From: Sasha Levin Date: Sun, 17 Feb 2019 23:18:03 +0000 (-0500) Subject: patches for 4.19 X-Git-Tag: v3.18.135~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=607bd65f4b2fe56644d0fdb6a2c2e0c586f2fb6b;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-numa-use-correct-type-for-printing-addresses-on.patch b/queue-4.19/acpi-numa-use-correct-type-for-printing-addresses-on.patch new file mode 100644 index 00000000000..db5f9f6f320 --- /dev/null +++ b/queue-4.19/acpi-numa-use-correct-type-for-printing-addresses-on.patch @@ -0,0 +1,89 @@ +From 3ab461b17e4110e68305443be05114660c2b4cc2 Mon Sep 17 00:00:00 2001 +From: Chao Fan +Date: Wed, 26 Dec 2018 11:34:50 +0800 +Subject: ACPI: NUMA: Use correct type for printing addresses on i386-PAE + +[ Upstream commit b9ced18acf68dffebe6888c7ec765a2b1db7a039 ] + +The addresses of NUMA nodes are not printed correctly on i386-PAE +which is misleading. + +Here is a debian9-32bit with PAE in a QEMU guest having more than 4G +of memory: + +qemu-system-i386 \ +-hda /var/lib/libvirt/images/debian32.qcow2 \ +-m 5G \ +-enable-kvm \ +-smp 10 \ +-numa node,mem=512M,nodeid=0,cpus=0 \ +-numa node,mem=512M,nodeid=1,cpus=1 \ +-numa node,mem=512M,nodeid=2,cpus=2 \ +-numa node,mem=512M,nodeid=3,cpus=3 \ +-numa node,mem=512M,nodeid=4,cpus=4 \ +-numa node,mem=512M,nodeid=5,cpus=5 \ +-numa node,mem=512M,nodeid=6,cpus=6 \ +-numa node,mem=512M,nodeid=7,cpus=7 \ +-numa node,mem=512M,nodeid=8,cpus=8 \ +-numa node,mem=512M,nodeid=9,cpus=9 \ +-serial stdio + +Because of the wrong value type, it prints as below: + +[ 0.021049] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled +[ 0.021740] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled +[ 0.022425] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled +[ 0.023092] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled +[ 0.023764] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled +[ 0.024431] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled +[ 0.025104] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled +[ 0.025791] ACPI: SRAT Memory (0x0 length 0x20000000) in proximity domain 6 enabled +[ 0.026412] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 7 enabled +[ 0.027118] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 8 enabled +[ 0.027802] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 9 enabled + +The upper half of the start address of the NUMA domains between 6 +and 9 inclusive was cut, so the printed values are incorrect. + +Fix the value type, to get the correct values in the log as follows: + +[ 0.023698] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled +[ 0.024325] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled +[ 0.024981] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled +[ 0.025659] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled +[ 0.026317] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled +[ 0.026980] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled +[ 0.027635] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled +[ 0.028311] ACPI: SRAT Memory (0x100000000 length 0x20000000) in proximity domain 6 enabled +[ 0.028985] ACPI: SRAT Memory (0x120000000 length 0x20000000) in proximity domain 7 enabled +[ 0.029667] ACPI: SRAT Memory (0x140000000 length 0x20000000) in proximity domain 8 enabled +[ 0.030334] ACPI: SRAT Memory (0x160000000 length 0x20000000) in proximity domain 9 enabled + +Signed-off-by: Chao Fan +[ rjw: Subject & changelog ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/numa.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c +index 85167603b9c9..0da58f0bf7e5 100644 +--- a/drivers/acpi/numa.c ++++ b/drivers/acpi/numa.c +@@ -147,9 +147,9 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header) + { + struct acpi_srat_mem_affinity *p = + (struct acpi_srat_mem_affinity *)header; +- pr_debug("SRAT Memory (0x%lx length 0x%lx) in proximity domain %d %s%s%s\n", +- (unsigned long)p->base_address, +- (unsigned long)p->length, ++ pr_debug("SRAT Memory (0x%llx length 0x%llx) in proximity domain %d %s%s%s\n", ++ (unsigned long long)p->base_address, ++ (unsigned long long)p->length, + p->proximity_domain, + (p->flags & ACPI_SRAT_MEM_ENABLED) ? + "enabled" : "disabled", +-- +2.19.1 + diff --git a/queue-4.19/arm-8789-1-signal-copy-registers-using-__copy_to_use.patch b/queue-4.19/arm-8789-1-signal-copy-registers-using-__copy_to_use.patch new file mode 100644 index 00000000000..283efa3ea47 --- /dev/null +++ b/queue-4.19/arm-8789-1-signal-copy-registers-using-__copy_to_use.patch @@ -0,0 +1,86 @@ +From dd94fc3a4c48b5ae18162573e2507a9dfaab6fd5 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:07 -0500 +Subject: ARM: 8789/1: signal: copy registers using __copy_to_user() + +Commit 5ca451cf6ed04443774bbb7ee45332dafa42e99f upstream. + +When saving the ARM integer registers, use __copy_to_user() to +copy them into user signal frame, rather than __put_user_error(). +This has the benefit of disabling/enabling PAN once for the whole copy +intead of once per write. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/signal.c | 49 ++++++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 22 deletions(-) + +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index b8f766cf3a90..76fe75d36312 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -288,30 +288,35 @@ static int + setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set) + { + struct aux_sigframe __user *aux; ++ struct sigcontext context; + int err = 0; + +- __put_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err); +- __put_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err); +- __put_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err); +- __put_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err); +- __put_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err); +- __put_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err); +- __put_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err); +- __put_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err); +- __put_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err); +- __put_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err); +- __put_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err); +- __put_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err); +- __put_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err); +- __put_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err); +- __put_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err); +- __put_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err); +- __put_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err); +- +- __put_user_error(current->thread.trap_no, &sf->uc.uc_mcontext.trap_no, err); +- __put_user_error(current->thread.error_code, &sf->uc.uc_mcontext.error_code, err); +- __put_user_error(current->thread.address, &sf->uc.uc_mcontext.fault_address, err); +- __put_user_error(set->sig[0], &sf->uc.uc_mcontext.oldmask, err); ++ context = (struct sigcontext) { ++ .arm_r0 = regs->ARM_r0, ++ .arm_r1 = regs->ARM_r1, ++ .arm_r2 = regs->ARM_r2, ++ .arm_r3 = regs->ARM_r3, ++ .arm_r4 = regs->ARM_r4, ++ .arm_r5 = regs->ARM_r5, ++ .arm_r6 = regs->ARM_r6, ++ .arm_r7 = regs->ARM_r7, ++ .arm_r8 = regs->ARM_r8, ++ .arm_r9 = regs->ARM_r9, ++ .arm_r10 = regs->ARM_r10, ++ .arm_fp = regs->ARM_fp, ++ .arm_ip = regs->ARM_ip, ++ .arm_sp = regs->ARM_sp, ++ .arm_lr = regs->ARM_lr, ++ .arm_pc = regs->ARM_pc, ++ .arm_cpsr = regs->ARM_cpsr, ++ ++ .trap_no = current->thread.trap_no, ++ .error_code = current->thread.error_code, ++ .fault_address = current->thread.address, ++ .oldmask = set->sig[0], ++ }; ++ ++ err |= __copy_to_user(&sf->uc.uc_mcontext, &context, sizeof(context)); + + err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(*set)); + +-- +2.19.1 + diff --git a/queue-4.19/arm-8790-1-signal-always-use-__copy_to_user-to-save-.patch b/queue-4.19/arm-8790-1-signal-always-use-__copy_to_user-to-save-.patch new file mode 100644 index 00000000000..012341d623b --- /dev/null +++ b/queue-4.19/arm-8790-1-signal-always-use-__copy_to_user-to-save-.patch @@ -0,0 +1,54 @@ +From 055580000808e87cc4412a57fe2d8acc0e134212 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:08 -0500 +Subject: ARM: 8790/1: signal: always use __copy_to_user to save iwmmxt context + +Commit 73839798af7ebc6c8d0c9271ebbbc148700e521f upstream. + +When setting a dummy iwmmxt context, create a local instance and +use __copy_to_user both cases whether iwmmxt is being used or not. +This has the benefit of disabling/enabling PAN once for the whole copy +intead of once per write. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/signal.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index 76fe75d36312..464393d241e1 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -77,8 +77,6 @@ static int preserve_iwmmxt_context(struct iwmmxt_sigframe __user *frame) + kframe->magic = IWMMXT_MAGIC; + kframe->size = IWMMXT_STORAGE_SIZE; + iwmmxt_task_copy(current_thread_info(), &kframe->storage); +- +- err = __copy_to_user(frame, kframe, sizeof(*frame)); + } else { + /* + * For bug-compatibility with older kernels, some space +@@ -86,10 +84,14 @@ static int preserve_iwmmxt_context(struct iwmmxt_sigframe __user *frame) + * Set the magic and size appropriately so that properly + * written userspace can skip it reliably: + */ +- __put_user_error(DUMMY_MAGIC, &frame->magic, err); +- __put_user_error(IWMMXT_STORAGE_SIZE, &frame->size, err); ++ *kframe = (struct iwmmxt_sigframe) { ++ .magic = DUMMY_MAGIC, ++ .size = IWMMXT_STORAGE_SIZE, ++ }; + } + ++ err = __copy_to_user(frame, kframe, sizeof(*kframe)); ++ + return err; + } + +-- +2.19.1 + diff --git a/queue-4.19/arm-8791-1-vfp-use-__copy_to_user-when-saving-vfp-st.patch b/queue-4.19/arm-8791-1-vfp-use-__copy_to_user-when-saving-vfp-st.patch new file mode 100644 index 00000000000..e041215eb6f --- /dev/null +++ b/queue-4.19/arm-8791-1-vfp-use-__copy_to_user-when-saving-vfp-st.patch @@ -0,0 +1,118 @@ +From bb4be39ef85e8c19d08cacf889ca8b20442f6ce0 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:09 -0500 +Subject: ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state + +Commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 upstream. + +Use __copy_to_user() rather than __put_user_error() for individual +members when saving VFP state. +This has the benefit of disabling/enabling PAN once per copied struct +intead of once per write. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/thread_info.h | 4 ++-- + arch/arm/kernel/signal.c | 13 +++++++------ + arch/arm/vfp/vfpmodule.c | 20 ++++++++------------ + 3 files changed, 17 insertions(+), 20 deletions(-) + +diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h +index 9b37b6ab27fe..8f55dc520a3e 100644 +--- a/arch/arm/include/asm/thread_info.h ++++ b/arch/arm/include/asm/thread_info.h +@@ -121,8 +121,8 @@ extern void vfp_flush_hwstate(struct thread_info *); + struct user_vfp; + struct user_vfp_exc; + +-extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *, +- struct user_vfp_exc __user *); ++extern int vfp_preserve_user_clear_hwstate(struct user_vfp *, ++ struct user_vfp_exc *); + extern int vfp_restore_user_hwstate(struct user_vfp *, + struct user_vfp_exc *); + #endif +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index 464393d241e1..1e2ecfe080bb 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -137,17 +137,18 @@ static int restore_iwmmxt_context(char __user **auxp) + + static int preserve_vfp_context(struct vfp_sigframe __user *frame) + { +- const unsigned long magic = VFP_MAGIC; +- const unsigned long size = VFP_STORAGE_SIZE; ++ struct vfp_sigframe kframe; + int err = 0; + +- __put_user_error(magic, &frame->magic, err); +- __put_user_error(size, &frame->size, err); ++ memset(&kframe, 0, sizeof(kframe)); ++ kframe.magic = VFP_MAGIC; ++ kframe.size = VFP_STORAGE_SIZE; + ++ err = vfp_preserve_user_clear_hwstate(&kframe.ufp, &kframe.ufp_exc); + if (err) +- return -EFAULT; ++ return err; + +- return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc); ++ return __copy_to_user(frame, &kframe, sizeof(kframe)); + } + + static int restore_vfp_context(char __user **auxp) +diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c +index dc7e6b50ef67..2b287d0d6bc2 100644 +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -553,12 +553,11 @@ void vfp_flush_hwstate(struct thread_info *thread) + * Save the current VFP state into the provided structures and prepare + * for entry into a new function (signal handler). + */ +-int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp, +- struct user_vfp_exc __user *ufp_exc) ++int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp, ++ struct user_vfp_exc *ufp_exc) + { + struct thread_info *thread = current_thread_info(); + struct vfp_hard_struct *hwstate = &thread->vfpstate.hard; +- int err = 0; + + /* Ensure that the saved hwstate is up-to-date. */ + vfp_sync_hwstate(thread); +@@ -567,22 +566,19 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp, + * Copy the floating point registers. There can be unused + * registers see asm/hwcap.h for details. + */ +- err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs, +- sizeof(hwstate->fpregs)); ++ memcpy(&ufp->fpregs, &hwstate->fpregs, sizeof(hwstate->fpregs)); ++ + /* + * Copy the status and control register. + */ +- __put_user_error(hwstate->fpscr, &ufp->fpscr, err); ++ ufp->fpscr = hwstate->fpscr; + + /* + * Copy the exception registers. + */ +- __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err); +- __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err); +- __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err); +- +- if (err) +- return -EFAULT; ++ ufp_exc->fpexc = hwstate->fpexc; ++ ufp_exc->fpinst = hwstate->fpinst; ++ ufp_exc->fpinst2 = ufp_exc->fpinst2; + + /* Ensure that VFP is disabled. */ + vfp_flush_hwstate(thread); +-- +2.19.1 + diff --git a/queue-4.19/arm-8792-1-oabi-compat-copy-oabi-events-using-__copy.patch b/queue-4.19/arm-8792-1-oabi-compat-copy-oabi-events-using-__copy.patch new file mode 100644 index 00000000000..0af37417a62 --- /dev/null +++ b/queue-4.19/arm-8792-1-oabi-compat-copy-oabi-events-using-__copy.patch @@ -0,0 +1,50 @@ +From 593d780beb3961b3ff91b7c5ba29dc7436db2e9d Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:10 -0500 +Subject: ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user() + +Commit 319508902600c2688e057750148487996396e9ca upstream. + +Copy events to user using __copy_to_user() rather than copy members of +individually with __put_user_error(). +This has the benefit of disabling/enabling PAN once per event intead of +once per event member. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/sys_oabi-compat.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c +index f0dd4b6ebb63..40da0872170f 100644 +--- a/arch/arm/kernel/sys_oabi-compat.c ++++ b/arch/arm/kernel/sys_oabi-compat.c +@@ -277,6 +277,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, + int maxevents, int timeout) + { + struct epoll_event *kbuf; ++ struct oabi_epoll_event e; + mm_segment_t fs; + long ret, err, i; + +@@ -295,8 +296,11 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, + set_fs(fs); + err = 0; + for (i = 0; i < ret; i++) { +- __put_user_error(kbuf[i].events, &events->events, err); +- __put_user_error(kbuf[i].data, &events->data, err); ++ e.events = kbuf[i].events; ++ e.data = kbuf[i].data; ++ err = __copy_to_user(events, &e, sizeof(e)); ++ if (err) ++ break; + events++; + } + kfree(kbuf); +-- +2.19.1 + diff --git a/queue-4.19/arm-8793-1-signal-replace-__put_user_error-with-__pu.patch b/queue-4.19/arm-8793-1-signal-replace-__put_user_error-with-__pu.patch new file mode 100644 index 00000000000..ce21df82a6d --- /dev/null +++ b/queue-4.19/arm-8793-1-signal-replace-__put_user_error-with-__pu.patch @@ -0,0 +1,55 @@ +From fea089950ee4688d362eec71a103a67784e1f40d Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:11 -0500 +Subject: ARM: 8793/1: signal: replace __put_user_error with __put_user + +Commit 18ea66bd6e7a95bdc598223d72757190916af28b upstream. + +With Spectre-v1.1 mitigations, __put_user_error is pointless. In an attempt +to remove it, replace its references in frame setups with __put_user. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/signal.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index 1e2ecfe080bb..b908382b69ff 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -336,7 +336,7 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set) + if (err == 0) + err |= preserve_vfp_context(&aux->vfp); + #endif +- __put_user_error(0, &aux->end_magic, err); ++ err |= __put_user(0, &aux->end_magic); + + return err; + } +@@ -499,7 +499,7 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs) + /* + * Set uc.uc_flags to a value which sc.trap_no would never have. + */ +- __put_user_error(0x5ac3c35a, &frame->uc.uc_flags, err); ++ err = __put_user(0x5ac3c35a, &frame->uc.uc_flags); + + err |= setup_sigframe(frame, regs, set); + if (err == 0) +@@ -519,8 +519,8 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs) + + err |= copy_siginfo_to_user(&frame->info, &ksig->info); + +- __put_user_error(0, &frame->sig.uc.uc_flags, err); +- __put_user_error(NULL, &frame->sig.uc.uc_link, err); ++ err |= __put_user(0, &frame->sig.uc.uc_flags); ++ err |= __put_user(NULL, &frame->sig.uc.uc_link); + + err |= __save_altstack(&frame->sig.uc.uc_stack, regs->ARM_sp); + err |= setup_sigframe(&frame->sig, regs, set); +-- +2.19.1 + diff --git a/queue-4.19/arm-8794-1-uaccess-prevent-speculative-use-of-the-cu.patch b/queue-4.19/arm-8794-1-uaccess-prevent-speculative-use-of-the-cu.patch new file mode 100644 index 00000000000..ec4ca727d80 --- /dev/null +++ b/queue-4.19/arm-8794-1-uaccess-prevent-speculative-use-of-the-cu.patch @@ -0,0 +1,50 @@ +From d776242c043bad0256f5da66290bdabce17a9a60 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:12 -0500 +Subject: ARM: 8794/1: uaccess: Prevent speculative use of the current + addr_limit + +Commit 621afc677465db231662ed126ae1f355bf8eac47 upstream. + +A mispredicted conditional call to set_fs could result in the wrong +addr_limit being forwarded under speculation to a subsequent access_ok +check, potentially forming part of a spectre-v1 attack using uaccess +routines. + +This patch prevents this forwarding from taking place, but putting heavy +barriers in set_fs after writing the addr_limit. + +Porting commit c2f0ad4fc089cff8 ("arm64: uaccess: Prevent speculative use +of the current addr_limit"). + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 5451e1f05a19..d65ef85fc617 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -69,6 +69,14 @@ extern int __put_user_bad(void); + static inline void set_fs(mm_segment_t fs) + { + current_thread_info()->addr_limit = fs; ++ ++ /* ++ * Prevent a mispredicted conditional call to set_fs from forwarding ++ * the wrong address limit to access_ok under speculation. ++ */ ++ dsb(nsh); ++ isb(); ++ + modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER); + } + +-- +2.19.1 + diff --git a/queue-4.19/arm-8795-1-spectre-v1.1-use-put_user-for-__put_user.patch b/queue-4.19/arm-8795-1-spectre-v1.1-use-put_user-for-__put_user.patch new file mode 100644 index 00000000000..32d43eef135 --- /dev/null +++ b/queue-4.19/arm-8795-1-spectre-v1.1-use-put_user-for-__put_user.patch @@ -0,0 +1,63 @@ +From 778a1c663036418746f6af12ef1946b20d723913 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:13 -0500 +Subject: ARM: 8795/1: spectre-v1.1: use put_user() for __put_user() + +Commit e3aa6243434fd9a82e84bb79ab1abd14f2d9a5a7 upstream. + +When Spectre mitigation is required, __put_user() needs to include +check_uaccess. This is already the case for put_user(), so just make +__put_user() an alias of put_user(). + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess.h | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index d65ef85fc617..1191e7da8fab 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -370,6 +370,14 @@ do { \ + __pu_err; \ + }) + ++#ifdef CONFIG_CPU_SPECTRE ++/* ++ * When mitigating Spectre variant 1.1, all accessors need to include ++ * verification of the address space. ++ */ ++#define __put_user(x, ptr) put_user(x, ptr) ++ ++#else + #define __put_user(x, ptr) \ + ({ \ + long __pu_err = 0; \ +@@ -377,12 +385,6 @@ do { \ + __pu_err; \ + }) + +-#define __put_user_error(x, ptr, err) \ +-({ \ +- __put_user_switch((x), (ptr), (err), __put_user_nocheck); \ +- (void) 0; \ +-}) +- + #define __put_user_nocheck(x, __pu_ptr, __err, __size) \ + do { \ + unsigned long __pu_addr = (unsigned long)__pu_ptr; \ +@@ -462,6 +464,7 @@ do { \ + : "r" (x), "i" (-EFAULT) \ + : "cc") + ++#endif /* !CONFIG_CPU_SPECTRE */ + + #ifdef CONFIG_MMU + extern unsigned long __must_check +-- +2.19.1 + diff --git a/queue-4.19/arm-8796-1-spectre-v1-v1.1-provide-helpers-for-addre.patch b/queue-4.19/arm-8796-1-spectre-v1-v1.1-provide-helpers-for-addre.patch new file mode 100644 index 00000000000..54c069eae08 --- /dev/null +++ b/queue-4.19/arm-8796-1-spectre-v1-v1.1-provide-helpers-for-addre.patch @@ -0,0 +1,103 @@ +From 4edea915d4efbb22690d54ff860f48123e2d594e Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:14 -0500 +Subject: ARM: 8796/1: spectre-v1,v1.1: provide helpers for address + sanitization + +Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream. + +Introduce C and asm helpers to sanitize user address, taking the +address range they target into account. + +Use asm helper for existing sanitization in __copy_from_user(). + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/assembler.h | 11 +++++++++++ + arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++++++++ + arch/arm/lib/copy_from_user.S | 6 +----- + 3 files changed, 38 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index b17ee03d280b..88286dd483ff 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -467,6 +467,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) + #endif + .endm + ++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req ++#ifdef CONFIG_CPU_SPECTRE ++ sub \tmp, \limit, #1 ++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr ++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) { ++ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) } ++ movlo \addr, #0 @ if (tmp < 0) addr = NULL ++ csdb ++#endif ++ .endm ++ + .macro uaccess_disable, tmp, isb=1 + #ifdef CONFIG_CPU_SW_DOMAIN_PAN + /* +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index 1191e7da8fab..c136eef8f690 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -99,6 +99,32 @@ static inline void set_fs(mm_segment_t fs) + #define __inttype(x) \ + __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL)) + ++/* ++ * Sanitise a uaccess pointer such that it becomes NULL if addr+size ++ * is above the current addr_limit. ++ */ ++#define uaccess_mask_range_ptr(ptr, size) \ ++ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size)) ++static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr, ++ size_t size) ++{ ++ void __user *safe_ptr = (void __user *)ptr; ++ unsigned long tmp; ++ ++ asm volatile( ++ " sub %1, %3, #1\n" ++ " subs %1, %1, %0\n" ++ " addhs %1, %1, #1\n" ++ " subhss %1, %1, %2\n" ++ " movlo %0, #0\n" ++ : "+r" (safe_ptr), "=&r" (tmp) ++ : "r" (size), "r" (current_thread_info()->addr_limit) ++ : "cc"); ++ ++ csdb(); ++ return safe_ptr; ++} ++ + /* + * Single-value transfer routines. They automatically use the right + * size if we just have the right pointer type. Note that the functions +diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S +index a826df3d3814..6709a8d33963 100644 +--- a/arch/arm/lib/copy_from_user.S ++++ b/arch/arm/lib/copy_from_user.S +@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user) + #ifdef CONFIG_CPU_SPECTRE + get_thread_info r3 + ldr r3, [r3, #TI_ADDR_LIMIT] +- adds ip, r1, r2 @ ip=addr+size +- sub r3, r3, #1 @ addr_limit - 1 +- cmpcc ip, r3 @ if (addr+size > addr_limit - 1) +- movcs r1, #0 @ addr = NULL +- csdb ++ uaccess_mask_range_ptr r1, r2, r3, ip + #endif + + #include "copy_template.S" +-- +2.19.1 + diff --git a/queue-4.19/arm-8797-1-spectre-v1.1-harden-__copy_to_user.patch b/queue-4.19/arm-8797-1-spectre-v1.1-harden-__copy_to_user.patch new file mode 100644 index 00000000000..0d1d658d8ff --- /dev/null +++ b/queue-4.19/arm-8797-1-spectre-v1.1-harden-__copy_to_user.patch @@ -0,0 +1,58 @@ +From 85374f5aa123c73cc8caa698502d61f154991c3a Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:15 -0500 +Subject: ARM: 8797/1: spectre-v1.1: harden __copy_to_user + +Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream. + +Sanitize user pointer given to __copy_to_user, both for standard version +and memcopy version of the user accessor. + +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/lib/copy_to_user.S | 6 +++++- + arch/arm/lib/uaccess_with_memcpy.c | 3 ++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S +index caf5019d8161..970abe521197 100644 +--- a/arch/arm/lib/copy_to_user.S ++++ b/arch/arm/lib/copy_to_user.S +@@ -94,6 +94,11 @@ + + ENTRY(__copy_to_user_std) + WEAK(arm_copy_to_user) ++#ifdef CONFIG_CPU_SPECTRE ++ get_thread_info r3 ++ ldr r3, [r3, #TI_ADDR_LIMIT] ++ uaccess_mask_range_ptr r0, r2, r3, ip ++#endif + + #include "copy_template.S" + +@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std) + rsb r0, r0, r2 + copy_abort_end + .popsection +- +diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c +index 9b4ed1728616..73dc7360cbdd 100644 +--- a/arch/arm/lib/uaccess_with_memcpy.c ++++ b/arch/arm/lib/uaccess_with_memcpy.c +@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) + n = __copy_to_user_std(to, from, n); + uaccess_restore(ua_flags); + } else { +- n = __copy_to_user_memcpy(to, from, n); ++ n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n), ++ from, n); + } + return n; + } +-- +2.19.1 + diff --git a/queue-4.19/arm-8810-1-vfp-fix-wrong-assignement-to-ufp_exc.patch b/queue-4.19/arm-8810-1-vfp-fix-wrong-assignement-to-ufp_exc.patch new file mode 100644 index 00000000000..60abdb2dc70 --- /dev/null +++ b/queue-4.19/arm-8810-1-vfp-fix-wrong-assignement-to-ufp_exc.patch @@ -0,0 +1,40 @@ +From 64ba38fbb4c230f312145f4ba6ef7c53062df731 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Wed, 13 Feb 2019 16:32:16 -0500 +Subject: ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc + +Commit 5df7a99bdd0de4a0480320264c44c04543c29d5a upstream. + +In vfp_preserve_user_clear_hwstate, ufp_exc->fpinst2 gets assigned to +itself. It should actually be hwstate->fpinst2 that gets assigned to the +ufp_exc field. + +Fixes commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 ("ARM: 8791/1: +vfp: use __copy_to_user() when saving VFP state"). + +Reported-by: David Binderman +Signed-off-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/vfp/vfpmodule.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c +index 2b287d0d6bc2..66c5e693428a 100644 +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -578,7 +578,7 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp, + */ + ufp_exc->fpexc = hwstate->fpexc; + ufp_exc->fpinst = hwstate->fpinst; +- ufp_exc->fpinst2 = ufp_exc->fpinst2; ++ ufp_exc->fpinst2 = hwstate->fpinst2; + + /* Ensure that VFP is disabled. */ + vfp_flush_hwstate(thread); +-- +2.19.1 + diff --git a/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch b/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch new file mode 100644 index 00000000000..17b8264b5c7 --- /dev/null +++ b/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch @@ -0,0 +1,112 @@ +From 697fb4137d155e29837ccd8b085f97f4f5dd8e3b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:20 -0500 +Subject: ARM: add PROC_VTABLE and PROC_TABLE macros + +Commit e209950fdd065d2cc46e6338e47e52841b830cba upstream. + +Allow the way we access members of the processor vtable to be changed +at compile time. We will need to move to per-CPU vtables to fix the +Spectre variant 2 issues on big.Little systems. + +However, we have a couple of calls that do not need the vtable +treatment, and indeed cause a kernel warning due to the (later) use +of smp_processor_id(), so also introduce the PROC_TABLE macro for +these which always use CPU 0's function pointers. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++----------- + arch/arm/kernel/setup.c | 4 +--- + 2 files changed, 27 insertions(+), 16 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index 30c499146320..c259cc49c641 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -23,7 +23,7 @@ struct mm_struct; + /* + * Don't change this structure - ASM code relies on it. + */ +-extern struct processor { ++struct processor { + /* MISC + * get data abort address/flags + */ +@@ -79,9 +79,13 @@ extern struct processor { + unsigned int suspend_size; + void (*do_suspend)(void *); + void (*do_resume)(void *); +-} processor; ++}; + + #ifndef MULTI_CPU ++static inline void init_proc_vtable(const struct processor *p) ++{ ++} ++ + extern void cpu_proc_init(void); + extern void cpu_proc_fin(void); + extern int cpu_do_idle(void); +@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn)); + extern void cpu_do_suspend(void *); + extern void cpu_do_resume(void *); + #else +-#define cpu_proc_init processor._proc_init +-#define cpu_check_bugs processor.check_bugs +-#define cpu_proc_fin processor._proc_fin +-#define cpu_reset processor.reset +-#define cpu_do_idle processor._do_idle +-#define cpu_dcache_clean_area processor.dcache_clean_area +-#define cpu_set_pte_ext processor.set_pte_ext +-#define cpu_do_switch_mm processor.switch_mm + +-/* These three are private to arch/arm/kernel/suspend.c */ +-#define cpu_do_suspend processor.do_suspend +-#define cpu_do_resume processor.do_resume ++extern struct processor processor; ++#define PROC_VTABLE(f) processor.f ++#define PROC_TABLE(f) processor.f ++static inline void init_proc_vtable(const struct processor *p) ++{ ++ processor = *p; ++} ++ ++#define cpu_proc_init PROC_VTABLE(_proc_init) ++#define cpu_check_bugs PROC_VTABLE(check_bugs) ++#define cpu_proc_fin PROC_VTABLE(_proc_fin) ++#define cpu_reset PROC_VTABLE(reset) ++#define cpu_do_idle PROC_VTABLE(_do_idle) ++#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area) ++#define cpu_set_pte_ext PROC_TABLE(set_pte_ext) ++#define cpu_do_switch_mm PROC_VTABLE(switch_mm) ++ ++/* These two are private to arch/arm/kernel/suspend.c */ ++#define cpu_do_suspend PROC_VTABLE(do_suspend) ++#define cpu_do_resume PROC_VTABLE(do_resume) + #endif + + extern void cpu_resume(void); +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index 8fd7baa158a4..f269f4440496 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -693,9 +693,7 @@ static void __init setup_processor(void) + cpu_name = list->cpu_name; + __cpu_architecture = __get_cpu_architecture(); + +-#ifdef MULTI_CPU +- processor = *list->proc; +-#endif ++ init_proc_vtable(list->proc); + #ifdef MULTI_TLB + cpu_tlb = *list->tlb; + #endif +-- +2.19.1 + diff --git a/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch b/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch new file mode 100644 index 00000000000..0124de69c34 --- /dev/null +++ b/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch @@ -0,0 +1,52 @@ +From 09e8c7c0674644d8fd1e48086593e80110e21ff0 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:19 -0500 +Subject: ARM: clean up per-processor check_bugs method call + +Commit 945aceb1db8885d3a35790cf2e810f681db52756 upstream. + +Call the per-processor type check_bugs() method in the same way as we +do other per-processor functions - move the "processor." detail into +proc-fns.h. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 1 + + arch/arm/kernel/bugs.c | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index e25f4392e1b2..30c499146320 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *); + extern void cpu_do_resume(void *); + #else + #define cpu_proc_init processor._proc_init ++#define cpu_check_bugs processor.check_bugs + #define cpu_proc_fin processor._proc_fin + #define cpu_reset processor.reset + #define cpu_do_idle processor._do_idle +diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c +index 7be511310191..d41d3598e5e5 100644 +--- a/arch/arm/kernel/bugs.c ++++ b/arch/arm/kernel/bugs.c +@@ -6,8 +6,8 @@ + void check_other_bugs(void) + { + #ifdef MULTI_CPU +- if (processor.check_bugs) +- processor.check_bugs(); ++ if (cpu_check_bugs) ++ cpu_check_bugs(); + #endif + } + +-- +2.19.1 + diff --git a/queue-4.19/arm-dts-da850-evm-correct-the-audio-codec-regulators.patch b/queue-4.19/arm-dts-da850-evm-correct-the-audio-codec-regulators.patch new file mode 100644 index 00000000000..8f09ab4573b --- /dev/null +++ b/queue-4.19/arm-dts-da850-evm-correct-the-audio-codec-regulators.patch @@ -0,0 +1,73 @@ +From 70ac266eba025f6ae0187510b49078d428dd148c Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Wed, 19 Dec 2018 13:47:23 +0200 +Subject: ARM: dts: da850-evm: Correct the audio codec regulators + +[ Upstream commit 706edaa88835e3d8de8920584ad5da76dd3d6666 ] + +Add the board level fixed regulators for 3.3V and 1.8V which is used to +power - among other things - the tlv320aic3106 codec. + +Apart from removing the following warning during boot: +tlv320aic3x-codec 0-0018: Too high supply voltage(s) AVDD: 5000000, DVDD: 5000000 + +With the correct voltages the driver can select correct OCMV value to +reduce pop noise. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/da850-evm.dts | 29 +++++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts +index f9b757905845..e0ac195950b1 100644 +--- a/arch/arm/boot/dts/da850-evm.dts ++++ b/arch/arm/boot/dts/da850-evm.dts +@@ -94,6 +94,28 @@ + regulator-boot-on; + }; + ++ baseboard_3v3: fixedregulator-3v3 { ++ /* TPS73701DCQ */ ++ compatible = "regulator-fixed"; ++ regulator-name = "baseboard_3v3"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ vin-supply = <&vbat>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ ++ baseboard_1v8: fixedregulator-1v8 { ++ /* TPS73701DCQ */ ++ compatible = "regulator-fixed"; ++ regulator-name = "baseboard_1v8"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ vin-supply = <&vbat>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ + backlight_lcd: backlight-regulator { + compatible = "regulator-fixed"; + regulator-name = "lcd_backlight_pwr"; +@@ -210,10 +232,9 @@ + + /* Regulators */ + IOVDD-supply = <&vdcdc2_reg>; +- /* Derived from VBAT: Baseboard 3.3V / 1.8V */ +- AVDD-supply = <&vbat>; +- DRVDD-supply = <&vbat>; +- DVDD-supply = <&vbat>; ++ AVDD-supply = <&baseboard_3v3>; ++ DRVDD-supply = <&baseboard_3v3>; ++ DVDD-supply = <&baseboard_1v8>; + }; + tca6416: gpio@20 { + compatible = "ti,tca6416"; +-- +2.19.1 + diff --git a/queue-4.19/arm-dts-da850-evm-correct-the-sound-card-name.patch b/queue-4.19/arm-dts-da850-evm-correct-the-sound-card-name.patch new file mode 100644 index 00000000000..20dc5514cf6 --- /dev/null +++ b/queue-4.19/arm-dts-da850-evm-correct-the-sound-card-name.patch @@ -0,0 +1,36 @@ +From 0ed811cff8cc300341b0b8eab60e9b88dc4f708c Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Wed, 19 Dec 2018 13:47:24 +0200 +Subject: ARM: dts: da850-evm: Correct the sound card name + +[ Upstream commit 7fca69d4e43fa1ae9cb4f652772c132dc5a659c6 ] + +To avoid the following error: +asoc-simple-card sound: ASoC: Failed to create card debugfs directory + +Which is because the card name contains '/' character, which can not be +used in file or directory names. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/da850-evm.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts +index e0ac195950b1..016616cc036c 100644 +--- a/arch/arm/boot/dts/da850-evm.dts ++++ b/arch/arm/boot/dts/da850-evm.dts +@@ -127,7 +127,7 @@ + + sound { + compatible = "simple-audio-card"; +- simple-audio-card,name = "DA850/OMAP-L138 EVM"; ++ simple-audio-card,name = "DA850-OMAPL138 EVM"; + simple-audio-card,widgets = + "Line", "Line In", + "Line", "Line Out"; +-- +2.19.1 + diff --git a/queue-4.19/arm-dts-da850-lcdk-correct-the-audio-codec-regulator.patch b/queue-4.19/arm-dts-da850-lcdk-correct-the-audio-codec-regulator.patch new file mode 100644 index 00000000000..93ff1e633bc --- /dev/null +++ b/queue-4.19/arm-dts-da850-lcdk-correct-the-audio-codec-regulator.patch @@ -0,0 +1,80 @@ +From 8ea3a6cb48f4d97583726f8c529e095c3c6d0611 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Wed, 19 Dec 2018 13:47:25 +0200 +Subject: ARM: dts: da850-lcdk: Correct the audio codec regulators + +[ Upstream commit bd540ebe68c3017194a1caa38e075bbbc0832749 ] + +Add the board level fixed regulators for 3.3V and 1.8V which is used to +power - among other things - the tlv320aic3106 codec. + +Apart from removing the following warning during boot: +tlv320aic3x-codec 0-0018: Invalid supply voltage(s) AVDD: -22, DVDD: -22 + +With the correct voltages the driver can select correct OCMV value to +reduce pop noise. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/da850-lcdk.dts | 36 ++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/arch/arm/boot/dts/da850-lcdk.dts b/arch/arm/boot/dts/da850-lcdk.dts +index 0177e3ed20fe..c196e37606c4 100644 +--- a/arch/arm/boot/dts/da850-lcdk.dts ++++ b/arch/arm/boot/dts/da850-lcdk.dts +@@ -39,6 +39,36 @@ + }; + }; + ++ vcc_5vd: fixedregulator-vcc_5vd { ++ compatible = "regulator-fixed"; ++ regulator-name = "vcc_5vd"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ regulator-boot-on; ++ }; ++ ++ vcc_3v3d: fixedregulator-vcc_3v3d { ++ /* TPS650250 - VDCDC1 */ ++ compatible = "regulator-fixed"; ++ regulator-name = "vcc_3v3d"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ vin-supply = <&vcc_5vd>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ ++ vcc_1v8d: fixedregulator-vcc_1v8d { ++ /* TPS650250 - VDCDC2 */ ++ compatible = "regulator-fixed"; ++ regulator-name = "vcc_1v8d"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ vin-supply = <&vcc_5vd>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ + sound { + compatible = "simple-audio-card"; + simple-audio-card,name = "DA850/OMAP-L138 LCDK"; +@@ -221,6 +251,12 @@ + compatible = "ti,tlv320aic3106"; + reg = <0x18>; + status = "okay"; ++ ++ /* Regulators */ ++ IOVDD-supply = <&vcc_3v3d>; ++ AVDD-supply = <&vcc_3v3d>; ++ DRVDD-supply = <&vcc_3v3d>; ++ DVDD-supply = <&vcc_1v8d>; + }; + }; + +-- +2.19.1 + diff --git a/queue-4.19/arm-dts-da850-lcdk-correct-the-sound-card-name.patch b/queue-4.19/arm-dts-da850-lcdk-correct-the-sound-card-name.patch new file mode 100644 index 00000000000..665d3b3f1a7 --- /dev/null +++ b/queue-4.19/arm-dts-da850-lcdk-correct-the-sound-card-name.patch @@ -0,0 +1,36 @@ +From b00bb7dc4aec548edbaf52130f2b43ca3923038e Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Wed, 19 Dec 2018 13:47:26 +0200 +Subject: ARM: dts: da850-lcdk: Correct the sound card name + +[ Upstream commit c25748acc5c20786ecb7518bfeae8fcef93472d6 ] + +To avoid the following error: +asoc-simple-card sound: ASoC: Failed to create card debugfs directory + +Which is because the card name contains '/' character, which can not be +used in file or directory names. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/da850-lcdk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/da850-lcdk.dts b/arch/arm/boot/dts/da850-lcdk.dts +index c196e37606c4..3a2fa6e035a3 100644 +--- a/arch/arm/boot/dts/da850-lcdk.dts ++++ b/arch/arm/boot/dts/da850-lcdk.dts +@@ -71,7 +71,7 @@ + + sound { + compatible = "simple-audio-card"; +- simple-audio-card,name = "DA850/OMAP-L138 LCDK"; ++ simple-audio-card,name = "DA850-OMAPL138 LCDK"; + simple-audio-card,widgets = + "Line", "Line In", + "Line", "Line Out"; +-- +2.19.1 + diff --git a/queue-4.19/arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch b/queue-4.19/arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch new file mode 100644 index 00000000000..9c6415ca72c --- /dev/null +++ b/queue-4.19/arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch @@ -0,0 +1,48 @@ +From 4d57157908b58c6c835c529f54bddfbe18a88d4d Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 8 Jan 2019 00:08:18 +0100 +Subject: ARM: dts: kirkwood: Fix polarity of GPIO fan lines + +[ Upstream commit b5f034845e70916fd33e172fad5ad530a29c10ab ] + +These two lines are active high, not active low. The bug was +found when we changed the kernel to respect the polarity defined +in the device tree. + +Fixes: 1b90e06b1429 ("ARM: kirkwood: Use devicetree to define DNS-32[05] fan") +Cc: Jamie Lentin +Cc: Guenter Roeck +Cc: Jason Cooper +Cc: Andrew Lunn +Cc: Gregory Clement +Cc: Sebastian Hesselbarth +Cc: Julien D'Ascenzio +Reviewed-by: Andrew Lunn +Tested-by: Jamie Lentin +Reported-by: Julien D'Ascenzio +Tested-by: Julien D'Ascenzio +Signed-off-by: Linus Walleij +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/kirkwood-dnskw.dtsi b/arch/arm/boot/dts/kirkwood-dnskw.dtsi +index cbaf06f2f78e..eb917462b219 100644 +--- a/arch/arm/boot/dts/kirkwood-dnskw.dtsi ++++ b/arch/arm/boot/dts/kirkwood-dnskw.dtsi +@@ -36,8 +36,8 @@ + compatible = "gpio-fan"; + pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>; + pinctrl-names = "default"; +- gpios = <&gpio1 14 GPIO_ACTIVE_LOW +- &gpio1 13 GPIO_ACTIVE_LOW>; ++ gpios = <&gpio1 14 GPIO_ACTIVE_HIGH ++ &gpio1 13 GPIO_ACTIVE_HIGH>; + gpio-fan,speed-map = <0 0 + 3000 1 + 6000 2>; +-- +2.19.1 + diff --git a/queue-4.19/arm-ensure-that-processor-vtables-is-not-lost-after-.patch b/queue-4.19/arm-ensure-that-processor-vtables-is-not-lost-after-.patch new file mode 100644 index 00000000000..404a896143d --- /dev/null +++ b/queue-4.19/arm-ensure-that-processor-vtables-is-not-lost-after-.patch @@ -0,0 +1,57 @@ +From 0ed4e3daa4245c2b6e12207cab53305cc85e5e9a Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:22 -0500 +Subject: ARM: ensure that processor vtables is not lost after boot + +Commit 3a4d0c2172bcf15b7a3d9d498b2b355f9864286b upstream. + +Marek Szyprowski reported problems with CPU hotplug in current kernels. +This was tracked down to the processor vtables being located in an +init section, and therefore discarded after kernel boot, despite being +required after boot to properly initialise the non-boot CPUs. + +Arrange for these tables to end up in .rodata when required. + +Reported-by: Marek Szyprowski +Tested-by: Krzysztof Kozlowski +Fixes: 383fb3ee8024 ("ARM: spectre-v2: per-CPU vtables to work around big.Little systems") +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/mm/proc-macros.S | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S +index 81d0efb055c6..19516fbc2c55 100644 +--- a/arch/arm/mm/proc-macros.S ++++ b/arch/arm/mm/proc-macros.S +@@ -274,6 +274,13 @@ + .endm + + .macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0 ++/* ++ * If we are building for big.Little with branch predictor hardening, ++ * we need the processor function tables to remain available after boot. ++ */ ++#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++ .section ".rodata" ++#endif + .type \name\()_processor_functions, #object + .align 2 + ENTRY(\name\()_processor_functions) +@@ -309,6 +316,9 @@ ENTRY(\name\()_processor_functions) + .endif + + .size \name\()_processor_functions, . - \name\()_processor_functions ++#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++ .previous ++#endif + .endm + + .macro define_cache_functions name:req +-- +2.19.1 + diff --git a/queue-4.19/arm-fix-the-cockup-in-the-previous-patch.patch b/queue-4.19/arm-fix-the-cockup-in-the-previous-patch.patch new file mode 100644 index 00000000000..679feec6918 --- /dev/null +++ b/queue-4.19/arm-fix-the-cockup-in-the-previous-patch.patch @@ -0,0 +1,50 @@ +From 8982fe0cb4ad3a9b7868990993a50ddcd2f1e97e Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:23 -0500 +Subject: ARM: fix the cockup in the previous patch + +Commit d6951f582cc50ba0ad22ef46b599740966599b14 upstream. + +The intention in the previous patch was to only place the processor +tables in the .rodata section if big.Little was being built and we +wanted the branch target hardening, but instead (due to the way it +was tested) it ended up always placing the tables into the .rodata +section. + +Although harmless, let's correct this anyway. + +Fixes: 3a4d0c2172bc ("ARM: ensure that processor vtables is not lost after boot") +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/mm/proc-macros.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S +index 19516fbc2c55..5461d589a1e2 100644 +--- a/arch/arm/mm/proc-macros.S ++++ b/arch/arm/mm/proc-macros.S +@@ -278,7 +278,7 @@ + * If we are building for big.Little with branch predictor hardening, + * we need the processor function tables to remain available after boot. + */ +-#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) + .section ".rodata" + #endif + .type \name\()_processor_functions, #object +@@ -316,7 +316,7 @@ ENTRY(\name\()_processor_functions) + .endif + + .size \name\()_processor_functions, . - \name\()_processor_functions +-#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) + .previous + #endif + .endm +-- +2.19.1 + diff --git a/queue-4.19/arm-make-lookup_processor_type-non-__init.patch b/queue-4.19/arm-make-lookup_processor_type-non-__init.patch new file mode 100644 index 00000000000..fc7935f8b95 --- /dev/null +++ b/queue-4.19/arm-make-lookup_processor_type-non-__init.patch @@ -0,0 +1,47 @@ +From f86762351a04ea5e067b38b0f86afda705896055 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:17 -0500 +Subject: ARM: make lookup_processor_type() non-__init + +Commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc upstream. + +Move lookup_processor_type() out of the __init section so it is callable +from (eg) the secondary startup code during hotplug. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/head-common.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S +index 6e0375e7db05..997b02302c31 100644 +--- a/arch/arm/kernel/head-common.S ++++ b/arch/arm/kernel/head-common.S +@@ -145,6 +145,9 @@ __mmap_switched_data: + #endif + .size __mmap_switched_data, . - __mmap_switched_data + ++ __FINIT ++ .text ++ + /* + * This provides a C-API version of __lookup_processor_type + */ +@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type) + ldmfd sp!, {r4 - r6, r9, pc} + ENDPROC(lookup_processor_type) + +- __FINIT +- .text +- + /* + * Read processor ID register (CP#15, CR0), and look up in the linker-built + * supported processor list. Note that we can't use the absolute addresses +-- +2.19.1 + diff --git a/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch b/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch new file mode 100644 index 00000000000..37607e4af9a --- /dev/null +++ b/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch @@ -0,0 +1,213 @@ +From 88e417165c0cc4f06bea8f429b8a488dbe6c49a4 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:21 -0500 +Subject: ARM: spectre-v2: per-CPU vtables to work around big.Little systems + +Commit 383fb3ee8024d596f488d2dbaf45e572897acbdb upstream. + +In big.Little systems, some CPUs require the Spectre workarounds in +paths such as the context switch, but other CPUs do not. In order +to handle these differences, we need per-CPU vtables. + +We are unable to use the kernel's per-CPU variables to support this +as per-CPU is not initialised at times when we need access to the +vtables, so we have to use an array indexed by logical CPU number. + +We use an array-of-pointers to avoid having function pointers in +the kernel's read/write .data section. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++ + arch/arm/kernel/setup.c | 5 +++++ + arch/arm/kernel/smp.c | 31 +++++++++++++++++++++++++++++++ + arch/arm/mm/proc-v7-bugs.c | 17 ++--------------- + 4 files changed, 61 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index c259cc49c641..e1b6f280ab08 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *); + #else + + extern struct processor processor; ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++#include ++/* ++ * This can't be a per-cpu variable because we need to access it before ++ * per-cpu has been initialised. We have a couple of functions that are ++ * called in a pre-emptible context, and so can't use smp_processor_id() ++ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the ++ * function pointers for these are identical across all CPUs. ++ */ ++extern struct processor *cpu_vtable[]; ++#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f ++#define PROC_TABLE(f) cpu_vtable[0]->f ++static inline void init_proc_vtable(const struct processor *p) ++{ ++ unsigned int cpu = smp_processor_id(); ++ *cpu_vtable[cpu] = *p; ++ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area != ++ cpu_vtable[0]->dcache_clean_area); ++ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext != ++ cpu_vtable[0]->set_pte_ext); ++} ++#else + #define PROC_VTABLE(f) processor.f + #define PROC_TABLE(f) processor.f + static inline void init_proc_vtable(const struct processor *p) + { + processor = *p; + } ++#endif + + #define cpu_proc_init PROC_VTABLE(_proc_init) + #define cpu_check_bugs PROC_VTABLE(check_bugs) +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index f269f4440496..7bbaa293a38c 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2); + + #ifdef MULTI_CPU + struct processor processor __ro_after_init; ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++struct processor *cpu_vtable[NR_CPUS] = { ++ [0] = &processor, ++}; ++#endif + #endif + #ifdef MULTI_TLB + struct cpu_tlb_fns cpu_tlb __ro_after_init; +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index f574a5e0d589..3bf82232b1be 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd) + #endif + } + ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++static int secondary_biglittle_prepare(unsigned int cpu) ++{ ++ if (!cpu_vtable[cpu]) ++ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL); ++ ++ return cpu_vtable[cpu] ? 0 : -ENOMEM; ++} ++ ++static void secondary_biglittle_init(void) ++{ ++ init_proc_vtable(lookup_processor(read_cpuid_id())->proc); ++} ++#else ++static int secondary_biglittle_prepare(unsigned int cpu) ++{ ++ return 0; ++} ++ ++static void secondary_biglittle_init(void) ++{ ++} ++#endif ++ + int __cpu_up(unsigned int cpu, struct task_struct *idle) + { + int ret; +@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + if (!smp_ops.smp_boot_secondary) + return -ENOSYS; + ++ ret = secondary_biglittle_prepare(cpu); ++ if (ret) ++ return ret; ++ + /* + * We need to tell the secondary core where to find + * its stack and the page tables. +@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void) + struct mm_struct *mm = &init_mm; + unsigned int cpu; + ++ secondary_biglittle_init(); ++ + /* + * The identity mapping is uncached (strongly ordered), so + * switch away from it before attempting any exclusive accesses. +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index 5544b82a2e7a..9a07916af8dd 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void) + case ARM_CPU_PART_CORTEX_A17: + case ARM_CPU_PART_CORTEX_A73: + case ARM_CPU_PART_CORTEX_A75: +- if (processor.switch_mm != cpu_v7_bpiall_switch_mm) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + harden_branch_predictor_bpiall; + spectre_v2_method = "BPIALL"; +@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void) + + case ARM_CPU_PART_CORTEX_A15: + case ARM_CPU_PART_BRAHMA_B15: +- if (processor.switch_mm != cpu_v7_iciallu_switch_mm) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + harden_branch_predictor_iciallu; + spectre_v2_method = "ICIALLU"; +@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void) + ARM_SMCCC_ARCH_WORKAROUND_1, &res); + if ((int)res.a0 != 0) + break; +- if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + call_hvc_arch_workaround_1; +- processor.switch_mm = cpu_v7_hvc_switch_mm; ++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm; + spectre_v2_method = "hypervisor"; + break; + +@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void) + ARM_SMCCC_ARCH_WORKAROUND_1, &res); + if ((int)res.a0 != 0) + break; +- if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + call_smc_arch_workaround_1; +- processor.switch_mm = cpu_v7_smc_switch_mm; ++ cpu_do_switch_mm = cpu_v7_smc_switch_mm; + spectre_v2_method = "firmware"; + break; + +@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void) + if (spectre_v2_method) + pr_info("CPU%u: Spectre v2: using %s workaround\n", + smp_processor_id(), spectre_v2_method); +- return; +- +-bl_error: +- pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n", +- cpu); + } + #else + static void cpu_v7_spectre_init(void) +-- +2.19.1 + diff --git a/queue-4.19/arm-split-out-processor-lookup.patch b/queue-4.19/arm-split-out-processor-lookup.patch new file mode 100644 index 00000000000..cfc55db8d0f --- /dev/null +++ b/queue-4.19/arm-split-out-processor-lookup.patch @@ -0,0 +1,91 @@ +From cddb2ddf5dd7f877d446f1f2783f6871d701ff75 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 13 Feb 2019 16:32:18 -0500 +Subject: ARM: split out processor lookup + +Commit 65987a8553061515b5851b472081aedb9837a391 upstream. + +Split out the lookup of the processor type and associated error handling +from the rest of setup_processor() - we will need to use this in the +secondary CPU bringup path for big.Little Spectre variant 2 mitigation. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: David A. Long +Reviewed-by: Julien Thierry +Tested-by: Julien Thierry +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/cputype.h | 1 + + arch/arm/kernel/setup.c | 31 +++++++++++++++++++------------ + 2 files changed, 20 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h +index 0d289240b6ca..775cac3c02bb 100644 +--- a/arch/arm/include/asm/cputype.h ++++ b/arch/arm/include/asm/cputype.h +@@ -111,6 +111,7 @@ + #include + + extern unsigned int processor_id; ++struct proc_info_list *lookup_processor(u32 midr); + + #ifdef CONFIG_CPU_CP15 + #define read_cpuid(reg) \ +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index 4c249cb261f3..8fd7baa158a4 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -667,22 +667,29 @@ static void __init smp_build_mpidr_hash(void) + } + #endif + +-static void __init setup_processor(void) ++/* ++ * locate processor in the list of supported processor types. The linker ++ * builds this table for us from the entries in arch/arm/mm/proc-*.S ++ */ ++struct proc_info_list *lookup_processor(u32 midr) + { +- struct proc_info_list *list; ++ struct proc_info_list *list = lookup_processor_type(midr); + +- /* +- * locate processor in the list of supported processor +- * types. The linker builds this table for us from the +- * entries in arch/arm/mm/proc-*.S +- */ +- list = lookup_processor_type(read_cpuid_id()); + if (!list) { +- pr_err("CPU configuration botched (ID %08x), unable to continue.\n", +- read_cpuid_id()); +- while (1); ++ pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n", ++ smp_processor_id(), midr); ++ while (1) ++ /* can't use cpu_relax() here as it may require MMU setup */; + } + ++ return list; ++} ++ ++static void __init setup_processor(void) ++{ ++ unsigned int midr = read_cpuid_id(); ++ struct proc_info_list *list = lookup_processor(midr); ++ + cpu_name = list->cpu_name; + __cpu_architecture = __get_cpu_architecture(); + +@@ -700,7 +707,7 @@ static void __init setup_processor(void) + #endif + + pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n", +- cpu_name, read_cpuid_id(), read_cpuid_id() & 15, ++ list->cpu_name, midr, midr & 15, + proc_arch[cpu_architecture()], get_cr()); + + snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c", +-- +2.19.1 + diff --git a/queue-4.19/blk-mq-fix-a-hung-issue-when-fsync.patch b/queue-4.19/blk-mq-fix-a-hung-issue-when-fsync.patch new file mode 100644 index 00000000000..29cf4e8c10f --- /dev/null +++ b/queue-4.19/blk-mq-fix-a-hung-issue-when-fsync.patch @@ -0,0 +1,60 @@ +From 0d0960395fb67e8b101fb84547f86a94fe3fb784 Mon Sep 17 00:00:00 2001 +From: Jianchao Wang +Date: Wed, 30 Jan 2019 17:01:56 +0800 +Subject: blk-mq: fix a hung issue when fsync + +[ Upstream commit 85bd6e61f34dffa8ec2dc75ff3c02ee7b2f1cbce ] + +Florian reported a io hung issue when fsync(). It should be +triggered by following race condition. + +data + post flush a flush + +blk_flush_complete_seq + case REQ_FSEQ_DATA + blk_flush_queue_rq + issued to driver blk_mq_dispatch_rq_list + try to issue a flush req + failed due to NON-NCQ command + .queue_rq return BLK_STS_DEV_RESOURCE + +request completion + req->end_io // doesn't check RESTART + mq_flush_data_end_io + case REQ_FSEQ_POSTFLUSH + blk_kick_flush + do nothing because previous flush + has not been completed + blk_mq_run_hw_queue + insert rq to hctx->dispatch + due to RESTART is still set, do nothing + +To fix this, replace the blk_mq_run_hw_queue in mq_flush_data_end_io +with blk_mq_sched_restart to check and clear the RESTART flag. + +Fixes: bd166ef1 (blk-mq-sched: add framework for MQ capable IO schedulers) +Reported-by: Florian Stecker +Tested-by: Florian Stecker +Signed-off-by: Jianchao Wang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-flush.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-flush.c b/block/blk-flush.c +index ce41f666de3e..76487948a27f 100644 +--- a/block/blk-flush.c ++++ b/block/blk-flush.c +@@ -424,7 +424,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error) + blk_flush_complete_seq(rq, fq, REQ_FSEQ_DATA, error); + spin_unlock_irqrestore(&fq->mq_flush_lock, flags); + +- blk_mq_run_hw_queue(hctx, true); ++ blk_mq_sched_restart(hctx); + } + + /** +-- +2.19.1 + diff --git a/queue-4.19/cifs-do-not-assume-one-credit-for-async-responses.patch b/queue-4.19/cifs-do-not-assume-one-credit-for-async-responses.patch new file mode 100644 index 00000000000..4b925f3ba3a --- /dev/null +++ b/queue-4.19/cifs-do-not-assume-one-credit-for-async-responses.patch @@ -0,0 +1,76 @@ +From 8730c030a2487e121fbe9e1d374f2e4da16c2a82 Mon Sep 17 00:00:00 2001 +From: Pavel Shilovsky +Date: Tue, 15 Jan 2019 15:08:48 -0800 +Subject: CIFS: Do not assume one credit for async responses + +[ Upstream commit 0fd1d37b0501efc6e295f56ab55cdaff784aa50c ] + +If we don't receive a response we can't assume that the server +granted one credit. Assume zero credits in such cases. + +Signed-off-by: Pavel Shilovsky +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 8a01e89ff827..1e5a1171212f 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2814,9 +2814,10 @@ smb2_echo_callback(struct mid_q_entry *mid) + { + struct TCP_Server_Info *server = mid->callback_data; + struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf; +- unsigned int credits_received = 1; ++ unsigned int credits_received = 0; + +- if (mid->mid_state == MID_RESPONSE_RECEIVED) ++ if (mid->mid_state == MID_RESPONSE_RECEIVED ++ || mid->mid_state == MID_RESPONSE_MALFORMED) + credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest); + + DeleteMidQEntry(mid); +@@ -3073,7 +3074,7 @@ smb2_readv_callback(struct mid_q_entry *mid) + struct TCP_Server_Info *server = tcon->ses->server; + struct smb2_sync_hdr *shdr = + (struct smb2_sync_hdr *)rdata->iov[0].iov_base; +- unsigned int credits_received = 1; ++ unsigned int credits_received = 0; + struct smb_rqst rqst = { .rq_iov = rdata->iov, + .rq_nvec = 2, + .rq_pages = rdata->pages, +@@ -3112,6 +3113,9 @@ smb2_readv_callback(struct mid_q_entry *mid) + task_io_account_read(rdata->got_bytes); + cifs_stats_bytes_read(tcon, rdata->got_bytes); + break; ++ case MID_RESPONSE_MALFORMED: ++ credits_received = le16_to_cpu(shdr->CreditRequest); ++ /* fall through */ + default: + if (rdata->result != -ENODATA) + rdata->result = -EIO; +@@ -3305,7 +3309,7 @@ smb2_writev_callback(struct mid_q_entry *mid) + struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink); + unsigned int written; + struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf; +- unsigned int credits_received = 1; ++ unsigned int credits_received = 0; + + switch (mid->mid_state) { + case MID_RESPONSE_RECEIVED: +@@ -3333,6 +3337,9 @@ smb2_writev_callback(struct mid_q_entry *mid) + case MID_RETRY_NEEDED: + wdata->result = -EAGAIN; + break; ++ case MID_RESPONSE_MALFORMED: ++ credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest); ++ /* fall through */ + default: + wdata->result = -EIO; + break; +-- +2.19.1 + diff --git a/queue-4.19/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch b/queue-4.19/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch new file mode 100644 index 00000000000..cf21d6b7a02 --- /dev/null +++ b/queue-4.19/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch @@ -0,0 +1,73 @@ +From fc49ae9debabb49b9a19b6323fea895c4c94216c Mon Sep 17 00:00:00 2001 +From: Ross Lagerwall +Date: Tue, 8 Jan 2019 18:30:56 +0000 +Subject: cifs: Limit memory used by lock request calls to a page + +[ Upstream commit 92a8109e4d3a34fb6b115c9098b51767dc933444 ] + +The code tries to allocate a contiguous buffer with a size supplied by +the server (maxBuf). This could fail if memory is fragmented since it +results in high order allocations for commonly used server +implementations. It is also wasteful since there are probably +few locks in the usual case. Limit the buffer to be no larger than a +page to avoid memory allocation failures due to fragmentation. + +Signed-off-by: Ross Lagerwall +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/file.c | 8 ++++++++ + fs/cifs/smb2file.c | 4 ++++ + 2 files changed, 12 insertions(+) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 7b637fc27990..23db881daab5 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1128,6 +1128,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) + return -EINVAL; + } + ++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) > ++ PAGE_SIZE); ++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), ++ PAGE_SIZE); + max_num = (max_buf - sizeof(struct smb_hdr)) / + sizeof(LOCKING_ANDX_RANGE); + buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); +@@ -1466,6 +1470,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) + return -EINVAL; + ++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) > ++ PAGE_SIZE); ++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), ++ PAGE_SIZE); + max_num = (max_buf - sizeof(struct smb_hdr)) / + sizeof(LOCKING_ANDX_RANGE); + buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); +diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c +index 2fc3d31967ee..b204e84b87fb 100644 +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -128,6 +128,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, + if (max_buf < sizeof(struct smb2_lock_element)) + return -EINVAL; + ++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE); ++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); + max_num = max_buf / sizeof(struct smb2_lock_element); + buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL); + if (!buf) +@@ -264,6 +266,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile) + return -EINVAL; + } + ++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE); ++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); + max_num = max_buf / sizeof(struct smb2_lock_element); + buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL); + if (!buf) { +-- +2.19.1 + diff --git a/queue-4.19/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch b/queue-4.19/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch new file mode 100644 index 00000000000..20dce54db2d --- /dev/null +++ b/queue-4.19/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch @@ -0,0 +1,96 @@ +From 15e8a1bff1543b5121825e531c688dbae6e40a42 Mon Sep 17 00:00:00 2001 +From: Sudeep Holla +Date: Mon, 7 Jan 2019 18:51:53 +0000 +Subject: cpufreq: check if policy is inactive early in __cpufreq_get() + +[ Upstream commit 2f66196208c98b3d1b4294edffb2c5a8197be899 ] + +cpuinfo_cur_freq gets current CPU frequency as detected by hardware +while scaling_cur_freq last known CPU frequency. Some platforms may not +allow checking the CPU frequency of an offline CPU or the associated +resources may have been released via cpufreq_exit when the CPU gets +offlined, in which case the policy would have been invalidated already. +If we attempt to get current frequency from the hardware, it may result +in hang or crash. + +For example on Juno, I see: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188 +[0000000000000188] pgd=0000000000000000 +Internal error: Oops: 96000004 [#1] PREEMPT SMP +Modules linked in: +CPU: 5 PID: 4202 Comm: cat Not tainted 4.20.0-08251-ga0f2c0318a15-dirty #87 +Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform +pstate: 40000005 (nZcv daif -PAN -UAO) +pc : scmi_cpufreq_get_rate+0x34/0xb0 +lr : scmi_cpufreq_get_rate+0x34/0xb0 +Call trace: + scmi_cpufreq_get_rate+0x34/0xb0 + __cpufreq_get+0x34/0xc0 + show_cpuinfo_cur_freq+0x24/0x78 + show+0x40/0x60 + sysfs_kf_seq_show+0xc0/0x148 + kernfs_seq_show+0x44/0x50 + seq_read+0xd4/0x480 + kernfs_fop_read+0x15c/0x208 + __vfs_read+0x60/0x188 + vfs_read+0x94/0x150 + ksys_read+0x6c/0xd8 + __arm64_sys_read+0x24/0x30 + el0_svc_common+0x78/0x100 + el0_svc_handler+0x38/0x78 + el0_svc+0x8/0xc +---[ end trace 3d1024e58f77f6b2 ]--- + +So fix the issue by checking if the policy is invalid early in +__cpufreq_get before attempting to get the current frequency. + +Signed-off-by: Sudeep Holla +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki + +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index f53fb41efb7b..b100260b6ed2 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1530,17 +1530,16 @@ static unsigned int __cpufreq_get(struct cpufreq_policy *policy) + { + unsigned int ret_freq = 0; + +- if (!cpufreq_driver->get) ++ if (unlikely(policy_is_inactive(policy)) || !cpufreq_driver->get) + return ret_freq; + + ret_freq = cpufreq_driver->get(policy->cpu); + + /* +- * Updating inactive policies is invalid, so avoid doing that. Also +- * if fast frequency switching is used with the given policy, the check ++ * If fast frequency switching is used with the given policy, the check + * against policy->cur is pointless, so skip it in that case too. + */ +- if (unlikely(policy_is_inactive(policy)) || policy->fast_switch_enabled) ++ if (policy->fast_switch_enabled) + return ret_freq; + + if (ret_freq && policy->cur && +@@ -1569,10 +1568,7 @@ unsigned int cpufreq_get(unsigned int cpu) + + if (policy) { + down_read(&policy->rwsem); +- +- if (!policy_is_inactive(policy)) +- ret_freq = __cpufreq_get(policy); +- ++ ret_freq = __cpufreq_get(policy); + up_read(&policy->rwsem); + + cpufreq_cpu_put(policy); +-- +2.19.1 + diff --git a/queue-4.19/drm-amdgpu-set-write_burst_length-to-64b-to-workarou.patch b/queue-4.19/drm-amdgpu-set-write_burst_length-to-64b-to-workarou.patch new file mode 100644 index 00000000000..bf5e209f206 --- /dev/null +++ b/queue-4.19/drm-amdgpu-set-write_burst_length-to-64b-to-workarou.patch @@ -0,0 +1,48 @@ +From 9999e8d9652cd586013c236028e69b2a66382856 Mon Sep 17 00:00:00 2001 +From: Jim Qu +Date: Mon, 17 Dec 2018 17:00:50 +0800 +Subject: drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang + +[ Upstream commit 0c6c8125582714e1fd3544983eba3d750db0f5b8 ] + +effect asics: VEGA10 and VEGA12 + +Signed-off-by: Jim Qu +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index 7c3b634d8d5f..de5a689e1925 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -71,7 +71,6 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = { + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000), +- SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831f07), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CLK_CTRL, 0xffffffff, 0x3f000100), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_IB_CNTL, 0x800f0100, 0x00000100), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000), +@@ -89,6 +88,7 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = { + static const struct soc15_reg_golden golden_settings_sdma_vg10[] = { + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG, 0x0018773f, 0x00104002), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104002), ++ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831d07), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG, 0x0018773f, 0x00104002), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104002) + }; +@@ -96,6 +96,7 @@ static const struct soc15_reg_golden golden_settings_sdma_vg10[] = { + static const struct soc15_reg_golden golden_settings_sdma_vg12[] = { + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG, 0x0018773f, 0x00104001), + SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104001), ++ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831d07), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG, 0x0018773f, 0x00104001), + SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104001) + }; +-- +2.19.1 + diff --git a/queue-4.19/drm-amdgpu-sriov-correct-pfvf-exchange-logic.patch b/queue-4.19/drm-amdgpu-sriov-correct-pfvf-exchange-logic.patch new file mode 100644 index 00000000000..a0efc8a1f65 --- /dev/null +++ b/queue-4.19/drm-amdgpu-sriov-correct-pfvf-exchange-logic.patch @@ -0,0 +1,69 @@ +From ed0259092868e5f0d82f8ad79f4df5e84b6ea16c Mon Sep 17 00:00:00 2001 +From: Emily Deng +Date: Sat, 29 Dec 2018 17:46:05 +0800 +Subject: drm/amdgpu/sriov:Correct pfvf exchange logic + +[ Upstream commit b8cf66182eddb22e9c7539821ed6eecdb4f86d1a ] + +The pfvf exchange need be in exclusive mode. And add pfvf exchange in gpu +reset. + +Signed-off-by: Emily Deng +Reviewed-By: Xiangliang Yu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 39bf2ce548c6..7f6af421d3e9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1653,8 +1653,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev) + + amdgpu_amdkfd_device_init(adev); + +- if (amdgpu_sriov_vf(adev)) ++ if (amdgpu_sriov_vf(adev)) { ++ amdgpu_virt_init_data_exchange(adev); + amdgpu_virt_release_full_gpu(adev, true); ++ } + + return 0; + } +@@ -2555,9 +2557,6 @@ int amdgpu_device_init(struct amdgpu_device *adev, + goto failed; + } + +- if (amdgpu_sriov_vf(adev)) +- amdgpu_virt_init_data_exchange(adev); +- + amdgpu_fbdev_init(adev); + + r = amdgpu_pm_sysfs_init(adev); +@@ -3269,6 +3268,7 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev, + r = amdgpu_ib_ring_tests(adev); + + error: ++ amdgpu_virt_init_data_exchange(adev); + amdgpu_virt_release_full_gpu(adev, true); + if (!r && adev->virt.gim_feature & AMDGIM_FEATURE_GIM_FLR_VRAMLOST) { + atomic_inc(&adev->vram_lost_counter); +diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +index 078f70faedcb..d06332be59d3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c ++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +@@ -174,7 +174,7 @@ static int xgpu_ai_send_access_requests(struct amdgpu_device *adev, + return r; + } + /* Retrieve checksum from mailbox2 */ +- if (req == IDH_REQ_GPU_INIT_ACCESS) { ++ if (req == IDH_REQ_GPU_INIT_ACCESS || req == IDH_REQ_GPU_RESET_ACCESS) { + adev->virt.fw_reserve.checksum_key = + RREG32_NO_KIQ(SOC15_REG_OFFSET(NBIO, 0, + mmBIF_BX_PF0_MAILBOX_MSGBUF_RCV_DW2)); +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-add-bus-flags.patch b/queue-4.19/drm-bridge-tc358767-add-bus-flags.patch new file mode 100644 index 00000000000..4c4ea055c1f --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-add-bus-flags.patch @@ -0,0 +1,40 @@ +From 465ca41da2320872c32b6178a2cddbb2b5fa0ed0 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:48 +0200 +Subject: drm/bridge: tc358767: add bus flags + +[ Upstream commit 4842379cbe6e851de914a7132f76f4e200b9a98b ] + +tc358767 driver does not set DRM bus_flags, even if it does configures +the polarity settings into its registers. This means that the DPI source +can't configure the polarities correctly. + +Add sync flags accordingly. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-2-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 8e28e738cb52..29a7e33e8ae0 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1195,6 +1195,10 @@ static int tc_bridge_attach(struct drm_bridge *bridge) + + drm_display_info_set_bus_formats(&tc->connector.display_info, + &bus_format, 1); ++ tc->connector.display_info.bus_flags = ++ DRM_BUS_FLAG_DE_HIGH | ++ DRM_BUS_FLAG_PIXDATA_NEGEDGE | ++ DRM_BUS_FLAG_SYNC_NEGEDGE; + drm_connector_attach_encoder(&tc->connector, tc->bridge.encoder); + + return 0; +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-add-defines-for-dp1_srcctrl-phy_.patch b/queue-4.19/drm-bridge-tc358767-add-defines-for-dp1_srcctrl-phy_.patch new file mode 100644 index 00000000000..6ac67bd7328 --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-add-defines-for-dp1_srcctrl-phy_.patch @@ -0,0 +1,72 @@ +From 392c5b42e003155a5e3483668535af36f999297f Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:49 +0200 +Subject: drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE + +[ Upstream commit adf4109896bbee27fd2ac3b48d22d6a0062fe517 ] + +DP1_SRCCTRL register and PHY_2LANE field did not have matching defines. +Add these. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-3-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 29a7e33e8ae0..5f0a666db2fd 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -142,6 +142,8 @@ + #define DP0_LTLOOPCTRL 0x06d8 + #define DP0_SNKLTCTRL 0x06e4 + ++#define DP1_SRCCTRL 0x07a0 ++ + /* PHY */ + #define DP_PHY_CTRL 0x0800 + #define DP_PHY_RST BIT(28) /* DP PHY Global Soft Reset */ +@@ -150,6 +152,7 @@ + #define PHY_M1_RST BIT(12) /* Reset PHY1 Main Channel */ + #define PHY_RDY BIT(16) /* PHY Main Channels Ready */ + #define PHY_M0_RST BIT(8) /* Reset PHY0 Main Channel */ ++#define PHY_2LANE BIT(2) /* PHY Enable 2 lanes */ + #define PHY_A0_EN BIT(1) /* PHY Aux Channel0 Enable */ + #define PHY_M0_EN BIT(0) /* PHY Main Channel0 Enable */ + +@@ -564,7 +567,7 @@ static int tc_aux_link_setup(struct tc_data *tc) + value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2; + tc_write(SYS_PLLPARAM, value); + +- tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN); ++ tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN); + + /* + * Initially PLLs are in bypass. Force PLL parameter update, +@@ -834,7 +837,7 @@ static int tc_main_link_setup(struct tc_data *tc) + DP0_SRCCTRL_LANESKEW | DP0_SRCCTRL_LANES_2 | + DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT); + /* from excel file - DP1_SrcCtrl */ +- tc_write(0x07a0, 0x00003083); ++ tc_write(DP1_SRCCTRL, 0x00003083); + + rate = clk_get_rate(tc->refclk); + switch (rate) { +@@ -855,8 +858,9 @@ static int tc_main_link_setup(struct tc_data *tc) + } + value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2; + tc_write(SYS_PLLPARAM, value); ++ + /* Setup Main Link */ +- dp_phy_ctrl = BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN | PHY_M0_EN; ++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN | PHY_M0_EN; + tc_write(DP_PHY_CTRL, dp_phy_ctrl); + msleep(100); + +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-fix-initial-dp0-1_srcctrl-value.patch b/queue-4.19/drm-bridge-tc358767-fix-initial-dp0-1_srcctrl-value.patch new file mode 100644 index 00000000000..c3a093d7ebf --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-fix-initial-dp0-1_srcctrl-value.patch @@ -0,0 +1,53 @@ +From 158a25e4e8e2ef88d5424415f1cb536fdf3b10b9 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:51 +0200 +Subject: drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value + +[ Upstream commit 9a63bd6fe1b5590ffa42ae2ed22ee21363293e31 ] + +Initially DP0_SRCCTRL is set to a static value which includes +DP0_SRCCTRL_LANES_2 and DP0_SRCCTRL_BW27, even when only 1 lane of +1.62Gbps speed is used. DP1_SRCCTRL is configured to a magic number. + +This patch changes the configuration as follows: + +Configure DP0_SRCCTRL by using tc_srcctrl() which provides the correct +value. + +DP1_SRCCTRL needs two bits to be set to the same value as DP0_SRCCTRL: +SSCG and BW27. All other bits can be zero. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-5-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index fee53422c31f..ab299f4debfa 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -836,12 +836,11 @@ static int tc_main_link_setup(struct tc_data *tc) + if (!tc->mode) + return -EINVAL; + +- /* from excel file - DP0_SrcCtrl */ +- tc_write(DP0_SRCCTRL, DP0_SRCCTRL_SCRMBLDIS | DP0_SRCCTRL_EN810B | +- DP0_SRCCTRL_LANESKEW | DP0_SRCCTRL_LANES_2 | +- DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT); +- /* from excel file - DP1_SrcCtrl */ +- tc_write(DP1_SRCCTRL, 0x00003083); ++ tc_write(DP0_SRCCTRL, tc_srcctrl(tc)); ++ /* SSCG and BW27 on DP1 must be set to the same as on DP0 */ ++ tc_write(DP1_SRCCTRL, ++ (tc->link.spread ? DP0_SRCCTRL_SSCG : 0) | ++ ((tc->link.base.rate != 162000) ? DP0_SRCCTRL_BW27 : 0)); + + rate = clk_get_rate(tc->refclk); + switch (rate) { +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-fix-output-h-v-syncs.patch b/queue-4.19/drm-bridge-tc358767-fix-output-h-v-syncs.patch new file mode 100644 index 00000000000..70d163f9c17 --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-fix-output-h-v-syncs.patch @@ -0,0 +1,46 @@ +From 0ef91882e3c21bbed04ef7509e443fb0c59f4d6a Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:53 +0200 +Subject: drm/bridge: tc358767: fix output H/V syncs + +[ Upstream commit 7923e09c7a766e2d58de7fc395bb84c18e5bc625 ] + +The H and V syncs of the DP output are always set to active high. This +patch fixes the syncs by configuring them according to the videomode. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-7-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index a1f3dd2afbb1..391547358756 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -98,6 +98,8 @@ + #define DP0_STARTVAL 0x064c + #define DP0_ACTIVEVAL 0x0650 + #define DP0_SYNCVAL 0x0654 ++#define SYNCVAL_HS_POL_ACTIVE_LOW (1 << 15) ++#define SYNCVAL_VS_POL_ACTIVE_LOW (1 << 31) + #define DP0_MISC 0x0658 + #define TU_SIZE_RECOMMENDED (63) /* LSCLK cycles per TU */ + #define BPC_6 (0 << 5) +@@ -726,7 +728,9 @@ static int tc_set_video_mode(struct tc_data *tc, struct drm_display_mode *mode) + + tc_write(DP0_ACTIVEVAL, (mode->vdisplay << 16) | (mode->hdisplay)); + +- tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0)); ++ tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0) | ++ ((mode->flags & DRM_MODE_FLAG_NHSYNC) ? SYNCVAL_HS_POL_ACTIVE_LOW : 0) | ++ ((mode->flags & DRM_MODE_FLAG_NVSYNC) ? SYNCVAL_VS_POL_ACTIVE_LOW : 0)); + + tc_write(DPIPXLFMT, VS_POL_ACTIVE_LOW | HS_POL_ACTIVE_LOW | + DE_POL_ACTIVE_HIGH | SUB_CFG_TYPE_CONFIG1 | DPI_BPP_RGB888); +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-fix-single-lane-configuration.patch b/queue-4.19/drm-bridge-tc358767-fix-single-lane-configuration.patch new file mode 100644 index 00000000000..4b60c1766a7 --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-fix-single-lane-configuration.patch @@ -0,0 +1,58 @@ +From 5d2008c1a7d4b45087d5ff0f5f76ed7e1d3d3c5f Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:50 +0200 +Subject: drm/bridge: tc358767: fix single lane configuration + +[ Upstream commit 4d9d54a730434cc068dd3515ba6116697196f77b ] + +PHY_2LANE bit is always set in DP_PHY_CTRL, breaking 1 lane use. + +Set PHY_2LANE only when 2 lanes are used. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-4-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 5f0a666db2fd..fee53422c31f 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -543,6 +543,7 @@ static int tc_aux_link_setup(struct tc_data *tc) + unsigned long rate; + u32 value; + int ret; ++ u32 dp_phy_ctrl; + + rate = clk_get_rate(tc->refclk); + switch (rate) { +@@ -567,7 +568,10 @@ static int tc_aux_link_setup(struct tc_data *tc) + value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2; + tc_write(SYS_PLLPARAM, value); + +- tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN); ++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN; ++ if (tc->link.base.num_lanes == 2) ++ dp_phy_ctrl |= PHY_2LANE; ++ tc_write(DP_PHY_CTRL, dp_phy_ctrl); + + /* + * Initially PLLs are in bypass. Force PLL parameter update, +@@ -860,7 +864,9 @@ static int tc_main_link_setup(struct tc_data *tc) + tc_write(SYS_PLLPARAM, value); + + /* Setup Main Link */ +- dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN | PHY_M0_EN; ++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN | PHY_M0_EN; ++ if (tc->link.base.num_lanes == 2) ++ dp_phy_ctrl |= PHY_2LANE; + tc_write(DP_PHY_CTRL, dp_phy_ctrl); + msleep(100); + +-- +2.19.1 + diff --git a/queue-4.19/drm-bridge-tc358767-reject-modes-which-require-too-m.patch b/queue-4.19/drm-bridge-tc358767-reject-modes-which-require-too-m.patch new file mode 100644 index 00000000000..fef0169c99c --- /dev/null +++ b/queue-4.19/drm-bridge-tc358767-reject-modes-which-require-too-m.patch @@ -0,0 +1,50 @@ +From 9d762ba754780d97fbf843f5cf93e32cc810a9f3 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 3 Jan 2019 13:59:52 +0200 +Subject: drm/bridge: tc358767: reject modes which require too much BW + +[ Upstream commit 51b9e62eb6950c762162ab7eb8390990179be067 ] + +The current driver accepts any videomode with pclk < 154MHz. This is not +correct, as with 1 lane and/or 1.62Mbps speed not all videomodes can be +supported. + +Add code to reject modes that require more bandwidth that is available. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Andrzej Hajda +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-6-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index ab299f4debfa..a1f3dd2afbb1 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1114,10 +1114,20 @@ static bool tc_bridge_mode_fixup(struct drm_bridge *bridge, + static enum drm_mode_status tc_connector_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { ++ struct tc_data *tc = connector_to_tc(connector); ++ u32 req, avail; ++ u32 bits_per_pixel = 24; ++ + /* DPI interface clock limitation: upto 154 MHz */ + if (mode->clock > 154000) + return MODE_CLOCK_HIGH; + ++ req = mode->clock * bits_per_pixel / 8; ++ avail = tc->link.base.num_lanes * tc->link.base.rate; ++ ++ if (req > avail) ++ return MODE_BAD; ++ + return MODE_OK; + } + +-- +2.19.1 + diff --git a/queue-4.19/drm-nouveau-don-t-disable-polling-in-fallback-mode.patch b/queue-4.19/drm-nouveau-don-t-disable-polling-in-fallback-mode.patch new file mode 100644 index 00000000000..848837f882e --- /dev/null +++ b/queue-4.19/drm-nouveau-don-t-disable-polling-in-fallback-mode.patch @@ -0,0 +1,46 @@ +From 7f2be82ba43b33177a6cbcec26d9013428b93eea Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 12 Sep 2018 12:58:43 +0200 +Subject: drm/nouveau: Don't disable polling in fallback mode + +[ Upstream commit 118780066e30c34de3d9349710b51780bfa0ba83 ] + +When a fan is controlled via linear fallback without cstate, we +shouldn't stop polling. Otherwise it won't be adjusted again and +keeps running at an initial crazy pace. + +Fixes: 800efb4c2857 ("drm/nouveau/drm/therm/fan: add a fallback if no fan control is specified in the vbios") +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1103356 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107447 +Reported-by: Thomas Blume +Signed-off-by: Takashi Iwai +Reviewed-by: Martin Peres +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c +index 3695cde669f8..07914e36939e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c +@@ -132,11 +132,12 @@ nvkm_therm_update(struct nvkm_therm *therm, int mode) + duty = nvkm_therm_update_linear(therm); + break; + case NVBIOS_THERM_FAN_OTHER: +- if (therm->cstate) ++ if (therm->cstate) { + duty = therm->cstate; +- else ++ poll = false; ++ } else { + duty = nvkm_therm_update_linear_fallback(therm); +- poll = false; ++ } + break; + } + immd = false; +-- +2.19.1 + diff --git a/queue-4.19/drm-nouveau-falcon-avoid-touching-registers-if-engin.patch b/queue-4.19/drm-nouveau-falcon-avoid-touching-registers-if-engin.patch new file mode 100644 index 00000000000..6a46fd53318 --- /dev/null +++ b/queue-4.19/drm-nouveau-falcon-avoid-touching-registers-if-engin.patch @@ -0,0 +1,43 @@ +From deb96d165d7d474fbc955d4b8862d2966b07dc18 Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Thu, 13 Dec 2018 22:44:08 -0500 +Subject: drm/nouveau/falcon: avoid touching registers if engine is off + +[ Upstream commit a5176a4cb85bb6213daadf691097cf411da35df2 ] + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108980 +Signed-off-by: Ilia Mirkin +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c b/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c +index 816ccaedfc73..8675613e142b 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c +@@ -22,6 +22,7 @@ + #include + + #include ++#include + #include + #include + +@@ -107,8 +108,10 @@ nvkm_falcon_fini(struct nvkm_engine *engine, bool suspend) + } + } + +- nvkm_mask(device, base + 0x048, 0x00000003, 0x00000000); +- nvkm_wr32(device, base + 0x014, 0xffffffff); ++ if (nvkm_mc_enabled(device, engine->subdev.index)) { ++ nvkm_mask(device, base + 0x048, 0x00000003, 0x00000000); ++ nvkm_wr32(device, base + 0x014, 0xffffffff); ++ } + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/dt-bindings-eeprom-at24-add-atmel-24c2048-compatible.patch b/queue-4.19/dt-bindings-eeprom-at24-add-atmel-24c2048-compatible.patch new file mode 100644 index 00000000000..001d06f7f5f --- /dev/null +++ b/queue-4.19/dt-bindings-eeprom-at24-add-atmel-24c2048-compatible.patch @@ -0,0 +1,32 @@ +From bb5441b2cb47c839456bf9815d614d3194e88e2a Mon Sep 17 00:00:00 2001 +From: Adrian Bunk +Date: Thu, 29 Nov 2018 21:58:57 +0200 +Subject: dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string + +[ Upstream commit 6c0c5dc33ff42af49243e94842d0ebdb153189ea ] + +Add new compatible to the device tree bindings. + +Signed-off-by: Adrian Bunk +Acked-by: Rob Herring +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/eeprom/at24.txt | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/eeprom/at24.txt b/Documentation/devicetree/bindings/eeprom/at24.txt +index aededdbc262b..f9a7c984274c 100644 +--- a/Documentation/devicetree/bindings/eeprom/at24.txt ++++ b/Documentation/devicetree/bindings/eeprom/at24.txt +@@ -27,6 +27,7 @@ Required properties: + "atmel,24c256", + "atmel,24c512", + "atmel,24c1024", ++ "atmel,24c2048", + + If is not "atmel", then a fallback must be used + with the same and "atmel" as manufacturer. +-- +2.19.1 + diff --git a/queue-4.19/eeprom-at24-add-support-for-24c2048.patch b/queue-4.19/eeprom-at24-add-support-for-24c2048.patch new file mode 100644 index 00000000000..4907e0a038f --- /dev/null +++ b/queue-4.19/eeprom-at24-add-support-for-24c2048.patch @@ -0,0 +1,61 @@ +From 4fa932d2737436ed185850ce159d117ecd6d64d2 Mon Sep 17 00:00:00 2001 +From: Adrian Bunk +Date: Thu, 29 Nov 2018 21:58:58 +0200 +Subject: eeprom: at24: add support for 24c2048 + +[ Upstream commit 37cf28d3b5bca1b532a0b6aac722e7f2788a9294 ] + +Works with ST M24M02. + +Signed-off-by: Adrian Bunk +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/Kconfig | 2 +- + drivers/misc/eeprom/at24.c | 3 +++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig +index 68a1ac929917..d382b13c27dd 100644 +--- a/drivers/misc/eeprom/Kconfig ++++ b/drivers/misc/eeprom/Kconfig +@@ -13,7 +13,7 @@ config EEPROM_AT24 + ones like at24c64, 24lc02 or fm24c04: + + 24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08, +- 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024 ++ 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024, 24c2048 + + Unless you like data loss puzzles, always be sure that any chip + you configure as a 24c32 (32 kbit) or larger is NOT really a +diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c +index 7e50e1d6f58c..94836fcbe721 100644 +--- a/drivers/misc/eeprom/at24.c ++++ b/drivers/misc/eeprom/at24.c +@@ -173,6 +173,7 @@ AT24_CHIP_DATA(at24_data_24c128, 131072 / 8, AT24_FLAG_ADDR16); + AT24_CHIP_DATA(at24_data_24c256, 262144 / 8, AT24_FLAG_ADDR16); + AT24_CHIP_DATA(at24_data_24c512, 524288 / 8, AT24_FLAG_ADDR16); + AT24_CHIP_DATA(at24_data_24c1024, 1048576 / 8, AT24_FLAG_ADDR16); ++AT24_CHIP_DATA(at24_data_24c2048, 2097152 / 8, AT24_FLAG_ADDR16); + /* identical to 24c08 ? */ + AT24_CHIP_DATA(at24_data_INT3499, 8192 / 8, 0); + +@@ -199,6 +200,7 @@ static const struct i2c_device_id at24_ids[] = { + { "24c256", (kernel_ulong_t)&at24_data_24c256 }, + { "24c512", (kernel_ulong_t)&at24_data_24c512 }, + { "24c1024", (kernel_ulong_t)&at24_data_24c1024 }, ++ { "24c2048", (kernel_ulong_t)&at24_data_24c2048 }, + { "at24", 0 }, + { /* END OF LIST */ } + }; +@@ -227,6 +229,7 @@ static const struct of_device_id at24_of_match[] = { + { .compatible = "atmel,24c256", .data = &at24_data_24c256 }, + { .compatible = "atmel,24c512", .data = &at24_data_24c512 }, + { .compatible = "atmel,24c1024", .data = &at24_data_24c1024 }, ++ { .compatible = "atmel,24c2048", .data = &at24_data_24c2048 }, + { /* END OF LIST */ }, + }; + MODULE_DEVICE_TABLE(of, at24_of_match); +-- +2.19.1 + diff --git a/queue-4.19/gpio-pl061-handle-failed-allocations.patch b/queue-4.19/gpio-pl061-handle-failed-allocations.patch new file mode 100644 index 00000000000..8329b145b81 --- /dev/null +++ b/queue-4.19/gpio-pl061-handle-failed-allocations.patch @@ -0,0 +1,43 @@ +From d2fb34ef4aba6dee7ba97608cca23aa1b84a5ae8 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Sat, 1 Dec 2018 12:57:18 +0100 +Subject: gpio: pl061: handle failed allocations + +[ Upstream commit df209c43a0e8258e096fb722dfbdae4f0dd13fde ] + +devm_kzalloc(), devm_kstrdup() and devm_kasprintf() all can +fail internal allocation and return NULL. Using any of the assigned +objects without checking is not safe. As this is early in the boot +phase and these allocations really should not fail, any failure here +is probably an indication of a more serious issue so it makes little +sense to try and rollback the previous allocated resources or try to +continue; but rather the probe function is simply exited with -ENOMEM. + +Signed-off-by: Nicholas Mc Guire +Fixes: 684284b64aae ("ARM: integrator: add MMCI device to IM-PD1") +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/mach-integrator/impd1.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c +index a109f6482413..0f916c245a2e 100644 +--- a/arch/arm/mach-integrator/impd1.c ++++ b/arch/arm/mach-integrator/impd1.c +@@ -393,7 +393,11 @@ static int __ref impd1_probe(struct lm_device *dev) + sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup), + GFP_KERNEL); + chipname = devm_kstrdup(&dev->dev, devname, GFP_KERNEL); +- mmciname = kasprintf(GFP_KERNEL, "lm%x:00700", dev->id); ++ mmciname = devm_kasprintf(&dev->dev, GFP_KERNEL, ++ "lm%x:00700", dev->id); ++ if (!lookup || !chipname || !mmciname) ++ return -ENOMEM; ++ + lookup->dev_id = mmciname; + /* + * Offsets on GPIO block 1: +-- +2.19.1 + diff --git a/queue-4.19/kvm-sev-fail-kvm_sev_init-if-already-initialized.patch b/queue-4.19/kvm-sev-fail-kvm_sev_init-if-already-initialized.patch new file mode 100644 index 00000000000..600f153da8d --- /dev/null +++ b/queue-4.19/kvm-sev-fail-kvm_sev_init-if-already-initialized.patch @@ -0,0 +1,44 @@ +From 7fb5cef6038339cdfda7ab40ceda3d48bd7c502f Mon Sep 17 00:00:00 2001 +From: David Rientjes +Date: Wed, 2 Jan 2019 12:56:33 -0800 +Subject: kvm: sev: Fail KVM_SEV_INIT if already initialized +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3f14a89d1132dcae3c8ce6721c6ef51f6e6d9b5f ] + +By code inspection, it was found that multiple calls to KVM_SEV_INIT +could deplete asid bits and overwrite kvm_sev_info's regions_list. + +Multiple calls to KVM_SVM_INIT is not likely to occur with QEMU, but this +should likely be fixed anyway. + +This code is serialized by kvm->lock. + +Fixes: 1654efcbc431 ("KVM: SVM: Add KVM_SEV_INIT command") +Reported-by: Cfir Cohen +Signed-off-by: David Rientjes +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 02ac8fa0cd6d..ee8f8d70b98a 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -6256,6 +6256,9 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp) + int asid, ret; + + ret = -EBUSY; ++ if (unlikely(sev->active)) ++ return ret; ++ + asid = sev_asid_new(); + if (asid < 0) + return ret; +-- +2.19.1 + diff --git a/queue-4.19/nvme-multipath-zero-out-ana-log-buffer.patch b/queue-4.19/nvme-multipath-zero-out-ana-log-buffer.patch new file mode 100644 index 00000000000..76616ff88fe --- /dev/null +++ b/queue-4.19/nvme-multipath-zero-out-ana-log-buffer.patch @@ -0,0 +1,40 @@ +From 147562f546ef1d93e33caf2f38e14a1e759df14d Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Tue, 8 Jan 2019 12:46:58 +0100 +Subject: nvme-multipath: zero out ANA log buffer + +[ Upstream commit c7055fd15ff46d92eb0dd1c16a4fe010d58224c8 ] + +When nvme_init_identify() fails the ANA log buffer is deallocated +but _not_ set to NULL. This can cause double free oops when this +controller is deleted without ever being reconnected. + +Signed-off-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index c27af277e14e..815509dbed84 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -556,6 +556,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + return 0; + out_free_ana_log_buf: + kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = NULL; + out: + return error; + } +@@ -563,5 +564,6 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + void nvme_mpath_uninit(struct nvme_ctrl *ctrl) + { + kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = NULL; + } + +-- +2.19.1 + diff --git a/queue-4.19/nvme-pad-fake-subsys-nqn-vid-and-ssvid-with-zeros.patch b/queue-4.19/nvme-pad-fake-subsys-nqn-vid-and-ssvid-with-zeros.patch new file mode 100644 index 00000000000..8ec176bfcf3 --- /dev/null +++ b/queue-4.19/nvme-pad-fake-subsys-nqn-vid-and-ssvid-with-zeros.patch @@ -0,0 +1,33 @@ +From a04fef53dfcc66ed3d28215ac81a36cd6194c733 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Tue, 8 Jan 2019 09:37:43 -0700 +Subject: nvme: pad fake subsys NQN vid and ssvid with zeros + +[ Upstream commit 3da584f57133e51aeb84aaefae5e3d69531a1e4f ] + +We need to preserve the leading zeros in the vid and ssvid when generating +a unique NQN. Truncating these may lead to naming collisions. + +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index e5bddae16ed4..e0d2b7473901 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2095,7 +2095,7 @@ static void nvme_init_subnqn(struct nvme_subsystem *subsys, struct nvme_ctrl *ct + + /* Generate a "fake" NQN per Figure 254 in NVMe 1.3 + ECN 001 */ + off = snprintf(subsys->subnqn, NVMF_NQN_SIZE, +- "nqn.2014.08.org.nvmexpress:%4x%4x", ++ "nqn.2014.08.org.nvmexpress:%04x%04x", + le16_to_cpu(id->vid), le16_to_cpu(id->ssvid)); + memcpy(subsys->subnqn + off, id->sn, sizeof(id->sn)); + off += sizeof(id->sn); +-- +2.19.1 + diff --git a/queue-4.19/nvme-pci-fix-out-of-bounds-access-in-nvme_cqe_pendin.patch b/queue-4.19/nvme-pci-fix-out-of-bounds-access-in-nvme_cqe_pendin.patch new file mode 100644 index 00000000000..06f8d7862a2 --- /dev/null +++ b/queue-4.19/nvme-pci-fix-out-of-bounds-access-in-nvme_cqe_pendin.patch @@ -0,0 +1,44 @@ +From b857b51fb554f0adc6b190ea2d0308200d780407 Mon Sep 17 00:00:00 2001 +From: Hongbo Yao +Date: Mon, 7 Jan 2019 10:22:07 +0800 +Subject: nvme-pci: fix out of bounds access in nvme_cqe_pending + +[ Upstream commit dcca1662727220d18fa351097ddff33f95f516c5 ] + +There is an out of bounds array access in nvme_cqe_peding(). + +When enable irq_thread for nvme interrupt, there is racing between the +nvmeq->cq_head updating and reading. + +nvmeq->cq_head is updated in nvme_update_cq_head(), if nvmeq->cq_head +equals nvmeq->q_depth and before its value set to zero, nvme_cqe_pending() +uses its value as an array index, the index will be out of bounds. + +Signed-off-by: Hongbo Yao +[hch: slight coding style update] +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 40f76b4f08fc..f46313f441ec 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -908,9 +908,11 @@ static void nvme_complete_cqes(struct nvme_queue *nvmeq, u16 start, u16 end) + + static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + { +- if (++nvmeq->cq_head == nvmeq->q_depth) { ++ if (nvmeq->cq_head == nvmeq->q_depth - 1) { + nvmeq->cq_head = 0; + nvmeq->cq_phase = !nvmeq->cq_phase; ++ } else { ++ nvmeq->cq_head++; + } + } + +-- +2.19.1 + diff --git a/queue-4.19/nvme-pci-use-the-same-attributes-when-freeing-host_m.patch b/queue-4.19/nvme-pci-use-the-same-attributes-when-freeing-host_m.patch new file mode 100644 index 00000000000..aabc1cdc43c --- /dev/null +++ b/queue-4.19/nvme-pci-use-the-same-attributes-when-freeing-host_m.patch @@ -0,0 +1,49 @@ +From 45fb2064f414c15c12619af3b0006bd94524443d Mon Sep 17 00:00:00 2001 +From: Liviu Dudau +Date: Sat, 29 Dec 2018 17:23:43 +0000 +Subject: nvme-pci: use the same attributes when freeing host_mem_desc_bufs. + +[ Upstream commit cc667f6d5de023ee131e96bb88e5cddca23272bd ] + +When using HMB the PCIe host driver allocates host_mem_desc_bufs using +dma_alloc_attrs() but frees them using dma_free_coherent(). Use the +correct dma_free_attrs() function to free the buffers. + +Signed-off-by: Liviu Dudau +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index d668682f91df..40f76b4f08fc 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1727,8 +1727,9 @@ static void nvme_free_host_mem(struct nvme_dev *dev) + struct nvme_host_mem_buf_desc *desc = &dev->host_mem_descs[i]; + size_t size = le32_to_cpu(desc->size) * dev->ctrl.page_size; + +- dma_free_coherent(dev->dev, size, dev->host_mem_desc_bufs[i], +- le64_to_cpu(desc->addr)); ++ dma_free_attrs(dev->dev, size, dev->host_mem_desc_bufs[i], ++ le64_to_cpu(desc->addr), ++ DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN); + } + + kfree(dev->host_mem_desc_bufs); +@@ -1794,8 +1795,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, + while (--i >= 0) { + size_t size = le32_to_cpu(descs[i].size) * dev->ctrl.page_size; + +- dma_free_coherent(dev->dev, size, bufs[i], +- le64_to_cpu(descs[i].addr)); ++ dma_free_attrs(dev->dev, size, bufs[i], ++ le64_to_cpu(descs[i].addr), ++ DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN); + } + + kfree(bufs); +-- +2.19.1 + diff --git a/queue-4.19/perf-report-fix-wrong-iteration-count-in-branch-hist.patch b/queue-4.19/perf-report-fix-wrong-iteration-count-in-branch-hist.patch new file mode 100644 index 00000000000..9f4836539aa --- /dev/null +++ b/queue-4.19/perf-report-fix-wrong-iteration-count-in-branch-hist.patch @@ -0,0 +1,225 @@ +From fa19abe029239a612fc59fb7cb07accb48ec5b12 Mon Sep 17 00:00:00 2001 +From: Jin Yao +Date: Fri, 4 Jan 2019 14:10:30 +0800 +Subject: perf report: Fix wrong iteration count in --branch-history + +[ Upstream commit a3366db06bb656cef2e03f30f780d93059bcc594 ] + +By calculating the removed loops, we can get the iteration count. + +But the iteration count could be reported incorrectly, reporting +impossibly high counts. + +That's because previous code uses the number of removed LBR entries for +the iteration count. That's not good. Fix this by increasing the +iteration count when a loop is detected. + +When matching the chain, the iteration count would be added up, finally we need +to compute the average value when printing out. + +For example, + + $ perf report --branch-history --stdio --no-children + +Before: + + ---f2 +0 + | + |--33.62%--f1 +9 (cycles:1) + | f1 +0 + | main +22 (cycles:1) + | main +17 + | main +38 (cycles:1) + | main +27 + | f1 +26 (cycles:1) + | f1 +24 + | f2 +27 (cycles:7) + | f2 +0 + | f1 +19 (cycles:1) + | f1 +14 + | f2 +27 (cycles:11) + | f2 +0 + | f1 +9 (cycles:1 iter:2968 avg_cycles:3) + | f1 +0 + | main +22 (cycles:1 iter:2968 avg_cycles:3) + | main +17 + | main +38 (cycles:1 iter:2968 avg_cycles:3) + +2968 is an impossible high iteration count and avg_cycles is too small. + +After: + + ---f2 +0 + | + |--33.62%--f1 +9 (cycles:1) + | f1 +0 + | main +22 (cycles:1) + | main +17 + | main +38 (cycles:1) + | main +27 + | f1 +26 (cycles:1) + | f1 +24 + | f2 +27 (cycles:7) + | f2 +0 + | f1 +19 (cycles:1) + | f1 +14 + | f2 +27 (cycles:11) + | f2 +0 + | f1 +9 (cycles:1 iter:1 avg_cycles:23) + | f1 +0 + | main +22 (cycles:1 iter:1 avg_cycles:23) + | main +17 + | main +38 (cycles:1 iter:1 avg_cycles:23) + +avg_cycles:23 is the average cycles of this iteration. + +Fixes: c4ee06251d42 ("perf report: Calculate the average cycles of iterations") + +Signed-off-by: Jin Yao +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1546582230-17507-1-git-send-email-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/callchain.c | 32 ++++++++++++++++++++------------ + tools/perf/util/callchain.h | 1 + + tools/perf/util/machine.c | 2 +- + 3 files changed, 22 insertions(+), 13 deletions(-) + +diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c +index 32ef7bdca1cf..dc2212e12184 100644 +--- a/tools/perf/util/callchain.c ++++ b/tools/perf/util/callchain.c +@@ -766,6 +766,7 @@ static enum match_result match_chain(struct callchain_cursor_node *node, + cnode->cycles_count += node->branch_flags.cycles; + cnode->iter_count += node->nr_loop_iter; + cnode->iter_cycles += node->iter_cycles; ++ cnode->from_count++; + } + } + +@@ -1345,10 +1346,10 @@ static int branch_to_str(char *bf, int bfsize, + static int branch_from_str(char *bf, int bfsize, + u64 branch_count, + u64 cycles_count, u64 iter_count, +- u64 iter_cycles) ++ u64 iter_cycles, u64 from_count) + { + int printed = 0, i = 0; +- u64 cycles; ++ u64 cycles, v = 0; + + cycles = cycles_count / branch_count; + if (cycles) { +@@ -1357,14 +1358,16 @@ static int branch_from_str(char *bf, int bfsize, + bf + printed, bfsize - printed); + } + +- if (iter_count) { +- printed += count_pri64_printf(i++, "iter", +- iter_count, +- bf + printed, bfsize - printed); ++ if (iter_count && from_count) { ++ v = iter_count / from_count; ++ if (v) { ++ printed += count_pri64_printf(i++, "iter", ++ v, bf + printed, bfsize - printed); + +- printed += count_pri64_printf(i++, "avg_cycles", +- iter_cycles / iter_count, +- bf + printed, bfsize - printed); ++ printed += count_pri64_printf(i++, "avg_cycles", ++ iter_cycles / iter_count, ++ bf + printed, bfsize - printed); ++ } + } + + if (i) +@@ -1377,6 +1380,7 @@ static int counts_str_build(char *bf, int bfsize, + u64 branch_count, u64 predicted_count, + u64 abort_count, u64 cycles_count, + u64 iter_count, u64 iter_cycles, ++ u64 from_count, + struct branch_type_stat *brtype_stat) + { + int printed; +@@ -1389,7 +1393,8 @@ static int counts_str_build(char *bf, int bfsize, + predicted_count, abort_count, brtype_stat); + } else { + printed = branch_from_str(bf, bfsize, branch_count, +- cycles_count, iter_count, iter_cycles); ++ cycles_count, iter_count, iter_cycles, ++ from_count); + } + + if (!printed) +@@ -1402,13 +1407,14 @@ static int callchain_counts_printf(FILE *fp, char *bf, int bfsize, + u64 branch_count, u64 predicted_count, + u64 abort_count, u64 cycles_count, + u64 iter_count, u64 iter_cycles, ++ u64 from_count, + struct branch_type_stat *brtype_stat) + { + char str[256]; + + counts_str_build(str, sizeof(str), branch_count, + predicted_count, abort_count, cycles_count, +- iter_count, iter_cycles, brtype_stat); ++ iter_count, iter_cycles, from_count, brtype_stat); + + if (fp) + return fprintf(fp, "%s", str); +@@ -1422,6 +1428,7 @@ int callchain_list_counts__printf_value(struct callchain_list *clist, + u64 branch_count, predicted_count; + u64 abort_count, cycles_count; + u64 iter_count, iter_cycles; ++ u64 from_count; + + branch_count = clist->branch_count; + predicted_count = clist->predicted_count; +@@ -1429,11 +1436,12 @@ int callchain_list_counts__printf_value(struct callchain_list *clist, + cycles_count = clist->cycles_count; + iter_count = clist->iter_count; + iter_cycles = clist->iter_cycles; ++ from_count = clist->from_count; + + return callchain_counts_printf(fp, bf, bfsize, branch_count, + predicted_count, abort_count, + cycles_count, iter_count, iter_cycles, +- &clist->brtype_stat); ++ from_count, &clist->brtype_stat); + } + + static void free_callchain_node(struct callchain_node *node) +diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h +index 154560b1eb65..99d38ac019b8 100644 +--- a/tools/perf/util/callchain.h ++++ b/tools/perf/util/callchain.h +@@ -118,6 +118,7 @@ struct callchain_list { + bool has_children; + }; + u64 branch_count; ++ u64 from_count; + u64 predicted_count; + u64 abort_count; + u64 cycles_count; +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index d7403d1207d7..b1508ce3e412 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -1988,7 +1988,7 @@ static void save_iterations(struct iterations *iter, + { + int i; + +- iter->nr_loop_iter = nr; ++ iter->nr_loop_iter++; + iter->cycles = 0; + + for (i = 0; i < nr; i++) +-- +2.19.1 + diff --git a/queue-4.19/perf-test-shell-use-a-fallback-to-get-the-pathname-i.patch b/queue-4.19/perf-test-shell-use-a-fallback-to-get-the-pathname-i.patch new file mode 100644 index 00000000000..c0522c7d157 --- /dev/null +++ b/queue-4.19/perf-test-shell-use-a-fallback-to-get-the-pathname-i.patch @@ -0,0 +1,47 @@ +From cc82c17a4290f58a184e26eacdb006f2125a1190 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Fri, 4 Jan 2019 15:10:00 -0300 +Subject: perf test shell: Use a fallback to get the pathname in vfs_getname + +[ Upstream commit 03fa483821c0b4db7c2b1453d3332f397d82313f ] + +Some kernels, like 4.19.13-300.fc29.x86_64 in fedora 29, fail with the +existing probe definition asking for the contents of result->name, +working when we ask for the 'filename' variable instead, so add a +fallback to that. + +Now those tests are back working on fedora 29 systems with that kernel: + + # perf test vfs_getname + 65: Use vfs_getname probe to get syscall args filenames : Ok + 66: Add vfs_getname probe to get syscall args filenames : Ok + 67: Check open filename arg using perf trace + vfs_getname: Ok + # + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lkml.kernel.org/n/tip-klt3n0i58dfqttveti09q3fi@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/lib/probe_vfs_getname.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh +index 1c16e56cd93e..7cb99b433888 100644 +--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh ++++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh +@@ -13,7 +13,8 @@ add_probe_vfs_getname() { + local verbose=$1 + if [ $had_vfs_getname -eq 1 ] ; then + line=$(perf probe -L getname_flags 2>&1 | egrep 'result.*=.*filename;' | sed -r 's/[[:space:]]+([[:digit:]]+)[[:space:]]+result->uptr.*/\1/') +- perf probe $verbose "vfs_getname=getname_flags:${line} pathname=result->name:string" ++ perf probe -q "vfs_getname=getname_flags:${line} pathname=result->name:string" || \ ++ perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:string" + fi + } + +-- +2.19.1 + diff --git a/queue-4.19/riscv-fix-trace_sys_exit-hook.patch b/queue-4.19/riscv-fix-trace_sys_exit-hook.patch new file mode 100644 index 00000000000..7f3968d4986 --- /dev/null +++ b/queue-4.19/riscv-fix-trace_sys_exit-hook.patch @@ -0,0 +1,31 @@ +From dcc02d4d7c50281d235d79038a897f7b5f9a7a4c Mon Sep 17 00:00:00 2001 +From: David Abdurachmanov +Date: Thu, 6 Dec 2018 16:26:34 +0100 +Subject: riscv: fix trace_sys_exit hook + +[ Upstream commit 775800b0f1d7303d4fd8ce0e0d9eca4ff2f338f2 ] + +Fix compilation error. + +Signed-off-by: David Abdurachmanov +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c +index 9f82a7e34c64..9db7d0076375 100644 +--- a/arch/riscv/kernel/ptrace.c ++++ b/arch/riscv/kernel/ptrace.c +@@ -120,6 +120,6 @@ void do_syscall_trace_exit(struct pt_regs *regs) + + #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) +- trace_sys_exit(regs, regs->regs[0]); ++ trace_sys_exit(regs, regs_return_value(regs)); + #endif + } +-- +2.19.1 + diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..a702f6174c9 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,49 @@ +dt-bindings-eeprom-at24-add-atmel-24c2048-compatible.patch +eeprom-at24-add-support-for-24c2048.patch +blk-mq-fix-a-hung-issue-when-fsync.patch +arm-8789-1-signal-copy-registers-using-__copy_to_use.patch +arm-8790-1-signal-always-use-__copy_to_user-to-save-.patch +arm-8791-1-vfp-use-__copy_to_user-when-saving-vfp-st.patch +arm-8792-1-oabi-compat-copy-oabi-events-using-__copy.patch +arm-8793-1-signal-replace-__put_user_error-with-__pu.patch +arm-8794-1-uaccess-prevent-speculative-use-of-the-cu.patch +arm-8795-1-spectre-v1.1-use-put_user-for-__put_user.patch +arm-8796-1-spectre-v1-v1.1-provide-helpers-for-addre.patch +arm-8797-1-spectre-v1.1-harden-__copy_to_user.patch +arm-8810-1-vfp-fix-wrong-assignement-to-ufp_exc.patch +arm-make-lookup_processor_type-non-__init.patch +arm-split-out-processor-lookup.patch +arm-clean-up-per-processor-check_bugs-method-call.patch +arm-add-proc_vtable-and-proc_table-macros.patch +arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch +arm-ensure-that-processor-vtables-is-not-lost-after-.patch +arm-fix-the-cockup-in-the-previous-patch.patch +drm-amdgpu-sriov-correct-pfvf-exchange-logic.patch +acpi-numa-use-correct-type-for-printing-addresses-on.patch +perf-report-fix-wrong-iteration-count-in-branch-hist.patch +perf-test-shell-use-a-fallback-to-get-the-pathname-i.patch +tools-uapi-fix-risc-v-64-bit-support.patch +riscv-fix-trace_sys_exit-hook.patch +cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch +drm-bridge-tc358767-add-bus-flags.patch +drm-bridge-tc358767-add-defines-for-dp1_srcctrl-phy_.patch +drm-bridge-tc358767-fix-single-lane-configuration.patch +drm-bridge-tc358767-fix-initial-dp0-1_srcctrl-value.patch +drm-bridge-tc358767-reject-modes-which-require-too-m.patch +drm-bridge-tc358767-fix-output-h-v-syncs.patch +nvme-pci-use-the-same-attributes-when-freeing-host_m.patch +nvme-pci-fix-out-of-bounds-access-in-nvme_cqe_pendin.patch +nvme-multipath-zero-out-ana-log-buffer.patch +nvme-pad-fake-subsys-nqn-vid-and-ssvid-with-zeros.patch +drm-amdgpu-set-write_burst_length-to-64b-to-workarou.patch +arm-dts-da850-evm-correct-the-audio-codec-regulators.patch +arm-dts-da850-evm-correct-the-sound-card-name.patch +arm-dts-da850-lcdk-correct-the-audio-codec-regulator.patch +arm-dts-da850-lcdk-correct-the-sound-card-name.patch +arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch +gpio-pl061-handle-failed-allocations.patch +drm-nouveau-don-t-disable-polling-in-fallback-mode.patch +drm-nouveau-falcon-avoid-touching-registers-if-engin.patch +cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch +kvm-sev-fail-kvm_sev_init-if-already-initialized.patch +cifs-do-not-assume-one-credit-for-async-responses.patch diff --git a/queue-4.19/tools-uapi-fix-risc-v-64-bit-support.patch b/queue-4.19/tools-uapi-fix-risc-v-64-bit-support.patch new file mode 100644 index 00000000000..d6ae6a5fcd5 --- /dev/null +++ b/queue-4.19/tools-uapi-fix-risc-v-64-bit-support.patch @@ -0,0 +1,82 @@ +From 3dae2cf49e9d6ab1f0711a6cfb9dd98a107f2000 Mon Sep 17 00:00:00 2001 +From: Aurelien Jarno +Date: Tue, 25 Dec 2018 15:46:24 +0100 +Subject: tools uapi: fix RISC-V 64-bit support + +[ Upstream commit d0df00e30e4bf9bc27ddbd092ad683ff6121b360 ] + +The BPF library is not built on 64-bit RISC-V, as the BPF feature is +not detected. Looking more in details, feature/test-bpf.c fails to build +with the following error: + +| In file included from /tmp/linux-4.19.12/tools/include/uapi/asm/bitsperlong.h:17, +| from /tmp/linux-4.19.12/tools/include/uapi/asm-generic/unistd.h:2, +| from /usr/include/riscv64-linux-gnu/asm/unistd.h:1, +| from test-bpf.c:2: +| /tmp/linux-4.19.12/tools/include/asm-generic/bitsperlong.h:14:2: error: #error Inconsistent word size. Check asm/bitsperlong.h +| #error Inconsistent word size. Check asm/bitsperlong.h +| ^~~~~ + +The UAPI from the tools directory is missing RISC-V support, therefore +bitsperlong.h from asm-generic is used, defaulting to 32 bits. + +Fix that by adding tools/arch/riscv/include/uapi/asm/bitsperlong.h as +a copy of arch/riscv/include/uapi/asm/bitsperlong.h and by updating +tools/include/uapi/asm/bitsperlong.h. + +Signed-off-by: Aurelien Jarno +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + .../arch/riscv/include/uapi/asm/bitsperlong.h | 25 +++++++++++++++++++ + tools/include/uapi/asm/bitsperlong.h | 2 ++ + 2 files changed, 27 insertions(+) + create mode 100644 tools/arch/riscv/include/uapi/asm/bitsperlong.h + +diff --git a/tools/arch/riscv/include/uapi/asm/bitsperlong.h b/tools/arch/riscv/include/uapi/asm/bitsperlong.h +new file mode 100644 +index 000000000000..0b3cb52fd29d +--- /dev/null ++++ b/tools/arch/riscv/include/uapi/asm/bitsperlong.h +@@ -0,0 +1,25 @@ ++/* ++ * Copyright (C) 2012 ARM Ltd. ++ * Copyright (C) 2015 Regents of the University of California ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H ++#define _UAPI_ASM_RISCV_BITSPERLONG_H ++ ++#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8) ++ ++#include ++ ++#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */ +diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h +index 8dd6aefdafa4..fd92ce8388fc 100644 +--- a/tools/include/uapi/asm/bitsperlong.h ++++ b/tools/include/uapi/asm/bitsperlong.h +@@ -13,6 +13,8 @@ + #include "../../arch/mips/include/uapi/asm/bitsperlong.h" + #elif defined(__ia64__) + #include "../../arch/ia64/include/uapi/asm/bitsperlong.h" ++#elif defined(__riscv) ++#include "../../arch/riscv/include/uapi/asm/bitsperlong.h" + #else + #include + #endif +-- +2.19.1 +