3); + /* Enable Interrupt output INT_OE in CFG3 register */ +- if (phy_interrupt_is_valid(phydev)) { +- val = phy_read(phydev, DP83867_CFG3); +- val |= BIT(7); +- phy_write(phydev, DP83867_CFG3, val); +- } ++ if (phy_interrupt_is_valid(phydev)) ++ val |= DP83867_CFG3_INT_OE; ++ ++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; ++ phy_write(phydev, DP83867_CFG3, val); + + if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) + dp83867_config_port_mirroring(phydev); +-- +2.20.1 + diff --git a/queue-4.19/net-phy-initialise-phydev-speed-and-duplex-sanely.patch b/queue-4.19/net-phy-initialise-phydev-speed-and-duplex-sanely.patch new file mode 100644 index 00000000000..3506bcb8d44 --- /dev/null +++ b/queue-4.19/net-phy-initialise-phydev-speed-and-duplex-sanely.patch @@ -0,0 +1,46 @@ +From c717397c2f73b019f36497bc59c2feb0bc193a9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2019 15:23:23 +0000 +Subject: net: phy: initialise phydev speed and duplex sanely + +From: Russell King + +[ Upstream commit a5d66f810061e2dd70fb7a108dcd14e535bc639f ] + +When a phydev is created, the speed and duplex are set to zero and +-1 respectively, rather than using the predefined SPEED_UNKNOWN and +DUPLEX_UNKNOWN constants. + +There is a window at initialisation time where we may report link +down using the 0/-1 values. Tidy this up and use the predefined +constants, so debug doesn't complain with: + +"Unsupported (update phy-core.c)/Unsupported (update phy-core.c)" + +when the speed and duplex settings are printed. + +Signed-off-by: Russell King +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 6144146aec29..43c4f358eeb8 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -420,8 +420,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + mdiodev->device_free = phy_mdio_device_free; + mdiodev->device_remove = phy_mdio_device_remove; + +- dev->speed = 0; +- dev->duplex = -1; ++ dev->speed = SPEED_UNKNOWN; ++ dev->duplex = DUPLEX_UNKNOWN; + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 0; +-- +2.20.1 + diff --git a/queue-4.19/nvme-discard-workaround-for-non-conformant-devices.patch b/queue-4.19/nvme-discard-workaround-for-non-conformant-devices.patch new file mode 100644 index 00000000000..c996cf72a33 --- /dev/null +++ b/queue-4.19/nvme-discard-workaround-for-non-conformant-devices.patch @@ -0,0 +1,63 @@ +From f203e4ccbb2f2827dc777455f44ecf339628282a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 21:55:01 +0100 +Subject: nvme: Discard workaround for non-conformant devices + +From: Eduard Hasenleithner + +[ Upstream commit 530436c45ef2e446c12538a400e465929a0b3ade ] + +Users observe IOMMU related errors when performing discard on nvme from +non-compliant nvme devices reading beyond the end of the DMA mapped +ranges to discard. + +Two different variants of this behavior have been observed: SM22XX +controllers round up the read size to a multiple of 512 bytes, and Phison +E12 unconditionally reads the maximum discard size allowed by the spec +(256 segments or 4kB). + +Make nvme_setup_discard unconditionally allocate the maximum DSM buffer +so the driver DMA maps a memory range that will always succeed. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=202665 many +Signed-off-by: Eduard Hasenleithner +[changelog, use existing define, kernel coding style] +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b2d9bd564960..b7bd89b3b2f9 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -551,8 +551,14 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + struct nvme_dsm_range *range; + struct bio *bio; + +- range = kmalloc_array(segments, sizeof(*range), +- GFP_ATOMIC | __GFP_NOWARN); ++ /* ++ * Some devices do not consider the DSM 'Number of Ranges' field when ++ * determining how much data to DMA. Always allocate memory for maximum ++ * number of segments to prevent device reading beyond end of buffer. ++ */ ++ static const size_t alloc_size = sizeof(*range) * NVME_DSM_MAX_RANGES; ++ ++ range = kzalloc(alloc_size, GFP_ATOMIC | __GFP_NOWARN); + if (!range) { + /* + * If we fail allocation our range, fallback to the controller +@@ -593,7 +599,7 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, + + req->special_vec.bv_page = virt_to_page(range); + req->special_vec.bv_offset = offset_in_page(range); +- req->special_vec.bv_len = sizeof(*range) * segments; ++ req->special_vec.bv_len = alloc_size; + req->rq_flags |= RQF_SPECIAL_PAYLOAD; + + return BLK_STS_OK; +-- +2.20.1 + diff --git a/queue-4.19/nvmem-imx-ocotp-reset-error-status-on-probe.patch b/queue-4.19/nvmem-imx-ocotp-reset-error-status-on-probe.patch new file mode 100644 index 00000000000..1f0f3efab48 --- /dev/null +++ b/queue-4.19/nvmem-imx-ocotp-reset-error-status-on-probe.patch @@ -0,0 +1,41 @@ +From 3a7315ed375812c68675822769adea365e6c18c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 11:42:35 +0000 +Subject: nvmem: imx-ocotp: reset error status on probe + +From: Lucas Stach + +[ Upstream commit c33c585f1b3a99d53920bdac614aca461d8db06f ] + +If software running before the OCOTP driver is loaded left the +controller with the error status pending, the driver will never +be able to complete the read timing setup. Reset the error status +on probe to make sure the controller is in usable state. + +Signed-off-by: Lucas Stach +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20191029114240.14905-6-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/imx-ocotp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c +index afb429a417fe..926d9cc080cf 100644 +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -466,6 +466,10 @@ static int imx_ocotp_probe(struct platform_device *pdev) + if (IS_ERR(priv->clk)) + return PTR_ERR(priv->clk); + ++ clk_prepare_enable(priv->clk); ++ imx_ocotp_clr_err_if_set(priv->base); ++ clk_disable_unprepare(priv->clk); ++ + priv->params = of_device_get_match_data(&pdev->dev); + imx_ocotp_nvmem_config.size = 4 * priv->params->nregs; + imx_ocotp_nvmem_config.dev = dev; +-- +2.20.1 + diff --git a/queue-4.19/parport-load-lowlevel-driver-if-ports-not-found.patch b/queue-4.19/parport-load-lowlevel-driver-if-ports-not-found.patch new file mode 100644 index 00000000000..4643a4f7061 --- /dev/null +++ b/queue-4.19/parport-load-lowlevel-driver-if-ports-not-found.patch @@ -0,0 +1,72 @@ +From d31a0d2ff2078d57e12715d13ff677bb8620457b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 15:45:39 +0100 +Subject: parport: load lowlevel driver if ports not found + +From: Sudip Mukherjee + +[ Upstream commit 231ec2f24dad18d021b361045bbd618ba62a274e ] + +Usually all the distro will load the parport low level driver as part +of their initialization. But we can get into a situation where all the +parallel port drivers are built as module and we unload all the modules +at a later time. Then if we just do "modprobe parport" it will only +load the parport module and will not load the low level driver which +will actually register the ports. So, check the bus if there is any +parport registered, if not, load the low level driver. + +We can get into the above situation with all distro but only Suse has +setup the alias for "parport_lowlevel" and so it only works in Suse. +Users of Debian based distro will need to load the lowlevel module +manually. + +Signed-off-by: Sudip Mukherjee +Link: https://lore.kernel.org/r/20191016144540.18810-3-sudipm.mukherjee@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/parport/share.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 7b4ee33c1935..15c81cffd2de 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) + return 0; + } + ++/* ++ * Iterates through all the devices connected to the bus and return 1 ++ * if the device is a parallel port. ++ */ ++ ++static int port_detect(struct device *dev, void *dev_drv) ++{ ++ if (is_parport(dev)) ++ return 1; ++ return 0; ++} ++ + /** + * parport_register_driver - register a parallel port device driver + * @drv: structure describing the driver +@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, + if (ret) + return ret; + ++ /* ++ * check if bus has any parallel port registered, if ++ * none is found then load the lowlevel driver. ++ */ ++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, ++ port_detect); ++ if (!ret) ++ get_lowlevel_driver(); ++ + mutex_lock(®istration_lock); + if (drv->match_port) + bus_for_each_dev(&parport_bus_type, NULL, drv, +-- +2.20.1 + diff --git a/queue-4.19/perf-intel-bts-does-not-support-aux-area-sampling.patch b/queue-4.19/perf-intel-bts-does-not-support-aux-area-sampling.patch new file mode 100644 index 00000000000..4a53be9505d --- /dev/null +++ b/queue-4.19/perf-intel-bts-does-not-support-aux-area-sampling.patch @@ -0,0 +1,54 @@ +From c29fa3cfd24f4aef6bb14cfa04a48bea9b4d89f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 14:42:25 +0200 +Subject: perf intel-bts: Does not support AUX area sampling + +From: Adrian Hunter + +[ Upstream commit 32a1ece4bdbde24734ab16484bad7316f03fc42d ] + +Add an error message because Intel BTS does not support AUX area +sampling. + +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Link: http://lore.kernel.org/lkml/20191115124225.5247-16-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/auxtrace.c | 2 ++ + tools/perf/arch/x86/util/intel-bts.c | 5 +++++ + 2 files changed, 7 insertions(+) + +diff --git a/tools/perf/arch/x86/util/auxtrace.c b/tools/perf/arch/x86/util/auxtrace.c +index b135af62011c..c28b6516d41d 100644 +--- a/tools/perf/arch/x86/util/auxtrace.c ++++ b/tools/perf/arch/x86/util/auxtrace.c +@@ -36,6 +36,8 @@ struct auxtrace_record *auxtrace_record__init_intel(struct perf_evlist *evlist, + + intel_pt_pmu = perf_pmu__find(INTEL_PT_PMU_NAME); + intel_bts_pmu = perf_pmu__find(INTEL_BTS_PMU_NAME); ++ if (intel_bts_pmu) ++ intel_bts_pmu->auxtrace = true; + + evlist__for_each_entry(evlist, evsel) { + if (intel_pt_pmu && evsel->attr.type == intel_pt_pmu->type) +diff --git a/tools/perf/arch/x86/util/intel-bts.c b/tools/perf/arch/x86/util/intel-bts.c +index 781df40b2966..b6120ef8b4a4 100644 +--- a/tools/perf/arch/x86/util/intel-bts.c ++++ b/tools/perf/arch/x86/util/intel-bts.c +@@ -118,6 +118,11 @@ static int intel_bts_recording_options(struct auxtrace_record *itr, + const struct cpu_map *cpus = evlist->cpus; + bool privileged = geteuid() == 0 || perf_event_paranoid() < 0; + ++ if (opts->auxtrace_sample_mode) { ++ pr_err("Intel BTS does not support AUX area sampling\n"); ++ return -EINVAL; ++ } ++ + btsr->evlist = evlist; + btsr->snapshot_mode = opts->auxtrace_snapshot_mode; + +-- +2.20.1 + diff --git a/queue-4.19/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch b/queue-4.19/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch new file mode 100644 index 00000000000..1a9e976e310 --- /dev/null +++ b/queue-4.19/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch @@ -0,0 +1,107 @@ +From 51aa2290be2c6d49d5a686e2fbc34d7ab6ac1e4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 21:50:17 +0800 +Subject: perf jevents: Fix resource leak in process_mapfile() and main() + +From: Yunfeng Ye + +[ Upstream commit 1785fbb73896dbd9d27a406f0d73047df42db710 ] + +There are memory leaks and file descriptor resource leaks in +process_mapfile() and main(). + +Fix this by adding free(), fclose() and free_arch_std_events() on the +error paths. + +Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file") +Fixes: 3f056b66647b ("perf jevents: Make build fail on JSON parse error") +Fixes: e9d32c1bf0cd ("perf vendor events: Add support for arch standard events") +Signed-off-by: Yunfeng Ye +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Feilong Lin +Cc: Hu Shiyuan +Cc: Jiri Olsa +Cc: John Garry +Cc: Kan Liang +Cc: Luke Mujica +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Zenghui Yu +Link: http://lore.kernel.org/lkml/d7907042-ec9c-2bef-25b4-810e14602f89@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/jevents.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index 6cd9623ebc93..38b5888ef7b3 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -754,6 +754,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + char *line, *p; + int line_num; + char *tblname; ++ int ret = 0; + + pr_info("%s: Processing mapfile %s\n", prog, fpath); + +@@ -765,6 +766,7 @@ static int process_mapfile(FILE *outfp, char *fpath) + if (!mapfp) { + pr_info("%s: Error %s opening %s\n", prog, strerror(errno), + fpath); ++ free(line); + return -1; + } + +@@ -791,7 +793,8 @@ static int process_mapfile(FILE *outfp, char *fpath) + /* TODO Deal with lines longer than 16K */ + pr_info("%s: Mapfile %s: line %d too long, aborting\n", + prog, fpath, line_num); +- return -1; ++ ret = -1; ++ goto out; + } + line[strlen(line)-1] = '\0'; + +@@ -821,7 +824,9 @@ static int process_mapfile(FILE *outfp, char *fpath) + + out: + print_mapping_table_suffix(outfp); +- return 0; ++ fclose(mapfp); ++ free(line); ++ return ret; + } + + /* +@@ -1118,6 +1123,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1130,6 +1136,7 @@ int main(int argc, char *argv[]) + goto empty_map; + } else if (rc < 0) { + /* Make build fail */ ++ fclose(eventsfp); + free_arch_std_events(); + return 1; + } else if (rc) { +@@ -1147,6 +1154,8 @@ int main(int argc, char *argv[]) + if (process_mapfile(eventsfp, mapfile)) { + pr_info("%s: Error processing mapfile %s\n", prog, mapfile); + /* Make build fail */ ++ fclose(eventsfp); ++ free_arch_std_events(); + return 1; + } + +-- +2.20.1 + diff --git a/queue-4.19/perf-parse-fix-potential-memory-leak-when-handling-t.patch b/queue-4.19/perf-parse-fix-potential-memory-leak-when-handling-t.patch new file mode 100644 index 00000000000..b3b85848043 --- /dev/null +++ b/queue-4.19/perf-parse-fix-potential-memory-leak-when-handling-t.patch @@ -0,0 +1,85 @@ +From 4739ac75114dd537ad641a7300f6d59b6efc57d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 10:09:25 -0800 +Subject: perf parse: Fix potential memory leak when handling tracepoint errors + +From: Ian Rogers + +[ Upstream commit 4584f084aa9d8033d5911935837dbee7b082d0e9 ] + +An error may be in place when tracepoint_error is called, use +parse_events__handle_error to avoid a memory leak and to capture the +first and last error. Error detected by LLVM's libFuzzer using the +following event: + +$ perf stat -e 'msr/event/,f:e' +event syntax error: 'msr/event/,f:e' + \___ can't access trace events + +Error: No permissions to read /sys/kernel/debug/tracing/events/f/e +Hint: Try 'sudo mount -o remount,mode=755 /sys/kernel/debug/tracing/' + +Initial error: +event syntax error: 'msr/event/,f:e' + \___ no value assigned for term +Run 'perf list' for a list of valid events + + Usage: perf stat [] [] + + -e, --event event selector. use 'perf list' to list available events + +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: clang-built-linux@googlegroups.com +Link: http://lore.kernel.org/lkml/20191120180925.21787-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 95043cae5774..6f7292442b82 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -457,6 +457,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, + static void tracepoint_error(struct parse_events_error *e, int err, + const char *sys, const char *name) + { ++ const char *str; + char help[BUFSIZ]; + + if (!e) +@@ -470,18 +471,18 @@ static void tracepoint_error(struct parse_events_error *e, int err, + + switch (err) { + case EACCES: +- e->str = strdup("can't access trace events"); ++ str = "can't access trace events"; + break; + case ENOENT: +- e->str = strdup("unknown tracepoint"); ++ str = "unknown tracepoint"; + break; + default: +- e->str = strdup("failed to add tracepoint"); ++ str = "failed to add tracepoint"; + break; + } + + tracing_path__strerror_open_tp(err, help, sizeof(help), sys, name); +- e->help = strdup(help); ++ parse_events__handle_error(e, 0, strdup(str), strdup(help)); + } + + static int add_tracepoint(struct list_head *list, int *idx, +-- +2.20.1 + diff --git a/queue-4.19/perf-parse-if-pmu-configuration-fails-free-terms.patch b/queue-4.19/perf-parse-if-pmu-configuration-fails-free-terms.patch new file mode 100644 index 00000000000..9c523aedfc7 --- /dev/null +++ b/queue-4.19/perf-parse-if-pmu-configuration-fails-free-terms.patch @@ -0,0 +1,62 @@ +From 55ab2e8b9fda49fe3633c6cf0afc55c6d10558f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 15:34:46 -0700 +Subject: perf parse: If pmu configuration fails free terms + +From: Ian Rogers + +[ Upstream commit 38f2c4226e6bc3e8c41c318242821ba5dc825aba ] + +Avoid a memory leak when the configuration fails. + +Signed-off-by: Ian Rogers +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andi Kleen +Cc: Daniel Borkmann +Cc: Jin Yao +Cc: John Garry +Cc: Kan Liang +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: clang-built-linux@googlegroups.com +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20191030223448.12930-9-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 7ea1a230e89d..95043cae5774 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1282,8 +1282,15 @@ int parse_events_add_pmu(struct parse_events_state *parse_state, + if (get_config_terms(head_config, &config_terms)) + return -ENOMEM; + +- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) ++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { ++ struct perf_evsel_config_term *pos, *tmp; ++ ++ list_for_each_entry_safe(pos, tmp, &config_terms, list) { ++ list_del_init(&pos->list); ++ free(pos); ++ } + return -EINVAL; ++ } + + evsel = __add_event(list, &parse_state->idx, &attr, + get_config_name(head_config), pmu, +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-filter-out-instances-except-for-inlined-s.patch b/queue-4.19/perf-probe-filter-out-instances-except-for-inlined-s.patch new file mode 100644 index 00000000000..b4a7633bd3d --- /dev/null +++ b/queue-4.19/perf-probe-filter-out-instances-except-for-inlined-s.patch @@ -0,0 +1,122 @@ +From a05a330f3ccaec9800c9b445243344ff924329ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 16:09:30 +0900 +Subject: perf probe: Filter out instances except for inlined subroutine and + subprogram + +From: Masami Hiramatsu + +[ Upstream commit da6cb952a89efe24bb76c4971370d485737a2d85 ] + +Filter out instances except for inlined_subroutine and subprogram DIE in +die_walk_instances() and die_is_func_instance(). + +This fixes an issue that perf probe sets some probes on calling address +instead of a target function itself. + +When perf probe walks on instances of an abstruct origin (a kind of +function prototype of inlined function), die_walk_instances() can also +pass a GNU_call_site (a GNU extension for call site) to callback. Since +it is not an inlined instance of target function, we have to filter out +when searching a probe point. + +Without this patch, perf probe sets probes on call site address too.This +can happen on some function which is marked "inlined", but has actual +symbol. (I'm not sure why GCC mark it "inlined"): + + # perf probe -D vfs_read + p:probe/vfs_read _text+2500017 + p:probe/vfs_read_1 _text+2499468 + p:probe/vfs_read_2 _text+2499563 + p:probe/vfs_read_3 _text+2498876 + p:probe/vfs_read_4 _text+2498512 + p:probe/vfs_read_5 _text+2498627 + +With this patch: + +Slightly different results, similar tho: + + # perf probe -D vfs_read + p:probe/vfs_read _text+2498512 + +Committer testing: + + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + +Before: + + # perf probe -D vfs_read + p:probe/vfs_read _text+3131557 + p:probe/vfs_read_1 _text+3130975 + p:probe/vfs_read_2 _text+3131047 + p:probe/vfs_read_3 _text+3130380 + p:probe/vfs_read_4 _text+3130000 + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + # + +After: + + # perf probe -D vfs_read + p:probe/vfs_read _text+3130000 + # + +Fixes: db0d2c6420ee ("perf probe: Search concrete out-of-line instances") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157241937063.32002.11024544873990816590.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 65a782864bb8..dc50fb1d5a18 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -325,18 +325,22 @@ bool die_is_func_def(Dwarf_Die *dw_die) + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; + Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && +- (dwarf_entrypc(dw_die, &tmp) == 0 || +- dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL); ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } + + /** +@@ -615,6 +619,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-find-range-only-function-instance.patch b/queue-4.19/perf-probe-fix-to-find-range-only-function-instance.patch new file mode 100644 index 00000000000..dad78d30b09 --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-find-range-only-function-instance.patch @@ -0,0 +1,50 @@ +From d803e791fb467aba98a97f102e3c8af5c1d1e443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 18:12:36 +0900 +Subject: perf probe: Fix to find range-only function instance + +From: Masami Hiramatsu + +[ Upstream commit b77afa1f810f37bd8a36cb1318178dfe2d7af6b6 ] + +Fix die_is_func_instance() to find range-only function instance. + +In some case, a function instance can be made without any low PC or +entry PC, but only with address ranges by optimization. (e.g. cold text +partially in "text.unlikely" section) To find such function instance, we +have to check the range attribute too. + +Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions") +Signed-off-by: Masami Hiramatsu +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157190835669.1859.8368628035930950596.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 7eb7de5aee44..5bbb87f63ecb 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -331,10 +331,14 @@ bool die_is_func_def(Dwarf_Die *dw_die) + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; + + /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ return !dwarf_func_inline(dw_die) && ++ (dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL); + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-list-probe-event-with-correct-line.patch b/queue-4.19/perf-probe-fix-to-list-probe-event-with-correct-line.patch new file mode 100644 index 00000000000..84e3b85a99a --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-list-probe-event-with-correct-line.patch @@ -0,0 +1,78 @@ +From 83b4ef187189aea47591a22a2bd886f90ef5bd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 17:46:52 +0900 +Subject: perf probe: Fix to list probe event with correct line number + +From: Masami Hiramatsu + +[ Upstream commit 3895534dd78f0fd4d3f9e05ee52b9cdd444a743e ] + +Since debuginfo__find_probe_point() uses dwarf_entrypc() for finding the +entry address of the function on which a probe is, it will fail when the +function DIE has only ranges attribute. + +To fix this issue, use die_entrypc() instead of dwarf_entrypc(). + +Without this fix, perf probe -l shows incorrect offset: + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579263632@work/linux/linux/kernel/cpu.c) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask+18446744071579263752@work/linux/linux/kernel/cpu.c) + +With this: + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@work/linux/linux/kernel/cpu.c) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:21@work/linux/linux/kernel/cpu.c) + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579765152@kernel/cpu.c) + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + [root@quaco ~]# + +Fixes: 1d46ea2a6a40 ("perf probe: Fix listing incorrect line number with inline function") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157199321227.8075.14655572419136993015.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index c37fbef1711d..c4fe0678e322 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1567,7 +1567,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1584,7 +1584,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch b/queue-4.19/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch new file mode 100644 index 00000000000..ec252c2fd73 --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch @@ -0,0 +1,96 @@ +From de5bc71fb5609d16e303ed166f021f61d482bfc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 17:46:34 +0900 +Subject: perf probe: Fix to probe a function which has no entry pc + +From: Masami Hiramatsu + +[ Upstream commit 5d16dbcc311d91267ddb45c6da4f187be320ecee ] + +Fix 'perf probe' to probe a function which has no entry pc or low pc but +only has ranges attribute. + +probe_point_search_cb() uses dwarf_entrypc() to get the probe address, +but that doesn't work for the function DIE which has only ranges +attribute. Use die_entrypc() instead. + +Without this fix: + + # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0 + Probe point 'clear_tasks_mm_cpumask' not found. + Error: Failed to add events. + +With this: + + # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0 + p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0 + +Committer testing: + +Before: + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0 + Probe point 'clear_tasks_mm_cpumask' not found. + Error: Failed to add events. + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0 + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + [root@quaco ~]# + +Using it with 'perf trace': + + [root@quaco ~]# perf trace -e probe:clear_tasks_mm_cpumask + +Doesn't seem to be used in x86_64: + + $ find . -name "*.c" | xargs grep clear_tasks_mm_cpumask + ./kernel/cpu.c: * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU + ./kernel/cpu.c:void clear_tasks_mm_cpumask(int cpu) + ./arch/xtensa/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/csky/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/sh/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/arm/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/powerpc/mm/nohash/mmu_context.c: clear_tasks_mm_cpumask(cpu); + $ find . -name "*.h" | xargs grep clear_tasks_mm_cpumask + ./include/linux/cpu.h:void clear_tasks_mm_cpumask(int cpu); + $ find . -name "*.S" | xargs grep clear_tasks_mm_cpumask + $ + +Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions") +Reported-by: Arnaldo Carvalho de Melo +Tested-by: Arnaldo Carvalho de Melo +Signed-off-by: Masami Hiramatsu +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157199319438.8075.4695576954550638618.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index d0d333c90b35..64d4837c8f82 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1002,7 +1002,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-probe-an-inline-function-which-has.patch b/queue-4.19/perf-probe-fix-to-probe-an-inline-function-which-has.patch new file mode 100644 index 00000000000..bfef4c00e14 --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-probe-an-inline-function-which-has.patch @@ -0,0 +1,72 @@ +From 704f43587e8ac94f224ef746efea44f93b4f4095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 17:46:43 +0900 +Subject: perf probe: Fix to probe an inline function which has no entry pc + +From: Masami Hiramatsu + +[ Upstream commit eb6933b29d20bf2c3053883d409a53f462c1a3ac ] + +Fix perf probe to probe an inlne function which has no entry pc +or low pc but only has ranges attribute. + +This seems very rare case, but I could find a few examples, as +same as probe_point_search_cb(), use die_entrypc() to get the +entry address in probe_point_inline_cb() too. + +Without this patch: + + # perf probe -D __amd_put_nb_event_constraints + Failed to get entry address of __amd_put_nb_event_constraints. + Probe point '__amd_put_nb_event_constraints' not found. + Error: Failed to add events. + +With this patch: + + # perf probe -D __amd_put_nb_event_constraints + p:probe/__amd_put_nb_event_constraints amd_put_event_constraints+43 + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints + Failed to get entry address of __amd_put_nb_event_constraints. + Probe point '__amd_put_nb_event_constraints' not found. + Error: Failed to add events. + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints + p:probe/__amd_put_nb_event_constraints _text+33789 + [root@quaco ~]# + +Fixes: 4ea42b181434 ("perf: Add perf probe subcommand, a kprobe-event setup helper") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157199320336.8075.16189530425277588587.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index c4fe0678e322..d0d333c90b35 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -950,7 +950,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch b/queue-4.19/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch new file mode 100644 index 00000000000..3e201c2b03b --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch @@ -0,0 +1,122 @@ +From c47630f468134dd36136d73787b2087cd1de54d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 16:09:40 +0900 +Subject: perf probe: Fix to show calling lines of inlined functions + +From: Masami Hiramatsu + +[ Upstream commit 86c0bf8539e7f46d91bd105e55eda96e0064caef ] + +Fix to show calling lines of inlined functions (where an inline function +is called). + +die_walk_lines() filtered out the lines inside inlined functions based +on the address. However this also filtered out the lines which call +those inlined functions from the target function. + +To solve this issue, check the call_file and call_line attributes and do +not filter out if it matches to the line information. + +Without this fix, perf probe -L doesn't show some lines correctly. +(don't see the lines after 17) + + # perf probe -L vfs_read + + 0 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) + 1 { + 2 ssize_t ret; + + 4 if (!(file->f_mode & FMODE_READ)) + return -EBADF; + 6 if (!(file->f_mode & FMODE_CAN_READ)) + return -EINVAL; + 8 if (unlikely(!access_ok(buf, count))) + return -EFAULT; + + 11 ret = rw_verify_area(READ, file, pos, count); + 12 if (!ret) { + 13 if (count > MAX_RW_COUNT) + count = MAX_RW_COUNT; + 15 ret = __vfs_read(file, buf, count, pos); + 16 if (ret > 0) { + fsnotify_access(file); + add_rchar(current, ret); + } + +With this fix: + + # perf probe -L vfs_read + + 0 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) + 1 { + 2 ssize_t ret; + + 4 if (!(file->f_mode & FMODE_READ)) + return -EBADF; + 6 if (!(file->f_mode & FMODE_CAN_READ)) + return -EINVAL; + 8 if (unlikely(!access_ok(buf, count))) + return -EFAULT; + + 11 ret = rw_verify_area(READ, file, pos, count); + 12 if (!ret) { + 13 if (count > MAX_RW_COUNT) + count = MAX_RW_COUNT; + 15 ret = __vfs_read(file, buf, count, pos); + 16 if (ret > 0) { + 17 fsnotify_access(file); + 18 add_rchar(current, ret); + } + 20 inc_syscr(current); + } + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157241937995.32002.17899884017011512577.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index fc3f3573332d..7ae3106b4e5e 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -768,7 +768,7 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; +@@ -812,13 +812,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-show-inlined-function-callsite-wit.patch b/queue-4.19/perf-probe-fix-to-show-inlined-function-callsite-wit.patch new file mode 100644 index 00000000000..9760ae2e943 --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-show-inlined-function-callsite-wit.patch @@ -0,0 +1,112 @@ +From e61f8671618c6835efcaf83726a89bce4dab43b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 17:47:01 +0900 +Subject: perf probe: Fix to show inlined function callsite without entry_pc + +From: Masami Hiramatsu + +[ Upstream commit 18e21eb671dc87a4f0546ba505a89ea93598a634 ] + +Fix 'perf probe --line' option to show inlined function callsite lines +even if the function DIE has only ranges. + +Without this: + + # perf probe -L amd_put_event_constraints + ... + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + __amd_put_nb_event_constraints(cpuc, event); + 5 } + +With this patch: + + # perf probe -L amd_put_event_constraints + ... + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + 4 __amd_put_nb_event_constraints(cpuc, event); + 5 } + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -L amd_put_event_constraints + + 0 static void amd_put_event_constraints(struct cpu_hw_events *cpuc, + struct perf_event *event) + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + __amd_put_nb_event_constraints(cpuc, event); + 5 } + + PMU_FORMAT_ATTR(event, "config:0-7,32-35"); + PMU_FORMAT_ATTR(umask, "config:8-15" ); + + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -L amd_put_event_constraints + + 0 static void amd_put_event_constraints(struct cpu_hw_events *cpuc, + struct perf_event *event) + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + 4 __amd_put_nb_event_constraints(cpuc, event); + 5 } + + PMU_FORMAT_ATTR(event, "config:0-7,32-35"); + PMU_FORMAT_ATTR(umask, "config:8-15" ); + + [root@quaco ~]# perf probe amd_put_event_constraints:4 + Added new event: + probe:amd_put_event_constraints (on amd_put_event_constraints:4) + + You can now use it in all perf tools, such as: + + perf record -e probe:amd_put_event_constraints -aR sleep 1 + + [root@quaco ~]# + + [root@quaco ~]# perf probe -l + probe:amd_put_event_constraints (on amd_put_event_constraints:4@arch/x86/events/amd/core.c) + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + [root@quaco ~]# + +Using it: + + [root@quaco ~]# perf trace -e probe:* + ^C[root@quaco ~]# + +Ok, Intel system here... :-) + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157199322107.8075.12659099000567865708.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 14a3da24a0a8..fc3f3573332d 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -686,7 +686,7 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch b/queue-4.19/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch new file mode 100644 index 00000000000..4924a8cfbab --- /dev/null +++ b/queue-4.19/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch @@ -0,0 +1,98 @@ +From c54df8daf32e9420c17acf46fc6349c71321aa4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 17:47:10 +0900 +Subject: perf probe: Fix to show ranges of variables in functions without + entry_pc + +From: Masami Hiramatsu + +[ Upstream commit af04dd2f8ebaa8fbd46f698714acbf43da14da45 ] + +Fix to show ranges of variables (--range and --vars option) in functions +which DIE has only ranges but no entry_pc attribute. + +Without this fix: + + # perf probe --range -V clear_tasks_mm_cpumask + Available variables at clear_tasks_mm_cpumask + @ + (No matched variables) + +With this fix: + + # perf probe --range -V clear_tasks_mm_cpumask + Available variables at clear_tasks_mm_cpumask + @ + [VAL] int cpu @ + +Committer testing: + +Before: + + [root@quaco ~]# perf probe --range -V clear_tasks_mm_cpumask + Available variables at clear_tasks_mm_cpumask + @ + (No matched variables) + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe --range -V clear_tasks_mm_cpumask + Available variables at clear_tasks_mm_cpumask + @ + [VAL] int cpu @ + [root@quaco ~]# + +Using it: + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask cpu + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask with cpu) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + [root@quaco ~]# perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c with cpu) + [root@quaco ~]# + [root@quaco ~]# perf trace -e probe:*cpumask + ^C[root@quaco ~]# + +Fixes: 349e8d261131 ("perf probe: Add --range option to show a variable's location range") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157199323018.8075.8179744380479673672.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 6e7cb3537ce0..14a3da24a0a8 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -1010,7 +1010,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +@@ -1073,7 +1073,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-return-a-better-scope-die-if-there-is-no-.patch b/queue-4.19/perf-probe-return-a-better-scope-die-if-there-is-no-.patch new file mode 100644 index 00000000000..6eaa2b46ca1 --- /dev/null +++ b/queue-4.19/perf-probe-return-a-better-scope-die-if-there-is-no-.patch @@ -0,0 +1,84 @@ +From bbbcce827fdcb1c3f700f545ae084dafa4a62557 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 09:16:49 +0900 +Subject: perf probe: Return a better scope DIE if there is no best scope + +From: Masami Hiramatsu + +[ Upstream commit c701636aeec4c173208697d68da6e4271125564b ] + +Make find_best_scope() returns innermost DIE at given address if there +is no best matched scope DIE. Since Gcc sometimes generates intuitively +strange line info which is out of inlined function address range, we +need this fixup. + +Without this, sometimes perf probe failed to probe on a line inside an +inlined function: + + # perf probe -D ksys_open:3 + Failed to find scope of probe point. + Error: Failed to add events. + +With this fix, 'perf probe' can probe it: + + # perf probe -D ksys_open:3 + p:probe/ksys_open _text+25707308 + p:probe/ksys_open_1 _text+25710596 + p:probe/ksys_open_2 _text+25711114 + p:probe/ksys_open_3 _text+25711343 + p:probe/ksys_open_4 _text+25714058 + p:probe/ksys_open_5 _text+2819653 + p:probe/ksys_open_6 _text+2819701 + +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Namhyung Kim +Cc: Ravi Bangoria +Cc: Steven Rostedt (VMware) +Cc: Tom Zanussi +Link: http://lore.kernel.org/lkml/157291300887.19771.14936015360963292236.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 946b027b45e8..7ccabb891e5a 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -764,6 +764,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) + return 0; + } + ++/* Return innermost DIE */ ++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) ++{ ++ struct find_scope_param *fsp = data; ++ ++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); ++ fsp->found = true; ++ return 1; ++} ++ + /* Find an appropriate scope fits to given conditions */ + static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + { +@@ -775,8 +785,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + .die_mem = die_mem, + .found = false, + }; ++ int ret; + +- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); ++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, ++ &fsp); ++ if (!ret && !fsp.found) ++ cu_walk_functions_at(&pf->cu_die, pf->addr, ++ find_inner_scope_cb, &fsp); + + return fsp.found ? die_mem : NULL; + } +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-skip-end-of-sequence-and-non-statement-li.patch b/queue-4.19/perf-probe-skip-end-of-sequence-and-non-statement-li.patch new file mode 100644 index 00000000000..5a6277a516f --- /dev/null +++ b/queue-4.19/perf-probe-skip-end-of-sequence-and-non-statement-li.patch @@ -0,0 +1,145 @@ +From a176d2b1e2483a092d5c4a4e5cb299189d20b71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 16:09:21 +0900 +Subject: perf probe: Skip end-of-sequence and non statement lines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masami Hiramatsu + +[ Upstream commit f4d99bdfd124823a81878b44b5e8750b97f73902 ] + +Skip end-of-sequence and non-statement lines while walking through lines +list. + +The "end-of-sequence" line information means: + + "the current address is that of the first byte after the + end of a sequence of target machine instructions." + (DWARF version 4 spec 6.2.2) + +This actually means out of scope and we can not probe on it. + +On the other hand, the statement lines (is_stmt) means: + + "the current instruction is a recommended breakpoint location. + A recommended breakpoint location is intended to “represent” + a line, a statement and/or a semantically distinct subpart + of a statement." + + (DWARF version 4 spec 6.2.2) + +So, non-statement line info also should be skipped. + +These can reduce unneeded probe points and also avoid an error. + +E.g. without this patch: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new events: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_3 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_4 (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask_4 -aR sleep 1 + + # + +This puts 5 probes on one line, but acutally it's not inlined function. +This is because there are many non statement instructions at the +function prologue. + +With this patch: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + # + +Now perf-probe skips unneeded addresses. + +Committer testing: + +Slightly different results, but similar: + +Before: + + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + # + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new events: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask_2 -aR sleep 1 + + # + +After: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + # + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157241936090.32002.12156347518596111660.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 7ae3106b4e5e..65a782864bb8 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -773,6 +773,7 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -803,6 +804,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-skip-overlapped-location-on-searching-var.patch b/queue-4.19/perf-probe-skip-overlapped-location-on-searching-var.patch new file mode 100644 index 00000000000..61dbe61faa1 --- /dev/null +++ b/queue-4.19/perf-probe-skip-overlapped-location-on-searching-var.patch @@ -0,0 +1,104 @@ +From 4df27b321067cedc52a2752c2b49a27df83273fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 16:09:49 +0900 +Subject: perf probe: Skip overlapped location on searching variables + +From: Masami Hiramatsu + +[ Upstream commit dee36a2abb67c175265d49b9a8c7dfa564463d9a ] + +Since debuginfo__find_probes() callback function can be called with the +location which already passed, the callback function must filter out +such overlapped locations. + +add_probe_trace_event() has already done it by commit 1a375ae7659a +("perf probe: Skip same probe address for a given line"), but +add_available_vars() doesn't. Thus perf probe -v shows same address +repeatedly as below: + + # perf probe -V vfs_read:18 + Available variables at vfs_read:18 + @ + char* buf + loff_t* pos + ssize_t ret + struct file* file + @ + char* buf + loff_t* pos + ssize_t ret + struct file* file + @ + char* buf + loff_t* pos + ssize_t ret + struct file* file + +With this fix, perf probe -V shows it correctly: + + # perf probe -V vfs_read:18 + Available variables at vfs_read:18 + @ + char* buf + loff_t* pos + ssize_t ret + struct file* file + @ + char* buf + loff_t* pos + ssize_t ret + struct file* file + +Fixes: cf6eb489e5c0 ("perf probe: Show accessible local variables") +Signed-off-by: Masami Hiramatsu +Tested-by: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157241938927.32002.4026859017790562751.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-finder.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 64d4837c8f82..946b027b45e8 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1414,6 +1414,18 @@ error: + return DIE_FIND_CB_END; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1424,6 +1436,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); +-- +2.20.1 + diff --git a/queue-4.19/perf-probe-walk-function-lines-in-lexical-blocks.patch b/queue-4.19/perf-probe-walk-function-lines-in-lexical-blocks.patch new file mode 100644 index 00000000000..abf1fbaf613 --- /dev/null +++ b/queue-4.19/perf-probe-walk-function-lines-in-lexical-blocks.patch @@ -0,0 +1,76 @@ +From ff7aa53222ec8dbf048dd4898857c7cd85db535c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 18:12:45 +0900 +Subject: perf probe: Walk function lines in lexical blocks + +From: Masami Hiramatsu + +[ Upstream commit acb6a7047ac2146b723fef69ee1ab6b7143546bf ] + +Since some inlined functions are in lexical blocks of given function, we +have to recursively walk through the DIE tree. Without this fix, +perf-probe -L can miss the inlined functions which is in a lexical block +(like if (..) { func() } case.) + +However, even though, to walk the lines in a given function, we don't +need to follow the children DIE of inlined functions because those do +not have any lines in the specified function. + +We need to walk though whole trees only if we walk all lines in a given +file, because an inlined function can include another inlined function +in the same file. + +Fixes: b0e9cb2802d4 ("perf probe: Fix to search nested inlined functions in CU") +Signed-off-by: Masami Hiramatsu +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/157190836514.1859.15996864849678136353.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dwarf-aux.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index 5bbb87f63ecb..6e7cb3537ce0 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -691,10 +691,9 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (lw->retval != 0) + return DIE_FIND_CB_END; + } ++ if (!lw->recursive) ++ return DIE_FIND_CB_SIBLING; + } +- if (!lw->recursive) +- /* Don't need to search recursively */ +- return DIE_FIND_CB_SIBLING; + + if (addr) { + fname = dwarf_decl_file(in_die); +@@ -741,6 +740,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) + { + struct __line_walk_param *lw = data; + ++ /* ++ * Since inlined function can include another inlined function in ++ * the same file, we need to walk in it recursively. ++ */ + lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); + if (lw->retval != 0) + return DWARF_CB_ABORT; +@@ -830,8 +833,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (rt_die != cu_die) + /* +- * Don't need walk functions recursively, because nested +- * inlined functions don't have lines of the specified DIE. ++ * Don't need walk inlined functions recursively, because ++ * inner inlined functions don't have the lines of the ++ * specified function. + */ + ret = __die_walk_funclines(rt_die, false, callback, data); + else { +-- +2.20.1 + diff --git a/queue-4.19/perf-report-add-warning-when-libunwind-not-compiled-.patch b/queue-4.19/perf-report-add-warning-when-libunwind-not-compiled-.patch new file mode 100644 index 00000000000..129a441377e --- /dev/null +++ b/queue-4.19/perf-report-add-warning-when-libunwind-not-compiled-.patch @@ -0,0 +1,58 @@ +From f1a28430488992491c604deaf8cab0e88a5bdd57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 10:21:22 +0800 +Subject: perf report: Add warning when libunwind not compiled in + +From: Jin Yao + +[ Upstream commit 800d3f561659b5436f8c57e7c26dd1f6928b5615 ] + +We received a user report that call-graph DWARF mode was enabled in +'perf record' but 'perf report' didn't unwind the callstack correctly. +The reason was, libunwind was not compiled in. + +We can use 'perf -vv' to check the compiled libraries but it would be +valuable to report a warning to user directly (especially valuable for +a perf newbie). + +The warning is: + +Warning: +Please install libunwind development packages during the perf build. + +Both TUI and stdio are supported. + +Signed-off-by: Jin Yao +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20191011022122.26369-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-report.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index b2188e623e22..2f94f7ad65bd 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -383,6 +383,13 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + ++#ifndef HAVE_LIBUNWIND_SUPPORT ++ if (dwarf_callchain_users) { ++ ui__warning("Please install libunwind development packages " ++ "during the perf build.\n"); ++ } ++#endif ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/perf-test-report-failure-for-mmap-events.patch b/queue-4.19/perf-test-report-failure-for-mmap-events.patch new file mode 100644 index 00000000000..77edb7a896a --- /dev/null +++ b/queue-4.19/perf-test-report-failure-for-mmap-events.patch @@ -0,0 +1,43 @@ +From 8f2590a54a217fd81aa2d49ff2eced498da3ba9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 17:19:41 +0800 +Subject: perf test: Report failure for mmap events + +From: Leo Yan + +[ Upstream commit 6add129c5d9210ada25217abc130df0b7096ee02 ] + +When fail to mmap events in task exit case, it misses to set 'err' to +-1; thus the testing will not report failure for it. + +This patch sets 'err' to -1 when fails to mmap events, thus Perf tool +can report correct result. + +Fixes: d723a55096b8 ("perf test: Add test case for checking number of EXIT events") +Signed-off-by: Leo Yan +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Link: http://lore.kernel.org/lkml/20191011091942.29841-1-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/task-exit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index e92fa6029ac7..788b0805d2f1 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -105,6 +105,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + if (perf_evlist__mmap(evlist, 128) < 0) { + pr_debug("failed to mmap events: %d (%s)\n", errno, + str_error_r(errno, sbuf, sizeof(sbuf))); ++ err = -1; + goto out_delete_evlist; + } + +-- +2.20.1 + diff --git a/queue-4.19/perf-tests-disable-bp_signal-testing-for-arm64.patch b/queue-4.19/perf-tests-disable-bp_signal-testing-for-arm64.patch new file mode 100644 index 00000000000..a179d97a820 --- /dev/null +++ b/queue-4.19/perf-tests-disable-bp_signal-testing-for-arm64.patch @@ -0,0 +1,113 @@ +From d14b27026fa14dc500b07d2eb482ddaa0d584cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2019 16:55:31 +0800 +Subject: perf tests: Disable bp_signal testing for arm64 + +From: Leo Yan + +[ Upstream commit 6a5f3d94cb69a185b921cb92c39888dc31009acb ] + +As there are several discussions for enabling perf breakpoint signal +testing on arm64 platform: arm64 needs to rely on single-step to execute +the breakpointed instruction and then reinstall the breakpoint exception +handler. But if we hook the breakpoint with a signal, the signal +handler will do the stepping rather than the breakpointed instruction, +this causes infinite loops as below: + + Kernel space | Userspace + ---------------------------------|-------------------------------- + | __test_function() -> hit + | breakpoint + breakpoint_handler() | + `-> user_enable_single_step() | + do_signal() | + | sig_handler() -> Step one + | instruction and + | trap to kernel + single_step_handler() | + `-> reinstall_suspended_bps() | + | __test_function() -> hit + | breakpoint again and + | repeat up flow infinitely + +As Will Deacon mentioned [1]: "that we require the overflow handler to +do the stepping on arm/arm64, which is relied upon by GDB/ptrace. The +hw_breakpoint code is a complete disaster so my preference would be to +rip out the perf part and just implement something directly in ptrace, +but it's a pretty horrible job". Though Will commented this on arm +architecture, but the comment also can apply on arm64 architecture. + +For complete information, I searched online and found a few years back, +Wang Nan sent one patch 'arm64: Store breakpoint single step state into +pstate' [2]; the patch tried to resolve this issue by avoiding single +stepping in signal handler and defer to enable the signal stepping when +return to __test_function(). The fixing was not merged due to the +concern for missing to handle different usage cases. + +Based on the info, the most feasible way is to skip Perf breakpoint +signal testing for arm64 and this could avoid the duplicate +investigation efforts when people see the failure. This patch skips +this case on arm64 platform, which is same with arm architecture. + +[1] https://lkml.org/lkml/2018/11/15/205 +[2] https://lkml.org/lkml/2015/12/23/477 + +Signed-off-by: Leo Yan +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Brajeswar Ghosh +Cc: Florian Fainelli +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Souptick Joarder +Cc: Will Deacon +Link: http://lore.kernel.org/lkml/20191018085531.6348-3-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/bp_signal.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c +index 910e25e64188..6cf00650602e 100644 +--- a/tools/perf/tests/bp_signal.c ++++ b/tools/perf/tests/bp_signal.c +@@ -48,14 +48,6 @@ asm ( + "__test_function:\n" + "incq (%rdi)\n" + "ret\n"); +-#elif defined (__aarch64__) +-extern void __test_function(volatile long *ptr); +-asm ( +- ".globl __test_function\n" +- "__test_function:\n" +- "str x30, [x0]\n" +- "ret\n"); +- + #else + static void __test_function(volatile long *ptr) + { +@@ -301,10 +293,15 @@ bool test__bp_signal_is_supported(void) + * stepping into the SIGIO handler and getting stuck on the + * breakpointed instruction. + * ++ * Since arm64 has the same issue with arm for the single-step ++ * handling, this case also gets suck on the breakpointed ++ * instruction. ++ * + * Just disable the test for these architectures until these + * issues are resolved. + */ +-#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) ++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \ ++ defined(__aarch64__) + return false; + #else + return true; +-- +2.20.1 + diff --git a/queue-4.19/perf-tools-splice-events-onto-evlist-even-on-error.patch b/queue-4.19/perf-tools-splice-events-onto-evlist-even-on-error.patch new file mode 100644 index 00000000000..0929c5d2bae --- /dev/null +++ b/queue-4.19/perf-tools-splice-events-onto-evlist-even-on-error.patch @@ -0,0 +1,76 @@ +From f485dcc0120ea533d0e9893809ee7fe2b6c3bdf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 11:08:22 -0700 +Subject: perf tools: Splice events onto evlist even on error + +From: Ian Rogers + +[ Upstream commit 8e8714c3d157568b7a769917a5e05573bbaf5af0 ] + +If event parsing fails the event list is leaked, instead splice the list +onto the out result and let the caller cleanup. + +An example input for parse_events found by libFuzzer that reproduces +this memory leak is 'm{'. + +Signed-off-by: Ian Rogers +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andi Kleen +Cc: Daniel Borkmann +Cc: Jin Yao +Cc: John Garry +Cc: Kan Liang +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: clang-built-linux@googlegroups.com +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20191025180827.191916-5-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 1a7c76d2baa8..7ea1a230e89d 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1843,15 +1843,20 @@ int parse_events(struct perf_evlist *evlist, const char *str, + + ret = parse_events__scanner(str, &parse_state, PE_START_EVENTS); + perf_pmu__parse_cleanup(); ++ ++ if (!ret && list_empty(&parse_state.list)) { ++ WARN_ONCE(true, "WARNING: event parser found nothing\n"); ++ return -1; ++ } ++ ++ /* ++ * Add list to the evlist even with errors to allow callers to clean up. ++ */ ++ perf_evlist__splice_list_tail(evlist, &parse_state.list); ++ + if (!ret) { + struct perf_evsel *last; + +- if (list_empty(&parse_state.list)) { +- WARN_ONCE(true, "WARNING: event parser found nothing\n"); +- return -1; +- } +- +- perf_evlist__splice_list_tail(evlist, &parse_state.list); + evlist->nr_groups += parse_state.nr_groups; + last = perf_evlist__last(evlist); + last->cmdline_group_boundary = true; +-- +2.20.1 + diff --git a/queue-4.19/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch b/queue-4.19/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch new file mode 100644 index 00000000000..c6a52679a23 --- /dev/null +++ b/queue-4.19/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch @@ -0,0 +1,96 @@ +From f64e3beb2f451f8f8330c1e75ab01d2085600ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2019 20:13:51 -0300 +Subject: perf trace: Filter own pid to avoid a feedback look in 'perf trace + record -a' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 7fbfe22cf4cfe01a88704dd76ca65d108039d297 ] + +When doing a system wide 'perf trace record' we need, just like in 'perf +trace' live mode, to filter out perf trace's own pid, so set up a +tracepoint filter for the raw_syscalls tracepoints right after adding +them to the argv array that is set up to then call cmd_record(). + +Reported-by: Andi Kleen +Cc: Adrian Hunter +Cc: David Ahern +Cc: Jiri Olsa +Cc: Luis Cláudio Gonçalves +Cc: Namhyung Kim +Link: https://lkml.kernel.org/n/tip-uysx5w8f2y5ndoln5cq370tv@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 3f43aedb384d..7ec3fc4dc5ed 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -2209,21 +2209,23 @@ static int trace__record(struct trace *trace, int argc, const char **argv) + "-m", "1024", + "-c", "1", + }; +- ++ pid_t pid = getpid(); ++ char *filter = asprintf__tp_filter_pids(1, &pid); + const char * const sc_args[] = { "-e", }; + unsigned int sc_args_nr = ARRAY_SIZE(sc_args); + const char * const majpf_args[] = { "-e", "major-faults" }; + unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args); + const char * const minpf_args[] = { "-e", "minor-faults" }; + unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args); ++ int err = -1; + +- /* +1 is for the event string below */ +- rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 1 + ++ /* +3 is for the event string below and the pid filter */ ++ rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 + + majpf_args_nr + minpf_args_nr + argc; + rec_argv = calloc(rec_argc + 1, sizeof(char *)); + +- if (rec_argv == NULL) +- return -ENOMEM; ++ if (rec_argv == NULL || filter == NULL) ++ goto out_free; + + j = 0; + for (i = 0; i < ARRAY_SIZE(record_args); i++) +@@ -2240,11 +2242,13 @@ static int trace__record(struct trace *trace, int argc, const char **argv) + rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit"; + else { + pr_err("Neither raw_syscalls nor syscalls events exist.\n"); +- free(rec_argv); +- return -1; ++ goto out_free; + } + } + ++ rec_argv[j++] = "--filter"; ++ rec_argv[j++] = filter; ++ + if (trace->trace_pgfaults & TRACE_PFMAJ) + for (i = 0; i < majpf_args_nr; i++) + rec_argv[j++] = majpf_args[i]; +@@ -2256,7 +2260,11 @@ static int trace__record(struct trace *trace, int argc, const char **argv) + for (i = 0; i < (unsigned int)argc; i++) + rec_argv[j++] = argv[i]; + +- return cmd_record(j, rec_argv); ++ err = cmd_record(j, rec_argv); ++out_free: ++ free(filter); ++ free(rec_argv); ++ return err; + } + + static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp); +-- +2.20.1 + diff --git a/queue-4.19/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch b/queue-4.19/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch new file mode 100644 index 00000000000..76ec4f51446 --- /dev/null +++ b/queue-4.19/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch @@ -0,0 +1,71 @@ +From 370ed1047ca14af8136d90cbd070b64188b5e793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2019 13:52:08 +0200 +Subject: phy: qcom-usb-hs: Fix extcon double register after power cycle + +From: Stephan Gerhold + +[ Upstream commit 64f86b9978449ff05bfa6c64b4c5439e21e9c80b ] + +Commit f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API") +switched from extcon_register_notifier() to the resource-managed +API, i.e. devm_extcon_register_notifier(). + +This is problematic in this case, because the extcon notifier +is dynamically registered/unregistered whenever the PHY is powered +on/off. The resource-managed API does not unregister the notifier +until the driver is removed, so as soon as the PHY is power cycled, +attempting to register the notifier again results in: + + double register detected + WARNING: CPU: 1 PID: 182 at kernel/notifier.c:26 notifier_chain_register+0x74/0xa0 + Call trace: + ... + extcon_register_notifier+0x74/0xb8 + devm_extcon_register_notifier+0x54/0xb8 + qcom_usb_hs_phy_power_on+0x1fc/0x208 + ... + +... and USB stops working after plugging the cable out and in +another time. + +The easiest way to fix this is to make a partial revert of +commit f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API") +and avoid using the resource-managed API in this case. + +Fixes: f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API") +Signed-off-by: Stephan Gerhold +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-usb-hs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +index abbbe75070da..5629d56a6257 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +@@ -160,8 +160,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) + /* setup initial state */ + qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, + uphy->vbus_edev); +- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, +- EXTCON_USB, &uphy->vbus_notify); ++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + if (ret) + goto err_ulpi; + } +@@ -182,6 +182,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) + { + struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); + ++ if (uphy->vbus_edev) ++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + regulator_disable(uphy->v3p3); + regulator_disable(uphy->v1p8); + clk_disable_unprepare(uphy->sleep_clk); +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch b/queue-4.19/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch new file mode 100644 index 00000000000..d13be61a3b6 --- /dev/null +++ b/queue-4.19/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch @@ -0,0 +1,50 @@ +From d12962f1a62d60eff747c000b8a2cdf1d967c71d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 16:11:54 +0100 +Subject: pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() + +From: Ben Dooks (Codethink) + +[ Upstream commit 10ff58aa3c2e2a093b6ad615a7e3d8bb0dc613e5 ] + +The regs pointer in amd_gpio_irq_handler() should have __iomem +on it, so add that to fix the following sparse warnings: + +drivers/pinctrl/pinctrl-amd.c:555:14: warning: incorrect type in assignment (different address spaces) +drivers/pinctrl/pinctrl-amd.c:555:14: expected unsigned int [usertype] *regs +drivers/pinctrl/pinctrl-amd.c:555:14: got void [noderef] *base +drivers/pinctrl/pinctrl-amd.c:563:34: warning: incorrect type in argument 1 (different address spaces) +drivers/pinctrl/pinctrl-amd.c:563:34: expected void const volatile [noderef] *addr +drivers/pinctrl/pinctrl-amd.c:563:34: got unsigned int [usertype] * +drivers/pinctrl/pinctrl-amd.c:580:34: warning: incorrect type in argument 1 (different address spaces) +drivers/pinctrl/pinctrl-amd.c:580:34: expected void const volatile [noderef] *addr +drivers/pinctrl/pinctrl-amd.c:580:34: got unsigned int [usertype] * +drivers/pinctrl/pinctrl-amd.c:587:25: warning: incorrect type in argument 2 (different address spaces) +drivers/pinctrl/pinctrl-amd.c:587:25: expected void volatile [noderef] *addr +drivers/pinctrl/pinctrl-amd.c:587:25: got unsigned int [usertype] * + +Signed-off-by: Ben Dooks (Codethink) +Link: https://lore.kernel.org/r/20191022151154.5986-1-ben.dooks@codethink.co.uk +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-amd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index cd7a5d95b499..b1ffdd3f6d07 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -544,7 +544,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + irqreturn_t ret = IRQ_NONE; + unsigned int i, irqnr; + unsigned long flags; +- u32 *regs, regval; ++ u32 __iomem *regs; ++ u32 regval; + u64 status, mask; + + /* Read the wake status */ +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch b/queue-4.19/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch new file mode 100644 index 00000000000..249c7d235cb --- /dev/null +++ b/queue-4.19/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch @@ -0,0 +1,112 @@ +From 12030dba040929968f772280b12b578071958ea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 13:42:06 +0100 +Subject: pinctrl: devicetree: Avoid taking direct reference to device name + string + +From: Will Deacon + +[ Upstream commit be4c60b563edee3712d392aaeb0943a768df7023 ] + +When populating the pinctrl mapping table entries for a device, the +'dev_name' field for each entry is initialised to point directly at the +string returned by 'dev_name()' for the device and subsequently used by +'create_pinctrl()' when looking up the mappings for the device being +probed. + +This is unreliable in the presence of calls to 'dev_set_name()', which may +reallocate the device name string leaving the pinctrl mappings with a +dangling reference. This then leads to a use-after-free every time the +name is dereferenced by a device probe: + + | BUG: KASAN: invalid-access in strcmp+0x20/0x64 + | Read of size 1 at addr 13ffffc153494b00 by task modprobe/590 + | Pointer tag: [13], memory tag: [fe] + | + | Call trace: + | __kasan_report+0x16c/0x1dc + | kasan_report+0x10/0x18 + | check_memory_region + | __hwasan_load1_noabort+0x4c/0x54 + | strcmp+0x20/0x64 + | create_pinctrl+0x18c/0x7f4 + | pinctrl_get+0x90/0x114 + | devm_pinctrl_get+0x44/0x98 + | pinctrl_bind_pins+0x5c/0x450 + | really_probe+0x1c8/0x9a4 + | driver_probe_device+0x120/0x1d8 + +Follow the example of sysfs, and duplicate the device name string before +stashing it away in the pinctrl mapping entries. + +Cc: Linus Walleij +Reported-by: Elena Petrova +Tested-by: Elena Petrova +Signed-off-by: Will Deacon +Link: https://lore.kernel.org/r/20191002124206.22928-1-will@kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/devicetree.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 2969ff3162c3..177ee1136e34 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -40,6 +40,13 @@ struct pinctrl_dt_map { + static void dt_free_map(struct pinctrl_dev *pctldev, + struct pinctrl_map *map, unsigned num_maps) + { ++ int i; ++ ++ for (i = 0; i < num_maps; ++i) { ++ kfree_const(map[i].dev_name); ++ map[i].dev_name = NULL; ++ } ++ + if (pctldev) { + const struct pinctrl_ops *ops = pctldev->desc->pctlops; + if (ops->dt_free_map) +@@ -74,7 +81,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { +- map[i].dev_name = dev_name(p->dev); ++ const char *devname; ++ ++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); ++ if (!devname) ++ goto err_free_map; ++ ++ map[i].dev_name = devname; + map[i].name = statename; + if (pctldev) + map[i].ctrl_dev_name = dev_name(pctldev->dev); +@@ -82,10 +95,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Remember the converted mapping table entries */ + dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); +- if (!dt_map) { +- dt_free_map(pctldev, map, num_maps); +- return -ENOMEM; +- } ++ if (!dt_map) ++ goto err_free_map; + + dt_map->pctldev = pctldev; + dt_map->map = map; +@@ -93,6 +104,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + list_add_tail(&dt_map->node, &p->dt_maps); + + return pinctrl_register_map(map, num_maps, false); ++ ++err_free_map: ++ dt_free_map(pctldev, map, num_maps); ++ return -ENOMEM; + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch b/queue-4.19/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch new file mode 100644 index 00000000000..c99884aab13 --- /dev/null +++ b/queue-4.19/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch @@ -0,0 +1,64 @@ +From 36e967fefa34b93fcb1e53fcb9fcc15ca6dc7f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 15:13:08 +0200 +Subject: pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B + +From: Geert Uytterhoeven + +[ Upstream commit 884caadad128efad8e00c1cdc3177bc8912ee8ec ] + +The definitions for bit field [19:18] of the Peripheral Function Select +Register 3 were accidentally copied from bit field [20], leading to +duplicates for the TCLK1_B function, and missing TCLK0, CAN_CLK_B, and +ET0_ETXD4 functions. + +Fix this by adding the missing GPIO_FN_CAN_CLK_B and GPIO_FN_ET0_ETXD4 +enum values, and correcting the functions. + +Reported-by: Ben Dooks +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20191024131308.16659-1-geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/sh/include/cpu-sh4/cpu/sh7734.h | 2 +- + drivers/pinctrl/sh-pfc/pfc-sh7734.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h +index 96f0246ad2f2..82b63208135a 100644 +--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h ++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h +@@ -134,7 +134,7 @@ enum { + GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, + GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, + GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, +- GPIO_FN_RD_WR, GPIO_FN_TCLK0, ++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, + GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, + GPIO_FN_ET0_ETXD3_A, + GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 33232041ee86..3eccc9b3ca84 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -1453,7 +1453,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { + GPIO_FN(ET0_ETXD2_A), + GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), + GPIO_FN(ET0_ETXD3_A), +- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), ++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), + GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), + GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), + GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), +@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP3_20 [1] */ + FN_EX_WAIT0, FN_TCLK1_B, + /* IP3_19_18 [2] */ +- FN_RD_WR, FN_TCLK1_B, 0, 0, ++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, + /* IP3_17_15 [3] */ + FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, + FN_ET0_ETXD3_A, 0, 0, 0, +-- +2.20.1 + diff --git a/queue-4.19/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch b/queue-4.19/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch new file mode 100644 index 00000000000..e15381df463 --- /dev/null +++ b/queue-4.19/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch @@ -0,0 +1,55 @@ +From 4b7d3baadfccb9fa58ef698d6a0b033eedddc128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Oct 2019 22:04:51 +0200 +Subject: RDMA/qedr: Fix memory leak in user qp and mr + +From: Michal Kalderon + +[ Upstream commit 24e412c1e00ebfe73619e6b88cbc26c2c7d41b85 ] + +User QPs pbl's weren't freed properly. +MR pbls weren't freed properly. + +Fixes: e0290cce6ac0 ("qedr: Add support for memory registeration verbs") +Link: https://lore.kernel.org/r/20191027200451.28187-5-michal.kalderon@marvell.com +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 8cc3df24e04e..9167a1c40bcf 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1701,6 +1701,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) + if (qp->urq.umem) + ib_umem_release(qp->urq.umem); + qp->urq.umem = NULL; ++ ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); ++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ kfree(qp->urq.pbl_tbl); ++ } + } + + static int qedr_create_user_qp(struct qedr_dev *dev, +@@ -2809,8 +2817,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr) + + dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); + +- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) +- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); ++ if (mr->type != QEDR_MR_DMA) ++ free_mr_info(dev, &mr->info); + + /* it could be user registered memory. */ + if (mr->umem) +-- +2.20.1 + diff --git a/queue-4.19/regulator-max8907-fix-the-usage-of-uninitialized-var.patch b/queue-4.19/regulator-max8907-fix-the-usage-of-uninitialized-var.patch new file mode 100644 index 00000000000..4da85295694 --- /dev/null +++ b/queue-4.19/regulator-max8907-fix-the-usage-of-uninitialized-var.patch @@ -0,0 +1,65 @@ +From eb9cbd7ea5d6457442fab28da9f6215ec982e007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2019 10:58:13 -0700 +Subject: regulator: max8907: Fix the usage of uninitialized variable in + max8907_regulator_probe() + +From: Yizhuo + +[ Upstream commit 472b39c3d1bba0616eb0e9a8fa3ad0f56927c7d7 ] + +Inside function max8907_regulator_probe(), variable val could +be uninitialized if regmap_read() fails. However, val is used +later in the if statement to decide the content written to +"pmic", which is potentially unsafe. + +Signed-off-by: Yizhuo +Link: https://lore.kernel.org/r/20191003175813.16415-1-yzhai003@ucr.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max8907-regulator.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c +index 860400d2cd85..a8f2f07239fb 100644 +--- a/drivers/regulator/max8907-regulator.c ++++ b/drivers/regulator/max8907-regulator.c +@@ -299,7 +299,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) + memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); + + /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ +- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_II2RR_VERSION_MASK) == + MAX8907_II2RR_VERSION_REV_B) { + pmic->desc[MAX8907_SD1].min_uV = 637500; +@@ -336,14 +339,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) + } + + if (pmic->desc[i].ops == &max8907_ldo_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_MASK_LDO_SEQ) != + MAX8907_MASK_LDO_SEQ) + pmic->desc[i].ops = &max8907_ldo_hwctl_ops; + } else if (pmic->desc[i].ops == &max8907_out5v_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & (MAX8907_MASK_OUT5V_VINEN | + MAX8907_MASK_OUT5V_ENSRC)) != + MAX8907_MASK_OUT5V_ENSRC) +-- +2.20.1 + diff --git a/queue-4.19/rfkill-allocate-static-minor.patch b/queue-4.19/rfkill-allocate-static-minor.patch new file mode 100644 index 00000000000..cb2d9874966 --- /dev/null +++ b/queue-4.19/rfkill-allocate-static-minor.patch @@ -0,0 +1,68 @@ +From ee30fba819c9096d0b968d4f814d0c8b6286f925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 19:40:42 +0200 +Subject: rfkill: allocate static minor + +From: Marcel Holtmann + +[ Upstream commit 8670b2b8b029a6650d133486be9d2ace146fd29a ] + +udev has a feature of creating /dev/ device-nodes if it finds +a devnode: modalias. This allows for auto-loading of modules that +provide the node. This requires to use a statically allocated minor +number for misc character devices. + +However, rfkill uses dynamic minor numbers and prevents auto-loading +of the module. So allocate the next static misc minor number and use +it for rfkill. + +Signed-off-by: Marcel Holtmann +Link: https://lore.kernel.org/r/20191024174042.19851-1-marcel@holtmann.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/miscdevice.h | 1 + + net/rfkill/core.c | 9 +++++++-- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h +index 3247a3dc7934..b06b75776a32 100644 +--- a/include/linux/miscdevice.h ++++ b/include/linux/miscdevice.h +@@ -57,6 +57,7 @@ + #define UHID_MINOR 239 + #define USERIO_MINOR 240 + #define VHOST_VSOCK_MINOR 241 ++#define RFKILL_MINOR 242 + #define MISC_DYNAMIC_MINOR 255 + + struct device; +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 1355f5ca8d22..7fbc8314f626 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1328,10 +1328,12 @@ static const struct file_operations rfkill_fops = { + .llseek = no_llseek, + }; + ++#define RFKILL_NAME "rfkill" ++ + static struct miscdevice rfkill_miscdev = { +- .name = "rfkill", + .fops = &rfkill_fops, +- .minor = MISC_DYNAMIC_MINOR, ++ .name = RFKILL_NAME, ++ .minor = RFKILL_MINOR, + }; + + static int __init rfkill_init(void) +@@ -1383,3 +1385,6 @@ static void __exit rfkill_exit(void) + class_unregister(&rfkill_class); + } + module_exit(rfkill_exit); ++ ++MODULE_ALIAS_MISCDEV(RFKILL_MINOR); ++MODULE_ALIAS("devname:" RFKILL_NAME); +-- +2.20.1 + diff --git a/queue-4.19/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch b/queue-4.19/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch new file mode 100644 index 00000000000..b2ac28e356d --- /dev/null +++ b/queue-4.19/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch @@ -0,0 +1,73 @@ +From 9fa6b94de4243c7e5a07048d1cf8275b3751f000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2019 09:54:08 +0800 +Subject: rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot + +From: Chris Chiu + +[ Upstream commit 0eeb91ade90ce06d2fa1e2fcb55e3316b64c203c ] + +The RTL8723BU has problems connecting to AP after each warm reboot. +Sometimes it returns no scan result, and in most cases, it fails +the authentication for unknown reason. However, it works totally +fine after cold reboot. + +Compare the value of register SYS_CR and SYS_CLK_MAC_CLK_ENABLE +for cold reboot and warm reboot, the registers imply that the MAC +is already powered and thus some procedures are skipped during +driver initialization. Double checked the vendor driver, it reads +the SYS_CR and SYS_CLK_MAC_CLK_ENABLE also but doesn't skip any +during initialization based on them. This commit only tells the +RTL8723BU to do full initialization without checking MAC status. + +Signed-off-by: Chris Chiu +Signed-off-by: Jes Sorensen +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 + + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 1 + + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 3 +++ + 3 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 8828baf26e7b..47c2bfe06d03 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1349,6 +1349,7 @@ struct rtl8xxxu_fileops { + u8 has_s0s1:1; + u8 has_tx_report:1; + u8 gen2_thermal_meter:1; ++ u8 needs_full_init:1; + u32 adda_1t_init; + u32 adda_1t_path_on; + u32 adda_2t_path_on_a; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +index 26b674aca125..14e207f2466c 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +@@ -1673,6 +1673,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { + .has_s0s1 = 1, + .has_tx_report = 1, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x01c00014, + .adda_1t_path_on = 0x01c00014, + .adda_2t_path_on_a = 0x01c00014, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 2b4fcdf4ec5b..66c6ee70f00a 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -3905,6 +3905,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + else + macpower = true; + ++ if (fops->needs_full_init) ++ macpower = false; ++ + ret = fops->power_on(priv); + if (ret < 0) { + dev_warn(dev, "%s: Failed power on\n", __func__); +-- +2.20.1 + diff --git a/queue-4.19/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch b/queue-4.19/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch new file mode 100644 index 00000000000..f2dc8fc8e4a --- /dev/null +++ b/queue-4.19/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch @@ -0,0 +1,64 @@ +From 08f1899c7fa263bba5072d14fe34098fe57707e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 10:18:38 +0800 +Subject: rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() + +From: Ping-Ke Shih + +[ Upstream commit 5174f1e41074b5186608badc2e89441d021e8c08 ] + +This leak was found by testing the EDIMAX EW-7612 on Raspberry Pi 3B+ with +Linux 5.4-rc5 (multi_v7_defconfig + rtlwifi + kmemleak) and noticed a +single memory leak during probe: + +unreferenced object 0xec13ee40 (size 176): + comm "kworker/u8:1", pid 36, jiffies 4294939321 (age 5580.790s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] __netdev_alloc_skb+0x9c/0x164 + [<863dfa6e>] rtl92c_set_fw_rsvdpagepkt+0x254/0x340 [rtl8192c_common] + [<9572be0d>] rtl92cu_set_hw_reg+0xf48/0xfa4 [rtl8192cu] + [<116df4d8>] rtl_op_bss_info_changed+0x234/0x96c [rtlwifi] + [<8933575f>] ieee80211_bss_info_change_notify+0xb8/0x264 [mac80211] + [] ieee80211_assoc_success+0x934/0x1798 [mac80211] + [] ieee80211_rx_mgmt_assoc_resp+0x174/0x314 [mac80211] + [<5974629e>] ieee80211_sta_rx_queued_mgmt+0x3f4/0x7f0 [mac80211] + [] ieee80211_iface_work+0x208/0x318 [mac80211] + [] process_one_work+0x22c/0x564 + [] worker_thread+0x44/0x5d8 + [<82c7b073>] kthread+0x150/0x154 + [] ret_from_fork+0x14/0x2c + [<794dff30>] 0x0 + +It is because 8192cu doesn't implement usb_cmd_send_packet(), and this +patch just frees the skb within the function to resolve memleak problem +by now. Since 8192cu doesn't turn on fwctrl_lps that needs to download +command packet for firmware via the function, applying this patch doesn't +affect driver behavior. + +Reported-by: Stefan Wahren +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index 1e60f70481f5..8c60a84941d5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -1556,6 +1556,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) + * This is maybe necessary: + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); + */ ++ dev_kfree_skb(skb); ++ + return true; + } + +-- +2.20.1 + diff --git a/queue-4.19/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch b/queue-4.19/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch new file mode 100644 index 00000000000..7531ac7b3a2 --- /dev/null +++ b/queue-4.19/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch @@ -0,0 +1,47 @@ +From cd446b8aadbbe1f6631e87ccc45a79c0b32bcf93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 20:20:21 -0500 +Subject: rtlwifi: prevent memory leak in rtl_usb_probe + +From: Navid Emamdoost + +[ Upstream commit 3f93616951138a598d930dcaec40f2bfd9ce43bb ] + +In rtl_usb_probe if allocation for usb_data fails the allocated hw +should be released. In addition the allocated rtlpriv->usb_data should +be released on error handling path. + +Signed-off-by: Navid Emamdoost +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 5adb939afee8..1181b725f503 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1050,8 +1050,10 @@ int rtl_usb_probe(struct usb_interface *intf, + rtlpriv->hw = hw; + rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32), + GFP_KERNEL); +- if (!rtlpriv->usb_data) ++ if (!rtlpriv->usb_data) { ++ ieee80211_free_hw(hw); + return -ENOMEM; ++ } + + /* this spin lock must be initialized early */ + spin_lock_init(&rtlpriv->locks.usb_lock); +@@ -1112,6 +1114,7 @@ error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); + complete(&rtlpriv->firmware_loading_complete); ++ kfree(rtlpriv->usb_data); + return -ENODEV; + } + EXPORT_SYMBOL(rtl_usb_probe); +-- +2.20.1 + diff --git a/queue-4.19/s390-disassembler-don-t-hide-instruction-addresses.patch b/queue-4.19/s390-disassembler-don-t-hide-instruction-addresses.patch new file mode 100644 index 00000000000..f80e6dc531c --- /dev/null +++ b/queue-4.19/s390-disassembler-don-t-hide-instruction-addresses.patch @@ -0,0 +1,73 @@ +From b7dd60382b7e52789e3f4d927a8c21b650360bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 18:25:16 +0100 +Subject: s390/disassembler: don't hide instruction addresses + +From: Ilya Leoshkevich + +[ Upstream commit 544f1d62e3e6c6e6d17a5e56f6139208acb5ff46 ] + +Due to kptr_restrict, JITted BPF code is now displayed like this: + +000000000b6ed1b2: ebdff0800024 stmg %r13,%r15,128(%r15) +000000004cde2ba0: 41d0f040 la %r13,64(%r15) +00000000fbad41b0: a7fbffa0 aghi %r15,-96 + +Leaking kernel addresses to dmesg is not a concern in this case, because +this happens only when JIT debugging is explicitly activated, which only +root can do. + +Use %px in this particular instance, and also to print an instruction +address in show_code and PCREL (e.g. brasl) arguments in print_insn. +While at present functionally equivalent to %016lx, %px is recommended +by Documentation/core-api/printk-formats.rst for such cases. + +Signed-off-by: Ilya Leoshkevich +Reviewed-by: Vasily Gorbik +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/dis.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index b2c68fbf2634..41925f220694 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -462,10 +462,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) + ptr += sprintf(ptr, "%%c%i", value); + else if (operand->flags & OPERAND_VR) + ptr += sprintf(ptr, "%%v%i", value); +- else if (operand->flags & OPERAND_PCREL) +- ptr += sprintf(ptr, "%lx", (signed int) value +- + addr); +- else if (operand->flags & OPERAND_SIGNED) ++ else if (operand->flags & OPERAND_PCREL) { ++ void *pcrel = (void *)((int)value + addr); ++ ++ ptr += sprintf(ptr, "%px", pcrel); ++ } else if (operand->flags & OPERAND_SIGNED) + ptr += sprintf(ptr, "%i", value); + else + ptr += sprintf(ptr, "%u", value); +@@ -537,7 +538,7 @@ void show_code(struct pt_regs *regs) + else + *ptr++ = ' '; + addr = regs->psw.addr + start - 32; +- ptr += sprintf(ptr, "%016lx: ", addr); ++ ptr += sprintf(ptr, "%px: ", (void *)addr); + if (start + opsize >= end) + break; + for (i = 0; i < opsize; i++) +@@ -565,7 +566,7 @@ void print_fn_code(unsigned char *code, unsigned long len) + opsize = insn_length(*code); + if (opsize > len) + break; +- ptr += sprintf(ptr, "%p: ", code); ++ ptr += sprintf(ptr, "%px: ", code); + for (i = 0; i < opsize; i++) + ptr += sprintf(ptr, "%02x", code[i]); + *ptr++ = '\t'; +-- +2.20.1 + diff --git a/queue-4.19/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch b/queue-4.19/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch new file mode 100644 index 00000000000..35581e9cc9c --- /dev/null +++ b/queue-4.19/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch @@ -0,0 +1,72 @@ +From 1b2dc8c1d0ae4984d21b5f633969cb5690a52ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 14:38:08 +0200 +Subject: s390/mm: add mm_pxd_folded() checks to pxd_free() + +From: Gerald Schaefer + +[ Upstream commit 2416cefc504ba8ae9b17e3e6b40afc72708f96be ] + +Unlike pxd_free_tlb(), the pxd_free() functions do not check for folded +page tables. This is not an issue so far, as those functions will actually +never be called, since no code will reach them when page tables are folded. + +In order to avoid future issues, and to make the s390 code more similar to +other architectures, add mm_pxd_folded() checks, similar to how it is done +in pxd_free_tlb(). + +This was found by testing a patch from from Anshuman Khandual, which is +currently discussed on LKML ("mm/debug: Add tests validating architecture +page table helpers"). + +Signed-off-by: Gerald Schaefer +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/pgalloc.h | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index 5ee733720a57..67838df3f3f9 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -56,7 +56,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION2_ENTRY_EMPTY); + return (p4d_t *) table; + } +-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) ++ ++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) ++{ ++ if (!mm_p4d_folded(mm)) ++ crst_table_free(mm, (unsigned long *) p4d); ++} + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + { +@@ -65,7 +70,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION3_ENTRY_EMPTY); + return (pud_t *) table; + } +-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) ++ ++static inline void pud_free(struct mm_struct *mm, pud_t *pud) ++{ ++ if (!mm_pud_folded(mm)) ++ crst_table_free(mm, (unsigned long *) pud); ++} + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + { +@@ -83,6 +93,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + + static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) + { ++ if (mm_pmd_folded(mm)) ++ return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + crst_table_free(mm, (unsigned long *) pmd); + } +-- +2.20.1 + diff --git a/queue-4.19/s390-time-ensure-get_clock_monotonic-returns-monoton.patch b/queue-4.19/s390-time-ensure-get_clock_monotonic-returns-monoton.patch new file mode 100644 index 00000000000..a5893e37759 --- /dev/null +++ b/queue-4.19/s390-time-ensure-get_clock_monotonic-returns-monoton.patch @@ -0,0 +1,65 @@ +From 8ec0bbb56642a983554ef20f7a42177df17e5517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 14:09:47 +0100 +Subject: s390/time: ensure get_clock_monotonic() returns monotonic values + +From: Heiko Carstens + +[ Upstream commit 011620688a71f2f1fe9901dbc2479a7c01053196 ] + +The current implementation of get_clock_monotonic() leaves it up to +the caller to call the function with preemption disabled. The only +core kernel caller (sched_clock) however does not disable preemption. + +In order to make sure that all callers of this function see monotonic +values handle disabling preemption within the function itself. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/timex.h | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h +index 64539c221672..0f12a3f91282 100644 +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -10,8 +10,9 @@ + #ifndef _ASM_S390_TIMEX_H + #define _ASM_S390_TIMEX_H + +-#include ++#include + #include ++#include + + /* The value of the TOD clock for 1.1.1970. */ + #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL +@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); + /** + * get_clock_monotonic - returns current time in clock rate units + * +- * The caller must ensure that preemption is disabled. + * The clock and tod_clock_base get changed via stop_machine. +- * Therefore preemption must be disabled when calling this +- * function, otherwise the returned value is not guaranteed to +- * be monotonic. ++ * Therefore preemption must be disabled, otherwise the returned ++ * value is not guaranteed to be monotonic. + */ + static inline unsigned long long get_tod_clock_monotonic(void) + { +- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ unsigned long long tod; ++ ++ preempt_disable(); ++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ preempt_enable(); ++ return tod; + } + + /** +-- +2.20.1 + diff --git a/queue-4.19/samples-pktgen-fix-proc_cmd-command-result-check-log.patch b/queue-4.19/samples-pktgen-fix-proc_cmd-command-result-check-log.patch new file mode 100644 index 00000000000..fe5c5af59b1 --- /dev/null +++ b/queue-4.19/samples-pktgen-fix-proc_cmd-command-result-check-log.patch @@ -0,0 +1,82 @@ +From d925d897ad76623aa7ad2bb72fa701cd298ed906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2019 17:25:07 +0900 +Subject: samples: pktgen: fix proc_cmd command result check logic + +From: Daniel T. Lee + +[ Upstream commit 3cad8f911575191fb3b81d8ed0e061e30f922223 ] + +Currently, proc_cmd is used to dispatch command to 'pg_ctrl', 'pg_thread', +'pg_set'. proc_cmd is designed to check command result with grep the +"Result:", but this might fail since this string is only shown in +'pg_thread' and 'pg_set'. + +This commit fixes this logic by grep-ing the "Result:" string only when +the command is not for 'pg_ctrl'. + +For clarity of an execution flow, 'errexit' flag has been set. + +To cleanup pktgen on exit, trap has been added for EXIT signal. + +Signed-off-by: Daniel T. Lee +Acked-by: Jesper Dangaard Brouer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + samples/pktgen/functions.sh | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh +index f8bb3cd0f4ce..7d928571b25c 100644 +--- a/samples/pktgen/functions.sh ++++ b/samples/pktgen/functions.sh +@@ -5,6 +5,8 @@ + # Author: Jesper Dangaaard Brouer + # License: GPL + ++set -o errexit ++ + ## -- General shell logging cmds -- + function err() { + local exitcode=$1 +@@ -58,6 +60,7 @@ function pg_set() { + function proc_cmd() { + local result + local proc_file=$1 ++ local status=0 + # after shift, the remaining args are contained in $@ + shift + local proc_ctrl=${PROC_DIR}/$proc_file +@@ -73,13 +76,13 @@ function proc_cmd() { + echo "cmd: $@ > $proc_ctrl" + fi + # Quoting of "$@" is important for space expansion +- echo "$@" > "$proc_ctrl" +- local status=$? ++ echo "$@" > "$proc_ctrl" || status=$? + +- result=$(grep "Result: OK:" $proc_ctrl) +- # Due to pgctrl, cannot use exit code $? from grep +- if [[ "$result" == "" ]]; then +- grep "Result:" $proc_ctrl >&2 ++ if [[ "$proc_file" != "pgctrl" ]]; then ++ result=$(grep "Result: OK:" $proc_ctrl) || true ++ if [[ "$result" == "" ]]; then ++ grep "Result:" $proc_ctrl >&2 ++ fi + fi + if (( $status != 0 )); then + err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" +@@ -105,6 +108,8 @@ function pgset() { + fi + } + ++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT ++ + ## -- General shell tricks -- + + function root_check_run_with_sudo() { +-- +2.20.1 + diff --git a/queue-4.19/selftests-bpf-correct-path-to-include-msg-path.patch b/queue-4.19/selftests-bpf-correct-path-to-include-msg-path.patch new file mode 100644 index 00000000000..ab2d1ff5903 --- /dev/null +++ b/queue-4.19/selftests-bpf-correct-path-to-include-msg-path.patch @@ -0,0 +1,72 @@ +From 39aa10310789be509fb442238d3ef97bedfe38e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 15:04:04 +0300 +Subject: selftests/bpf: Correct path to include msg + path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ivan Khoronzhuk + +[ Upstream commit c588146378962786ddeec817f7736a53298a7b01 ] + +The "path" buf is supposed to contain path + printf msg up to 24 bytes. +It will be cut anyway, but compiler generates truncation warns like: + +" +samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c: In +function ‘setup_cgroup_environment’: +samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:52:34: +warning: ‘/cgroup.controllers’ directive output may be truncated +writing 19 bytes into a region of size between 1 and 4097 +[-Wformat-truncation=] +snprintf(path, sizeof(path), "%s/cgroup.controllers", cgroup_path); + ^~~~~~~~~~~~~~~~~~~ +samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:52:2: +note: ‘snprintf’ output between 20 and 4116 bytes into a destination +of size 4097 +snprintf(path, sizeof(path), "%s/cgroup.controllers", cgroup_path); +^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:72:34: +warning: ‘/cgroup.subtree_control’ directive output may be truncated +writing 23 bytes into a region of size between 1 and 4097 +[-Wformat-truncation=] +snprintf(path, sizeof(path), "%s/cgroup.subtree_control", + ^~~~~~~~~~~~~~~~~~~~~~~ +cgroup_path); +samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:72:2: +note: ‘snprintf’ output between 24 and 4120 bytes into a destination +of size 4097 +snprintf(path, sizeof(path), "%s/cgroup.subtree_control", +cgroup_path); +" + +In order to avoid warns, lets decrease buf size for cgroup workdir on +24 bytes with assumption to include also "/cgroup.subtree_control" to +the address. The cut will never happen anyway. + +Signed-off-by: Ivan Khoronzhuk +Signed-off-by: Daniel Borkmann +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20191002120404.26962-3-ivan.khoronzhuk@linaro.org +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/cgroup_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c +index cf16948aad4a..6af24f9a780d 100644 +--- a/tools/testing/selftests/bpf/cgroup_helpers.c ++++ b/tools/testing/selftests/bpf/cgroup_helpers.c +@@ -44,7 +44,7 @@ + */ + int setup_cgroup_environment(void) + { +- char cgroup_workdir[PATH_MAX + 1]; ++ char cgroup_workdir[PATH_MAX - 24]; + + format_cgroup_path(cgroup_workdir, ""); + +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..fa6d22d4f3b --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,166 @@ +drm-mst-fix-query_payload-ack-reply-struct.patch +drm-panel-add-missing-drm_panel_init-in-panel-driver.patch +drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch +iio-light-bh1750-resolve-compiler-warning-and-make-c.patch +drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch +spi-add-call-to-spi_slave_abort-function-when-spidev.patch +staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch +staging-rtl8188eu-fix-possible-null-dereference.patch +rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch +libertas-fix-a-potential-null-pointer-dereference.patch +ath10k-fix-backtrace-on-coredump.patch +ib-iser-bound-protection_sg-size-by-data_sg-size.patch +media-am437x-vpfe-setting-std-to-current-value-is-no.patch +media-i2c-ov2659-fix-s_stream-return-value.patch +media-ov6650-fix-crop-rectangle-alignment-not-passed.patch +media-i2c-ov2659-fix-missing-720p-register-config.patch +media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch +media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch +tools-power-cpupower-fix-initializer-override-in-hsw.patch +media-venus-core-fix-msm8996-frequency-table.patch +ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch +pinctrl-devicetree-avoid-taking-direct-reference-to-.patch +drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch +selftests-bpf-correct-path-to-include-msg-path.patch +media-venus-fix-occasionally-failures-to-suspend.patch +usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch +hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch +regulator-max8907-fix-the-usage-of-uninitialized-var.patch +media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch +media-cec-funcs.h-add-status_req-checks.patch +drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch +samples-pktgen-fix-proc_cmd-command-result-check-log.patch +block-fix-writeback-throttling-w-1-compiler-warnings.patch +mips-syscall-emit-loongson3-sync-workarounds-within-.patch +mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch +drm-drm_vblank-change-einval-by-the-correct-errno.patch +media-cx88-fix-some-error-handling-path-in-cx8800_in.patch +media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch +media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch +media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch +media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch +media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch +media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch +media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-17386 +syscalls-x86-use-the-correct-function-type-in-syscal.patch +drm-amd-display-fix-dongle_caps-containing-stale-inf.patch +extcon-sm5502-reset-registers-during-initialization.patch +x86-mm-use-the-correct-function-type-for-native_set_.patch +ath10k-correct-error-handling-of-dma_map_single.patch +drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch +perf-test-report-failure-for-mmap-events.patch +perf-report-add-warning-when-libunwind-not-compiled-.patch +perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch +usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch +iio-adc-max1027-reset-the-device-at-probe-time.patch +bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch +bluetooth-workaround-directed-advertising-bug-in-bro.patch +bluetooth-hci_core-fix-init-for-hci_user_channel.patch +bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch +x86-mce-lower-throttling-mce-messages-priority-to-wa.patch +perf-tests-disable-bp_signal-testing-for-arm64.patch +drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch +rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch +ipmi-don-t-allow-device-module-unload-when-in-use.patch +x86-ioapic-prevent-inconsistent-state-when-moving-an.patch +media-smiapp-register-sensor-after-enabling-runtime-.patch +md-bitmap-avoid-race-window-between-md_bitmap_resize.patch +arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch +i40e-initialize-itrn-registers-with-correct-values.patch +net-phy-dp83867-enable-robust-auto-mdix.patch +drm-tegra-sor-use-correct-sor-index-on-tegra210.patch +spi-sprd-adi-add-missing-lock-protection-when-reboot.patch +acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch +rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch +gpu-host1x-allocate-gather-copy-for-host1x.patch +net-dsa-lan9303-select-regmap-when-lan9303-enable.patch +alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch +phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch +s390-time-ensure-get_clock_monotonic-returns-monoton.patch +s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch +net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch +libata-ensure-ata_port-probe-has-completed-before-de.patch +loop-fix-no-unmap-write-zeroes-request-behavior.patch +pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch +iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch +libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch +bluetooth-fix-advertising-duplicated-flags.patch +pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch +ixgbe-protect-tx-timestamping-from-api-misuse.patch +media-rcar_drif-fix-a-memory-disclosure.patch +media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch +nvmem-imx-ocotp-reset-error-status-on-probe.patch +rfkill-allocate-static-minor.patch +bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch +spi-img-spfi-fix-potential-double-release.patch +alsa-timer-limit-max-amount-of-slave-instances.patch +rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch +perf-probe-fix-to-find-range-only-function-instance.patch +perf-probe-fix-to-list-probe-event-with-correct-line.patch +perf-jevents-fix-resource-leak-in-process_mapfile-an.patch +perf-probe-walk-function-lines-in-lexical-blocks.patch +perf-probe-fix-to-probe-an-inline-function-which-has.patch +perf-probe-fix-to-show-ranges-of-variables-in-functi.patch +perf-probe-fix-to-show-inlined-function-callsite-wit.patch +libsubcmd-use-o0-with-debug-1.patch +perf-probe-fix-to-probe-a-function-which-has-no-entr.patch +perf-tools-splice-events-onto-evlist-even-on-error.patch +drm-amdgpu-disallow-direct-upload-save-restore-list-.patch +drm-amdgpu-fix-potential-double-drop-fence-reference.patch +xen-gntdev-use-select-for-dma_shared_buffer.patch +perf-parse-if-pmu-configuration-fails-free-terms.patch +perf-probe-skip-overlapped-location-on-searching-var.patch +perf-probe-return-a-better-scope-die-if-there-is-no-.patch +perf-probe-fix-to-show-calling-lines-of-inlined-func.patch +perf-probe-skip-end-of-sequence-and-non-statement-li.patch +perf-probe-filter-out-instances-except-for-inlined-s.patch +ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch +fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch +media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch +soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch +crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch +ice-delay-less.patch +media-si470x-i2c-add-missed-operations-in-remove.patch +edac-ghes-fix-grain-calculation.patch +spi-pxa2xx-add-missed-security-checks.patch +asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch +iio-dac-ad5446-add-support-for-new-ad5600-dac.patch +asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch +s390-disassembler-don-t-hide-instruction-addresses.patch +nvme-discard-workaround-for-non-conformant-devices.patch +parport-load-lowlevel-driver-if-ports-not-found.patch +bcache-fix-static-checker-warning-in-bcache_device_f.patch +cpufreq-register-drivers-only-after-cpu-devices-have.patch +x86-crash-add-a-forward-declaration-of-struct-kimage.patch +tracing-use-kvcalloc-for-tgid_map-array-allocation.patch +tracing-kprobe-check-whether-the-non-suffixed-symbol.patch +bcache-fix-deadlock-in-bcache_allocator.patch +iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch +asoc-wm8904-fix-regcache-handling.patch +spi-tegra20-slink-add-missed-clk_unprepare.patch +tun-fix-data-race-in-gro_normal_list.patch +crypto-virtio-deal-with-unsupported-input-sizes.patch +mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch +btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch +btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch +asoc-wm2200-add-missed-operations-in-remove-and-prob.patch +spi-st-ssc4-add-missed-pm_runtime_disable.patch +asoc-wm5100-add-missed-pm_runtime_disable.patch +asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch +x86-insn-add-some-intel-instructions-to-the-opcode-m.patch +brcmfmac-remove-monitor-interface-when-detaching.patch +iwlwifi-check-kasprintf-return-value.patch +fbtft-make-sure-string-is-null-terminated.patch +net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch +crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch +crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch +mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch +crypto-vmx-avoid-weird-build-failures.patch +libtraceevent-fix-memory-leakage-in-copy_filter_type.patch +perf-parse-fix-potential-memory-leak-when-handling-t.patch +mips-fix-build-when-48-bits-virtual-memory-is-enable.patch +drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch +perf-intel-bts-does-not-support-aux-area-sampling.patch +net-phy-initialise-phydev-speed-and-duplex-sanely.patch +btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch +btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch diff --git a/queue-4.19/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch b/queue-4.19/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch new file mode 100644 index 00000000000..11a2fa5c5b7 --- /dev/null +++ b/queue-4.19/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch @@ -0,0 +1,53 @@ +From 9ccb19cb504fe3bd1899734f671bd35c75b5f998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 18:29:48 -0500 +Subject: soundwire: intel: fix PDI/stream mapping for Bulk + +From: Pierre-Louis Bossart + +[ Upstream commit c134f914e9f55b7817e2bae625ec0e5f1379f7cd ] + +The previous formula is incorrect for PDI0/1, the mapping is not +linear but has a discontinuity between PDI1 and PDI2. + +This change has no effect on PCM PDIs (same mapping). + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20191022232948.17156-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index 29bc99c4a7b6..e49d3c810677 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -352,7 +352,10 @@ intel_pdi_shim_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + int pdi_conf = 0; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* + * Program stream parameters to stream SHIM register +@@ -381,7 +384,10 @@ intel_pdi_alh_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi) + unsigned int link_id = sdw->instance; + unsigned int conf; + +- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5; ++ /* the Bulk and PCM streams are not contiguous */ ++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3; ++ if (pdi->num >= 2) ++ pdi->intel_alh_id += 2; + + /* Program Stream config ALH register */ + conf = intel_readl(alh, SDW_ALH_STRMZCFG(pdi->intel_alh_id)); +-- +2.20.1 + diff --git a/queue-4.19/spi-add-call-to-spi_slave_abort-function-when-spidev.patch b/queue-4.19/spi-add-call-to-spi_slave_abort-function-when-spidev.patch new file mode 100644 index 00000000000..86e955fdf94 --- /dev/null +++ b/queue-4.19/spi-add-call-to-spi_slave_abort-function-when-spidev.patch @@ -0,0 +1,50 @@ +From 352a1be149d699a2512c3754a8cb30fd73842059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 11:11:42 +0200 +Subject: spi: Add call to spi_slave_abort() function when spidev driver is + released + +From: Lukasz Majewski + +[ Upstream commit 9f918a728cf86b2757b6a7025e1f46824bfe3155 ] + +This change is necessary for spidev devices (e.g. /dev/spidev3.0) working +in the slave mode (like NXP's dspi driver for Vybrid SoC). + +When SPI HW works in this mode - the master is responsible for providing +CS and CLK signals. However, when some fault happens - like for example +distortion on SPI lines - the SPI Linux driver needs a chance to recover +from this abnormal situation and prepare itself for next (correct) +transmission. + +This change doesn't pose any threat on drivers working in master mode as +spi_slave_abort() function checks if SPI slave mode is supported. + +Signed-off-by: Lukasz Majewski +Link: https://lore.kernel.org/r/20190924110547.14770-2-lukma@denx.de +Signed-off-by: Mark Brown +Reported-by: kbuild test robot +Link: https://lore.kernel.org/r/20190925091143.15468-2-lukma@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index c5fe08bc34a0..028725573e63 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -634,6 +634,9 @@ static int spidev_release(struct inode *inode, struct file *filp) + if (dofree) + kfree(spidev); + } ++#ifdef CONFIG_SPI_SLAVE ++ spi_slave_abort(spidev->spi); ++#endif + mutex_unlock(&device_list_lock); + + return 0; +-- +2.20.1 + diff --git a/queue-4.19/spi-img-spfi-fix-potential-double-release.patch b/queue-4.19/spi-img-spfi-fix-potential-double-release.patch new file mode 100644 index 00000000000..ed1a91580a1 --- /dev/null +++ b/queue-4.19/spi-img-spfi-fix-potential-double-release.patch @@ -0,0 +1,39 @@ +From a7e7b5332542bc69329a233a969bab65b497fe97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 10:36:09 +0800 +Subject: spi: img-spfi: fix potential double release + +From: Pan Bian + +[ Upstream commit e9a8ba9769a0e354341bc6cc01b98aadcea1dfe9 ] + +The channels spfi->tx_ch and spfi->rx_ch are not set to NULL after they +are released. As a result, they will be released again, either on the +error handling branch in the same function or in the corresponding +remove function, i.e. img_spfi_remove(). This patch fixes the bug by +setting the two members to NULL. + +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/1573007769-20131-1-git-send-email-bianpan2016@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-img-spfi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index e6eb979f1b8a..e4b31d6e6e33 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -676,6 +676,8 @@ static int img_spfi_probe(struct platform_device *pdev) + dma_release_channel(spfi->tx_ch); + if (spfi->rx_ch) + dma_release_channel(spfi->rx_ch); ++ spfi->tx_ch = NULL; ++ spfi->rx_ch = NULL; + dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); + } else { + master->dma_tx = spfi->tx_ch; +-- +2.20.1 + diff --git a/queue-4.19/spi-pxa2xx-add-missed-security-checks.patch b/queue-4.19/spi-pxa2xx-add-missed-security-checks.patch new file mode 100644 index 00000000000..8027879e875 --- /dev/null +++ b/queue-4.19/spi-pxa2xx-add-missed-security-checks.patch @@ -0,0 +1,45 @@ +From 5bfa9628c418e9590ab788c5c8e05a8251095518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Nov 2019 16:09:43 +0800 +Subject: spi: pxa2xx: Add missed security checks + +From: Chuhong Yuan + +[ Upstream commit 5eb263ef08b5014cfc2539a838f39d2fd3531423 ] + +pxa2xx_spi_init_pdata misses checks for devm_clk_get and +platform_get_irq. +Add checks for them to fix the bugs. + +Since ssp->clk and ssp->irq are used in probe, they are mandatory here. +So we cannot use _optional() for devm_clk_get and platform_get_irq. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20191109080943.30428-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index f41333817c50..525388126e26 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1470,7 +1470,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(ssp->clk)) ++ return NULL; ++ + ssp->irq = platform_get_irq(pdev, 0); ++ if (ssp->irq < 0) ++ return NULL; ++ + ssp->type = type; + ssp->pdev = pdev; + ssp->port_id = pxa2xx_spi_get_port_id(adev); +-- +2.20.1 + diff --git a/queue-4.19/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch b/queue-4.19/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch new file mode 100644 index 00000000000..ecf68899040 --- /dev/null +++ b/queue-4.19/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch @@ -0,0 +1,39 @@ +From 215c1c8989406d977c10f5efb4fe33020fa1dedb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 18:10:30 +0800 +Subject: spi: sprd: adi: Add missing lock protection when rebooting + +From: Lingling Xu + +[ Upstream commit 91ea1d70607e374b014b4b9bea771ce661f9f64b ] + +When rebooting the system, we should lock the watchdog after +configuration to make sure the watchdog can reboot the system +successfully. + +Signed-off-by: Lingling Xu +Signed-off-by: Baolin Wang +Link: https://lore.kernel.org/r/7b04711127434555e3a1a86bc6be99860cd86668.1572257085.git.baolin.wang@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sprd-adi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c +index df5960bddfe6..f1fc2bde6ef3 100644 +--- a/drivers/spi/spi-sprd-adi.c ++++ b/drivers/spi/spi-sprd-adi.c +@@ -367,6 +367,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this, + val |= BIT_WDG_RUN | BIT_WDG_RST; + sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val); + ++ /* Lock the watchdog */ ++ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, ~WDG_UNLOCK_KEY); ++ + mdelay(1000); + + dev_emerg(sadi->dev, "Unable to restart system\n"); +-- +2.20.1 + diff --git a/queue-4.19/spi-st-ssc4-add-missed-pm_runtime_disable.patch b/queue-4.19/spi-st-ssc4-add-missed-pm_runtime_disable.patch new file mode 100644 index 00000000000..a2e656f24bc --- /dev/null +++ b/queue-4.19/spi-st-ssc4-add-missed-pm_runtime_disable.patch @@ -0,0 +1,45 @@ +From 30933f5e80dbf274d67fb1cac5fd1cc5b0c8fec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 10:48:48 +0800 +Subject: spi: st-ssc4: add missed pm_runtime_disable + +From: Chuhong Yuan + +[ Upstream commit cd050abeba2a95fe5374eec28ad2244617bcbab6 ] + +The driver forgets to call pm_runtime_disable in probe failure +and remove. +Add the missed calls to fix it. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20191118024848.21645-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-st-ssc4.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c +index a4e43fc19ece..5df01ffdef46 100644 +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -385,6 +385,7 @@ static int spi_st_probe(struct platform_device *pdev) + return 0; + + clk_disable: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi_st->clk); + put_master: + spi_master_put(master); +@@ -396,6 +397,8 @@ static int spi_st_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_master_get_devdata(master); + ++ pm_runtime_disable(&pdev->dev); ++ + clk_disable_unprepare(spi_st->clk); + + pinctrl_pm_select_sleep_state(&pdev->dev); +-- +2.20.1 + diff --git a/queue-4.19/spi-tegra20-slink-add-missed-clk_unprepare.patch b/queue-4.19/spi-tegra20-slink-add-missed-clk_unprepare.patch new file mode 100644 index 00000000000..a70a902e789 --- /dev/null +++ b/queue-4.19/spi-tegra20-slink-add-missed-clk_unprepare.patch @@ -0,0 +1,53 @@ +From f276d110dd3c0403e6b9ed1ae574c7445f89ce01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 16:31:22 +0800 +Subject: spi: tegra20-slink: add missed clk_unprepare + +From: Chuhong Yuan + +[ Upstream commit 04358e40ba96d687c0811c21d9dede73f5244a98 ] + +The driver misses calling clk_unprepare in probe failure and remove. +Add the calls to fix it. + +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20191115083122.12278-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-slink.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 1427f343b39a..d1187317bb5d 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1078,7 +1078,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + ret = clk_enable(tspi->clk); + if (ret < 0) { + dev_err(&pdev->dev, "Clock enable failed %d\n", ret); +- goto exit_free_master; ++ goto exit_clk_unprepare; + } + + spi_irq = platform_get_irq(pdev, 0); +@@ -1151,6 +1151,8 @@ exit_free_irq: + free_irq(spi_irq, tspi); + exit_clk_disable: + clk_disable(tspi->clk); ++exit_clk_unprepare: ++ clk_unprepare(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1164,6 +1166,7 @@ static int tegra_slink_remove(struct platform_device *pdev) + free_irq(tspi->irq, tspi); + + clk_disable(tspi->clk); ++ clk_unprepare(tspi->clk); + + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); +-- +2.20.1 + diff --git a/queue-4.19/staging-rtl8188eu-fix-possible-null-dereference.patch b/queue-4.19/staging-rtl8188eu-fix-possible-null-dereference.patch new file mode 100644 index 00000000000..1ba48db80f1 --- /dev/null +++ b/queue-4.19/staging-rtl8188eu-fix-possible-null-dereference.patch @@ -0,0 +1,54 @@ +From fdc2186fa61e6c5bba352f11aa3f47950a95ed4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 08:03:17 -0700 +Subject: staging: rtl8188eu: fix possible null dereference + +From: Connor Kuehl + +[ Upstream commit 228241944a48113470d3c3b46c88ba7fbe0a274b ] + +Inside a nested 'else' block at the beginning of this function is a +call that assigns 'psta' to the return value of 'rtw_get_stainfo()'. +If 'rtw_get_stainfo()' returns NULL and the flow of control reaches +the 'else if' where 'psta' is dereferenced, then we will dereference +a NULL pointer. + +Fix this by checking if 'psta' is not NULL before reading its +'psta->qos_option' data member. + +Addresses-Coverity: ("Dereference null return value") + +Signed-off-by: Connor Kuehl +Acked-by: Larry Finger +Link: https://lore.kernel.org/r/20190926150317.5894-1-connor.kuehl@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index dd9b02d316f3..c6a5b62cb363 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -778,7 +778,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); + memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || + check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { +@@ -786,7 +786,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); + memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else { + RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); +-- +2.20.1 + diff --git a/queue-4.19/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch b/queue-4.19/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch new file mode 100644 index 00000000000..72c6c08ccb9 --- /dev/null +++ b/queue-4.19/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch @@ -0,0 +1,72 @@ +From 25807492741aaf17215ded3a3ab65f59da1195f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2019 21:51:33 -0500 +Subject: staging: rtl8192u: fix multiple memory leaks on error path + +From: Navid Emamdoost + +[ Upstream commit ca312438cf176a16d4b89350cade8789ba8d7133 ] + +In rtl8192_tx on error handling path allocated urbs and also skb should +be released. + +Signed-off-by: Navid Emamdoost +Link: https://lore.kernel.org/r/20190920025137.29407-1-navid.emamdoost@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/r8192U_core.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index e218b5c20642..2066a1d9bc84 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1467,7 +1467,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); + struct usb_device *udev = priv->udev; + int pend; +- int status; ++ int status, rt = -1; + struct urb *tx_urb = NULL, *tx_urb_zero = NULL; + unsigned int idx_pipe; + +@@ -1611,8 +1611,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + } + if (bSend0Byte) { + tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); +- if (!tx_urb_zero) +- return -ENOMEM; ++ if (!tx_urb_zero) { ++ rt = -ENOMEM; ++ goto error; ++ } + usb_fill_bulk_urb(tx_urb_zero, udev, + usb_sndbulkpipe(udev, idx_pipe), + &zero, 0, tx_zero_isr, dev); +@@ -1622,7 +1624,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + "Error TX URB for zero byte %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ goto error; + } + } + netif_trans_update(dev); +@@ -1633,7 +1635,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ ++error: ++ dev_kfree_skb_any(skb); ++ usb_free_urb(tx_urb); ++ usb_free_urb(tx_urb_zero); ++ return rt; + } + + static short rtl8192_usb_initendpoints(struct net_device *dev) +-- +2.20.1 + diff --git a/queue-4.19/syscalls-x86-use-the-correct-function-type-in-syscal.patch b/queue-4.19/syscalls-x86-use-the-correct-function-type-in-syscal.patch new file mode 100644 index 00000000000..f54d0c25440 --- /dev/null +++ b/queue-4.19/syscalls-x86-use-the-correct-function-type-in-syscal.patch @@ -0,0 +1,72 @@ +From 57dbf2cad2dbb6b14330fdd01dc3ccc3d80700a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2019 15:40:45 -0700 +Subject: syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 + +From: Sami Tolvanen + +[ Upstream commit 8661d769ab77c675b5eb6c3351a372b9fbc1bf40 ] + +Although a syscall defined using SYSCALL_DEFINE0 doesn't accept +parameters, use the correct function type to avoid type mismatches +with Control-Flow Integrity (CFI) checking. + +Signed-off-by: Sami Tolvanen +Acked-by: Andy Lutomirski +Cc: Borislav Petkov +Cc: H . Peter Anvin +Cc: Kees Cook +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/20191008224049.115427-2-samitolvanen@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/syscall_wrapper.h | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h +index e046a405743d..90eb70df0b18 100644 +--- a/arch/x86/include/asm/syscall_wrapper.h ++++ b/arch/x86/include/asm/syscall_wrapper.h +@@ -48,12 +48,13 @@ + * To keep the naming coherent, re-define SYSCALL_DEFINE0 to create an alias + * named __ia32_sys_*() + */ +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ +- asmlinkage long __x64_sys_##sname(void) ++ ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + + #define COND_SYSCALL(name) \ + cond_syscall(__x64_sys_##name); \ +@@ -181,11 +182,11 @@ + * macros to work correctly. + */ + #ifndef SYSCALL_DEFINE0 +-#define SYSCALL_DEFINE0(sname) \ +- SYSCALL_METADATA(_##sname, 0); \ +- asmlinkage long __x64_sys_##sname(void); \ +- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ +- asmlinkage long __x64_sys_##sname(void) ++#define SYSCALL_DEFINE0(sname) \ ++ SYSCALL_METADATA(_##sname, 0); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\ ++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \ ++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused) + #endif + + #ifndef COND_SYSCALL +-- +2.20.1 + diff --git a/queue-4.19/tools-power-cpupower-fix-initializer-override-in-hsw.patch b/queue-4.19/tools-power-cpupower-fix-initializer-override-in-hsw.patch new file mode 100644 index 00000000000..a63b88f2aba --- /dev/null +++ b/queue-4.19/tools-power-cpupower-fix-initializer-override-in-hsw.patch @@ -0,0 +1,63 @@ +From fc64b798cff204acf833c93c6a2215e8e6bfff29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 09:26:42 -0700 +Subject: tools/power/cpupower: Fix initializer override in hsw_ext_cstates + +From: Nathan Chancellor + +[ Upstream commit 7e5705c635ecfccde559ebbbe1eaf05b5cc60529 ] + +When building cpupower with clang, the following warning appears: + + utils/idle_monitor/hsw_ext_idle.c:42:16: warning: initializer overrides + prior initialization of this subobject [-Winitializer-overrides] + .desc = N_("Processor Package C2"), + ^~~~~~~~~~~~~~~~~~~~~~ + ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_' + #define N_(String) gettext_noop(String) + ^~~~~~ + ./utils/helpers/helpers.h:23:30: note: expanded from macro + 'gettext_noop' + #define gettext_noop(String) String + ^~~~~~ + utils/idle_monitor/hsw_ext_idle.c:41:16: note: previous initialization + is here + .desc = N_("Processor Package C9"), + ^~~~~~~~~~~~~~~~~~~~~~ + ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_' + #define N_(String) gettext_noop(String) + ^~~~~~ + ./utils/helpers/helpers.h:23:30: note: expanded from macro + 'gettext_noop' + #define gettext_noop(String) String + ^~~~~~ + 1 warning generated. + +This appears to be a copy and paste or merge mistake because the name +and id fields both have PC9 in them, not PC2. Remove the second +assignment to fix the warning. + +Fixes: 7ee767b69b68 ("cpupower: Add Haswell family 0x45 specific idle monitor to show PC8,9,10 states") +Link: https://github.com/ClangBuiltLinux/linux/issues/718 +Signed-off-by: Nathan Chancellor +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +index f794d6bbb7e9..3e4ff4a1cdf4 100644 +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent, +-- +2.20.1 + diff --git a/queue-4.19/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch b/queue-4.19/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch new file mode 100644 index 00000000000..112b3039424 --- /dev/null +++ b/queue-4.19/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch @@ -0,0 +1,95 @@ +From b97635cc787efda0c261b76ea69c8e274ce2d8ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 17:31:44 +0900 +Subject: tracing/kprobe: Check whether the non-suffixed symbol is notrace + +From: Masami Hiramatsu + +[ Upstream commit c7411a1a126f649be71526a36d4afac9e5aefa13 ] + +Check whether the non-suffixed symbol is notrace, since suffixed +symbols are generated by the compilers for optimization. Based on +these suffixed symbols, notrace check might not work because +some of them are just a partial code of the original function. +(e.g. cold-cache (unlikely) code is separated from original + function as FUNCTION.cold.XX) + +For example, without this fix, + # echo p device_add.cold.67 > /sys/kernel/debug/tracing/kprobe_events + sh: write error: Invalid argument + + # cat /sys/kernel/debug/tracing/error_log + [ 135.491035] trace_kprobe: error: Failed to register probe event + Command: p device_add.cold.67 + ^ + # dmesg | tail -n 1 + [ 135.488599] trace_kprobe: Could not probe notrace function device_add.cold.67 + +With this, + # echo p device_add.cold.66 > /sys/kernel/debug/tracing/kprobe_events + # cat /sys/kernel/debug/kprobes/list + ffffffff81599de9 k device_add.cold.66+0x0 [DISABLED] + +Actually, kprobe blacklist already did similar thing, +see within_kprobe_blacklist(). + +Link: http://lkml.kernel.org/r/157233790394.6706.18243942030937189679.stgit@devnote2 + +Fixes: 45408c4f9250 ("tracing: kprobes: Prohibit probing on notrace function") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index f9a0cd094b81..c61b2b0a99e9 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -519,11 +519,10 @@ disable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file) + + #if defined(CONFIG_KPROBES_ON_FTRACE) && \ + !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE) +-static bool within_notrace_func(struct trace_kprobe *tk) ++static bool __within_notrace_func(unsigned long addr) + { +- unsigned long offset, size, addr; ++ unsigned long offset, size; + +- addr = trace_kprobe_address(tk); + if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset)) + return false; + +@@ -536,6 +535,28 @@ static bool within_notrace_func(struct trace_kprobe *tk) + */ + return !ftrace_location_range(addr, addr + size - 1); + } ++ ++static bool within_notrace_func(struct trace_kprobe *tk) ++{ ++ unsigned long addr = addr = trace_kprobe_address(tk); ++ char symname[KSYM_NAME_LEN], *p; ++ ++ if (!__within_notrace_func(addr)) ++ return false; ++ ++ /* Check if the address is on a suffixed-symbol */ ++ if (!lookup_symbol_name(addr, symname)) { ++ p = strchr(symname, '.'); ++ if (!p) ++ return true; ++ *p = '\0'; ++ addr = (unsigned long)kprobe_lookup_name(symname, 0); ++ if (addr) ++ return __within_notrace_func(addr); ++ } ++ ++ return true; ++} + #else + #define within_notrace_func(tk) (false) + #endif +-- +2.20.1 + diff --git a/queue-4.19/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch b/queue-4.19/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch new file mode 100644 index 00000000000..76f0bf30f27 --- /dev/null +++ b/queue-4.19/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch @@ -0,0 +1,59 @@ +From 1f3fe2177feb50923e132608eb8065376f854b5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 11:34:30 +0800 +Subject: tracing: use kvcalloc for tgid_map array allocation + +From: Yuming Han + +[ Upstream commit 6ee40511cb838f9ced002dff7131bca87e3ccbdd ] + +Fail to allocate memory for tgid_map, because it requires order-6 page. +detail as: + +c3 sh: page allocation failure: order:6, + mode:0x140c0c0(GFP_KERNEL), nodemask=(null) +c3 sh cpuset=/ mems_allowed=0 +c3 CPU: 3 PID: 5632 Comm: sh Tainted: G W O 4.14.133+ #10 +c3 Hardware name: Generic DT based system +c3 Backtrace: +c3 [] (dump_backtrace) from [](show_stack+0x18/0x1c) +c3 [] (show_stack) from [](dump_stack+0x84/0xa4) +c3 [] (dump_stack) from [](warn_alloc+0xc4/0x19c) +c3 [] (warn_alloc) from [](__alloc_pages_nodemask+0xd18/0xf28) +c3 [] (__alloc_pages_nodemask) from [](kmalloc_order+0x20/0x38) +c3 [] (kmalloc_order) from [](kmalloc_order_trace+0x24/0x108) +c3 [] (kmalloc_order_trace) from [](set_tracer_flag+0xb0/0x158) +c3 [] (set_tracer_flag) from [](trace_options_core_write+0x7c/0xcc) +c3 [] (trace_options_core_write) from [](__vfs_write+0x40/0x14c) +c3 [] (__vfs_write) from [](vfs_write+0xc4/0x198) +c3 [] (vfs_write) from [](SyS_write+0x6c/0xd0) +c3 [] (SyS_write) from [](ret_fast_syscall+0x0/0x54) + +Switch to use kvcalloc to avoid unexpected allocation failures. + +Link: http://lkml.kernel.org/r/1571888070-24425-1-git-send-email-chunyan.zhang@unisoc.com + +Signed-off-by: Yuming Han +Signed-off-by: Chunyan Zhang +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index bdd7f3d78724..b6ff2f84df17 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4389,7 +4389,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) + + if (mask == TRACE_ITER_RECORD_TGID) { + if (!tgid_map) +- tgid_map = kcalloc(PID_MAX_DEFAULT + 1, ++ tgid_map = kvcalloc(PID_MAX_DEFAULT + 1, + sizeof(*tgid_map), + GFP_KERNEL); + if (!tgid_map) { +-- +2.20.1 + diff --git a/queue-4.19/tun-fix-data-race-in-gro_normal_list.patch b/queue-4.19/tun-fix-data-race-in-gro_normal_list.patch new file mode 100644 index 00000000000..796bffd9ce3 --- /dev/null +++ b/queue-4.19/tun-fix-data-race-in-gro_normal_list.patch @@ -0,0 +1,92 @@ +From 6389b83dd960b74c60af7fc12e21c763f4a20341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 09:52:09 -0800 +Subject: tun: fix data-race in gro_normal_list() + +From: Petar Penkov + +[ Upstream commit c39e342a050a4425348e6fe7f75827c0a1a7ebc5 ] + +There is a race in the TUN driver between napi_busy_loop and +napi_gro_frags. This commit resolves the race by adding the NAPI struct +via netif_tx_napi_add, instead of netif_napi_add, which disables polling +for the NAPI struct. + +KCSAN reported: +BUG: KCSAN: data-race in gro_normal_list.part.0 / napi_busy_loop + +write to 0xffff8880b5d474b0 of 4 bytes by task 11205 on cpu 0: + gro_normal_list.part.0+0x77/0xb0 net/core/dev.c:5682 + gro_normal_list net/core/dev.c:5678 [inline] + gro_normal_one net/core/dev.c:5692 [inline] + napi_frags_finish net/core/dev.c:5705 [inline] + napi_gro_frags+0x625/0x770 net/core/dev.c:5778 + tun_get_user+0x2150/0x26a0 drivers/net/tun.c:1976 + tun_chr_write_iter+0x79/0xd0 drivers/net/tun.c:2022 + call_write_iter include/linux/fs.h:1895 [inline] + do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693 + do_iter_write fs/read_write.c:970 [inline] + do_iter_write+0x13b/0x3c0 fs/read_write.c:951 + vfs_writev+0x118/0x1c0 fs/read_write.c:1015 + do_writev+0xe3/0x250 fs/read_write.c:1058 + __do_sys_writev fs/read_write.c:1131 [inline] + __se_sys_writev fs/read_write.c:1128 [inline] + __x64_sys_writev+0x4e/0x60 fs/read_write.c:1128 + do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +read to 0xffff8880b5d474b0 of 4 bytes by task 11168 on cpu 1: + gro_normal_list net/core/dev.c:5678 [inline] + napi_busy_loop+0xda/0x4f0 net/core/dev.c:6126 + sk_busy_loop include/net/busy_poll.h:108 [inline] + __skb_recv_udp+0x4ad/0x560 net/ipv4/udp.c:1689 + udpv6_recvmsg+0x29e/0xe90 net/ipv6/udp.c:288 + inet6_recvmsg+0xbb/0x240 net/ipv6/af_inet6.c:592 + sock_recvmsg_nosec net/socket.c:871 [inline] + sock_recvmsg net/socket.c:889 [inline] + sock_recvmsg+0x92/0xb0 net/socket.c:885 + sock_read_iter+0x15f/0x1e0 net/socket.c:967 + call_read_iter include/linux/fs.h:1889 [inline] + new_sync_read+0x389/0x4f0 fs/read_write.c:414 + __vfs_read+0xb1/0xc0 fs/read_write.c:427 + vfs_read fs/read_write.c:461 [inline] + vfs_read+0x143/0x2c0 fs/read_write.c:446 + ksys_read+0xd5/0x1b0 fs/read_write.c:587 + __do_sys_read fs/read_write.c:597 [inline] + __se_sys_read fs/read_write.c:595 [inline] + __x64_sys_read+0x4c/0x60 fs/read_write.c:595 + do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 11168 Comm: syz-executor.0 Not tainted 5.4.0-rc6+ #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") +Signed-off-by: Petar Penkov +Reported-by: syzbot +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/tun.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index e1ac1c57089f..bbd92221c6ca 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -319,8 +319,8 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile, + tfile->napi_enabled = napi_en; + tfile->napi_frags_enabled = napi_en && napi_frags; + if (napi_en) { +- netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll, +- NAPI_POLL_WEIGHT); ++ netif_tx_napi_add(tun->dev, &tfile->napi, tun_napi_poll, ++ NAPI_POLL_WEIGHT); + napi_enable(&tfile->napi); + } + } +-- +2.20.1 + diff --git a/queue-4.19/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch b/queue-4.19/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch new file mode 100644 index 00000000000..85a93ad2cf8 --- /dev/null +++ b/queue-4.19/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch @@ -0,0 +1,89 @@ +From 7cc8749e275f6f5e54239e5a05998cb61793fbe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2019 15:15:56 +0200 +Subject: usb: renesas_usbhs: add suspend event support in gadget mode + +From: Veeraiyan Chidambaram + +[ Upstream commit 39abcc84846bbc0538f13c190b6a9c7e36890cd2 ] + +When R-Car Gen3 USB 2.0 is in Gadget mode, if host is detached an interrupt +will be generated and Suspended state bit is set in interrupt status +register. Interrupt handler will call driver->suspend(composite_suspend) +if suspended state bit is set. composite_suspend will call +ffs_func_suspend which will post FUNCTIONFS_SUSPEND and will be consumed +by user space application via /dev/ep0. + +To be able to detect host detach, extend the DVSQ_MASK to cover the +Suspended bit of the DVSQ[2:0] bitfield from the Interrupt Status +Register 0 (INTSTS0) register and perform appropriate action in the +DVST interrupt handler (usbhsg_irq_dev_state). + +Without this commit, disconnection of the phone from R-Car-H3 ES2.0 +Salvator-X CN9 port is not recognized and reverse role switch does +not happen. If phone is connected again it does not enumerate. + +With this commit, disconnection will be recognized and reverse role +switch will happen by a user space application. If phone is connected +again it will enumerate properly and will become visible in the output +of 'lsusb'. + +Signed-off-by: Veeraiyan Chidambaram +Signed-off-by: Eugeniu Rosca +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1568207756-22325-3-git-send-email-external.veeraiyan.c@de.adit-jv.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/renesas_usbhs/common.h | 3 ++- + drivers/usb/renesas_usbhs/mod_gadget.c | 12 +++++++++--- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h +index c47b721b8bca..63a75fd9fa0c 100644 +--- a/drivers/usb/renesas_usbhs/common.h ++++ b/drivers/usb/renesas_usbhs/common.h +@@ -157,11 +157,12 @@ struct usbhs_priv; + #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ + #define VALID (1 << 3) /* USB Request Receive */ + +-#define DVSQ_MASK (0x3 << 4) /* Device State */ ++#define DVSQ_MASK (0x7 << 4) /* Device State */ + #define POWER_STATE (0 << 4) + #define DEFAULT_STATE (1 << 4) + #define ADDRESS_STATE (2 << 4) + #define CONFIGURATION_STATE (3 << 4) ++#define SUSPENDED_STATE (4 << 4) + + #define CTSQ_MASK (0x7) /* Control Transfer Stage */ + #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 7feac4128a2d..f36248e9387d 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -456,12 +456,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, + { + struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); + struct device *dev = usbhsg_gpriv_to_dev(gpriv); ++ int state = usbhs_status_get_device_state(irq_state); + + gpriv->gadget.speed = usbhs_bus_get_speed(priv); + +- dev_dbg(dev, "state = %x : speed : %d\n", +- usbhs_status_get_device_state(irq_state), +- gpriv->gadget.speed); ++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); ++ ++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && ++ (state & SUSPENDED_STATE)) { ++ if (gpriv->driver && gpriv->driver->suspend) ++ gpriv->driver->suspend(&gpriv->gadget); ++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); ++ } + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch b/queue-4.19/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch new file mode 100644 index 00000000000..c8477300c4e --- /dev/null +++ b/queue-4.19/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch @@ -0,0 +1,82 @@ +From 113ed6d4419896f1b129199af2b583790ab0a82e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 13:55:18 +0200 +Subject: usb: usbfs: Suppress problematic bind and unbind uevents. + +From: Ingo Rohloff + +[ Upstream commit abb0b3d96a1f9407dd66831ae33985a386d4200d ] + +commit 1455cf8dbfd0 ("driver core: emit uevents when device is bound +to a driver") added bind and unbind uevents when a driver is bound or +unbound to a physical device. + +For USB devices which are handled via the generic usbfs layer (via +libusb for example), this is problematic: +Each time a user space program calls + ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); +and then later + ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); +The kernel will now produce a bind or unbind event, which does not +really contain any useful information. + +This allows a user space program to run a DoS attack against programs +which listen to uevents (in particular systemd/eudev/upowerd): +A malicious user space program just has to call in a tight loop + + ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); + ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); + +With this loop the malicious user space program floods the kernel and +all programs listening to uevents with tons of bind and unbind +events. + +This patch suppresses uevents for ioctls USBDEVFS_CLAIMINTERFACE and +USBDEVFS_RELEASEINTERFACE. + +Signed-off-by: Ingo Rohloff +Link: https://lore.kernel.org/r/20191011115518.2801-1-ingo.rohloff@lauterbach.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/devio.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 29c6414f48f1..00204824bffd 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -739,8 +739,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) + intf = usb_ifnum_to_if(dev, ifnum); + if (!intf) + err = -ENOENT; +- else ++ else { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while claiming interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + err = usb_driver_claim_interface(&usbfs_driver, intf, ps); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); ++ } + if (err == 0) + set_bit(ifnum, &ps->ifclaimed); + return err; +@@ -760,7 +767,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) + if (!intf) + err = -ENOENT; + else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while releasing interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + usb_driver_release_interface(&usbfs_driver, intf); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); + err = 0; + } + return err; +-- +2.20.1 + diff --git a/queue-4.19/x86-crash-add-a-forward-declaration-of-struct-kimage.patch b/queue-4.19/x86-crash-add-a-forward-declaration-of-struct-kimage.patch new file mode 100644 index 00000000000..16d98ac020d --- /dev/null +++ b/queue-4.19/x86-crash-add-a-forward-declaration-of-struct-kimage.patch @@ -0,0 +1,72 @@ +From 2ac1df3fd3544a91ac3a0499f1766dc69d58e037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 17:00:27 +0800 +Subject: x86/crash: Add a forward declaration of struct kimage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lianbo Jiang + +[ Upstream commit 112eee5d06007dae561f14458bde7f2a4879ef4e ] + +Add a forward declaration of struct kimage to the crash.h header because +future changes will invoke a crash-specific function from the realmode +init path and the compiler will complain otherwise like this: + + In file included from arch/x86/realmode/init.c:11: + ./arch/x86/include/asm/crash.h:5:32: warning: ‘struct kimage’ declared inside\ + parameter list will not be visible outside of this definition or declaration + 5 | int crash_load_segments(struct kimage *image); + | ^~~~~~ + ./arch/x86/include/asm/crash.h:6:37: warning: ‘struct kimage’ declared inside\ + parameter list will not be visible outside of this definition or declaration + 6 | int crash_copy_backup_region(struct kimage *image); + | ^~~~~~ + ./arch/x86/include/asm/crash.h:7:39: warning: ‘struct kimage’ declared inside\ + parameter list will not be visible outside of this definition or declaration + 7 | int crash_setup_memmap_entries(struct kimage *image, + | + + [ bp: Rewrite the commit message. ] + +Reported-by: kbuild test robot +Signed-off-by: Lianbo Jiang +Signed-off-by: Borislav Petkov +Cc: bhe@redhat.com +Cc: d.hatayama@fujitsu.com +Cc: dhowells@redhat.com +Cc: dyoung@redhat.com +Cc: ebiederm@xmission.com +Cc: horms@verge.net.au +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jürgen Gross +Cc: kexec@lists.infradead.org +Cc: Thomas Gleixner +Cc: Tom Lendacky +Cc: vgoyal@redhat.com +Cc: x86-ml +Link: https://lkml.kernel.org/r/20191108090027.11082-4-lijiang@redhat.com +Link: https://lkml.kernel.org/r/201910310233.EJRtTMWP%25lkp@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/crash.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h +index a7adb2bfbf0b..6b8ad6fa3979 100644 +--- a/arch/x86/include/asm/crash.h ++++ b/arch/x86/include/asm/crash.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_CRASH_H + #define _ASM_X86_CRASH_H + ++struct kimage; ++ + int crash_load_segments(struct kimage *image); + int crash_copy_backup_region(struct kimage *image); + int crash_setup_memmap_entries(struct kimage *image, +-- +2.20.1 + diff --git a/queue-4.19/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch b/queue-4.19/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch new file mode 100644 index 00000000000..3e135515c45 --- /dev/null +++ b/queue-4.19/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch @@ -0,0 +1,258 @@ +From 895d065e3f0bc2a23437e213415cf8c16d2dec19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 15:54:47 +0200 +Subject: x86/insn: Add some Intel instructions to the opcode map + +From: Adrian Hunter + +[ Upstream commit b980be189c9badba50634671e2303e92bf28e35a ] + +Add to the opcode map the following instructions: + cldemote + tpause + umonitor + umwait + movdiri + movdir64b + enqcmd + enqcmds + encls + enclu + enclv + pconfig + wbnoinvd + +For information about the instructions, refer Intel SDM May 2019 +(325462-070US) and Intel Architecture Instruction Set Extensions +May 2019 (319433-037). + +The instruction decoding can be tested using the perf tools' +"x86 instruction decoder - new instructions" test as folllows: + + $ perf test -v "new " 2>&1 | grep -i cldemote + Decoded ok: 0f 1c 00 cldemote (%eax) + Decoded ok: 0f 1c 05 78 56 34 12 cldemote 0x12345678 + Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%eax,%ecx,8) + Decoded ok: 0f 1c 00 cldemote (%rax) + Decoded ok: 41 0f 1c 00 cldemote (%r8) + Decoded ok: 0f 1c 04 25 78 56 34 12 cldemote 0x12345678 + Decoded ok: 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%rax,%rcx,8) + Decoded ok: 41 0f 1c 84 c8 78 56 34 12 cldemote 0x12345678(%r8,%rcx,8) + $ perf test -v "new " 2>&1 | grep -i tpause + Decoded ok: 66 0f ae f3 tpause %ebx + Decoded ok: 66 0f ae f3 tpause %ebx + Decoded ok: 66 41 0f ae f0 tpause %r8d + $ perf test -v "new " 2>&1 | grep -i umonitor + Decoded ok: 67 f3 0f ae f0 umonitor %ax + Decoded ok: f3 0f ae f0 umonitor %eax + Decoded ok: 67 f3 0f ae f0 umonitor %eax + Decoded ok: f3 0f ae f0 umonitor %rax + Decoded ok: 67 f3 41 0f ae f0 umonitor %r8d + $ perf test -v "new " 2>&1 | grep -i umwait + Decoded ok: f2 0f ae f0 umwait %eax + Decoded ok: f2 0f ae f0 umwait %eax + Decoded ok: f2 41 0f ae f0 umwait %r8d + $ perf test -v "new " 2>&1 | grep -i movdiri + Decoded ok: 0f 38 f9 03 movdiri %eax,(%ebx) + Decoded ok: 0f 38 f9 88 78 56 34 12 movdiri %ecx,0x12345678(%eax) + Decoded ok: 48 0f 38 f9 03 movdiri %rax,(%rbx) + Decoded ok: 48 0f 38 f9 88 78 56 34 12 movdiri %rcx,0x12345678(%rax) + $ perf test -v "new " 2>&1 | grep -i movdir64b + Decoded ok: 66 0f 38 f8 18 movdir64b (%eax),%ebx + Decoded ok: 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%eax),%ecx + Decoded ok: 67 66 0f 38 f8 1c movdir64b (%si),%bx + Decoded ok: 67 66 0f 38 f8 8c 34 12 movdir64b 0x1234(%si),%cx + Decoded ok: 66 0f 38 f8 18 movdir64b (%rax),%rbx + Decoded ok: 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%rax),%rcx + Decoded ok: 67 66 0f 38 f8 18 movdir64b (%eax),%ebx + Decoded ok: 67 66 0f 38 f8 88 78 56 34 12 movdir64b 0x12345678(%eax),%ecx + $ perf test -v "new " 2>&1 | grep -i enqcmd + Decoded ok: f2 0f 38 f8 18 enqcmd (%eax),%ebx + Decoded ok: f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%eax),%ecx + Decoded ok: 67 f2 0f 38 f8 1c enqcmd (%si),%bx + Decoded ok: 67 f2 0f 38 f8 8c 34 12 enqcmd 0x1234(%si),%cx + Decoded ok: f3 0f 38 f8 18 enqcmds (%eax),%ebx + Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx + Decoded ok: 67 f3 0f 38 f8 1c enqcmds (%si),%bx + Decoded ok: 67 f3 0f 38 f8 8c 34 12 enqcmds 0x1234(%si),%cx + Decoded ok: f2 0f 38 f8 18 enqcmd (%rax),%rbx + Decoded ok: f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%rax),%rcx + Decoded ok: 67 f2 0f 38 f8 18 enqcmd (%eax),%ebx + Decoded ok: 67 f2 0f 38 f8 88 78 56 34 12 enqcmd 0x12345678(%eax),%ecx + Decoded ok: f3 0f 38 f8 18 enqcmds (%rax),%rbx + Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%rax),%rcx + Decoded ok: 67 f3 0f 38 f8 18 enqcmds (%eax),%ebx + Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx + $ perf test -v "new " 2>&1 | grep -i enqcmds + Decoded ok: f3 0f 38 f8 18 enqcmds (%eax),%ebx + Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx + Decoded ok: 67 f3 0f 38 f8 1c enqcmds (%si),%bx + Decoded ok: 67 f3 0f 38 f8 8c 34 12 enqcmds 0x1234(%si),%cx + Decoded ok: f3 0f 38 f8 18 enqcmds (%rax),%rbx + Decoded ok: f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%rax),%rcx + Decoded ok: 67 f3 0f 38 f8 18 enqcmds (%eax),%ebx + Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12 enqcmds 0x12345678(%eax),%ecx + $ perf test -v "new " 2>&1 | grep -i encls + Decoded ok: 0f 01 cf encls + Decoded ok: 0f 01 cf encls + $ perf test -v "new " 2>&1 | grep -i enclu + Decoded ok: 0f 01 d7 enclu + Decoded ok: 0f 01 d7 enclu + $ perf test -v "new " 2>&1 | grep -i enclv + Decoded ok: 0f 01 c0 enclv + Decoded ok: 0f 01 c0 enclv + $ perf test -v "new " 2>&1 | grep -i pconfig + Decoded ok: 0f 01 c5 pconfig + Decoded ok: 0f 01 c5 pconfig + $ perf test -v "new " 2>&1 | grep -i wbnoinvd + Decoded ok: f3 0f 09 wbnoinvd + Decoded ok: f3 0f 09 wbnoinvd + +Signed-off-by: Adrian Hunter +Reviewed-by: Andi Kleen +Acked-by: Masami Hiramatsu +Cc: Borislav Petkov +Cc: H. Peter Anvin +Cc: Jiri Olsa +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: x86@kernel.org +Link: http://lore.kernel.org/lkml/20191115135447.6519-3-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + arch/x86/lib/x86-opcode-map.txt | 18 ++++++++++++------ + tools/objtool/arch/x86/lib/x86-opcode-map.txt | 18 ++++++++++++------ + 2 files changed, 24 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +-- +2.20.1 + diff --git a/queue-4.19/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch b/queue-4.19/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch new file mode 100644 index 00000000000..068149f8d09 --- /dev/null +++ b/queue-4.19/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch @@ -0,0 +1,81 @@ +From 2a6fcb9a91ca819e4d1aeb3835efeda9a11ee088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 12:19:01 +0200 +Subject: x86/ioapic: Prevent inconsistent state when moving an interrupt + +From: Thomas Gleixner + +[ Upstream commit df4393424af3fbdcd5c404077176082a8ce459c4 ] + +There is an issue with threaded interrupts which are marked ONESHOT +and using the fasteoi handler: + + if (IS_ONESHOT()) + mask_irq(); + .... + cond_unmask_eoi_irq() + chip->irq_eoi(); + if (setaffinity_pending) { + mask_ioapic(); + ... + move_affinity(); + unmask_ioapic(); + } + +So if setaffinity is pending the interrupt will be moved and then +unconditionally unmasked at the ioapic level, which is wrong in two +aspects: + + 1) It should be kept masked up to the point where the threaded handler + finished. + + 2) The physical chip state and the software masked state are inconsistent + +Guard both the mask and the unmask with a check for the software masked +state. If the line is marked masked then the ioapic line is also masked, so +both mask_ioapic() and unmask_ioapic() can be skipped safely. + +Signed-off-by: Thomas Gleixner +Cc: Andy Shevchenko +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Sebastian Siewior +Fixes: 3aa551c9b4c4 ("genirq: add threaded interrupt handler support") +Link: https://lkml.kernel.org/r/20191017101938.321393687@linutronix.de +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index ab22eded61d2..fa3b85b222e3 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1724,9 +1724,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) + + static inline bool ioapic_irqd_mask(struct irq_data *data) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic_irq(data); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic_irq(data); + return true; + } + return false; +@@ -1763,7 +1764,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) + */ + if (!io_apic_level_ack_pending(data->chip_data)) + irq_move_masked_irq(data); +- unmask_ioapic_irq(data); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic_irq(data); + } + } + #else +-- +2.20.1 + diff --git a/queue-4.19/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch b/queue-4.19/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch new file mode 100644 index 00000000000..031c20a6885 --- /dev/null +++ b/queue-4.19/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch @@ -0,0 +1,67 @@ +From 39589c6cd2d68aeb076a2bfff1d2e5c2c6f923de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 17:54:24 +0200 +Subject: x86/mce: Lower throttling MCE messages' priority to warning + +From: Benjamin Berg + +[ Upstream commit 9c3bafaa1fd88e4dd2dba3735a1f1abb0f2c7bb7 ] + +On modern CPUs it is quite normal that the temperature limits are +reached and the CPU is throttled. In fact, often the thermal design is +not sufficient to cool the CPU at full load and limits can quickly be +reached when a burst in load happens. This will even happen with +technologies like RAPL limitting the long term power consumption of +the package. + +Also, these limits are "softer", as Srinivas explains: + +"CPU temperature doesn't have to hit max(TjMax) to get these warnings. +OEMs ha[ve] an ability to program a threshold where a thermal interrupt +can be generated. In some systems the offset is 20C+ (Read only value). + +In recent systems, there is another offset on top of it which can be +programmed by OS, once some agent can adjust power limits dynamically. +By default this is set to low by the firmware, which I guess the +prime motivation of Benjamin to submit the patch." + +So these messages do not usually indicate a hardware issue (e.g. +insufficient cooling). Log them as warnings to avoid confusion about +their severity. + + [ bp: Massage commit mesage. ] + +Signed-off-by: Benjamin Berg +Signed-off-by: Borislav Petkov +Reviewed-by: Hans de Goede +Tested-by: Christian Kellner +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: linux-edac +Cc: Peter Zijlstra +Cc: Srinivas Pandruvada +Cc: Thomas Gleixner +Cc: Tony Luck +Cc: x86-ml +Link: https://lkml.kernel.org/r/20191009155424.249277-1-bberg@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c +index ee229ceee745..ec6a07b04fdb 100644 +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -185,7 +185,7 @@ static void therm_throt_process(bool new_event, int event, int level) + /* if we just entered the thermal event */ + if (new_event) { + if (event == THERMAL_THROTTLING_EVENT) +- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", ++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", + this_cpu, + level == CORE_LEVEL ? "Core" : "Package", + state->count); +-- +2.20.1 + diff --git a/queue-4.19/x86-mm-use-the-correct-function-type-for-native_set_.patch b/queue-4.19/x86-mm-use-the-correct-function-type-for-native_set_.patch new file mode 100644 index 00000000000..46fad098f54 --- /dev/null +++ b/queue-4.19/x86-mm-use-the-correct-function-type-for-native_set_.patch @@ -0,0 +1,65 @@ +From 1d9b35ea41a32e34d02c2fb73b0e4d4a4aae4403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2019 14:14:02 -0700 +Subject: x86/mm: Use the correct function type for native_set_fixmap() + +From: Sami Tolvanen + +[ Upstream commit f53e2cd0b8ab7d9e390414470bdbd830f660133f ] + +We call native_set_fixmap indirectly through the function pointer +struct pv_mmu_ops::set_fixmap, which expects the first parameter to be +'unsigned' instead of 'enum fixed_addresses'. This patch changes the +function type for native_set_fixmap to match the pointer, which fixes +indirect call mismatches with Control-Flow Integrity (CFI) checking. + +Signed-off-by: Sami Tolvanen +Reviewed-by: Kees Cook +Cc: Andy Lutomirski +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: H . Peter Anvin +Cc: H. Peter Anvin +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Rik van Riel +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/20190913211402.193018-1-samitolvanen@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/fixmap.h | 2 +- + arch/x86/mm/pgtable.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 6390bd8c141b..5e12b2319d7a 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -159,7 +159,7 @@ extern pte_t *kmap_pte; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 59274e2c1ac4..bf52106ab9c4 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -660,8 +660,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + fixmaps_set++; + } + +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +- pgprot_t flags) ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, ++ phys_addr_t phys, pgprot_t flags) + { + /* Sanitize 'prot' against any unsupported bits: */ + pgprot_val(flags) &= __default_kernel_pte_mask; +-- +2.20.1 + diff --git a/queue-4.19/xen-gntdev-use-select-for-dma_shared_buffer.patch b/queue-4.19/xen-gntdev-use-select-for-dma_shared_buffer.patch new file mode 100644 index 00000000000..26f0c2227bf --- /dev/null +++ b/queue-4.19/xen-gntdev-use-select-for-dma_shared_buffer.patch @@ -0,0 +1,48 @@ +From 788cea4411ca77d0b6b2d92690fc2c87edade65a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 17:10:25 -0300 +Subject: xen/gntdev: Use select for DMA_SHARED_BUFFER + +From: Jason Gunthorpe + +[ Upstream commit fa6614d8ef13c63aac52ad7c07c5e69ce4aba3dd ] + +DMA_SHARED_BUFFER can not be enabled by the user (it represents a library +set in the kernel). The kconfig convention is to use select for such +symbols so they are turned on implicitly when the user enables a kconfig +that needs them. + +Otherwise the XEN_GNTDEV_DMABUF kconfig is overly difficult to enable. + +Fixes: 932d6562179e ("xen/gntdev: Add initial support for dma-buf UAPI") +Cc: Oleksandr Andrushchenko +Cc: Boris Ostrovsky +Cc: xen-devel@lists.xenproject.org +Cc: Juergen Gross +Cc: Stefano Stabellini +Reviewed-by: Juergen Gross +Reviewed-by: Oleksandr Andrushchenko +Signed-off-by: Jason Gunthorpe +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig +index 90d387b50ab7..0505eeb593b5 100644 +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -158,7 +158,8 @@ config XEN_GNTDEV + + config XEN_GNTDEV_DMABUF + bool "Add support for dma-buf grant access device driver extension" +- depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC && DMA_SHARED_BUFFER ++ depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC ++ select DMA_SHARED_BUFFER + help + Allows userspace processes and kernel modules to use Xen backed + dma-buf implementation. With this extension grant references to +-- +2.20.1 +