From: Greg Kroah-Hartman Date: Sun, 15 Dec 2019 13:53:35 +0000 (+0100) Subject: 5.3-stable patches X-Git-Tag: v5.4.4~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=55bba6fff1aa34d3b2847a7fc206f2c2454dbcc8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.3-stable patches added patches: acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch acpi-osl-only-free-map-once-in-osl.c.patch acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch ar5523-check-null-before-memcpy-in-ar5523_cmd.patch arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch asoc-rt5645-fixed-buddy-jack-support.patch asoc-rt5645-fixed-typo-for-buddy-jack-support.patch blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch cgroup-pids-use-atomic64_t-for-pids-limit.patch coresight-serialize-enabling-disabling-a-link-device.patch cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch cpuidle-teo-rename-local-variable-in-teo_select.patch erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch intel_th-fix-a-double-put_device-in-error-path.patch intel_th-pci-add-ice-lake-cpu-support.patch intel_th-pci-add-tiger-lake-cpu-support.patch md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch media-bdisp-fix-memleak-on-release.patch media-cec.h-cec_op_rec_flag_-values-were-swapped.patch media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch media-radio-wl1273-fix-interrupt-masking-on-release.patch mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch perf-tests-fix-out-of-bounds-memory-access.patch pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch pinctrl-rza2-fix-gpio-name-typos.patch pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch pm-devfreq-lock-devfreq-in-trans_stat_show.patch powerpc-perf-disable-trace_imc-pmu.patch ppdev-fix-ppgettime-ppsettime-ioctls.patch rdma-core-fix-ib_dma_max_seg_size.patch s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch wil6210-check-len-before-memcpy-calls.patch --- diff --git a/queue-5.3/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch b/queue-5.3/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch new file mode 100644 index 00000000000..ddd7c0aafa8 --- /dev/null +++ b/queue-5.3/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch @@ -0,0 +1,59 @@ +From 627ead724eff33673597216f5020b72118827de4 Mon Sep 17 00:00:00 2001 +From: Vamshi K Sthambamkadi +Date: Thu, 28 Nov 2019 15:58:29 +0530 +Subject: ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() + +From: Vamshi K Sthambamkadi + +commit 627ead724eff33673597216f5020b72118827de4 upstream. + +kmemleak reported backtrace: + [] kmem_cache_alloc_trace+0x128/0x260 + [<6677f215>] i2c_acpi_install_space_handler+0x4b/0xe0 + [<1180f4fc>] i2c_register_adapter+0x186/0x400 + [<6083baf7>] i2c_add_adapter+0x4e/0x70 + [] intel_gmbus_setup+0x1a2/0x2c0 [i915] + [<84cb69ae>] i915_driver_probe+0x8d8/0x13a0 [i915] + [<81911d4b>] i915_pci_probe+0x48/0x160 [i915] + [<4b159af1>] pci_device_probe+0xdc/0x160 + [] really_probe+0x1ee/0x450 + [] driver_probe_device+0x142/0x1b0 + [] device_driver_attach+0x49/0x50 + [] __driver_attach+0xc9/0x150 + [] bus_for_each_dev+0x56/0xa0 + [<80089bba>] driver_attach+0x19/0x20 + [] bus_add_driver+0x177/0x220 + [<7b29d8c7>] driver_register+0x56/0xf0 + +In i2c_acpi_remove_space_handler(), a leak occurs whenever the +"data" parameter is initialized to 0 before being passed to +acpi_bus_get_private_data(). + +This is because the NULL pointer check in acpi_bus_get_private_data() +(condition->if(!*data)) returns EINVAL and, in consequence, memory is +never freed in i2c_acpi_remove_space_handler(). + +Fix the NULL pointer check in acpi_bus_get_private_data() to follow +the analogous check in acpi_get_data_full(). + +Signed-off-by: Vamshi K Sthambamkadi +[ rjw: Subject & changelog ] +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -153,7 +153,7 @@ int acpi_bus_get_private_data(acpi_handl + { + acpi_status status; + +- if (!*data) ++ if (!data) + return -EINVAL; + + status = acpi_get_data(handle, acpi_bus_private_data_handler, data); diff --git a/queue-5.3/acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch b/queue-5.3/acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch new file mode 100644 index 00000000000..06756ebe22b --- /dev/null +++ b/queue-5.3/acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch @@ -0,0 +1,110 @@ +From 77adf9355304f8dcf09054280af5e23fc451ab3d Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 30 Oct 2019 18:05:45 +0300 +Subject: ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge + +From: Mika Westerberg + +commit 77adf9355304f8dcf09054280af5e23fc451ab3d upstream. + +Valerio and others reported that commit 84c8b58ed3ad ("ACPI / hotplug / +PCI: Don't scan bridges managed by native hotplug") prevents some recent +LG and HP laptops from booting with endless loop of: + + ACPI Error: No handler or method for GPE 08, disabling event (20190215/evgpe-835) + ACPI Error: No handler or method for GPE 09, disabling event (20190215/evgpe-835) + ACPI Error: No handler or method for GPE 0A, disabling event (20190215/evgpe-835) + ... + +What seems to happen is that during boot, after the initial PCI enumeration +when EC is enabled the platform triggers ACPI Notify() to one of the root +ports. The root port itself looks like this: + + pci 0000:00:1b.0: PCI bridge to [bus 02-3a] + pci 0000:00:1b.0: bridge window [mem 0xc4000000-0xda0fffff] + pci 0000:00:1b.0: bridge window [mem 0x80000000-0xa1ffffff 64bit pref] + +The BIOS has configured the root port so that it does not have I/O bridge +window. + +Now when the ACPI Notify() is triggered ACPI hotplug handler calls +acpiphp_native_scan_bridge() for each non-hotplug bridge (as this system is +using native PCIe hotplug) and pci_assign_unassigned_bridge_resources() to +allocate resources. + +The device connected to the root port is a PCIe switch (Thunderbolt +controller) with two hotplug downstream ports. Because of the hotplug ports +__pci_bus_size_bridges() tries to add "additional I/O" of 256 bytes to each +(DEFAULT_HOTPLUG_IO_SIZE). This gets further aligned to 4k as that's the +minimum I/O window size so each hotplug port gets 4k I/O window and the +same happens for the root port (which is also hotplug port). This means +3 * 4k = 12k I/O window. + +Because of this pci_assign_unassigned_bridge_resources() ends up opening a +I/O bridge window for the root port at first available I/O address which +seems to be in range 0x1000 - 0x3fff. Normally this range is used for ACPI +stuff such as GPE bits (below is part of /proc/ioports): + + 1800-1803 : ACPI PM1a_EVT_BLK + 1804-1805 : ACPI PM1a_CNT_BLK + 1808-180b : ACPI PM_TMR + 1810-1815 : ACPI CPU throttle + 1850-1850 : ACPI PM2_CNT_BLK + 1854-1857 : pnp 00:05 + 1860-187f : ACPI GPE0_BLK + +However, when the ACPI Notify() happened this range was not yet reserved +for ACPI/PNP (that happens later) so PCI gets it. It then starts writing to +this range and accidentally stomps over GPE bits among other things causing +the endless stream of messages about missing GPE handler. + +This problem does not happen if "pci=hpiosize=0" is passed in the kernel +command line. The reason is that then the kernel does not try to allocate +the additional 256 bytes for each hotplug port. + +Fix this by allocating resources directly below the non-hotplug bridges +where a new device may appear as a result of ACPI Notify(). This avoids the +hotplug bridges and prevents opening the additional I/O window. + +Fixes: 84c8b58ed3ad ("ACPI / hotplug / PCI: Don't scan bridges managed by native hotplug") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=203617 +Link: https://lore.kernel.org/r/20191030150545.19885-1-mika.westerberg@linux.intel.com +Reported-by: Valerio Passini +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/hotplug/acpiphp_glue.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -449,8 +449,15 @@ static void acpiphp_native_scan_bridge(s + + /* Scan non-hotplug bridges that need to be reconfigured */ + for_each_pci_bridge(dev, bus) { +- if (!hotplug_is_native(dev)) +- max = pci_scan_bridge(bus, dev, max, 1); ++ if (hotplug_is_native(dev)) ++ continue; ++ ++ max = pci_scan_bridge(bus, dev, max, 1); ++ if (dev->subordinate) { ++ pcibios_resource_survey_bus(dev->subordinate); ++ pci_bus_size_bridges(dev->subordinate); ++ pci_bus_assign_resources(dev->subordinate); ++ } + } + } + +@@ -480,7 +487,6 @@ static void enable_slot(struct acpiphp_s + if (PCI_SLOT(dev->devfn) == slot->device) + acpiphp_native_scan_bridge(dev); + } +- pci_assign_unassigned_bridge_resources(bus->self); + } else { + LIST_HEAD(add_list); + int max, pass; diff --git a/queue-5.3/acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch b/queue-5.3/acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch new file mode 100644 index 00000000000..024906cd37c --- /dev/null +++ b/queue-5.3/acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch @@ -0,0 +1,93 @@ +From 6025e2fae3dde3c3d789d08f8ceacbdd9f90d471 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 24 Oct 2019 23:57:23 +0200 +Subject: ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links + +From: Hans de Goede + +commit 6025e2fae3dde3c3d789d08f8ceacbdd9f90d471 upstream. + +The iGPU / GFX0 device's _PS0 method on the ASUS T200TA depends on the +I2C1 controller (which is connected to the embedded controller). But unlike +in the T100TA/T100CHI this dependency is not listed in the _DEP of the GFX0 +device. + +This results in the dev_WARN_ONCE(..., "Transfer while suspended\n") call +in i2c-designware-master.c triggering and the AML code not working as it +should. + +This commit fixes this by adding a dmi based quirk mechanism for devices +which miss a _DEP, and adding a quirk for the LNXVIDEO depending on the +I2C1 device on the Asus T200TA. + +Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller") +Tested-by: Pierre-Louis Bossart +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -463,6 +464,18 @@ struct lpss_device_links { + const char *consumer_hid; + const char *consumer_uid; + u32 flags; ++ const struct dmi_system_id *dep_missing_ids; ++}; ++ ++/* Please keep this list sorted alphabetically by vendor and model */ ++static const struct dmi_system_id i2c1_dep_missing_dmi_ids[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "T200TA"), ++ }, ++ }, ++ {} + }; + + /* +@@ -478,7 +491,8 @@ static const struct lpss_device_links lp + /* CHT iGPU depends on PMIC I2C controller */ + {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT iGPU depends on the Embedded Controller I2C controller (UID 1) */ +- {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME, ++ i2c1_dep_missing_dmi_ids}, + /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ + {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ +@@ -577,7 +591,8 @@ static void acpi_lpss_link_consumer(stru + if (!dev2) + return; + +- if (acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1))) ++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids)) ++ || acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1))) + device_link_add(dev2, dev1, link->flags); + + put_device(dev2); +@@ -592,7 +607,8 @@ static void acpi_lpss_link_supplier(stru + if (!dev2) + return; + +- if (acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2))) ++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids)) ++ || acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2))) + device_link_add(dev1, dev2, link->flags); + + put_device(dev2); diff --git a/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch b/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch new file mode 100644 index 00000000000..533c97c8880 --- /dev/null +++ b/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch @@ -0,0 +1,37 @@ +From b3b3519c04bdff91651d0a6deb79dbd4516b5d7b Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 24 Oct 2019 23:57:22 +0200 +Subject: ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links + +From: Hans de Goede + +commit b3b3519c04bdff91651d0a6deb79dbd4516b5d7b upstream. + +Various Asus Bay Trail devices (T100TA, T100CHI, T200TA) have an embedded +controller connected to I2C1 and the iGPU (LNXVIDEO) _PS0/_PS3 methods +access it, so we need to add a consumer link from LNXVIDEO to I2C1 on +these devices to avoid suspend/resume ordering problems. + +Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller") +Tested-by: Pierre-Louis Bossart +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -477,6 +477,8 @@ static const struct lpss_device_links lp + {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME}, + /* CHT iGPU depends on PMIC I2C controller */ + {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ /* BYT iGPU depends on the Embedded Controller I2C controller (UID 1) */ ++ {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ + {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ diff --git a/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch b/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch new file mode 100644 index 00000000000..d1f8e2fd258 --- /dev/null +++ b/queue-5.3/acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch @@ -0,0 +1,47 @@ +From cc18735f208565343a9824adeca5305026598550 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 24 Oct 2019 23:57:21 +0200 +Subject: ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links + +From: Hans de Goede + +commit cc18735f208565343a9824adeca5305026598550 upstream. + +So far on Bay Trail (BYT) we only have been adding a device_link adding +the iGPU (LNXVIDEO) device as consumer for the I2C controller for the +PMIC for I2C5, but the PMIC only uses I2C5 on BYT CR (cost reduced) on +regular BYT platforms I2C7 is used and we were not adding the device_link +sometimes causing resume ordering issues. + +This commit adds LNXVIDEO -> BYT I2C7 to the lpss_device_links table, +fixing this. + +Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller") +Tested-by: Pierre-Louis Bossart +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_lpss.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -473,9 +473,14 @@ struct lpss_device_links { + * the supplier is not enumerated until after the consumer is probed. + */ + static const struct lpss_device_links lpss_device_links[] = { ++ /* CHT External sdcard slot controller depends on PMIC I2C ctrl */ + {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME}, ++ /* CHT iGPU depends on PMIC I2C controller */ + {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ + {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, ++ /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ ++ {"80860F41", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + }; + + static bool hid_uid_match(struct acpi_device *adev, diff --git a/queue-5.3/acpi-osl-only-free-map-once-in-osl.c.patch b/queue-5.3/acpi-osl-only-free-map-once-in-osl.c.patch new file mode 100644 index 00000000000..258ff92f5bd --- /dev/null +++ b/queue-5.3/acpi-osl-only-free-map-once-in-osl.c.patch @@ -0,0 +1,111 @@ +From 833a426cc471b6088011b3d67f1dc4e147614647 Mon Sep 17 00:00:00 2001 +From: Francesco Ruggeri +Date: Tue, 19 Nov 2019 21:47:27 -0800 +Subject: ACPI: OSL: only free map once in osl.c + +From: Francesco Ruggeri + +commit 833a426cc471b6088011b3d67f1dc4e147614647 upstream. + +acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock +before freeing the map. This creates a race condition the can result +in the map being freed more than once. +A panic can be caused by running + +for ((i=0; i<10; i++)) +do + for ((j=0; j<100000; j++)) + do + cat /sys/firmware/acpi/tables/data/BERT >/dev/null + done & +done + +This patch makes sure that only the process that drops the reference +to 0 does the freeing. + +Fixes: b7c1fadd6c2e ("ACPI: Do not use krefs under a mutex in osl.c") +Signed-off-by: Francesco Ruggeri +Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/osl.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -360,19 +360,21 @@ void *__ref acpi_os_map_memory(acpi_phys + } + EXPORT_SYMBOL_GPL(acpi_os_map_memory); + +-static void acpi_os_drop_map_ref(struct acpi_ioremap *map) ++/* Must be called with mutex_lock(&acpi_ioremap_lock) */ ++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) + { +- if (!--map->refcount) ++ unsigned long refcount = --map->refcount; ++ ++ if (!refcount) + list_del_rcu(&map->list); ++ return refcount; + } + + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { +- if (!map->refcount) { +- synchronize_rcu_expedited(); +- acpi_unmap(map->phys, map->virt); +- kfree(map); +- } ++ synchronize_rcu_expedited(); ++ acpi_unmap(map->phys, map->virt); ++ kfree(map); + } + + /** +@@ -392,6 +394,7 @@ static void acpi_os_map_cleanup(struct a + void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + { + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (!acpi_permanent_mmap) { + __acpi_unmap_table(virt, size); +@@ -405,10 +408,11 @@ void __ref acpi_os_unmap_iomem(void __io + WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); + +@@ -443,6 +447,7 @@ void acpi_os_unmap_generic_address(struc + { + u64 addr; + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) + return; +@@ -458,10 +463,11 @@ void acpi_os_unmap_generic_address(struc + mutex_unlock(&acpi_ioremap_lock); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL(acpi_os_unmap_generic_address); + diff --git a/queue-5.3/acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch b/queue-5.3/acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch new file mode 100644 index 00000000000..6b725c4d002 --- /dev/null +++ b/queue-5.3/acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch @@ -0,0 +1,53 @@ +From b9ea0bae260f6aae546db224daa6ac1bd9d94b91 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 4 Dec 2019 02:54:27 +0100 +Subject: ACPI: PM: Avoid attaching ACPI PM domain to certain devices + +From: Rafael J. Wysocki + +commit b9ea0bae260f6aae546db224daa6ac1bd9d94b91 upstream. + +Certain ACPI-enumerated devices represented as platform devices in +Linux, like fans, require special low-level power management handling +implemented by their drivers that is not in agreement with the ACPI +PM domain behavior. That leads to problems with managing ACPI fans +during system-wide suspend and resume. + +For this reason, make acpi_dev_pm_attach() skip the affected devices +by adding a list of device IDs to avoid to it and putting the IDs of +the affected devices into that list. + +Fixes: e5cc8ef31267 (ACPI / PM: Provide ACPI PM callback routines for subsystems) +Reported-by: Zhang Rui +Tested-by: Todd Brandt +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -1309,9 +1309,19 @@ static void acpi_dev_pm_detach(struct de + */ + int acpi_dev_pm_attach(struct device *dev, bool power_on) + { ++ /* ++ * Skip devices whose ACPI companions match the device IDs below, ++ * because they require special power management handling incompatible ++ * with the generic ACPI PM domain. ++ */ ++ static const struct acpi_device_id special_pm_ids[] = { ++ {"PNP0C0B", }, /* Generic ACPI fan */ ++ {"INT3404", }, /* Fan */ ++ {} ++ }; + struct acpi_device *adev = ACPI_COMPANION(dev); + +- if (!adev) ++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids)) + return 0; + + /* diff --git a/queue-5.3/acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch b/queue-5.3/acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch new file mode 100644 index 00000000000..f0a352a81dd --- /dev/null +++ b/queue-5.3/acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch @@ -0,0 +1,51 @@ +From a814dcc269830c9dbb8a83731cfc6fc5dd787f8d Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 1 Oct 2019 17:27:21 +0300 +Subject: ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI + +From: Andy Shevchenko + +commit a814dcc269830c9dbb8a83731cfc6fc5dd787f8d upstream. + +We have a stub defined for the acpi_dev_get_first_match_dev() in acpi.h +for the case when CONFIG_ACPI=n. + +Moreover, acpi_dev_put(), counterpart function, is already placed under +CONFIG_ACPI. + +Thus, move acpi_dev_get_first_match_dev() under CONFIG_ACPI as well. + +Fixes: 817b4d64da03 ("ACPI / utils: Introduce acpi_dev_get_first_match_dev() helper") +Reported-by: kbuild test robot +Signed-off-by: Andy Shevchenko +Reviewed-by: Mika Westerberg +Cc: 5.2+ # 5.2+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + include/acpi/acpi_bus.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -78,9 +78,6 @@ acpi_evaluate_dsm_typed(acpi_handle hand + bool acpi_dev_found(const char *hid); + bool acpi_dev_present(const char *hid, const char *uid, s64 hrv); + +-struct acpi_device * +-acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); +- + #ifdef CONFIG_ACPI + + #include +@@ -683,6 +680,9 @@ static inline bool acpi_device_can_power + adev->power.states[ACPI_STATE_D3_HOT].flags.explicit_set); + } + ++struct acpi_device * ++acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); ++ + static inline void acpi_dev_put(struct acpi_device *adev) + { + put_device(&adev->dev); diff --git a/queue-5.3/alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch b/queue-5.3/alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch new file mode 100644 index 00000000000..e6b0ddb665d --- /dev/null +++ b/queue-5.3/alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch @@ -0,0 +1,34 @@ +From 480136343cbe89426d6c2ab74ffb4e3ee572c7ee Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Tue, 10 Dec 2019 00:05:41 +0900 +Subject: ALSA: fireface: fix return value in error path of isochronous resources reservation + +From: Takashi Sakamoto + +commit 480136343cbe89426d6c2ab74ffb4e3ee572c7ee upstream. + +Even if isochronous resources reservation fails, error code doesn't return +in pcm.hw_params callback. + +Cc: #5.3+ +Fixes: 55162d2bb0e8 ("ALSA: fireface: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/fireface/ff-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/fireface/ff-pcm.c ++++ b/sound/firewire/fireface/ff-pcm.c +@@ -219,7 +219,7 @@ static int pcm_hw_params(struct snd_pcm_ + mutex_unlock(&ff->mutex); + } + +- return 0; ++ return err; + } + + static int pcm_hw_free(struct snd_pcm_substream *substream) diff --git a/queue-5.3/alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch b/queue-5.3/alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch new file mode 100644 index 00000000000..ab2f075613c --- /dev/null +++ b/queue-5.3/alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch @@ -0,0 +1,34 @@ +From 59a126aa3113fc23f03fedcafe3705f1de5aff50 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Tue, 10 Dec 2019 00:03:04 +0900 +Subject: ALSA: oxfw: fix return value in error path of isochronous resources reservation + +From: Takashi Sakamoto + +commit 59a126aa3113fc23f03fedcafe3705f1de5aff50 upstream. + +Even if isochronous resources reservation fails, error code doesn't return +in pcm.hw_params callback. + +Cc: #5.3+ +Fixes: 4f380d007052 ("ALSA: oxfw: configure packet format in pcm.hw_params callback") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/oxfw/oxfw-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/oxfw/oxfw-pcm.c ++++ b/sound/firewire/oxfw/oxfw-pcm.c +@@ -255,7 +255,7 @@ static int pcm_playback_hw_params(struct + mutex_unlock(&oxfw->mutex); + } + +- return 0; ++ return err; + } + + static int pcm_capture_hw_free(struct snd_pcm_substream *substream) diff --git a/queue-5.3/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch b/queue-5.3/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch new file mode 100644 index 00000000000..f6bdacaf136 --- /dev/null +++ b/queue-5.3/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch @@ -0,0 +1,40 @@ +From 315cee426f87658a6799815845788fde965ddaad Mon Sep 17 00:00:00 2001 +From: Denis Efremov +Date: Mon, 30 Sep 2019 23:31:47 +0300 +Subject: ar5523: check NULL before memcpy() in ar5523_cmd() + +From: Denis Efremov + +commit 315cee426f87658a6799815845788fde965ddaad upstream. + +memcpy() call with "idata == NULL && ilen == 0" results in undefined +behavior in ar5523_cmd(). For example, NULL is passed in callchain +"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch +adds ilen check before memcpy() call in ar5523_cmd() to prevent an +undefined behavior. + +Cc: Pontus Fuchs +Cc: Kalle Valo +Cc: "David S. Miller" +Cc: David Laight +Cc: stable@vger.kernel.org +Signed-off-by: Denis Efremov +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, + + if (flags & AR5523_CMD_FLAG_MAGIC) + hdr->magic = cpu_to_be32(1 << 24); +- memcpy(hdr + 1, idata, ilen); ++ if (ilen) ++ memcpy(hdr + 1, idata, ilen); + + cmd->odata = odata; + cmd->olen = olen; diff --git a/queue-5.3/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch b/queue-5.3/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch new file mode 100644 index 00000000000..2360c6cac19 --- /dev/null +++ b/queue-5.3/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch @@ -0,0 +1,45 @@ +From 287897f9aaa2ad1c923d9875914f57c4dc9159c8 Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Sat, 16 Nov 2019 17:16:51 +0200 +Subject: ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity + +From: Jarkko Nikula + +commit 287897f9aaa2ad1c923d9875914f57c4dc9159c8 upstream. + +The MMC card detection GPIO polarity is active low on TAO3530, like in many +other similar boards. Now the card is not detected and it is unable to +mount rootfs from an SD card. + +Fix this by using the correct polarity. + +This incorrect polarity was defined already in the commit 30d95c6d7092 +("ARM: dts: omap3: Add Technexion TAO3530 SOM omap3-tao3530.dtsi") in v3.18 +kernel and later changed to use defined GPIO constants in v4.4 kernel by +the commit 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags +cell for OMAP2+ boards"). + +While the latter commit did not introduce the issue I'm marking it with +Fixes tag due the v4.4 kernels still being maintained. + +Fixes: 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards") +Cc: linux-stable # 4.4+ +Signed-off-by: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/omap3-tao3530.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap3-tao3530.dtsi ++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi +@@ -222,7 +222,7 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + vqmmc-supply = <&vsim>; +- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; + bus-width = <8>; + }; + diff --git a/queue-5.3/asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch b/queue-5.3/asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch new file mode 100644 index 00000000000..b0a280a11c5 --- /dev/null +++ b/queue-5.3/asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch @@ -0,0 +1,75 @@ +From fe965096c9495ddcf78ec163348105e2baf8d185 Mon Sep 17 00:00:00 2001 +From: Shengjiu Wang +Date: Mon, 11 Nov 2019 15:50:48 +0800 +Subject: ASoC: fsl_audmix: Add spin lock to protect tdms + +From: Shengjiu Wang + +commit fe965096c9495ddcf78ec163348105e2baf8d185 upstream. + +Audmix support two substream, When two substream start +to run, the trigger function may be called by two substream +in same time, that the priv->tdms may be updated wrongly. + +The expected priv->tdms is 0x3, but sometimes the +result is 0x2, or 0x1. + +Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver") +Signed-off-by: Shengjiu Wang +Acked-by: Nicolin Chen +Reviewed-by: Daniel Baluta +Link: https://lore.kernel.org/r/1e706afe53fdd1fbbbc79277c48a98f8416ba873.1573458378.git.shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/fsl_audmix.c | 6 ++++++ + sound/soc/fsl/fsl_audmix.h | 1 + + 2 files changed, 7 insertions(+) + +--- a/sound/soc/fsl/fsl_audmix.c ++++ b/sound/soc/fsl/fsl_audmix.c +@@ -286,6 +286,7 @@ static int fsl_audmix_dai_trigger(struct + struct snd_soc_dai *dai) + { + struct fsl_audmix *priv = snd_soc_dai_get_drvdata(dai); ++ unsigned long lock_flags; + + /* Capture stream shall not be handled */ + if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) +@@ -295,12 +296,16 @@ static int fsl_audmix_dai_trigger(struct + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ spin_lock_irqsave(&priv->lock, lock_flags); + priv->tdms |= BIT(dai->driver->id); ++ spin_unlock_irqrestore(&priv->lock, lock_flags); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: ++ spin_lock_irqsave(&priv->lock, lock_flags); + priv->tdms &= ~BIT(dai->driver->id); ++ spin_unlock_irqrestore(&priv->lock, lock_flags); + break; + default: + return -EINVAL; +@@ -493,6 +498,7 @@ static int fsl_audmix_probe(struct platf + return PTR_ERR(priv->ipg_clk); + } + ++ spin_lock_init(&priv->lock); + platform_set_drvdata(pdev, priv); + pm_runtime_enable(dev); + +--- a/sound/soc/fsl/fsl_audmix.h ++++ b/sound/soc/fsl/fsl_audmix.h +@@ -96,6 +96,7 @@ struct fsl_audmix { + struct platform_device *pdev; + struct regmap *regmap; + struct clk *ipg_clk; ++ spinlock_t lock; /* Protect tdms */ + u8 tdms; + }; + diff --git a/queue-5.3/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch b/queue-5.3/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch new file mode 100644 index 00000000000..c79f6e873ac --- /dev/null +++ b/queue-5.3/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch @@ -0,0 +1,37 @@ +From 8f157d4ff039e03e2ed4cb602eeed2fd4687a58f Mon Sep 17 00:00:00 2001 +From: Pawel Harlozinski +Date: Tue, 12 Nov 2019 14:02:36 +0100 +Subject: ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report + +From: Pawel Harlozinski + +commit 8f157d4ff039e03e2ed4cb602eeed2fd4687a58f upstream. + +Check for existance of jack before tracing. +NULL pointer dereference has been reported by KASAN while unloading +machine driver (snd_soc_cnl_rt274). + +Signed-off-by: Pawel Harlozinski +Link: https://lore.kernel.org/r/20191112130237.10141-1-pawel.harlozinski@linux.intel.com +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-jack.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/soc-jack.c ++++ b/sound/soc/soc-jack.c +@@ -100,10 +100,9 @@ void snd_soc_jack_report(struct snd_soc_ + unsigned int sync = 0; + int enable; + +- trace_snd_soc_jack_report(jack, mask, status); +- + if (!jack) + return; ++ trace_snd_soc_jack_report(jack, mask, status); + + dapm = &jack->card->dapm; + diff --git a/queue-5.3/asoc-rt5645-fixed-buddy-jack-support.patch b/queue-5.3/asoc-rt5645-fixed-buddy-jack-support.patch new file mode 100644 index 00000000000..b402fa2f739 --- /dev/null +++ b/queue-5.3/asoc-rt5645-fixed-buddy-jack-support.patch @@ -0,0 +1,58 @@ +From e7cfd867fd9842f346688f28412eb83dec342900 Mon Sep 17 00:00:00 2001 +From: Jacob Rasmussen +Date: Mon, 11 Nov 2019 11:59:57 -0700 +Subject: ASoC: rt5645: Fixed buddy jack support. + +From: Jacob Rasmussen + +commit e7cfd867fd9842f346688f28412eb83dec342900 upstream. + +The headphone jack on buddy was broken with the following commit: +commit 6b5da66322c5 ("ASoC: rt5645: read jd1_1 status for jd +detection"). +This changes the jd_mode for buddy to 4 so buddy can read from the same +register that was used in the working version of this driver without +affecting any other devices that might use this, since no other device uses +jd_mode = 4. To test this I plugged and uplugged the headphone jack, verifying +audio works. + +Signed-off-by: Jacob Rasmussen +Reviewed-by: Ross Zwisler +Link: https://lore.kernel.org/r/20191111185957.217244-1-jacobraz@google.com +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5645.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(stru + snd_soc_jack_report(rt5645->mic_jack, + report, SND_JACK_MICROPHONE); + return; ++ case 4: ++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002; ++ break; + default: /* read rt5645 jd1_1 status */ + val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; + break; +@@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data + static const struct rt5645_platform_data buddy_platform_data = { + .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5, + .dmic2_data_pin = RT5645_DMIC_DATA_IN2P, +- .jd_mode = 3, ++ .jd_mode = 4, + .level_trigger_irq = true, + }; + +@@ -3999,6 +4002,7 @@ static int rt5645_i2c_probe(struct i2c_c + RT5645_JD1_MODE_1); + break; + case 3: ++ case 4: + regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1, + RT5645_JD1_MODE_MASK, + RT5645_JD1_MODE_2); diff --git a/queue-5.3/asoc-rt5645-fixed-typo-for-buddy-jack-support.patch b/queue-5.3/asoc-rt5645-fixed-typo-for-buddy-jack-support.patch new file mode 100644 index 00000000000..6d34e00a363 --- /dev/null +++ b/queue-5.3/asoc-rt5645-fixed-typo-for-buddy-jack-support.patch @@ -0,0 +1,36 @@ +From fe23be2d85b05f561431d75acddec726ea807d2a Mon Sep 17 00:00:00 2001 +From: Jacob Rasmussen +Date: Thu, 14 Nov 2019 16:20:11 -0700 +Subject: ASoC: rt5645: Fixed typo for buddy jack support. + +From: Jacob Rasmussen + +commit fe23be2d85b05f561431d75acddec726ea807d2a upstream. + +Had a typo in e7cfd867fd98 that resulted in buddy jack support not being +fixed. + +Fixes: e7cfd867fd98 ("ASoC: rt5645: Fixed buddy jack support.") +Signed-off-by: Jacob Rasmussen +Reviewed-by: Ross Zwisler +Cc: +CC: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20191114232011.165762-1-jacobraz@google.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5645.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3271,7 +3271,7 @@ static void rt5645_jack_detect_work(stru + report, SND_JACK_MICROPHONE); + return; + case 4: +- val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002; ++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; + break; + default: /* read rt5645 jd1_1 status */ + val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; diff --git a/queue-5.3/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch b/queue-5.3/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch new file mode 100644 index 00000000000..727c92c0a60 --- /dev/null +++ b/queue-5.3/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch @@ -0,0 +1,61 @@ +From 8962842ca5abdcf98e22ab3b2b45a103f0408b95 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Sat, 2 Nov 2019 16:02:15 +0800 +Subject: blk-mq: avoid sysfs buffer overflow with too many CPU cores + +From: Ming Lei + +commit 8962842ca5abdcf98e22ab3b2b45a103f0408b95 upstream. + +It is reported that sysfs buffer overflow can be triggered if the system +has too many CPU cores(>841 on 4K PAGE_SIZE) when showing CPUs of +hctx via /sys/block/$DEV/mq/$N/cpu_list. + +Use snprintf to avoid the potential buffer overflow. + +This version doesn't change the attribute format, and simply stops +showing CPU numbers if the buffer is going to overflow. + +Cc: stable@vger.kernel.org +Fixes: 676141e48af7("blk-mq: don't dump CPU -> hw queue map on driver load") +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq-sysfs.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -166,20 +166,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserv + + static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) + { ++ const size_t size = PAGE_SIZE - 1; + unsigned int i, first = 1; +- ssize_t ret = 0; ++ int ret = 0, pos = 0; + + for_each_cpu(i, hctx->cpumask) { + if (first) +- ret += sprintf(ret + page, "%u", i); ++ ret = snprintf(pos + page, size - pos, "%u", i); + else +- ret += sprintf(ret + page, ", %u", i); ++ ret = snprintf(pos + page, size - pos, ", %u", i); ++ ++ if (ret >= size - pos) ++ break; + + first = 0; ++ pos += ret; + } + +- ret += sprintf(ret + page, "\n"); +- return ret; ++ ret = snprintf(pos + page, size - pos, "\n"); ++ return pos + ret; + } + + static struct blk_mq_hw_ctx_sysfs_entry blk_mq_hw_sysfs_nr_tags = { diff --git a/queue-5.3/cgroup-pids-use-atomic64_t-for-pids-limit.patch b/queue-5.3/cgroup-pids-use-atomic64_t-for-pids-limit.patch new file mode 100644 index 00000000000..da985d9fa62 --- /dev/null +++ b/queue-5.3/cgroup-pids-use-atomic64_t-for-pids-limit.patch @@ -0,0 +1,78 @@ +From a713af394cf382a30dd28a1015cbe572f1b9ca75 Mon Sep 17 00:00:00 2001 +From: Aleksa Sarai +Date: Thu, 17 Oct 2019 02:50:01 +1100 +Subject: cgroup: pids: use atomic64_t for pids->limit + +From: Aleksa Sarai + +commit a713af394cf382a30dd28a1015cbe572f1b9ca75 upstream. + +Because pids->limit can be changed concurrently (but we don't want to +take a lock because it would be needlessly expensive), use atomic64_ts +instead. + +Fixes: commit 49b786ea146f ("cgroup: implement the PIDs subsystem") +Cc: stable@vger.kernel.org # v4.3+ +Signed-off-by: Aleksa Sarai +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup/pids.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/kernel/cgroup/pids.c ++++ b/kernel/cgroup/pids.c +@@ -45,7 +45,7 @@ struct pids_cgroup { + * %PIDS_MAX = (%PID_MAX_LIMIT + 1). + */ + atomic64_t counter; +- int64_t limit; ++ atomic64_t limit; + + /* Handle for "pids.events" */ + struct cgroup_file events_file; +@@ -73,8 +73,8 @@ pids_css_alloc(struct cgroup_subsys_stat + if (!pids) + return ERR_PTR(-ENOMEM); + +- pids->limit = PIDS_MAX; + atomic64_set(&pids->counter, 0); ++ atomic64_set(&pids->limit, PIDS_MAX); + atomic64_set(&pids->events_limit, 0); + return &pids->css; + } +@@ -146,13 +146,14 @@ static int pids_try_charge(struct pids_c + + for (p = pids; parent_pids(p); p = parent_pids(p)) { + int64_t new = atomic64_add_return(num, &p->counter); ++ int64_t limit = atomic64_read(&p->limit); + + /* + * Since new is capped to the maximum number of pid_t, if + * p->limit is %PIDS_MAX then we know that this test will never + * fail. + */ +- if (new > p->limit) ++ if (new > limit) + goto revert; + } + +@@ -277,7 +278,7 @@ set_limit: + * Limit updates don't need to be mutex'd, since it isn't + * critical that any racing fork()s follow the new limit. + */ +- pids->limit = limit; ++ atomic64_set(&pids->limit, limit); + return nbytes; + } + +@@ -285,7 +286,7 @@ static int pids_max_show(struct seq_file + { + struct cgroup_subsys_state *css = seq_css(sf); + struct pids_cgroup *pids = css_pids(css); +- int64_t limit = pids->limit; ++ int64_t limit = atomic64_read(&pids->limit); + + if (limit >= PIDS_MAX) + seq_printf(sf, "%s\n", PIDS_MAX_STR); diff --git a/queue-5.3/coresight-serialize-enabling-disabling-a-link-device.patch b/queue-5.3/coresight-serialize-enabling-disabling-a-link-device.patch new file mode 100644 index 00000000000..26e857da7a7 --- /dev/null +++ b/queue-5.3/coresight-serialize-enabling-disabling-a-link-device.patch @@ -0,0 +1,323 @@ +From edda32dabedb01f98b9d7b9a4492c13357834bbe Mon Sep 17 00:00:00 2001 +From: Yabin Cui +Date: Mon, 4 Nov 2019 11:12:50 -0700 +Subject: coresight: Serialize enabling/disabling a link device. + +From: Yabin Cui + +commit edda32dabedb01f98b9d7b9a4492c13357834bbe upstream. + +When tracing etm data of multiple threads on multiple cpus through perf +interface, some link devices are shared between paths of different cpus. +It creates race conditions when different cpus wants to enable/disable +the same link device at the same time. + +Example 1: +Two cpus want to enable different ports of a coresight funnel, thus +calling the funnel enable operation at the same time. But the funnel +enable operation isn't reentrantable. + +Example 2: +For an enabled coresight dynamic replicator with refcnt=1, one cpu wants +to disable it, while another cpu wants to enable it. Ideally we still have +an enabled replicator with refcnt=1 at the end. But in reality the result +is uncertain. + +Since coresight devices claim themselves when enabled for self-hosted +usage, the race conditions above usually make the link devices not usable +after many cycles. + +To fix the race conditions, this patch uses spinlocks to serialize +enabling/disabling link devices. + +Fixes: a06ae8609b3d ("coresight: add CoreSight core layer framework") +Signed-off-by: Yabin Cui +Signed-off-by: Mathieu Poirier +Cc: stable # 5.3 +Link: https://lore.kernel.org/r/20191104181251.26732-14-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight-funnel.c | 32 +++++++++++--- + drivers/hwtracing/coresight/coresight-replicator.c | 33 ++++++++++++-- + drivers/hwtracing/coresight/coresight-tmc-etf.c | 26 ++++++++--- + drivers/hwtracing/coresight/coresight.c | 47 ++++++--------------- + 4 files changed, 88 insertions(+), 50 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -37,12 +37,14 @@ DEFINE_CORESIGHT_DEVLIST(funnel_devs, "f + * @atclk: optional clock for the core parts of the funnel. + * @csdev: component vitals needed by the framework. + * @priority: port selection order. ++ * @spinlock: serialize enable/disable operations. + */ + struct funnel_drvdata { + void __iomem *base; + struct clk *atclk; + struct coresight_device *csdev; + unsigned long priority; ++ spinlock_t spinlock; + }; + + static int dynamic_funnel_enable_hw(struct funnel_drvdata *drvdata, int port) +@@ -75,11 +77,21 @@ static int funnel_enable(struct coresigh + { + int rc = 0; + struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool first_enable = false; + +- if (drvdata->base) +- rc = dynamic_funnel_enable_hw(drvdata, inport); +- ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_read(&csdev->refcnt[inport]) == 0) { ++ if (drvdata->base) ++ rc = dynamic_funnel_enable_hw(drvdata, inport); ++ if (!rc) ++ first_enable = true; ++ } + if (!rc) ++ atomic_inc(&csdev->refcnt[inport]); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ ++ if (first_enable) + dev_dbg(&csdev->dev, "FUNNEL inport %d enabled\n", inport); + return rc; + } +@@ -106,11 +118,19 @@ static void funnel_disable(struct coresi + int outport) + { + struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool last_disable = false; + +- if (drvdata->base) +- dynamic_funnel_disable_hw(drvdata, inport); ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_dec_return(&csdev->refcnt[inport]) == 0) { ++ if (drvdata->base) ++ dynamic_funnel_disable_hw(drvdata, inport); ++ last_disable = true; ++ } ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport); ++ if (last_disable) ++ dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport); + } + + static const struct coresight_ops_link funnel_link_ops = { +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -31,11 +31,13 @@ DEFINE_CORESIGHT_DEVLIST(replicator_devs + * whether this one is programmable or not. + * @atclk: optional clock for the core parts of the replicator. + * @csdev: component vitals needed by the framework ++ * @spinlock: serialize enable/disable operations. + */ + struct replicator_drvdata { + void __iomem *base; + struct clk *atclk; + struct coresight_device *csdev; ++ spinlock_t spinlock; + }; + + static void dynamic_replicator_reset(struct replicator_drvdata *drvdata) +@@ -97,10 +99,22 @@ static int replicator_enable(struct core + { + int rc = 0; + struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool first_enable = false; + +- if (drvdata->base) +- rc = dynamic_replicator_enable(drvdata, inport, outport); ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_read(&csdev->refcnt[outport]) == 0) { ++ if (drvdata->base) ++ rc = dynamic_replicator_enable(drvdata, inport, ++ outport); ++ if (!rc) ++ first_enable = true; ++ } + if (!rc) ++ atomic_inc(&csdev->refcnt[outport]); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ ++ if (first_enable) + dev_dbg(&csdev->dev, "REPLICATOR enabled\n"); + return rc; + } +@@ -137,10 +151,19 @@ static void replicator_disable(struct co + int outport) + { + struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ unsigned long flags; ++ bool last_disable = false; + +- if (drvdata->base) +- dynamic_replicator_disable(drvdata, inport, outport); +- dev_dbg(&csdev->dev, "REPLICATOR disabled\n"); ++ spin_lock_irqsave(&drvdata->spinlock, flags); ++ if (atomic_dec_return(&csdev->refcnt[outport]) == 0) { ++ if (drvdata->base) ++ dynamic_replicator_disable(drvdata, inport, outport); ++ last_disable = true; ++ } ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ ++ if (last_disable) ++ dev_dbg(&csdev->dev, "REPLICATOR disabled\n"); + } + + static const struct coresight_ops_link replicator_link_ops = { +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -334,9 +334,10 @@ static int tmc_disable_etf_sink(struct c + static int tmc_enable_etf_link(struct coresight_device *csdev, + int inport, int outport) + { +- int ret; ++ int ret = 0; + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ bool first_enable = false; + + spin_lock_irqsave(&drvdata->spinlock, flags); + if (drvdata->reading) { +@@ -344,12 +345,18 @@ static int tmc_enable_etf_link(struct co + return -EBUSY; + } + +- ret = tmc_etf_enable_hw(drvdata); ++ if (atomic_read(&csdev->refcnt[0]) == 0) { ++ ret = tmc_etf_enable_hw(drvdata); ++ if (!ret) { ++ drvdata->mode = CS_MODE_SYSFS; ++ first_enable = true; ++ } ++ } + if (!ret) +- drvdata->mode = CS_MODE_SYSFS; ++ atomic_inc(&csdev->refcnt[0]); + spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- if (!ret) ++ if (first_enable) + dev_dbg(&csdev->dev, "TMC-ETF enabled\n"); + return ret; + } +@@ -359,6 +366,7 @@ static void tmc_disable_etf_link(struct + { + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); ++ bool last_disable = false; + + spin_lock_irqsave(&drvdata->spinlock, flags); + if (drvdata->reading) { +@@ -366,11 +374,15 @@ static void tmc_disable_etf_link(struct + return; + } + +- tmc_etf_disable_hw(drvdata); +- drvdata->mode = CS_MODE_DISABLED; ++ if (atomic_dec_return(&csdev->refcnt[0]) == 0) { ++ tmc_etf_disable_hw(drvdata); ++ drvdata->mode = CS_MODE_DISABLED; ++ last_disable = true; ++ } + spin_unlock_irqrestore(&drvdata->spinlock, flags); + +- dev_dbg(&csdev->dev, "TMC-ETF disabled\n"); ++ if (last_disable) ++ dev_dbg(&csdev->dev, "TMC-ETF disabled\n"); + } + + static void *tmc_alloc_etf_buffer(struct coresight_device *csdev, +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -253,9 +253,9 @@ static int coresight_enable_link(struct + struct coresight_device *parent, + struct coresight_device *child) + { +- int ret; ++ int ret = 0; + int link_subtype; +- int refport, inport, outport; ++ int inport, outport; + + if (!parent || !child) + return -EINVAL; +@@ -264,29 +264,17 @@ static int coresight_enable_link(struct + outport = coresight_find_link_outport(csdev, child); + link_subtype = csdev->subtype.link_subtype; + +- if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) +- refport = inport; +- else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT) +- refport = outport; +- else +- refport = 0; +- +- if (refport < 0) +- return refport; +- +- if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { +- if (link_ops(csdev)->enable) { +- ret = link_ops(csdev)->enable(csdev, inport, outport); +- if (ret) { +- atomic_dec(&csdev->refcnt[refport]); +- return ret; +- } +- } +- } +- +- csdev->enable = true; ++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG && inport < 0) ++ return inport; ++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT && outport < 0) ++ return outport; ++ ++ if (link_ops(csdev)->enable) ++ ret = link_ops(csdev)->enable(csdev, inport, outport); ++ if (!ret) ++ csdev->enable = true; + +- return 0; ++ return ret; + } + + static void coresight_disable_link(struct coresight_device *csdev, +@@ -295,7 +283,7 @@ static void coresight_disable_link(struc + { + int i, nr_conns; + int link_subtype; +- int refport, inport, outport; ++ int inport, outport; + + if (!parent || !child) + return; +@@ -305,20 +293,15 @@ static void coresight_disable_link(struc + link_subtype = csdev->subtype.link_subtype; + + if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) { +- refport = inport; + nr_conns = csdev->pdata->nr_inport; + } else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT) { +- refport = outport; + nr_conns = csdev->pdata->nr_outport; + } else { +- refport = 0; + nr_conns = 1; + } + +- if (atomic_dec_return(&csdev->refcnt[refport]) == 0) { +- if (link_ops(csdev)->disable) +- link_ops(csdev)->disable(csdev, inport, outport); +- } ++ if (link_ops(csdev)->disable) ++ link_ops(csdev)->disable(csdev, inport, outport); + + for (i = 0; i < nr_conns; i++) + if (atomic_read(&csdev->refcnt[i]) != 0) diff --git a/queue-5.3/cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch b/queue-5.3/cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch new file mode 100644 index 00000000000..a8a12488815 --- /dev/null +++ b/queue-5.3/cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch @@ -0,0 +1,81 @@ +From db0d32d84031188443e25edbd50a71a6e7ac5d1d Mon Sep 17 00:00:00 2001 +From: John Hubbard +Date: Wed, 30 Oct 2019 22:21:59 -0700 +Subject: cpufreq: powernv: fix stack bloat and hard limit on number of CPUs + +From: John Hubbard + +commit db0d32d84031188443e25edbd50a71a6e7ac5d1d upstream. + +The following build warning occurred on powerpc 64-bit builds: + +drivers/cpufreq/powernv-cpufreq.c: In function 'init_chip_info': +drivers/cpufreq/powernv-cpufreq.c:1070:1: warning: the frame size of +1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] + +This is with a cross-compiler based on gcc 8.1.0, which I got from: + https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.1.0/ + +The warning is due to putting 1024 bytes on the stack: + + unsigned int chip[256]; + +...and it's also undesirable to have a hard limit on the number of +CPUs here. + +Fix both problems by dynamically allocating based on num_possible_cpus, +as recommended by Michael Ellerman. + +Fixes: 053819e0bf840 ("cpufreq: powernv: Handle throttling due to Pmax capping at chip level") +Signed-off-by: John Hubbard +Acked-by: Viresh Kumar +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/powernv-cpufreq.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -1041,9 +1041,14 @@ static struct cpufreq_driver powernv_cpu + + static int init_chip_info(void) + { +- unsigned int chip[256]; ++ unsigned int *chip; + unsigned int cpu, i; + unsigned int prev_chip_id = UINT_MAX; ++ int ret = 0; ++ ++ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL); ++ if (!chip) ++ return -ENOMEM; + + for_each_possible_cpu(cpu) { + unsigned int id = cpu_to_chip_id(cpu); +@@ -1055,8 +1060,10 @@ static int init_chip_info(void) + } + + chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL); +- if (!chips) +- return -ENOMEM; ++ if (!chips) { ++ ret = -ENOMEM; ++ goto free_and_return; ++ } + + for (i = 0; i < nr_chips; i++) { + chips[i].id = chip[i]; +@@ -1066,7 +1073,9 @@ static int init_chip_info(void) + per_cpu(chip_info, cpu) = &chips[i]; + } + +- return 0; ++free_and_return: ++ kfree(chip); ++ return ret; + } + + static inline void clean_chip_info(void) diff --git a/queue-5.3/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch b/queue-5.3/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch new file mode 100644 index 00000000000..0dd587edfc7 --- /dev/null +++ b/queue-5.3/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch @@ -0,0 +1,58 @@ +From 918c1fe9fbbe46fcf56837ff21f0ef96424e8b29 Mon Sep 17 00:00:00 2001 +From: Zhenzhong Duan +Date: Wed, 23 Oct 2019 09:57:14 +0800 +Subject: cpuidle: Do not unset the driver if it is there already + +From: Zhenzhong Duan + +commit 918c1fe9fbbe46fcf56837ff21f0ef96424e8b29 upstream. + +Fix __cpuidle_set_driver() to check if any of the CPUs in the mask has +a driver different from drv already and, if so, return -EBUSY before +updating any cpuidle_drivers per-CPU pointers. + +Fixes: 82467a5a885d ("cpuidle: simplify multiple driver support") +Cc: 3.11+ # 3.11+ +Signed-off-by: Zhenzhong Duan +[ rjw: Subject & changelog ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/driver.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_drive + * __cpuidle_set_driver - set per CPU driver variables for the given driver. + * @drv: a valid pointer to a struct cpuidle_driver + * +- * For each CPU in the driver's cpumask, unset the registered driver per CPU +- * to @drv. +- * +- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. ++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver ++ * different from drv already. + */ + static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) + { + int cpu; + + for_each_cpu(cpu, drv->cpumask) { ++ struct cpuidle_driver *old_drv; + +- if (__cpuidle_get_cpu_driver(cpu)) { +- __cpuidle_unset_driver(drv); ++ old_drv = __cpuidle_get_cpu_driver(cpu); ++ if (old_drv && old_drv != drv) + return -EBUSY; +- } ++ } + ++ for_each_cpu(cpu, drv->cpumask) + per_cpu(cpuidle_drivers, cpu) = drv; +- } + + return 0; + } diff --git a/queue-5.3/cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch b/queue-5.3/cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch new file mode 100644 index 00000000000..8a05d318776 --- /dev/null +++ b/queue-5.3/cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch @@ -0,0 +1,118 @@ +From e43dcf20215f0287ea113102617ca04daa76b70e Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 10 Oct 2019 23:36:15 +0200 +Subject: cpuidle: teo: Consider hits and misses metrics of disabled states + +From: Rafael J. Wysocki + +commit e43dcf20215f0287ea113102617ca04daa76b70e upstream. + +The TEO governor uses idle duration "bins" defined in accordance with +the CPU idle states table provided by the driver, so that each "bin" +covers the idle duration range between the target residency of the +idle state corresponding to it and the target residency of the closest +deeper idle state. The governor collects statistics for each bin +regardless of whether or not the idle state corresponding to it is +currently enabled. + +In particular, the "hits" and "misses" metrics measure the likelihood +of a situation in which both the time till the next timer (sleep +length) and the idle duration measured after wakeup fall into the +given bin. Namely, if the "hits" value is greater than the "misses" +one, that situation is more likely than the one in which the sleep +length falls into the given bin, but the idle duration measured after +wakeup falls into a bin corresponding to one of the shallower idle +states. + +If the idle state corresponding to the given bin is disabled, it +cannot be selected and if it turns out to be the one that should be +selected, a shallower idle state needs to be used instead of it. +Nevertheless, the metrics collected for the bin corresponding to it +are still valid and need to be taken into account as though that +state had not been disabled. + +For this reason, make teo_select() always use the "hits" and "misses" +values of the idle duration range that the sleep length falls into +even if the specific idle state corresponding to it is disabled and +if the "hits" values is greater than the "misses" one, select the +closest enabled shallower idle state in that case. + +Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/governors/teo.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +--- a/drivers/cpuidle/governors/teo.c ++++ b/drivers/cpuidle/governors/teo.c +@@ -241,7 +241,7 @@ static int teo_select(struct cpuidle_dri + { + struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); + int latency_req = cpuidle_governor_latency_req(dev->cpu); +- unsigned int duration_us, early_hits; ++ unsigned int duration_us, hits, misses, early_hits; + int max_early_idx, constraint_idx, idx, i; + ktime_t delta_tick; + +@@ -255,6 +255,8 @@ static int teo_select(struct cpuidle_dri + cpu_data->sleep_length_ns = tick_nohz_get_sleep_length(&delta_tick); + duration_us = ktime_to_us(cpu_data->sleep_length_ns); + ++ hits = 0; ++ misses = 0; + early_hits = 0; + max_early_idx = -1; + constraint_idx = drv->state_count; +@@ -273,6 +275,17 @@ static int teo_select(struct cpuidle_dri + continue; + + /* ++ * This state is disabled, so the range of idle duration ++ * values corresponding to it is covered by the current ++ * candidate state, but still the "hits" and "misses" ++ * metrics of the disabled state need to be used to ++ * decide whether or not the state covering the range in ++ * question is good enough. ++ */ ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; ++ ++ /* + * If the "early hits" metric of a disabled state is + * greater than the current maximum, it should be taken + * into account, because it would be a mistake to select +@@ -288,8 +301,11 @@ static int teo_select(struct cpuidle_dri + continue; + } + +- if (idx < 0) ++ if (idx < 0) { + idx = i; /* first enabled state */ ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; ++ } + + if (s->target_residency > duration_us) + break; +@@ -298,6 +314,8 @@ static int teo_select(struct cpuidle_dri + constraint_idx = i; + + idx = i; ++ hits = cpu_data->states[i].hits; ++ misses = cpu_data->states[i].misses; + + if (early_hits < cpu_data->states[i].early_hits && + !(tick_nohz_tick_stopped() && +@@ -315,8 +333,7 @@ static int teo_select(struct cpuidle_dri + * "early hits" metric, but if that cannot be determined, just use the + * state selected so far. + */ +- if (cpu_data->states[idx].hits <= cpu_data->states[idx].misses && +- max_early_idx >= 0) { ++ if (hits <= misses && max_early_idx >= 0) { + idx = max_early_idx; + duration_us = drv->states[idx].target_residency; + } diff --git a/queue-5.3/cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch b/queue-5.3/cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch new file mode 100644 index 00000000000..26054fdfde8 --- /dev/null +++ b/queue-5.3/cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch @@ -0,0 +1,102 @@ +From 159e48560f51d9c2aa02d762a18cd24f7868ab27 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 10 Oct 2019 23:37:39 +0200 +Subject: cpuidle: teo: Fix "early hits" handling for disabled idle states + +From: Rafael J. Wysocki + +commit 159e48560f51d9c2aa02d762a18cd24f7868ab27 upstream. + +The TEO governor uses idle duration "bins" defined in accordance with +the CPU idle states table provided by the driver, so that each "bin" +covers the idle duration range between the target residency of the +idle state corresponding to it and the target residency of the closest +deeper idle state. The governor collects statistics for each bin +regardless of whether or not the idle state corresponding to it is +currently enabled. + +In particular, the "early hits" metric measures the likelihood of a +situation in which the idle duration measured after wakeup falls into +to given bin, but the time till the next timer (sleep length) falls +into a bin corresponding to one of the deeper idle states. It is +used when the "hits" and "misses" metrics indicate that the state +"matching" the sleep length should not be selected, so that the state +with the maximum "early hits" value is selected instead of it. + +If the idle state corresponding to the given bin is disabled, it +cannot be selected and if it turns out to be the one that should be +selected, a shallower idle state needs to be used instead of it. +Nevertheless, the metrics collected for the bin corresponding to it +are still valid and need to be taken into account as though that +state had not been disabled. + +As far as the "early hits" metric is concerned, teo_select() tries to +take disabled states into account, but the state index corresponding +to the maximum "early hits" value computed by it may be incorrect. +Namely, it always uses the index of the previous maximum "early hits" +state then, but there may be enabled idle states closer to the +disabled one in question. In particular, if the current candidate +state (whose index is the idx value) is closer to the disabled one +and the "early hits" value of the disabled state is greater than the +current maximum, the index of the current candidate state (idx) +should replace the "maximum early hits state" index. + +Modify the code to handle that case correctly. + +Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems") +Reported-by: Doug Smythies +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/governors/teo.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/cpuidle/governors/teo.c ++++ b/drivers/cpuidle/governors/teo.c +@@ -285,18 +285,35 @@ static int teo_select(struct cpuidle_dri + hits = cpu_data->states[i].hits; + misses = cpu_data->states[i].misses; + ++ if (early_hits >= cpu_data->states[i].early_hits || ++ idx < 0) ++ continue; ++ ++ /* ++ * If the current candidate state has been the one with ++ * the maximum "early hits" metric so far, the "early ++ * hits" metric of the disabled state replaces the ++ * current "early hits" count to avoid selecting a ++ * deeper state with lower "early hits" metric. ++ */ ++ if (max_early_idx == idx) { ++ early_hits = cpu_data->states[i].early_hits; ++ continue; ++ } ++ + /* +- * If the "early hits" metric of a disabled state is +- * greater than the current maximum, it should be taken +- * into account, because it would be a mistake to select +- * a deeper state with lower "early hits" metric. The +- * index cannot be changed to point to it, however, so +- * just increase the "early hits" count alone and let +- * the index still point to a shallower idle state. ++ * The current candidate state is closer to the disabled ++ * one than the current maximum "early hits" state, so ++ * replace the latter with it, but in case the maximum ++ * "early hits" state index has not been set so far, ++ * check if the current candidate state is not too ++ * shallow for that role. + */ +- if (max_early_idx >= 0 && +- early_hits < cpu_data->states[i].early_hits) ++ if (!(tick_nohz_tick_stopped() && ++ drv->states[idx].target_residency < TICK_USEC)) { + early_hits = cpu_data->states[i].early_hits; ++ max_early_idx = idx; ++ } + + continue; + } diff --git a/queue-5.3/cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch b/queue-5.3/cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch new file mode 100644 index 00000000000..8e1865ef130 --- /dev/null +++ b/queue-5.3/cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch @@ -0,0 +1,38 @@ +From 069ce2ef1a6dd84cbd4d897b333e30f825e021f0 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 10 Oct 2019 23:32:17 +0200 +Subject: cpuidle: teo: Ignore disabled idle states that are too deep + +From: Rafael J. Wysocki + +commit 069ce2ef1a6dd84cbd4d897b333e30f825e021f0 upstream. + +Prevent disabled CPU idle state with target residencies beyond the +anticipated idle duration from being taken into account by the TEO +governor. + +Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/governors/teo.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/cpuidle/governors/teo.c ++++ b/drivers/cpuidle/governors/teo.c +@@ -266,6 +266,13 @@ static int teo_select(struct cpuidle_dri + + if (s->disabled || su->disable) { + /* ++ * Ignore disabled states with target residencies beyond ++ * the anticipated idle duration. ++ */ ++ if (s->target_residency > duration_us) ++ continue; ++ ++ /* + * If the "early hits" metric of a disabled state is + * greater than the current maximum, it should be taken + * into account, because it would be a mistake to select diff --git a/queue-5.3/cpuidle-teo-rename-local-variable-in-teo_select.patch b/queue-5.3/cpuidle-teo-rename-local-variable-in-teo_select.patch new file mode 100644 index 00000000000..460ada0188c --- /dev/null +++ b/queue-5.3/cpuidle-teo-rename-local-variable-in-teo_select.patch @@ -0,0 +1,82 @@ +From 4f690bb8ce4cc5d3fabe3a8e9c2401de1554cdc1 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 10 Oct 2019 23:32:59 +0200 +Subject: cpuidle: teo: Rename local variable in teo_select() + +From: Rafael J. Wysocki + +commit 4f690bb8ce4cc5d3fabe3a8e9c2401de1554cdc1 upstream. + +Rename a local variable in teo_select() in preparation for subsequent +code modifications, no intentional impact. + +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpuidle/governors/teo.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/cpuidle/governors/teo.c ++++ b/drivers/cpuidle/governors/teo.c +@@ -241,7 +241,7 @@ static int teo_select(struct cpuidle_dri + { + struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); + int latency_req = cpuidle_governor_latency_req(dev->cpu); +- unsigned int duration_us, count; ++ unsigned int duration_us, early_hits; + int max_early_idx, constraint_idx, idx, i; + ktime_t delta_tick; + +@@ -255,7 +255,7 @@ static int teo_select(struct cpuidle_dri + cpu_data->sleep_length_ns = tick_nohz_get_sleep_length(&delta_tick); + duration_us = ktime_to_us(cpu_data->sleep_length_ns); + +- count = 0; ++ early_hits = 0; + max_early_idx = -1; + constraint_idx = drv->state_count; + idx = -1; +@@ -278,12 +278,12 @@ static int teo_select(struct cpuidle_dri + * into account, because it would be a mistake to select + * a deeper state with lower "early hits" metric. The + * index cannot be changed to point to it, however, so +- * just increase the max count alone and let the index +- * still point to a shallower idle state. ++ * just increase the "early hits" count alone and let ++ * the index still point to a shallower idle state. + */ + if (max_early_idx >= 0 && +- count < cpu_data->states[i].early_hits) +- count = cpu_data->states[i].early_hits; ++ early_hits < cpu_data->states[i].early_hits) ++ early_hits = cpu_data->states[i].early_hits; + + continue; + } +@@ -299,10 +299,10 @@ static int teo_select(struct cpuidle_dri + + idx = i; + +- if (count < cpu_data->states[i].early_hits && ++ if (early_hits < cpu_data->states[i].early_hits && + !(tick_nohz_tick_stopped() && + drv->states[i].target_residency < TICK_USEC)) { +- count = cpu_data->states[i].early_hits; ++ early_hits = cpu_data->states[i].early_hits; + max_early_idx = i; + } + } +@@ -331,10 +331,9 @@ static int teo_select(struct cpuidle_dri + if (idx < 0) { + idx = 0; /* No states enabled. Must use 0. */ + } else if (idx > 0) { ++ unsigned int count = 0; + u64 sum = 0; + +- count = 0; +- + /* + * Count and sum the most recent idle duration values less than + * the current expected idle duration value. diff --git a/queue-5.3/erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch b/queue-5.3/erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch new file mode 100644 index 00000000000..f1c8794f4d2 --- /dev/null +++ b/queue-5.3/erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch @@ -0,0 +1,42 @@ +From 926d1650176448d7684b991fbe1a5b1a8289e97c Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Sun, 1 Dec 2019 16:01:09 +0800 +Subject: erofs: zero out when listxattr is called with no xattr + +From: Gao Xiang + +commit 926d1650176448d7684b991fbe1a5b1a8289e97c upstream. + +As David reported [1], ENODATA returns when attempting +to modify files by using EROFS as an overlayfs lower layer. + +The root cause is that listxattr could return unexpected +-ENODATA by mistake for inodes without xattr. That breaks +listxattr return value convention and it can cause copy +up failure when used with overlayfs. + +Resolve by zeroing out if no xattr is found for listxattr. + +[1] https://lore.kernel.org/r/CAEvUa7nxnby+rxK-KRMA46=exeOMApkDMAV08AjMkkPnTPV4CQ@mail.gmail.com +Link: https://lore.kernel.org/r/20191201084040.29275-1-hsiangkao@aol.com +Fixes: cadf1ccf1b00 ("staging: erofs: add error handling for xattr submodule") +Cc: # 4.19+ +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/erofs/xattr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/erofs/xattr.c ++++ b/drivers/staging/erofs/xattr.c +@@ -649,6 +649,8 @@ ssize_t erofs_listxattr(struct dentry *d + struct listxattr_iter it; + + ret = init_inode_xattrs(d_inode(dentry)); ++ if (ret == -ENOATTR) ++ return 0; + if (ret) + return ret; + diff --git a/queue-5.3/intel_th-fix-a-double-put_device-in-error-path.patch b/queue-5.3/intel_th-fix-a-double-put_device-in-error-path.patch new file mode 100644 index 00000000000..9a1bcbe1dc8 --- /dev/null +++ b/queue-5.3/intel_th-fix-a-double-put_device-in-error-path.patch @@ -0,0 +1,54 @@ +From 512592779a337feb5905d8fcf9498dbf33672d4a Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 20 Nov 2019 15:08:04 +0200 +Subject: intel_th: Fix a double put_device() in error path + +From: Alexander Shishkin + +commit 512592779a337feb5905d8fcf9498dbf33672d4a upstream. + +Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") +factored out intel_th_subdevice_alloc() from intel_th_populate(), but got +the error path wrong, resulting in two instances of a double put_device() +on a freshly initialized, but not 'added' device. + +Fix this by only doing one put_device() in the error path. + +Signed-off-by: Alexander Shishkin +Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") +Reported-by: Wen Yang +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v4.14+ +Link: https://lore.kernel.org/r/20191120130806.44028-2-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -649,10 +649,8 @@ intel_th_subdevice_alloc(struct intel_th + } + + err = intel_th_device_add_resources(thdev, res, subdev->nres); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_put_device; +- } + + if (subdev->type == INTEL_TH_OUTPUT) { + if (subdev->mknode) +@@ -667,10 +665,8 @@ intel_th_subdevice_alloc(struct intel_th + } + + err = device_add(&thdev->dev); +- if (err) { +- put_device(&thdev->dev); ++ if (err) + goto fail_free_res; +- } + + /* need switch driver to be loaded to enumerate the rest */ + if (subdev->type == INTEL_TH_SWITCH && !req) { diff --git a/queue-5.3/intel_th-pci-add-ice-lake-cpu-support.patch b/queue-5.3/intel_th-pci-add-ice-lake-cpu-support.patch new file mode 100644 index 00000000000..fe796924752 --- /dev/null +++ b/queue-5.3/intel_th-pci-add-ice-lake-cpu-support.patch @@ -0,0 +1,35 @@ +From 6a1743422a7c0fda26764a544136cac13e5ae486 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 20 Nov 2019 15:08:05 +0200 +Subject: intel_th: pci: Add Ice Lake CPU support + +From: Alexander Shishkin + +commit 6a1743422a7c0fda26764a544136cac13e5ae486 upstream. + +This adds support for the Trace Hub in Ice Lake CPU. + +Signed-off-by: Alexander Shishkin +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20191120130806.44028-3-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -210,6 +210,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Ice Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Tiger Lake PCH */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.3/intel_th-pci-add-tiger-lake-cpu-support.patch b/queue-5.3/intel_th-pci-add-tiger-lake-cpu-support.patch new file mode 100644 index 00000000000..0acdca3592d --- /dev/null +++ b/queue-5.3/intel_th-pci-add-tiger-lake-cpu-support.patch @@ -0,0 +1,35 @@ +From 6e6c18bcb78c0dc0601ebe216bed12c844492d0c Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 20 Nov 2019 15:08:06 +0200 +Subject: intel_th: pci: Add Tiger Lake CPU support + +From: Alexander Shishkin + +commit 6e6c18bcb78c0dc0601ebe216bed12c844492d0c upstream. + +This adds support for the Trace Hub in Tiger Lake CPU. + +Signed-off-by: Alexander Shishkin +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20191120130806.44028-4-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -215,6 +215,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Tiger Lake CPU */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Tiger Lake PCH */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.3/md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch b/queue-5.3/md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch new file mode 100644 index 00000000000..3fd9a568d4f --- /dev/null +++ b/queue-5.3/md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch @@ -0,0 +1,182 @@ +From 775d78319f1ceb32be8eb3b1202ccdc60e9cb7f1 Mon Sep 17 00:00:00 2001 +From: David Jeffery +Date: Mon, 16 Sep 2019 13:15:14 -0400 +Subject: md: improve handling of bio with REQ_PREFLUSH in md_flush_request() + +From: David Jeffery + +commit 775d78319f1ceb32be8eb3b1202ccdc60e9cb7f1 upstream. + +If pers->make_request fails in md_flush_request(), the bio is lost. To +fix this, pass back a bool to indicate if the original make_request call +should continue to handle the I/O and instead of assuming the flush logic +will push it to completion. + +Convert md_flush_request to return a bool and no longer calls the raid +driver's make_request function. If the return is true, then the md flush +logic has or will complete the bio and the md make_request call is done. +If false, then the md make_request function needs to keep processing like +it is a normal bio. Let the original call to md_handle_request handle any +need to retry sending the bio to the raid driver's make_request function +should it be needed. + +Also mark md_flush_request and the make_request function pointer as +__must_check to issue warnings should these critical return values be +ignored. + +Fixes: 2bc13b83e629 ("md: batch flush requests.") +Cc: stable@vger.kernel.org # # v4.19+ +Cc: NeilBrown +Signed-off-by: David Jeffery +Reviewed-by: Xiao Ni +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md-linear.c | 5 ++--- + drivers/md/md-multipath.c | 5 ++--- + drivers/md/md.c | 11 +++++++++-- + drivers/md/md.h | 4 ++-- + drivers/md/raid0.c | 5 ++--- + drivers/md/raid1.c | 5 ++--- + drivers/md/raid10.c | 5 ++--- + drivers/md/raid5.c | 4 ++-- + 8 files changed, 23 insertions(+), 21 deletions(-) + +--- a/drivers/md/md-linear.c ++++ b/drivers/md/md-linear.c +@@ -244,10 +244,9 @@ static bool linear_make_request(struct m + sector_t start_sector, end_sector, data_offset; + sector_t bio_sector = bio->bi_iter.bi_sector; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + tmp_dev = which_dev(mddev, bio_sector); + start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors; +--- a/drivers/md/md-multipath.c ++++ b/drivers/md/md-multipath.c +@@ -104,10 +104,9 @@ static bool multipath_make_request(struc + struct multipath_bh * mp_bh; + struct multipath_info *multipath; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + mp_bh = mempool_alloc(&conf->pool, GFP_NOIO); + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -545,7 +545,13 @@ static void md_submit_flush_data(struct + } + } + +-void md_flush_request(struct mddev *mddev, struct bio *bio) ++/* ++ * Manages consolidation of flushes and submitting any flushes needed for ++ * a bio with REQ_PREFLUSH. Returns true if the bio is finished or is ++ * being finished in another context. Returns false if the flushing is ++ * complete but still needs the I/O portion of the bio to be processed. ++ */ ++bool md_flush_request(struct mddev *mddev, struct bio *bio) + { + ktime_t start = ktime_get_boottime(); + spin_lock_irq(&mddev->lock); +@@ -570,9 +576,10 @@ void md_flush_request(struct mddev *mdde + bio_endio(bio); + else { + bio->bi_opf &= ~REQ_PREFLUSH; +- mddev->pers->make_request(mddev, bio); ++ return false; + } + } ++ return true; + } + EXPORT_SYMBOL(md_flush_request); + +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -546,7 +546,7 @@ struct md_personality + int level; + struct list_head list; + struct module *owner; +- bool (*make_request)(struct mddev *mddev, struct bio *bio); ++ bool __must_check (*make_request)(struct mddev *mddev, struct bio *bio); + /* + * start up works that do NOT require md_thread. tasks that + * requires md_thread should go into start() +@@ -699,7 +699,7 @@ extern void md_error(struct mddev *mddev + extern void md_finish_reshape(struct mddev *mddev); + + extern int mddev_congested(struct mddev *mddev, int bits); +-extern void md_flush_request(struct mddev *mddev, struct bio *bio); ++extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); + extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev, + sector_t sector, int size, struct page *page); + extern int md_super_wait(struct mddev *mddev); +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -572,10 +572,9 @@ static bool raid0_make_request(struct md + unsigned chunk_sects; + unsigned sectors; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) { + raid0_handle_discard(mddev, bio); +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1564,10 +1564,9 @@ static bool raid1_make_request(struct md + { + sector_t sectors; + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + /* + * There is a limit to the maximum size, but +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1523,10 +1523,9 @@ static bool raid10_make_request(struct m + int chunk_sects = chunk_mask + 1; + int sectors = bio_sectors(bio); + +- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) { +- md_flush_request(mddev, bio); ++ if (unlikely(bio->bi_opf & REQ_PREFLUSH) ++ && md_flush_request(mddev, bio)) + return true; +- } + + if (!md_write_start(mddev, bio)) + return false; +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5587,8 +5587,8 @@ static bool raid5_make_request(struct md + if (ret == 0) + return true; + if (ret == -ENODEV) { +- md_flush_request(mddev, bi); +- return true; ++ if (md_flush_request(mddev, bi)) ++ return true; + } + /* ret == -EAGAIN, fallback */ + /* diff --git a/queue-5.3/media-bdisp-fix-memleak-on-release.patch b/queue-5.3/media-bdisp-fix-memleak-on-release.patch new file mode 100644 index 00000000000..96388aacf42 --- /dev/null +++ b/queue-5.3/media-bdisp-fix-memleak-on-release.patch @@ -0,0 +1,40 @@ +From 11609a7e21f8cea42630350aa57662928fa4dc63 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 10 Oct 2019 10:13:31 -0300 +Subject: media: bdisp: fix memleak on release + +From: Johan Hovold + +commit 11609a7e21f8cea42630350aa57662928fa4dc63 upstream. + +If a process is interrupted while accessing the video device and the +device lock is contended, release() could return early and fail to free +related resources. + +Note that the return value of the v4l2 release file operation is +ignored. + +Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") +Cc: stable # 4.2 +Signed-off-by: Johan Hovold +Reviewed-by: Fabien Dessenne +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -651,8 +651,7 @@ static int bdisp_release(struct file *fi + + dev_dbg(bdisp->dev, "%s\n", __func__); + +- if (mutex_lock_interruptible(&bdisp->lock)) +- return -ERESTARTSYS; ++ mutex_lock(&bdisp->lock); + + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + diff --git a/queue-5.3/media-cec.h-cec_op_rec_flag_-values-were-swapped.patch b/queue-5.3/media-cec.h-cec_op_rec_flag_-values-were-swapped.patch new file mode 100644 index 00000000000..900b58d4f6a --- /dev/null +++ b/queue-5.3/media-cec.h-cec_op_rec_flag_-values-were-swapped.patch @@ -0,0 +1,35 @@ +From 806e0cdfee0b99efbb450f9f6e69deb7118602fc Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Mon, 16 Sep 2019 02:47:41 -0300 +Subject: media: cec.h: CEC_OP_REC_FLAG_ values were swapped + +From: Hans Verkuil + +commit 806e0cdfee0b99efbb450f9f6e69deb7118602fc upstream. + +CEC_OP_REC_FLAG_NOT_USED is 0 and CEC_OP_REC_FLAG_USED is 1, not the +other way around. + +Signed-off-by: Hans Verkuil +Reported-by: Jiunn Chang +Cc: # for v4.10 and up +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/linux/cec.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/uapi/linux/cec.h ++++ b/include/uapi/linux/cec.h +@@ -768,8 +768,8 @@ struct cec_event { + #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93 + #define CEC_MSG_TUNER_DEVICE_STATUS 0x07 + /* Recording Flag Operand (rec_flag) */ +-#define CEC_OP_REC_FLAG_USED 0 +-#define CEC_OP_REC_FLAG_NOT_USED 1 ++#define CEC_OP_REC_FLAG_NOT_USED 0 ++#define CEC_OP_REC_FLAG_USED 1 + /* Tuner Display Info Operand (tuner_display_info) */ + #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0 + #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1 diff --git a/queue-5.3/media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch b/queue-5.3/media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch new file mode 100644 index 00000000000..64f597d432e --- /dev/null +++ b/queue-5.3/media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch @@ -0,0 +1,92 @@ +From ae02d49493b5d32bb3e035fdeb1655346f5e1ea5 Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Mon, 7 Oct 2019 19:45:02 +0200 +Subject: media: hantro: Fix s_fmt for dynamic resolution changes + +From: Ezequiel Garcia + +commit ae02d49493b5d32bb3e035fdeb1655346f5e1ea5 upstream. + +Commit 953aaa1492c53 ("media: rockchip/vpu: Prepare things to support decoders") +changed the conditions under S_FMT was allowed for OUTPUT +CAPTURE buffers. + +However, and according to the mem-to-mem stateless decoder specification, +in order to support dynamic resolution changes, S_FMT should be allowed +even if OUTPUT buffers have been allocated. + +Relax decoder S_FMT restrictions on OUTPUT buffers, allowing a +resolution modification, provided the pixel format stays the same. + +Tested on RK3288 platforms using ChromiumOS Video Decode/Encode +Accelerator Unittests. + +[hverkuil: fix typo: In other -> In order] + +Fixes: 953aaa1492c53 ("media: rockchip/vpu: Prepare things to support decoders") +Signed-off-by: Ezequiel Garcia +Reviewed-by: Boris Brezillon +Cc: # for v5.4 and up +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_v4l2.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/staging/media/hantro/hantro_v4l2.c ++++ b/drivers/staging/media/hantro/hantro_v4l2.c +@@ -356,20 +356,27 @@ vidioc_s_fmt_out_mplane(struct file *fil + { + struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp; + struct hantro_ctx *ctx = fh_to_ctx(priv); ++ struct vb2_queue *vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type); + const struct hantro_fmt *formats; + unsigned int num_fmts; +- struct vb2_queue *vq; + int ret; + +- /* Change not allowed if queue is busy. */ +- vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type); +- if (vb2_is_busy(vq)) +- return -EBUSY; ++ ret = vidioc_try_fmt_out_mplane(file, priv, f); ++ if (ret) ++ return ret; + + if (!hantro_is_encoder_ctx(ctx)) { + struct vb2_queue *peer_vq; + + /* ++ * In order to support dynamic resolution change, ++ * the decoder admits a resolution change, as long ++ * as the pixelformat remains. Can't be done if streaming. ++ */ ++ if (vb2_is_streaming(vq) || (vb2_is_busy(vq) && ++ pix_mp->pixelformat != ctx->src_fmt.pixelformat)) ++ return -EBUSY; ++ /* + * Since format change on the OUTPUT queue will reset + * the CAPTURE queue, we can't allow doing so + * when the CAPTURE queue has buffers allocated. +@@ -378,12 +385,15 @@ vidioc_s_fmt_out_mplane(struct file *fil + V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE); + if (vb2_is_busy(peer_vq)) + return -EBUSY; ++ } else { ++ /* ++ * The encoder doesn't admit a format change if ++ * there are OUTPUT buffers allocated. ++ */ ++ if (vb2_is_busy(vq)) ++ return -EBUSY; + } + +- ret = vidioc_try_fmt_out_mplane(file, priv, f); +- if (ret) +- return ret; +- + formats = hantro_get_formats(ctx, &num_fmts); + ctx->vpu_src_fmt = hantro_find_format(formats, num_fmts, + pix_mp->pixelformat); diff --git a/queue-5.3/media-radio-wl1273-fix-interrupt-masking-on-release.patch b/queue-5.3/media-radio-wl1273-fix-interrupt-masking-on-release.patch new file mode 100644 index 00000000000..30955e3ccd3 --- /dev/null +++ b/queue-5.3/media-radio-wl1273-fix-interrupt-masking-on-release.patch @@ -0,0 +1,40 @@ +From 1091eb830627625dcf79958d99353c2391f41708 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 10 Oct 2019 10:13:32 -0300 +Subject: media: radio: wl1273: fix interrupt masking on release + +From: Johan Hovold + +commit 1091eb830627625dcf79958d99353c2391f41708 upstream. + +If a process is interrupted while accessing the radio device and the +core lock is contended, release() could return early and fail to update +the interrupt mask. + +Note that the return value of the v4l2 release file operation is +ignored. + +Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver") +Cc: stable # 2.6.38 +Cc: Matti Aaltonen +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/radio/radio-wl1273.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1148,8 +1148,7 @@ static int wl1273_fm_fops_release(struct + if (radio->rds_users > 0) { + radio->rds_users--; + if (radio->rds_users == 0) { +- if (mutex_lock_interruptible(&core->lock)) +- return -EINTR; ++ mutex_lock(&core->lock); + + radio->irq_flags &= ~WL1273_RDS_EVENT; + diff --git a/queue-5.3/mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch b/queue-5.3/mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch new file mode 100644 index 00000000000..b5340599a84 --- /dev/null +++ b/queue-5.3/mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch @@ -0,0 +1,73 @@ +From f6498b922e57aecbe3b7fa30a308d9d586c0c369 Mon Sep 17 00:00:00 2001 +From: "H. Nikolaus Schaller" +Date: Thu, 7 Nov 2019 11:30:37 +0100 +Subject: mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card + +From: H. Nikolaus Schaller + +commit f6498b922e57aecbe3b7fa30a308d9d586c0c369 upstream. + +Pandora_wl1251_init_card was used to do special pdata based +setup of the sdio mmc interface. This does no longer work with +v4.7 and later. A fix requires a device tree based mmc3 setup. + +Therefore we move the special setup to omap_hsmmc.c instead +of calling some pdata supplied init_card function. + +The new code checks for a DT child node compatible to wl1251 +so it will not affect other MMC3 use cases. + +Generally, this code was and still is a hack and should be +moved to mmc core to e.g. read such properties from optional +DT child nodes. + +Fixes: 81eef6ca9201 ("mmc: omap_hsmmc: Use dma_request_chan() for requesting DMA channel") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.7+ +[Ulf: Fixed up some checkpatch complaints] +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/omap_hsmmc.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -1512,6 +1512,36 @@ static void omap_hsmmc_init_card(struct + + if (mmc_pdata(host)->init_card) + mmc_pdata(host)->init_card(card); ++ else if (card->type == MMC_TYPE_SDIO || ++ card->type == MMC_TYPE_SD_COMBO) { ++ struct device_node *np = mmc_dev(mmc)->of_node; ++ ++ /* ++ * REVISIT: should be moved to sdio core and made more ++ * general e.g. by expanding the DT bindings of child nodes ++ * to provide a mechanism to provide this information: ++ * Documentation/devicetree/bindings/mmc/mmc-card.txt ++ */ ++ ++ np = of_get_compatible_child(np, "ti,wl1251"); ++ if (np) { ++ /* ++ * We have TI wl1251 attached to MMC3. Pass this ++ * information to the SDIO core because it can't be ++ * probed by normal methods. ++ */ ++ ++ dev_info(host->dev, "found wl1251\n"); ++ card->quirks |= MMC_QUIRK_NONSTD_SDIO; ++ card->cccr.wide_bus = 1; ++ card->cis.vendor = 0x104c; ++ card->cis.device = 0x9066; ++ card->cis.blksize = 512; ++ card->cis.max_dtr = 24000000; ++ card->ocr = 0x80; ++ of_node_put(np); ++ } ++ } + } + + static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable) diff --git a/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch b/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..c256a5d8873 --- /dev/null +++ b/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch @@ -0,0 +1,94 @@ +From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001 +From: Leo Yan +Date: Thu, 7 Nov 2019 10:02:44 +0800 +Subject: perf tests: Fix out of bounds memory access + +From: Leo Yan + +commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream. + +The test case 'Read backward ring buffer' failed on 32-bit architectures +which were found by LKFT perf testing. The test failed on arm32 x15 +device, qemu_arm32, qemu_i386, and found intermittent failure on i386; +the failure log is as below: + + 50: Read backward ring buffer : + --- start --- + test child forked, pid 510 + Using CPUID GenuineIntel-6-9E-9 + mmap size 1052672B + mmap size 8192B + Finished reading overwrite ring buffer: rewind + free(): invalid next size (fast) + test child interrupted + ---- end ---- + Read backward ring buffer: FAILED! + +The log hints there have issue for memory usage, thus free() reports +error 'invalid next size' and directly exit for the case. Finally, this +issue is root caused as out of bounds memory access for the data array +'evsel->id'. + +The backward ring buffer test invokes do_test() twice. 'evsel->id' is +allocated at the first call with the flow: + + test__backward_ring_buffer() + `-> do_test() + `-> evlist__mmap() + `-> evlist__mmap_ex() + `-> perf_evsel__alloc_id() + +So 'evsel->id' is allocated with one item, and it will be used in +function perf_evlist__id_add(): + + evsel->id[0] = id + evsel->ids = 1 + +At the second call for do_test(), it skips to initialize 'evsel->id' +and reuses the array which is allocated in the first call. But +'evsel->ids' contains the stale value. Thus: + + evsel->id[1] = id -> out of bound access + evsel->ids = 2 + +To fix this issue, we will use evlist__open() and evlist__close() pair +functions to prepare and cleanup context for evlist; so 'evsel->id' and +'evsel->ids' can be initialized properly when invoke do_test() and avoid +the out of bounds memory access. + +Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer") +Signed-off-by: Leo Yan +Reviewed-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Naresh Kamboju +Cc: Peter Zijlstra +Cc: Wang Nan +Cc: stable@vger.kernel.org # v4.10+ +Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/tests/backward-ring-buffer.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/tools/perf/tests/backward-ring-buffer.c ++++ b/tools/perf/tests/backward-ring-buffer.c +@@ -144,6 +144,15 @@ int test__backward_ring_buffer(struct te + goto out_delete_evlist; + } + ++ evlist__close(evlist); ++ ++ err = evlist__open(evlist); ++ if (err < 0) { ++ pr_debug("perf_evlist__open: %s\n", ++ str_error_r(errno, sbuf, sizeof(sbuf))); ++ goto out_delete_evlist; ++ } ++ + err = do_test(evlist, 1, &sample_count, &comm_count); + if (err != TEST_OK) + goto out_delete_evlist; diff --git a/queue-5.3/pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch b/queue-5.3/pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch new file mode 100644 index 00000000000..0bd2998d435 --- /dev/null +++ b/queue-5.3/pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch @@ -0,0 +1,44 @@ +From 04fb02757ae5188031eb71b2f6f189edb1caf5dc Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Fri, 15 Nov 2019 16:57:52 +0100 +Subject: pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() + +From: Gregory CLEMENT + +commit 04fb02757ae5188031eb71b2f6f189edb1caf5dc upstream. + +As explained in the following commit a9a1a4833613 ("pinctrl: +armada-37xx: Fix gpio interrupt setup") the armada_37xx_irq_set_type() +function can be called before the initialization of the mask field. + +That means that we can't use this field in this function and need to +workaround it using hwirq. + +Fixes: 30ac0d3b0702 ("pinctrl: armada-37xx: Add edge both type gpio irq support") +Cc: stable@vger.kernel.org +Reported-by: Russell King +Signed-off-by: Gregory CLEMENT +Link: https://lore.kernel.org/r/20191115155752.2562-1-gregory.clement@bootlin.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -595,10 +595,10 @@ static int armada_37xx_irq_set_type(stru + regmap_read(info->regmap, in_reg, &in_val); + + /* Set initial polarity based on current input level. */ +- if (in_val & d->mask) +- val |= d->mask; /* falling */ ++ if (in_val & BIT(d->hwirq % GPIO_PER_REG)) ++ val |= BIT(d->hwirq % GPIO_PER_REG); /* falling */ + else +- val &= ~d->mask; /* rising */ ++ val &= ~(BIT(d->hwirq % GPIO_PER_REG)); /* rising */ + break; + } + default: diff --git a/queue-5.3/pinctrl-rza2-fix-gpio-name-typos.patch b/queue-5.3/pinctrl-rza2-fix-gpio-name-typos.patch new file mode 100644 index 00000000000..922d431ee2f --- /dev/null +++ b/queue-5.3/pinctrl-rza2-fix-gpio-name-typos.patch @@ -0,0 +1,37 @@ +From 930d3a4907ae6cdb476db23fc7caa86e9de1e557 Mon Sep 17 00:00:00 2001 +From: Chris Brandt +Date: Mon, 30 Sep 2019 09:58:04 -0500 +Subject: pinctrl: rza2: Fix gpio name typos + +From: Chris Brandt + +commit 930d3a4907ae6cdb476db23fc7caa86e9de1e557 upstream. + +Fix apparent copy/paste errors that were overlooked in the original driver. + "P0_4" -> "PF_4" + "P0_3" -> "PG_3" + +Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller") +Cc: +Signed-off-by: Chris Brandt +Link: https://lore.kernel.org/r/20190930145804.30497-1-chris.brandt@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/pinctrl-rza2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/pinctrl-rza2.c ++++ b/drivers/pinctrl/pinctrl-rza2.c +@@ -212,8 +212,8 @@ static const char * const rza2_gpio_name + "PC_0", "PC_1", "PC_2", "PC_3", "PC_4", "PC_5", "PC_6", "PC_7", + "PD_0", "PD_1", "PD_2", "PD_3", "PD_4", "PD_5", "PD_6", "PD_7", + "PE_0", "PE_1", "PE_2", "PE_3", "PE_4", "PE_5", "PE_6", "PE_7", +- "PF_0", "PF_1", "PF_2", "PF_3", "P0_4", "PF_5", "PF_6", "PF_7", +- "PG_0", "PG_1", "PG_2", "P0_3", "PG_4", "PG_5", "PG_6", "PG_7", ++ "PF_0", "PF_1", "PF_2", "PF_3", "PF_4", "PF_5", "PF_6", "PF_7", ++ "PG_0", "PG_1", "PG_2", "PG_3", "PG_4", "PG_5", "PG_6", "PG_7", + "PH_0", "PH_1", "PH_2", "PH_3", "PH_4", "PH_5", "PH_6", "PH_7", + /* port I does not exist */ + "PJ_0", "PJ_1", "PJ_2", "PJ_3", "PJ_4", "PJ_5", "PJ_6", "PJ_7", diff --git a/queue-5.3/pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch b/queue-5.3/pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch new file mode 100644 index 00000000000..d4f6628089e --- /dev/null +++ b/queue-5.3/pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch @@ -0,0 +1,39 @@ +From 3d2557ab75d4c568c79eefa2e550e0d80348a6bd Mon Sep 17 00:00:00 2001 +From: Nishka Dasgupta +Date: Sun, 4 Aug 2019 21:32:00 +0530 +Subject: pinctrl: samsung: Add of_node_put() before return in error path + +From: Nishka Dasgupta + +commit 3d2557ab75d4c568c79eefa2e550e0d80348a6bd upstream. + +Each iteration of for_each_child_of_node puts the previous node, but in +the case of a return from the middle of the loop, there is no put, thus +causing a memory leak. Hence add an of_node_put before the return of +exynos_eint_wkup_init() error path. +Issue found with Coccinelle. + +Signed-off-by: Nishka Dasgupta +Cc: +Fixes: 14c255d35b25 ("pinctrl: exynos: Add irq_chip instance for Exynos7 wakeup interrupts") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/samsung/pinctrl-exynos.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -486,8 +486,10 @@ int exynos_eint_wkup_init(struct samsung + if (match) { + irq_chip = kmemdup(match->data, + sizeof(*irq_chip), GFP_KERNEL); +- if (!irq_chip) ++ if (!irq_chip) { ++ of_node_put(np); + return -ENOMEM; ++ } + wkup_np = np; + break; + } diff --git a/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch new file mode 100644 index 00000000000..24276f0531d --- /dev/null +++ b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch @@ -0,0 +1,60 @@ +From 5c7f48dd14e892e3e920dd6bbbd52df79e1b3b41 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 5 Aug 2019 18:27:07 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init + +From: Krzysztof Kozlowski + +commit 5c7f48dd14e892e3e920dd6bbbd52df79e1b3b41 upstream. + +In exynos_eint_wkup_init() the for_each_child_of_node() loop is used +with a break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Cc: +Fixes: 43b169db1841 ("pinctrl: add exynos4210 specific extensions for samsung pinctrl driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/samsung/pinctrl-exynos.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/samsung/pinctrl-exynos.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c +@@ -506,6 +506,7 @@ int exynos_eint_wkup_init(struct samsung + bank->nr_pins, &exynos_eint_irqd_ops, bank); + if (!bank->irq_domain) { + dev_err(dev, "wkup irq domain add failed\n"); ++ of_node_put(wkup_np); + return -ENXIO; + } + +@@ -520,8 +521,10 @@ int exynos_eint_wkup_init(struct samsung + weint_data = devm_kcalloc(dev, + bank->nr_pins, sizeof(*weint_data), + GFP_KERNEL); +- if (!weint_data) ++ if (!weint_data) { ++ of_node_put(wkup_np); + return -ENOMEM; ++ } + + for (idx = 0; idx < bank->nr_pins; ++idx) { + irq = irq_of_parse_and_map(bank->of_node, idx); +@@ -538,10 +541,13 @@ int exynos_eint_wkup_init(struct samsung + } + } + +- if (!muxed_banks) ++ if (!muxed_banks) { ++ of_node_put(wkup_np); + return 0; ++ } + + irq = irq_of_parse_and_map(wkup_np, 0); ++ of_node_put(wkup_np); + if (!irq) { + dev_err(dev, "irq number for muxed EINTs not found\n"); + return 0; diff --git a/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch new file mode 100644 index 00000000000..53bb0e37d80 --- /dev/null +++ b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch @@ -0,0 +1,58 @@ +From a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 5 Aug 2019 18:27:10 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in init code + +From: Krzysztof Kozlowski + +commit a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 upstream. + +Several functions use for_each_child_of_node() loop with a break to find +a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Cc: +Fixes: 9a2c1c3b91aa ("pinctrl: samsung: Allow grouping multiple pinmux/pinconf nodes") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/samsung/pinctrl-samsung.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -272,6 +272,7 @@ static int samsung_dt_node_to_map(struct + &reserved_maps, num_maps); + if (ret < 0) { + samsung_dt_free_map(pctldev, *map, *num_maps); ++ of_node_put(np); + return ret; + } + } +@@ -785,8 +786,10 @@ static struct samsung_pmx_func *samsung_ + if (!of_get_child_count(cfg_np)) { + ret = samsung_pinctrl_create_function(dev, drvdata, + cfg_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; +@@ -797,8 +800,11 @@ static struct samsung_pmx_func *samsung_ + for_each_child_of_node(cfg_np, func_np) { + ret = samsung_pinctrl_create_function(dev, drvdata, + func_np, func); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(func_np); ++ of_node_put(cfg_np); + return ERR_PTR(ret); ++ } + if (ret > 0) { + ++func; + ++func_cnt; diff --git a/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch new file mode 100644 index 00000000000..11744251567 --- /dev/null +++ b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch @@ -0,0 +1,52 @@ +From 6fbbcb050802d6ea109f387e961b1dbcc3a80c96 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 5 Aug 2019 18:27:08 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init + +From: Krzysztof Kozlowski + +commit 6fbbcb050802d6ea109f387e961b1dbcc3a80c96 upstream. + +In s3c24xx_eint_init() the for_each_child_of_node() loop is used with a +break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Cc: +Fixes: af99a7507469 ("pinctrl: Add pinctrl-s3c24xx driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/samsung/pinctrl-s3c24xx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +@@ -490,8 +490,10 @@ static int s3c24xx_eint_init(struct sams + return -ENODEV; + + eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL); +- if (!eint_data) ++ if (!eint_data) { ++ of_node_put(eint_np); + return -ENOMEM; ++ } + + eint_data->drvdata = d; + +@@ -503,12 +505,14 @@ static int s3c24xx_eint_init(struct sams + irq = irq_of_parse_and_map(eint_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint_np); + return -ENXIO; + } + + eint_data->parents[i] = irq; + irq_set_chained_handler_and_data(irq, handlers[i], eint_data); + } ++ of_node_put(eint_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { diff --git a/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch new file mode 100644 index 00000000000..f4b4c5fd6b7 --- /dev/null +++ b/queue-5.3/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch @@ -0,0 +1,53 @@ +From 7f028caadf6c37580d0f59c6c094ed09afc04062 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 5 Aug 2019 18:27:09 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init + +From: Krzysztof Kozlowski + +commit 7f028caadf6c37580d0f59c6c094ed09afc04062 upstream. + +In s3c64xx_eint_eint0_init() the for_each_child_of_node() loop is used +with a break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Cc: +Fixes: 61dd72613177 ("pinctrl: Add pinctrl-s3c64xx driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/samsung/pinctrl-s3c64xx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +@@ -704,8 +704,10 @@ static int s3c64xx_eint_eint0_init(struc + return -ENODEV; + + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); +- if (!data) ++ if (!data) { ++ of_node_put(eint0_np); + return -ENOMEM; ++ } + data->drvdata = d; + + for (i = 0; i < NUM_EINT0_IRQ; ++i) { +@@ -714,6 +716,7 @@ static int s3c64xx_eint_eint0_init(struc + irq = irq_of_parse_and_map(eint0_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint0_np); + return -ENXIO; + } + +@@ -721,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struc + s3c64xx_eint0_handlers[i], + data); + } ++ of_node_put(eint0_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { diff --git a/queue-5.3/pm-devfreq-lock-devfreq-in-trans_stat_show.patch b/queue-5.3/pm-devfreq-lock-devfreq-in-trans_stat_show.patch new file mode 100644 index 00000000000..41e29fe7f03 --- /dev/null +++ b/queue-5.3/pm-devfreq-lock-devfreq-in-trans_stat_show.patch @@ -0,0 +1,59 @@ +From 2abb0d5268ae7b5ddf82099b1f8d5aa8414637d4 Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Tue, 24 Sep 2019 10:52:23 +0300 +Subject: PM / devfreq: Lock devfreq in trans_stat_show + +From: Leonard Crestez + +commit 2abb0d5268ae7b5ddf82099b1f8d5aa8414637d4 upstream. + +There is no locking in this sysfs show function so stats printing can +race with a devfreq_update_status called as part of freq switching or +with initialization. + +Also add an assert in devfreq_update_status to make it clear that lock +must be held by caller. + +Fixes: 39688ce6facd ("PM / devfreq: account suspend/resume for stats") +Cc: stable@vger.kernel.org +Signed-off-by: Leonard Crestez +Reviewed-by: Matthias Kaehlcke +Reviewed-by: Chanwoo Choi +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/devfreq/devfreq.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -160,6 +160,7 @@ int devfreq_update_status(struct devfreq + int lev, prev_lev, ret = 0; + unsigned long cur_time; + ++ lockdep_assert_held(&devfreq->lock); + cur_time = jiffies; + + /* Immediately exit if previous_freq is not initialized yet. */ +@@ -1397,12 +1398,17 @@ static ssize_t trans_stat_show(struct de + int i, j; + unsigned int max_state = devfreq->profile->max_state; + +- if (!devfreq->stop_polling && +- devfreq_update_status(devfreq, devfreq->previous_freq)) +- return 0; + if (max_state == 0) + return sprintf(buf, "Not Supported.\n"); + ++ mutex_lock(&devfreq->lock); ++ if (!devfreq->stop_polling && ++ devfreq_update_status(devfreq, devfreq->previous_freq)) { ++ mutex_unlock(&devfreq->lock); ++ return 0; ++ } ++ mutex_unlock(&devfreq->lock); ++ + len = sprintf(buf, " From : To\n"); + len += sprintf(buf + len, " :"); + for (i = 0; i < max_state; i++) diff --git a/queue-5.3/powerpc-perf-disable-trace_imc-pmu.patch b/queue-5.3/powerpc-perf-disable-trace_imc-pmu.patch new file mode 100644 index 00000000000..ab6c24e0f28 --- /dev/null +++ b/queue-5.3/powerpc-perf-disable-trace_imc-pmu.patch @@ -0,0 +1,51 @@ +From 249fad734a25889a4f23ed014d43634af6798063 Mon Sep 17 00:00:00 2001 +From: Madhavan Srinivasan +Date: Mon, 18 Nov 2019 09:14:52 +0530 +Subject: powerpc/perf: Disable trace_imc pmu + +From: Madhavan Srinivasan + +commit 249fad734a25889a4f23ed014d43634af6798063 upstream. + +When a root user or a user with CAP_SYS_ADMIN privilege uses any +trace_imc performance monitoring unit events, to monitor application +or KVM threads, it may result in a checkstop (System crash). + +The cause is frequent switching of the "trace/accumulation" mode of +the In-Memory Collection hardware (LDBAR). + +This patch disables the trace_imc PMU unit entirely to avoid +triggering the checkstop. A future patch will reenable it at a later +stage once a workaround has been developed. + +Fixes: 012ae244845f ("powerpc/perf: Trace imc PMU functions") +Cc: stable@vger.kernel.org # v5.2+ +Signed-off-by: Madhavan Srinivasan +Tested-by: Hariharan T.S. +[mpe: Add pr_info_once() so dmesg shows the PMU has been disabled] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191118034452.9939-1-maddy@linux.vnet.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powernv/opal-imc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powernv/opal-imc.c ++++ b/arch/powerpc/platforms/powernv/opal-imc.c +@@ -285,7 +285,14 @@ static int opal_imc_counters_probe(struc + domain = IMC_DOMAIN_THREAD; + break; + case IMC_TYPE_TRACE: +- domain = IMC_DOMAIN_TRACE; ++ /* ++ * FIXME. Using trace_imc events to monitor application ++ * or KVM thread performance can cause a checkstop ++ * (system crash). ++ * Disable it for now. ++ */ ++ pr_info_once("IMC: disabling trace_imc PMU\n"); ++ domain = -1; + break; + default: + pr_warn("IMC Unknown Device type \n"); diff --git a/queue-5.3/ppdev-fix-ppgettime-ppsettime-ioctls.patch b/queue-5.3/ppdev-fix-ppgettime-ppsettime-ioctls.patch new file mode 100644 index 00000000000..017796f26ec --- /dev/null +++ b/queue-5.3/ppdev-fix-ppgettime-ppsettime-ioctls.patch @@ -0,0 +1,76 @@ +From 998174042da229e2cf5841f574aba4a743e69650 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 8 Nov 2019 21:34:30 +0100 +Subject: ppdev: fix PPGETTIME/PPSETTIME ioctls + +From: Arnd Bergmann + +commit 998174042da229e2cf5841f574aba4a743e69650 upstream. + +Going through the uses of timeval in the user space API, +I noticed two bugs in ppdev that were introduced in the y2038 +conversion: + +* The range check was accidentally moved from ppsettime to + ppgettime + +* On sparc64, the microseconds are in the other half of the + 64-bit word. + +Fix both, and mark the fix for stable backports. + +Cc: stable@vger.kernel.org +Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20191108203435.112759-8-arnd@arndb.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ppdev.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file + if (copy_from_user(time32, argp, sizeof(time32))) + return -EFAULT; + ++ if ((time32[0] < 0) || (time32[1] < 0)) ++ return -EINVAL; ++ + return pp_set_timeout(pp->pdev, time32[0], time32[1]); + + case PPSETTIME64: + if (copy_from_user(time64, argp, sizeof(time64))) + return -EFAULT; + ++ if ((time64[0] < 0) || (time64[1] < 0)) ++ return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] >>= 32; ++ + return pp_set_timeout(pp->pdev, time64[0], time64[1]); + + case PPGETTIME32: + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time32[0] = ts.tv_sec; + time32[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time32[0] < 0) || (time32[1] < 0)) +- return -EINVAL; + + if (copy_to_user(argp, time32, sizeof(time32))) + return -EFAULT; +@@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file + jiffies_to_timespec64(pp->pdev->timeout, &ts); + time64[0] = ts.tv_sec; + time64[1] = ts.tv_nsec / NSEC_PER_USEC; +- if ((time64[0] < 0) || (time64[1] < 0)) +- return -EINVAL; ++ ++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) ++ time64[1] <<= 32; + + if (copy_to_user(argp, time64, sizeof(time64))) + return -EFAULT; diff --git a/queue-5.3/rdma-core-fix-ib_dma_max_seg_size.patch b/queue-5.3/rdma-core-fix-ib_dma_max_seg_size.patch new file mode 100644 index 00000000000..661a6a7ea3d --- /dev/null +++ b/queue-5.3/rdma-core-fix-ib_dma_max_seg_size.patch @@ -0,0 +1,67 @@ +From ecdfdfdbe4d4c74029f2b416b7ee6d0aeb56364a Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 25 Oct 2019 15:58:27 -0700 +Subject: RDMA/core: Fix ib_dma_max_seg_size() + +From: Bart Van Assche + +commit ecdfdfdbe4d4c74029f2b416b7ee6d0aeb56364a upstream. + +If dev->dma_device->params == NULL then the maximum DMA segment size is 64 +KB. See also the dma_get_max_seg_size() implementation. This patch fixes +the following kernel warning: + + DMA-API: infiniband rxe0: mapping sg segment longer than device claims to support [len=126976] [max=65536] + WARNING: CPU: 4 PID: 4848 at kernel/dma/debug.c:1220 debug_dma_map_sg+0x3d9/0x450 + RIP: 0010:debug_dma_map_sg+0x3d9/0x450 + Call Trace: + srp_queuecommand+0x626/0x18d0 [ib_srp] + scsi_queue_rq+0xd02/0x13e0 [scsi_mod] + __blk_mq_try_issue_directly+0x2b3/0x3f0 + blk_mq_request_issue_directly+0xac/0xf0 + blk_insert_cloned_request+0xdf/0x170 + dm_mq_queue_rq+0x43d/0x830 [dm_mod] + __blk_mq_try_issue_directly+0x2b3/0x3f0 + blk_mq_request_issue_directly+0xac/0xf0 + blk_mq_try_issue_list_directly+0xb8/0x170 + blk_mq_sched_insert_requests+0x23c/0x3b0 + blk_mq_flush_plug_list+0x529/0x730 + blk_flush_plug_list+0x21f/0x260 + blk_mq_make_request+0x56b/0xf20 + generic_make_request+0x196/0x660 + submit_bio+0xae/0x290 + blkdev_direct_IO+0x822/0x900 + generic_file_direct_write+0x110/0x200 + __generic_file_write_iter+0x124/0x2a0 + blkdev_write_iter+0x168/0x270 + aio_write+0x1c4/0x310 + io_submit_one+0x971/0x1390 + __x64_sys_io_submit+0x12a/0x390 + do_syscall_64+0x6f/0x2e0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Link: https://lore.kernel.org/r/20191025225830.257535-2-bvanassche@acm.org +Cc: +Fixes: 0b5cb3300ae5 ("RDMA/srp: Increase max_segment_size") +Signed-off-by: Bart Van Assche +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + include/rdma/ib_verbs.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -3978,9 +3978,7 @@ static inline void ib_dma_unmap_sg_attrs + */ + static inline unsigned int ib_dma_max_seg_size(struct ib_device *dev) + { +- struct device_dma_parameters *p = dev->dma_device->dma_parms; +- +- return p ? p->max_segment_size : UINT_MAX; ++ return dma_get_max_seg_size(dev->dma_device); + } + + /** diff --git a/queue-5.3/s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch b/queue-5.3/s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch new file mode 100644 index 00000000000..85c324237c7 --- /dev/null +++ b/queue-5.3/s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch @@ -0,0 +1,65 @@ +From ab874f22d35a8058d8fdee5f13eb69d8867efeae Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Wed, 11 Sep 2019 19:42:23 +0200 +Subject: s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported + +From: Gerald Schaefer + +commit ab874f22d35a8058d8fdee5f13eb69d8867efeae upstream. + +On older HW or under a hypervisor, w/o the instruction-execution- +protection (IEP) facility, and also w/o EDAT-1, a translation-specification +exception may be recognized when bit 55 of a pte is one (_PAGE_NOEXEC). + +The current code tries to prevent setting _PAGE_NOEXEC in such cases, +by removing it within set_pte_at(). However, ptep_set_access_flags() +will modify a pte directly, w/o using set_pte_at(). There is at least +one scenario where this can result in an active pte with _PAGE_NOEXEC +set, which would then lead to a panic due to a translation-specification +exception (write to swapped out page): + +do_swap_page + pte = mk_pte (with _PAGE_NOEXEC bit) + set_pte_at (will remove _PAGE_NOEXEC bit in page table, but keep it + in local variable pte) + vmf->orig_pte = pte (pte still contains _PAGE_NOEXEC bit) + do_wp_page + wp_page_reuse + entry = vmf->orig_pte (still with _PAGE_NOEXEC bit) + ptep_set_access_flags (writes entry with _PAGE_NOEXEC bit) + +Fix this by clearing _PAGE_NOEXEC already in mk_pte_phys(), where the +pgprot value is applied, so that no pte with _PAGE_NOEXEC will ever be +visible, if it is not supported. The check in set_pte_at() can then also +be removed. + +Cc: # 4.11+ +Fixes: 57d7f939e7bd ("s390: add no-execute support") +Signed-off-by: Gerald Schaefer +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/pgtable.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -1172,8 +1172,6 @@ void gmap_pmdp_idte_global(struct mm_str + static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t entry) + { +- if (!MACHINE_HAS_NX) +- pte_val(entry) &= ~_PAGE_NOEXEC; + if (pte_present(entry)) + pte_val(entry) &= ~_PAGE_UNUSED; + if (mm_has_pgste(mm)) +@@ -1190,6 +1188,8 @@ static inline pte_t mk_pte_phys(unsigned + { + pte_t __pte; + pte_val(__pte) = physpage + pgprot_val(pgprot); ++ if (!MACHINE_HAS_NX) ++ pte_val(__pte) &= ~_PAGE_NOEXEC; + return pte_mkyoung(__pte); + } + diff --git a/queue-5.3/series b/queue-5.3/series index a41641dc6e9..bcae4b18bd1 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -72,3 +72,53 @@ dm-writecache-handle-req_fua.patch dm-zoned-reduce-overhead-of-backing-device-checks.patch workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch workqueue-fix-pwq-ref-leak-in-rescuer_thread.patch +asoc-rt5645-fixed-buddy-jack-support.patch +asoc-rt5645-fixed-typo-for-buddy-jack-support.patch +asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch +asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch +md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch +blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch +cgroup-pids-use-atomic64_t-for-pids-limit.patch +wil6210-check-len-before-memcpy-calls.patch +ar5523-check-null-before-memcpy-in-ar5523_cmd.patch +s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch +media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch +media-bdisp-fix-memleak-on-release.patch +media-radio-wl1273-fix-interrupt-masking-on-release.patch +media-cec.h-cec_op_rec_flag_-values-were-swapped.patch +cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch +cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch +cpuidle-teo-rename-local-variable-in-teo_select.patch +cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch +cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch +erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch +perf-tests-fix-out-of-bounds-memory-access.patch +powerpc-perf-disable-trace_imc-pmu.patch +intel_th-fix-a-double-put_device-in-error-path.patch +intel_th-pci-add-ice-lake-cpu-support.patch +intel_th-pci-add-tiger-lake-cpu-support.patch +pm-devfreq-lock-devfreq-in-trans_stat_show.patch +cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch +alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch +alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch +acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch +acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch +acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch +acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch +acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch +acpi-osl-only-free-map-once-in-osl.c.patch +acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch +acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch +pinctrl-rza2-fix-gpio-name-typos.patch +pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch +pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch +mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch +arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch +rdma-core-fix-ib_dma_max_seg_size.patch +ppdev-fix-ppgettime-ppsettime-ioctls.patch +stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch +coresight-serialize-enabling-disabling-a-link-device.patch diff --git a/queue-5.3/stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch b/queue-5.3/stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch new file mode 100644 index 00000000000..994f77a66b2 --- /dev/null +++ b/queue-5.3/stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch @@ -0,0 +1,60 @@ +From 0a8f72fafb3f72a08df4ee491fcbeaafd6de85fd Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Thu, 14 Nov 2019 08:42:00 +0200 +Subject: stm class: Lose the protocol driver when dropping its reference + +From: Alexander Shishkin + +commit 0a8f72fafb3f72a08df4ee491fcbeaafd6de85fd upstream. + +Commit c7fd62bc69d02 ("stm class: Introduce framing protocol drivers") +forgot to tear down the link between an stm device and its protocol +driver when policy is removed. This leads to an invalid pointer reference +if one tries to write to an stm device after the policy has been removed +and the protocol driver module unloaded, leading to the below splat: + +> BUG: unable to handle page fault for address: ffffffffc0737068 +> #PF: supervisor read access in kernel mode +> #PF: error_code(0x0000) - not-present page +> PGD 3d780f067 P4D 3d780f067 PUD 3d7811067 PMD 492781067 PTE 0 +> Oops: 0000 [#1] SMP NOPTI +> CPU: 1 PID: 26122 Comm: cat Not tainted 5.4.0-rc5+ #1 +> RIP: 0010:stm_output_free+0x40/0xc0 [stm_core] +> Call Trace: +> stm_char_release+0x3e/0x70 [stm_core] +> __fput+0xc6/0x260 +> ____fput+0xe/0x10 +> task_work_run+0x9d/0xc0 +> exit_to_usermode_loop+0x103/0x110 +> do_syscall_64+0x19d/0x1e0 +> entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fix this by tearing down the link from an stm device to its protocol +driver when the policy involving that driver is removed. + +Signed-off-by: Alexander Shishkin +Fixes: c7fd62bc69d02 ("stm class: Introduce framing protocol drivers") +Reported-by: Ammy Yi +Tested-by: Ammy Yi +CC: stable@vger.kernel.org # v4.20+ +Link: https://lore.kernel.org/r/20191114064201.43089-2-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/policy.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwtracing/stm/policy.c ++++ b/drivers/hwtracing/stm/policy.c +@@ -345,7 +345,11 @@ void stp_policy_unbind(struct stp_policy + stm->policy = NULL; + policy->stm = NULL; + ++ /* ++ * Drop the reference on the protocol driver and lose the link. ++ */ + stm_put_protocol(stm->pdrv); ++ stm->pdrv = NULL; + stm_put_device(stm); + } + diff --git a/queue-5.3/wil6210-check-len-before-memcpy-calls.patch b/queue-5.3/wil6210-check-len-before-memcpy-calls.patch new file mode 100644 index 00000000000..781d141c07f --- /dev/null +++ b/queue-5.3/wil6210-check-len-before-memcpy-calls.patch @@ -0,0 +1,54 @@ +From 2c840676be8ffc624bf9bb4490d944fd13c02d71 Mon Sep 17 00:00:00 2001 +From: Denis Efremov +Date: Tue, 1 Oct 2019 15:08:23 +0300 +Subject: wil6210: check len before memcpy() calls + +From: Denis Efremov + +commit 2c840676be8ffc624bf9bb4490d944fd13c02d71 upstream. + +memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with +src == NULL and len == 0. This is an undefined behavior. Fix it +by checking "ie_len > 0" before the memcpy() calls. + +As suggested by GCC documentation: +"The pointers passed to memmove (and similar functions in ) +must be non-null even when nbytes==0, so GCC can use that information +to remove the check after the memmove call." [1] + +[1] https://gcc.gnu.org/gcc-4.9/porting_to.html + +Cc: Maya Erez +Cc: Kalle Valo +Cc: "David S. Miller" +Cc: stable@vger.kernel.org +Signed-off-by: Denis Efremov +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/wil6210/wmi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/wil6210/wmi.c ++++ b/drivers/net/wireless/ath/wil6210/wmi.c +@@ -2478,7 +2478,8 @@ int wmi_set_ie(struct wil6210_vif *vif, + cmd->mgmt_frm_type = type; + /* BUG: FW API define ieLen as u8. Will fix FW */ + cmd->ie_len = cpu_to_le16(ie_len); +- memcpy(cmd->ie_info, ie, ie_len); ++ if (ie_len) ++ memcpy(cmd->ie_info, ie, ie_len); + rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len); + kfree(cmd); + out: +@@ -2514,7 +2515,8 @@ int wmi_update_ft_ies(struct wil6210_vif + } + + cmd->ie_len = cpu_to_le16(ie_len); +- memcpy(cmd->ie_info, ie, ie_len); ++ if (ie_len) ++ memcpy(cmd->ie_info, ie, ie_len); + rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len); + kfree(cmd); +