From: Sasha Levin Date: Wed, 3 Jul 2019 18:13:18 +0000 (-0400) Subject: fixes for 5.1 X-Git-Tag: v5.1.17~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6d0ec863bcae2baaf84672e64f74d10237f544c1;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.1 Signed-off-by: Sasha Levin --- diff --git a/queue-5.1/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch b/queue-5.1/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch new file mode 100644 index 00000000000..e7065f0bceb --- /dev/null +++ b/queue-5.1/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch @@ -0,0 +1,46 @@ +From e4ee1a8ada93cc902b26cc881d1580d72ab12692 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Wed, 22 May 2019 11:21:41 -0500 +Subject: ALSA: hdac: fix memory release for SST and SOF drivers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 6d647b736a6b1cbf2f8deab0e6a94c34a6ea9d60 ] + +During the integration of HDaudio support, we changed the way in which +we get hdev in snd_hdac_ext_bus_device_init() to use one preallocated +with devm_kzalloc(), however it still left kfree(hdev) in +snd_hdac_ext_bus_device_exit(). It leads to oopses when trying to +rmmod and modprobe. Fix it, by just removing kfree call. + +SOF also uses some of the snd_hdac_ functions for HDAudio support but +allocated the memory with kzalloc. A matching fix is provided +separately to align all users of the snd_hdac_ library. + +Fixes: 6298542fa33b ("ALSA: hdac: remove memory allocation from snd_hdac_ext_bus_device_init") +Reviewed-by: Takashi Iwai +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/hda/ext/hdac_ext_bus.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c +index ec7715c6b0c0..c147ebe542da 100644 +--- a/sound/hda/ext/hdac_ext_bus.c ++++ b/sound/hda/ext/hdac_ext_bus.c +@@ -172,7 +172,6 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_init); + void snd_hdac_ext_bus_device_exit(struct hdac_device *hdev) + { + snd_hdac_device_exit(hdev); +- kfree(hdev); + } + EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_exit); + +-- +2.20.1 + diff --git a/queue-5.1/arm64-tlbflush-ensure-start-end-of-address-range-are.patch b/queue-5.1/arm64-tlbflush-ensure-start-end-of-address-range-are.patch new file mode 100644 index 00000000000..c3104bf0ae2 --- /dev/null +++ b/queue-5.1/arm64-tlbflush-ensure-start-end-of-address-range-are.patch @@ -0,0 +1,46 @@ +From 1e3984f55d5b7e0b3eb3963d97e353eb99cb1cc7 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 11 Jun 2019 12:47:34 +0100 +Subject: arm64: tlbflush: Ensure start/end of address range are aligned to + stride + +[ Upstream commit 01d57485fcdb9f9101a10a18e32d5f8b023cab86 ] + +Since commit 3d65b6bbc01e ("arm64: tlbi: Set MAX_TLBI_OPS to +PTRS_PER_PTE"), we resort to per-ASID invalidation when attempting to +perform more than PTRS_PER_PTE invalidation instructions in a single +call to __flush_tlb_range(). Whilst this is beneficial, the mmu_gather +code does not ensure that the end address of the range is rounded-up +to the stride when freeing intermediate page tables in pXX_free_tlb(), +which defeats our range checking. + +Align the bounds passed into __flush_tlb_range(). + +Cc: Catalin Marinas +Cc: Peter Zijlstra +Reported-by: Hanjun Guo +Tested-by: Hanjun Guo +Reviewed-by: Hanjun Guo +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/tlbflush.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h +index 3a1870228946..dff8f9ea5754 100644 +--- a/arch/arm64/include/asm/tlbflush.h ++++ b/arch/arm64/include/asm/tlbflush.h +@@ -195,6 +195,9 @@ static inline void __flush_tlb_range(struct vm_area_struct *vma, + unsigned long asid = ASID(vma->vm_mm); + unsigned long addr; + ++ start = round_down(start, stride); ++ end = round_up(end, stride); ++ + if ((end - start) >= (MAX_TLBI_OPS * stride)) { + flush_tlb_mm(vma->vm_mm); + return; +-- +2.20.1 + diff --git a/queue-5.1/asoc-ak4458-add-return-value-for-ak4458_probe.patch b/queue-5.1/asoc-ak4458-add-return-value-for-ak4458_probe.patch new file mode 100644 index 00000000000..9564e452b61 --- /dev/null +++ b/queue-5.1/asoc-ak4458-add-return-value-for-ak4458_probe.patch @@ -0,0 +1,65 @@ +From dcf754b892ee655cca3de1c366041ff686bbf692 Mon Sep 17 00:00:00 2001 +From: Viorel Suman +Date: Thu, 9 May 2019 13:30:36 +0000 +Subject: ASoC: ak4458: add return value for ak4458_probe + +[ Upstream commit a8dee20d792432740509237943700fbcfc230bad ] + +AK4458 is probed successfully even if AK4458 is not present - this +is caused by probe function returning no error on i2c access failure. +Return an error on probe if i2c access has failed. + +Signed-off-by: Shengjiu Wang +Signed-off-by: Viorel Suman +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index eab7c76cfcd9..4c5c3ec92609 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -536,9 +536,10 @@ static void ak4458_power_on(struct ak4458_priv *ak4458) + } + } + +-static void ak4458_init(struct snd_soc_component *component) ++static int ak4458_init(struct snd_soc_component *component) + { + struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component); ++ int ret; + + /* External Mute ON */ + if (ak4458->mute_gpiod) +@@ -546,21 +547,21 @@ static void ak4458_init(struct snd_soc_component *component) + + ak4458_power_on(ak4458); + +- snd_soc_component_update_bits(component, AK4458_00_CONTROL1, ++ ret = snd_soc_component_update_bits(component, AK4458_00_CONTROL1, + 0x80, 0x80); /* ACKS bit = 1; 10000000 */ ++ if (ret < 0) ++ return ret; + +- ak4458_rstn_control(component, 1); ++ return ak4458_rstn_control(component, 1); + } + + static int ak4458_probe(struct snd_soc_component *component) + { + struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component); + +- ak4458_init(component); +- + ak4458->fs = 48000; + +- return 0; ++ return ak4458_init(component); + } + + static void ak4458_remove(struct snd_soc_component *component) +-- +2.20.1 + diff --git a/queue-5.1/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch b/queue-5.1/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch new file mode 100644 index 00000000000..eb0b24fc744 --- /dev/null +++ b/queue-5.1/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch @@ -0,0 +1,39 @@ +From 22b6fd70bb4954a92ec057bcbe30e09758e80111 Mon Sep 17 00:00:00 2001 +From: Viorel Suman +Date: Mon, 13 May 2019 10:02:42 +0000 +Subject: ASoC: ak4458: rstn_control - return a non-zero on error only + +[ Upstream commit 176a11834b65ec35e3b7a953f87fb9cc41309497 ] + +snd_soc_component_update_bits() may return 1 if operation +was successful and the value of the register changed. +Return a non-zero in ak4458_rstn_control for an error only. + +Signed-off-by: Shengjiu Wang +Signed-off-by: Viorel Suman +Reviewed-by: Daniel Baluta +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index 4c5c3ec92609..71562154c0b1 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -304,7 +304,10 @@ static int ak4458_rstn_control(struct snd_soc_component *component, int bit) + AK4458_00_CONTROL1, + AK4458_RSTN_MASK, + 0x0); +- return ret; ++ if (ret < 0) ++ return ret; ++ ++ return 0; + } + + static int ak4458_hw_params(struct snd_pcm_substream *substream, +-- +2.20.1 + diff --git a/queue-5.1/asoc-core-fix-deadlock-in-snd_soc_instantiate_card.patch b/queue-5.1/asoc-core-fix-deadlock-in-snd_soc_instantiate_card.patch new file mode 100644 index 00000000000..4c52819796c --- /dev/null +++ b/queue-5.1/asoc-core-fix-deadlock-in-snd_soc_instantiate_card.patch @@ -0,0 +1,58 @@ +From b09972750d68a9cb42dc20343543210c96220f27 Mon Sep 17 00:00:00 2001 +From: Ranjani Sridharan +Date: Fri, 7 Jun 2019 22:07:06 -0700 +Subject: ASoC: core: Fix deadlock in snd_soc_instantiate_card() + +[ Upstream commit 495f926c68ddb905a7a0192963096138c6a934e1 ] + +Move the client_mutex lock to snd_soc_unbind_card() before +removing link components. This prevents the deadlock +in the error path in snd_soc_instantiate_card(). + +Fixes: 34ac3c3eb8 (ASoC: core: lock client_mutex while removing +link components) +Reported-by: kernelci.org bot +Signed-off-by: Ranjani Sridharan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 9df3bdeb5c47..c010cc864cf3 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1008,14 +1008,12 @@ static void soc_remove_link_components(struct snd_soc_card *card, + struct snd_soc_component *component; + struct snd_soc_rtdcom_list *rtdcom; + +- mutex_lock(&client_mutex); + for_each_rtdcom(rtd, rtdcom) { + component = rtdcom->component; + + if (component->driver->remove_order == order) + soc_remove_component(component); + } +- mutex_unlock(&client_mutex); + } + + static void soc_remove_dai_links(struct snd_soc_card *card) +@@ -2836,12 +2834,14 @@ static void snd_soc_unbind_card(struct snd_soc_card *card, bool unregister) + snd_soc_dapm_shutdown(card); + snd_soc_flush_all_delayed_work(card); + ++ mutex_lock(&client_mutex); + /* remove all components used by DAI links on this card */ + for_each_comp_order(order) { + for_each_card_rtds(card, rtd) { + soc_remove_link_components(card, rtd, order); + } + } ++ mutex_unlock(&client_mutex); + + soc_cleanup_card_resources(card); + if (!unregister) +-- +2.20.1 + diff --git a/queue-5.1/asoc-core-lock-client_mutex-while-removing-link-comp.patch b/queue-5.1/asoc-core-lock-client_mutex-while-removing-link-comp.patch new file mode 100644 index 00000000000..3302e7134a5 --- /dev/null +++ b/queue-5.1/asoc-core-lock-client_mutex-while-removing-link-comp.patch @@ -0,0 +1,41 @@ +From 3a43ae531379fd6386f7241e30f48596f6c406d5 Mon Sep 17 00:00:00 2001 +From: Ranjani Sridharan +Date: Thu, 23 May 2019 10:12:01 -0700 +Subject: ASoC: core: lock client_mutex while removing link components + +[ Upstream commit 34ac3c3eb8f0c07252ceddf0a22dd240e5c91ccb ] + +Removing link components results in topology unloading. So, +acquire the client_mutex before removing components in +soc_remove_link_components. This will prevent the lockdep warning +seen when dai links are removed during topology removal. + +Signed-off-by: Ranjani Sridharan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index a7b4fab92f26..a4668a788ed5 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1008,12 +1008,14 @@ static void soc_remove_link_components(struct snd_soc_card *card, + struct snd_soc_component *component; + struct snd_soc_rtdcom_list *rtdcom; + ++ mutex_lock(&client_mutex); + for_each_rtdcom(rtd, rtdcom) { + component = rtdcom->component; + + if (component->driver->remove_order == order) + soc_remove_component(component); + } ++ mutex_unlock(&client_mutex); + } + + static void soc_remove_dai_links(struct snd_soc_card *card) +-- +2.20.1 + diff --git a/queue-5.1/asoc-core-move-dai-pre-links-initiation-to-snd_soc_i.patch b/queue-5.1/asoc-core-move-dai-pre-links-initiation-to-snd_soc_i.patch new file mode 100644 index 00000000000..c87dd674e4a --- /dev/null +++ b/queue-5.1/asoc-core-move-dai-pre-links-initiation-to-snd_soc_i.patch @@ -0,0 +1,90 @@ +From da12cfdca11a9f6a11e2a2064e66e49988e6a918 Mon Sep 17 00:00:00 2001 +From: Tzung-Bi Shih +Date: Tue, 4 Jun 2019 11:31:02 +0800 +Subject: ASoC: core: move DAI pre-links initiation to snd_soc_instantiate_card + +[ Upstream commit 70fc53734e71ce51f46dfcfd1a1c319e1cfe080c ] + +Kernel crashes when an ASoC component rebinding. + +The dai_link->platforms has been reset to NULL by soc_cleanup_platform() +in soc_cleanup_card_resources() when un-registering component. However, +it has no chance to re-allocate the dai_link->platforms when registering +the component again. + +Move the DAI pre-links initiation from snd_soc_register_card() to +snd_soc_instantiate_card() to make sure all DAI pre-links get initiated +when component rebinding. + +As an example, by using the following commands: +- echo -n max98357a > /sys/bus/platform/drivers/max98357a/unbind +- echo -n max98357a > /sys/bus/platform/drivers/max98357a/bind + +Got the error message: +"Unable to handle kernel NULL pointer dereference at virtual address". + +The call trace: +snd_soc_is_matching_component+0x30/0x6c +soc_bind_dai_link+0x16c/0x240 +snd_soc_bind_card+0x1e4/0xb10 +snd_soc_add_component+0x270/0x300 +snd_soc_register_component+0x54/0x6c + +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index a4668a788ed5..9df3bdeb5c47 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -2069,6 +2069,16 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card) + int ret, i, order; + + mutex_lock(&client_mutex); ++ for_each_card_prelinks(card, i, dai_link) { ++ ret = soc_init_dai_link(card, dai_link); ++ if (ret) { ++ soc_cleanup_platform(card); ++ dev_err(card->dev, "ASoC: failed to init link %s: %d\n", ++ dai_link->name, ret); ++ mutex_unlock(&client_mutex); ++ return ret; ++ } ++ } + mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_INIT); + + card->dapm.bias_level = SND_SOC_BIAS_OFF; +@@ -2793,26 +2803,9 @@ static int snd_soc_bind_card(struct snd_soc_card *card) + */ + int snd_soc_register_card(struct snd_soc_card *card) + { +- int i, ret; +- struct snd_soc_dai_link *link; +- + if (!card->name || !card->dev) + return -EINVAL; + +- mutex_lock(&client_mutex); +- for_each_card_prelinks(card, i, link) { +- +- ret = soc_init_dai_link(card, link); +- if (ret) { +- soc_cleanup_platform(card); +- dev_err(card->dev, "ASoC: failed to init link %s\n", +- link->name); +- mutex_unlock(&client_mutex); +- return ret; +- } +- } +- mutex_unlock(&client_mutex); +- + dev_set_drvdata(card->dev, card); + + snd_soc_initialize_card_lists(card); +-- +2.20.1 + diff --git a/queue-5.1/asoc-cs4265-readable-register-too-low.patch b/queue-5.1/asoc-cs4265-readable-register-too-low.patch new file mode 100644 index 00000000000..e03a434c03d --- /dev/null +++ b/queue-5.1/asoc-cs4265-readable-register-too-low.patch @@ -0,0 +1,43 @@ +From 073a689586aef2a986ff5f12c0271d5751fcd164 Mon Sep 17 00:00:00 2001 +From: Matt Flax +Date: Wed, 8 May 2019 16:33:13 +1000 +Subject: ASoC : cs4265 : readable register too low + +[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ] + +The cs4265_readable_register function stopped short of the maximum +register. + +An example bug is taken from : +https://github.com/Audio-Injector/Ultra/issues/25 + +Where alsactl store fails with : +Cannot read control '2,0,0,C Data Buffer,0': Input/output error + +This patch fixes the bug by setting the cs4265 to have readable +registers up to the maximum hardware register CS4265_MAX_REGISTER. + +Signed-off-by: Matt Flax +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4265.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index ab27d2b94d02..c0190ec59e74 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { + static bool cs4265_readable_register(struct device *dev, unsigned int reg) + { + switch (reg) { +- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: ++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: + return true; + default: + return false; +-- +2.20.1 + diff --git a/queue-5.1/asoc-hda-fix-unbalanced-codec-dev-refcount-for-hda_d.patch b/queue-5.1/asoc-hda-fix-unbalanced-codec-dev-refcount-for-hda_d.patch new file mode 100644 index 00000000000..fde5b0a45a0 --- /dev/null +++ b/queue-5.1/asoc-hda-fix-unbalanced-codec-dev-refcount-for-hda_d.patch @@ -0,0 +1,46 @@ +From ed7fa1d421a7edafeee8dd8b8401651982e1d5b2 Mon Sep 17 00:00:00 2001 +From: Ranjani Sridharan +Date: Fri, 31 May 2019 09:01:37 -0700 +Subject: ASoC: hda: fix unbalanced codec dev refcount for HDA_DEV_ASOC + +[ Upstream commit d6947bb234dcc86e878d502516d0fb9d635aa2ae ] + +HDA_DEV_ASOC type codec device refcounts are managed differently +from HDA_DEV_LEGACY devices. The refcount is released explicitly +in snd_hdac_ext_bus_device_remove() for ASOC type devices. +So, remove the put_device() call in snd_hda_codec_dev_free() +for such devices to make the refcount balanced. This will prevent +the NULL pointer exception when the codec driver is released +after the card is freed. + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_codec.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index b20eb7fc83eb..fcdf2cd3783b 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -840,7 +840,14 @@ static int snd_hda_codec_dev_free(struct snd_device *device) + if (codec->core.type == HDA_DEV_LEGACY) + snd_hdac_device_unregister(&codec->core); + codec_display_power(codec, false); +- put_device(hda_codec_dev(codec)); ++ ++ /* ++ * In the case of ASoC HD-audio bus, the device refcount is released in ++ * snd_hdac_ext_bus_device_remove() explicitly. ++ */ ++ if (codec->core.type == HDA_DEV_LEGACY) ++ put_device(hda_codec_dev(codec)); ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-baytrail-add-quirk-for-aegex-10-ru2-table.patch b/queue-5.1/asoc-intel-baytrail-add-quirk-for-aegex-10-ru2-table.patch new file mode 100644 index 00000000000..17dc56b714a --- /dev/null +++ b/queue-5.1/asoc-intel-baytrail-add-quirk-for-aegex-10-ru2-table.patch @@ -0,0 +1,104 @@ +From 01aba57e5d2159d431d9999efc2161b8a1043ece Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kov=C3=A1cs=20Tam=C3=A1s?= +Date: Fri, 31 May 2019 19:22:26 +0200 +Subject: ASoC: Intel: Baytrail: add quirk for Aegex 10 (RU2) tablet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3e951e7914408aee196db77a5cb377801c85692a ] + +This tablet has an incorrect acpi identifier just like +Thinkpad10 tablet, which is why it is trying to load the RT5640 driver +instead of the RT5762 driver. The RT5640 driver, on the other hand, checks +the hardware ID, so no driver are loaded during boot. This fix resolves to +load the RT5672 driver on this tablet during boot. It also provides the +correct IO configuration, like the jack detect mode 3, for 1.8V pullup. I +would like to thank Pierre-Louis Bossart for helping with this patch. + +Signed-off-by: Kovács Tamás +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5670.c | 12 ++++++++++++ + .../soc/intel/common/soc-acpi-intel-byt-match.c | 17 +++++++++++++++++ + 2 files changed, 29 insertions(+) + +diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c +index 9a037108b1ae..a746e11ccfe3 100644 +--- a/sound/soc/codecs/rt5670.c ++++ b/sound/soc/codecs/rt5670.c +@@ -2882,6 +2882,18 @@ static const struct dmi_system_id dmi_platform_intel_quirks[] = { + RT5670_DEV_GPIO | + RT5670_JD_MODE3), + }, ++ { ++ .callback = rt5670_quirk_cb, ++ .ident = "Aegex 10 tablet (RU2)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "AEGEX"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "RU2"), ++ }, ++ .driver_data = (unsigned long *)(RT5670_DMIC_EN | ++ RT5670_DMIC2_INR | ++ RT5670_DEV_GPIO | ++ RT5670_JD_MODE3), ++ }, + {} + }; + +diff --git a/sound/soc/intel/common/soc-acpi-intel-byt-match.c b/sound/soc/intel/common/soc-acpi-intel-byt-match.c +index fe812a909db4..3a37f4eca437 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-byt-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-byt-match.c +@@ -22,6 +22,7 @@ static unsigned long byt_machine_id; + + #define BYT_THINKPAD_10 1 + #define BYT_POV_P1006W 2 ++#define BYT_AEGEX_10 3 + + static int byt_thinkpad10_quirk_cb(const struct dmi_system_id *id) + { +@@ -35,6 +36,12 @@ static int byt_pov_p1006w_quirk_cb(const struct dmi_system_id *id) + return 1; + } + ++static int byt_aegex10_quirk_cb(const struct dmi_system_id *id) ++{ ++ byt_machine_id = BYT_AEGEX_10; ++ return 1; ++} ++ + static const struct dmi_system_id byt_table[] = { + { + .callback = byt_thinkpad10_quirk_cb, +@@ -75,9 +82,18 @@ static const struct dmi_system_id byt_table[] = { + DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"), + }, + }, ++ { ++ /* Aegex 10 tablet (RU2) */ ++ .callback = byt_aegex10_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "AEGEX"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "RU2"), ++ }, ++ }, + { } + }; + ++/* The Thinkapd 10 and Aegex 10 tablets have the same ID problem */ + static struct snd_soc_acpi_mach byt_thinkpad_10 = { + .id = "10EC5640", + .drv_name = "cht-bsw-rt5672", +@@ -104,6 +120,7 @@ static struct snd_soc_acpi_mach *byt_quirk(void *arg) + + switch (byt_machine_id) { + case BYT_THINKPAD_10: ++ case BYT_AEGEX_10: + return &byt_thinkpad_10; + case BYT_POV_P1006W: + return &byt_pov_p1006w; +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-bytcht_es8316-fix-kernel-oops-with-platfo.patch b/queue-5.1/asoc-intel-bytcht_es8316-fix-kernel-oops-with-platfo.patch new file mode 100644 index 00000000000..530bbc1d4bb --- /dev/null +++ b/queue-5.1/asoc-intel-bytcht_es8316-fix-kernel-oops-with-platfo.patch @@ -0,0 +1,43 @@ +From daeb20d3cfe38568411351983fb734d6c6b340a4 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Tue, 4 Jun 2019 15:08:56 -0500 +Subject: ASoC: Intel: bytcht_es8316: fix kernel oops with platform_name + override + +[ Upstream commit 79136a016add1acb690fe8d96be50dd22a143d26 ] + +The platform override code uses devm_ functions to allocate memory for +the new name but the card device is not initialized. Fix by moving the +init earlier. + +Fixes: e4bc6b1195f64 ("ASoC: Intel: bytcht_es8316: platform name fixup support") +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index d2a7e6ba11ae..1c686f83220a 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -471,6 +471,7 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + } + + /* override plaform name, if required */ ++ byt_cht_es8316_card.dev = dev; + platform_name = mach->mach_params.platform; + + ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_es8316_card, +@@ -538,7 +539,6 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + (quirk & BYT_CHT_ES8316_MONO_SPEAKER) ? "mono" : "stereo", + mic_name[BYT_CHT_ES8316_MAP(quirk)]); + byt_cht_es8316_card.long_name = long_name; +- byt_cht_es8316_card.dev = dev; + snd_soc_card_set_drvdata(&byt_cht_es8316_card, priv); + + ret = devm_snd_soc_register_card(dev, &byt_cht_es8316_card); +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-cht_bsw_max98090-fix-kernel-oops-with-pla.patch b/queue-5.1/asoc-intel-cht_bsw_max98090-fix-kernel-oops-with-pla.patch new file mode 100644 index 00000000000..748a480b4f0 --- /dev/null +++ b/queue-5.1/asoc-intel-cht_bsw_max98090-fix-kernel-oops-with-pla.patch @@ -0,0 +1,43 @@ +From ce6786b98ef6cd13214fc37da73c2d86459209a0 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Tue, 4 Jun 2019 15:08:55 -0500 +Subject: ASoC: Intel: cht_bsw_max98090: fix kernel oops with platform_name + override + +[ Upstream commit fb54555134b9b17835545e4d096b5550c27eed64 ] + +The platform override code uses devm_ functions to allocate memory for +the new name but the card device is not initialized. Fix by moving the +init earlier. + +Fixes: 7e7e24d7c7ff0 ("ASoC: Intel: cht_bsw_max98090_ti: platform name fixup support") +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/cht_bsw_max98090_ti.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +index c0e0844f75b9..572e336ae0f9 100644 +--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c ++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +@@ -454,6 +454,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + } + + /* override plaform name, if required */ ++ snd_soc_card_cht.dev = &pdev->dev; + mach = (&pdev->dev)->platform_data; + platform_name = mach->mach_params.platform; + +@@ -463,7 +464,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + return ret_val; + + /* register the soc card */ +- snd_soc_card_cht.dev = &pdev->dev; + snd_soc_card_set_drvdata(&snd_soc_card_cht, drv); + + if (drv->quirks & QUIRK_PMC_PLT_CLK_0) +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-cht_bsw_nau8824-fix-kernel-oops-with-plat.patch b/queue-5.1/asoc-intel-cht_bsw_nau8824-fix-kernel-oops-with-plat.patch new file mode 100644 index 00000000000..9123ca2d5ee --- /dev/null +++ b/queue-5.1/asoc-intel-cht_bsw_nau8824-fix-kernel-oops-with-plat.patch @@ -0,0 +1,43 @@ +From 6e495d823216a9c1fe658356c33be902c84a5604 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Tue, 4 Jun 2019 15:08:57 -0500 +Subject: ASoC: Intel: cht_bsw_nau8824: fix kernel oops with platform_name + override + +[ Upstream commit 096701e8131425044d2054a0c210d6ea24ee7386 ] + +The platform override code uses devm_ functions to allocate memory for +the new name but the card device is not initialized. Fix by moving the +init earlier. + +Fixes: 4506db8043341 ("ASoC: Intel: cht_bsw_nau8824: platform name fixup support") +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/cht_bsw_nau8824.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/cht_bsw_nau8824.c b/sound/soc/intel/boards/cht_bsw_nau8824.c +index 02c2fa239331..20fae391c75a 100644 +--- a/sound/soc/intel/boards/cht_bsw_nau8824.c ++++ b/sound/soc/intel/boards/cht_bsw_nau8824.c +@@ -257,6 +257,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + snd_soc_card_set_drvdata(&snd_soc_card_cht, drv); + + /* override plaform name, if required */ ++ snd_soc_card_cht.dev = &pdev->dev; + mach = (&pdev->dev)->platform_data; + platform_name = mach->mach_params.platform; + +@@ -266,7 +267,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + return ret_val; + + /* register the soc card */ +- snd_soc_card_cht.dev = &pdev->dev; + ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht); + if (ret_val) { + dev_err(&pdev->dev, +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-cht_bsw_rt5672-fix-kernel-oops-with-platf.patch b/queue-5.1/asoc-intel-cht_bsw_rt5672-fix-kernel-oops-with-platf.patch new file mode 100644 index 00000000000..300de34e8d6 --- /dev/null +++ b/queue-5.1/asoc-intel-cht_bsw_rt5672-fix-kernel-oops-with-platf.patch @@ -0,0 +1,43 @@ +From a7f136a0d7c51f3c36b30bd77122b545b3cc99ad Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Tue, 4 Jun 2019 15:08:58 -0500 +Subject: ASoC: Intel: cht_bsw_rt5672: fix kernel oops with platform_name + override + +[ Upstream commit 9bbc799318a34061703f2a980e2b6df7fc6760f0 ] + +The platform override code uses devm_ functions to allocate memory for +the new name but the card device is not initialized. Fix by moving the +init earlier. + +Fixes: f403906da05cd ("ASoC: Intel: cht_bsw_rt5672: platform name fixup support") +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c +index 3d5a2b3a06f0..87ce3857376d 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5672.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5672.c +@@ -425,6 +425,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + } + + /* override plaform name, if required */ ++ snd_soc_card_cht.dev = &pdev->dev; + platform_name = mach->mach_params.platform; + + ret_val = snd_soc_fixup_dai_links_platform_name(&snd_soc_card_cht, +@@ -442,7 +443,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev) + snd_soc_card_set_drvdata(&snd_soc_card_cht, drv); + + /* register the soc card */ +- snd_soc_card_cht.dev = &pdev->dev; + ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht); + if (ret_val) { + dev_err(&pdev->dev, +-- +2.20.1 + diff --git a/queue-5.1/asoc-intel-sst-fix-kmalloc-call-with-wrong-flags.patch b/queue-5.1/asoc-intel-sst-fix-kmalloc-call-with-wrong-flags.patch new file mode 100644 index 00000000000..03ee4225a65 --- /dev/null +++ b/queue-5.1/asoc-intel-sst-fix-kmalloc-call-with-wrong-flags.patch @@ -0,0 +1,91 @@ +From f1e1d5b1e6a89115a6e3ef8d5b4096022e13f749 Mon Sep 17 00:00:00 2001 +From: Alex Levin +Date: Fri, 7 Jun 2019 15:19:11 -0700 +Subject: ASoC: Intel: sst: fix kmalloc call with wrong flags + +[ Upstream commit 3da428ff2aa5a5191ba2f1630eea75f03242f3f2 ] + +When calling kmalloc with GFP_KERNEL in case CONFIG_SLOB is unset, +kmem_cache_alloc_trace is called. + +In case CONFIG_TRACING is set, kmem_cache_alloc_trace will ball +slab_alloc, which will call slab_pre_alloc_hook which might_sleep_if. + +The context in which it is called in this case, the +intel_sst_interrupt_mrfld, calling a sleeping kmalloc generates a BUG(): + +Fixes: 972b0d456e64 ("ASoC: Intel: remove GFP_ATOMIC, use GFP_KERNEL") + +[ 20.250671] BUG: sleeping function called from invalid context at mm/slab.h:422 +[ 20.250683] in_atomic(): 1, irqs_disabled(): 1, pid: 1791, name: Chrome_IOThread +[ 20.250690] CPU: 0 PID: 1791 Comm: Chrome_IOThread Tainted: G W 4.19.43 #61 +[ 20.250693] Hardware name: GOOGLE Kefka, BIOS Google_Kefka.7287.337.0 03/02/2017 +[ 20.250697] Call Trace: +[ 20.250704] +[ 20.250716] dump_stack+0x7e/0xc3 +[ 20.250725] ___might_sleep+0x12a/0x140 +[ 20.250731] kmem_cache_alloc_trace+0x53/0x1c5 +[ 20.250736] ? update_cfs_rq_load_avg+0x17e/0x1aa +[ 20.250740] ? cpu_load_update+0x6c/0xc2 +[ 20.250746] sst_create_ipc_msg+0x2d/0x88 +[ 20.250752] intel_sst_interrupt_mrfld+0x12a/0x22c +[ 20.250758] __handle_irq_event_percpu+0x133/0x228 +[ 20.250764] handle_irq_event_percpu+0x35/0x7a +[ 20.250768] handle_irq_event+0x36/0x55 +[ 20.250773] handle_fasteoi_irq+0xab/0x16c +[ 20.250779] handle_irq+0xd9/0x11e +[ 20.250785] do_IRQ+0x54/0xe0 +[ 20.250791] common_interrupt+0xf/0xf +[ 20.250795] +[ 20.250800] RIP: 0010:__lru_cache_add+0x4e/0xad +[ 20.250806] Code: 00 01 48 c7 c7 b8 df 01 00 65 48 03 3c 25 28 f1 00 00 48 8b 48 08 48 89 ca 48 ff ca f6 c1 01 48 0f 44 d0 f0 ff 42 34 0f b6 0f <89> ca fe c2 88 17 48 89 44 cf 08 80 fa 0f 74 0e 48 8b 08 66 85 c9 +[ 20.250809] RSP: 0000:ffffa568810bfd98 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd6 +[ 20.250814] RAX: ffffd3b904eb1940 RBX: ffffd3b904eb1940 RCX: 0000000000000004 +[ 20.250817] RDX: ffffd3b904eb1940 RSI: ffffa10ee5c47450 RDI: ffffa10efba1dfb8 +[ 20.250821] RBP: ffffa568810bfda8 R08: ffffa10ef9c741c1 R09: dead000000000100 +[ 20.250824] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa10ee8d52a40 +[ 20.250827] R13: ffffa10ee8d52000 R14: ffffa10ee5c47450 R15: 800000013ac65067 +[ 20.250835] lru_cache_add_active_or_unevictable+0x4e/0xb8 +[ 20.250841] handle_mm_fault+0xd98/0x10c4 +[ 20.250848] __do_page_fault+0x235/0x42d +[ 20.250853] ? page_fault+0x8/0x30 +[ 20.250858] do_page_fault+0x3d/0x17a +[ 20.250862] ? page_fault+0x8/0x30 +[ 20.250866] page_fault+0x1e/0x30 +[ 20.250872] RIP: 0033:0x7962fdea9304 +[ 20.250875] Code: 0f 11 4c 17 f0 c3 48 3b 15 f1 26 31 00 0f 83 e2 00 00 00 48 39 f7 72 0f 74 12 4c 8d 0c 16 4c 39 cf 0f 82 63 01 00 00 48 89 d1 a4 c3 80 fa 08 73 12 80 fa 04 73 1e 80 fa 01 77 26 72 05 0f b6 +[ 20.250879] RSP: 002b:00007962f4db5468 EFLAGS: 00010206 +[ 20.250883] RAX: 00003c8cc9d47008 RBX: 0000000000000000 RCX: 0000000000001b48 +[ 20.250886] RDX: 0000000000002b40 RSI: 00003c8cc9551000 RDI: 00003c8cc9d48000 +[ 20.250890] RBP: 00007962f4db5820 R08: 0000000000000000 R09: 00003c8cc9552b48 +[ 20.250893] R10: 0000562dd1064d30 R11: 00003c8cc825b908 R12: 00003c8cc966d3c0 +[ 20.250896] R13: 00003c8cc9e280c0 R14: 0000000000000000 R15: 0000000000000000 + +Signed-off-by: Alex Levin +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/atom/sst/sst_pvt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c +index 00a37a09dc9b..dba0ca07ebf9 100644 +--- a/sound/soc/intel/atom/sst/sst_pvt.c ++++ b/sound/soc/intel/atom/sst/sst_pvt.c +@@ -166,11 +166,11 @@ int sst_create_ipc_msg(struct ipc_post **arg, bool large) + { + struct ipc_post *msg; + +- msg = kzalloc(sizeof(*msg), GFP_KERNEL); ++ msg = kzalloc(sizeof(*msg), GFP_ATOMIC); + if (!msg) + return -ENOMEM; + if (large) { +- msg->mailbox_data = kzalloc(SST_MAILBOX_SIZE, GFP_KERNEL); ++ msg->mailbox_data = kzalloc(SST_MAILBOX_SIZE, GFP_ATOMIC); + if (!msg->mailbox_data) { + kfree(msg); + return -ENOMEM; +-- +2.20.1 + diff --git a/queue-5.1/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch b/queue-5.1/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch new file mode 100644 index 00000000000..75fd4e4d2b6 --- /dev/null +++ b/queue-5.1/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch @@ -0,0 +1,56 @@ +From 767e347d968f956247956b3893833b34a09e4637 Mon Sep 17 00:00:00 2001 +From: Yu-Hsuan Hsu +Date: Tue, 4 Jun 2019 18:49:09 +0800 +Subject: ASoC: max98090: remove 24-bit format support if RJ is 0 + +[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ] + +The supported formats are S16_LE and S24_LE now. However, by datasheet +of max98090, S24_LE is only supported when it is in the right justified +mode. We should remove 24-bit format if it is not in that mode to avoid +triggering error. + +Signed-off-by: Yu-Hsuan Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 7619ea31ab50..ada8c25e643d 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1909,6 +1909,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, + return 0; + } + ++static int max98090_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct snd_soc_component *component = dai->component; ++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); ++ unsigned int fmt = max98090->dai_fmt; ++ ++ /* Remove 24-bit format support if it is not in right justified mode. */ ++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { ++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); ++ } ++ return 0; ++} ++ + static int max98090_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -2316,6 +2331,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); + #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) + + static const struct snd_soc_dai_ops max98090_dai_ops = { ++ .startup = max98090_dai_startup, + .set_sysclk = max98090_dai_set_sysclk, + .set_fmt = max98090_dai_set_fmt, + .set_tdm_slot = max98090_set_tdm_slot, +-- +2.20.1 + diff --git a/queue-5.1/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch b/queue-5.1/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch new file mode 100644 index 00000000000..19f47817dc9 --- /dev/null +++ b/queue-5.1/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch @@ -0,0 +1,47 @@ +From d9244276dae0813c0391c43c0798ae792bb94915 Mon Sep 17 00:00:00 2001 +From: Libin Yang +Date: Wed, 8 May 2019 10:32:41 +0800 +Subject: ASoC: soc-pcm: BE dai needs prepare when pause release after resume + +[ Upstream commit 5087a8f17df868601cd7568299e91c28086d2b45 ] + +If playback/capture is paused and system enters S3, after system returns +from suspend, BE dai needs to call prepare() callback when playback/capture +is released from pause if RESUME_INFO flag is not set. + +Currently, the dpcm_be_dai_prepare() function will block calling prepare() +if the pcm is in SND_SOC_DPCM_STATE_PAUSED state. This will cause the +following test case fail if the pcm uses BE: + +playback -> pause -> S3 suspend -> S3 resume -> pause release + +The playback may exit abnormally when pause is released because the BE dai +prepare() is not called. + +This patch allows dpcm_be_dai_prepare() to call dai prepare() callback in +SND_SOC_DPCM_STATE_PAUSED state. + +Signed-off-by: Libin Yang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index be80a12fba27..2a3aacec8057 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2469,7 +2469,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) + continue; + + dev_dbg(be->dev, "ASoC: prepare BE %s\n", +-- +2.20.1 + diff --git a/queue-5.1/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch b/queue-5.1/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch new file mode 100644 index 00000000000..55aae3f758b --- /dev/null +++ b/queue-5.1/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch @@ -0,0 +1,39 @@ +From d299c1d26fcf78fba75777d8476370e62c9ea9bf Mon Sep 17 00:00:00 2001 +From: Marcus Cooper +Date: Mon, 3 Jun 2019 19:47:28 +0200 +Subject: ASoC: sun4i-i2s: Add offset to RX channel select + +[ Upstream commit f9927000cb35f250051f0f1878db12ee2626eea1 ] + +Whilst testing the capture functionality of the i2s on the newer +SoCs it was noticed that the recording was somewhat distorted. +This was due to the offset not being set correctly on the receiver +side. + +Signed-off-by: Marcus Cooper +Acked-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index 8162e107e50b..bc128e2a6096 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -460,6 +460,10 @@ static int sun4i_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + regmap_update_bits(i2s->regmap, SUN8I_I2S_TX_CHAN_SEL_REG, + SUN8I_I2S_TX_CHAN_OFFSET_MASK, + SUN8I_I2S_TX_CHAN_OFFSET(offset)); ++ ++ regmap_update_bits(i2s->regmap, SUN8I_I2S_RX_CHAN_SEL_REG, ++ SUN8I_I2S_TX_CHAN_OFFSET_MASK, ++ SUN8I_I2S_TX_CHAN_OFFSET(offset)); + } + + regmap_field_write(i2s->field_fmt_mode, val); +-- +2.20.1 + diff --git a/queue-5.1/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch b/queue-5.1/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch new file mode 100644 index 00000000000..5279c1fdc1c --- /dev/null +++ b/queue-5.1/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch @@ -0,0 +1,35 @@ +From 110781dddb7d665efd3581b9a2f261e3eef18c0e Mon Sep 17 00:00:00 2001 +From: Marcus Cooper +Date: Mon, 3 Jun 2019 19:47:27 +0200 +Subject: ASoC: sun4i-i2s: Fix sun8i tx channel offset mask + +[ Upstream commit 7e46169a5f35762f335898a75d1b8a242f2ae0f5 ] + +Although not causing any noticeable issues, the mask for the +channel offset is covering too many bits. + +Signed-off-by: Marcus Cooper +Acked-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index d5ec1a20499d..8162e107e50b 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -110,7 +110,7 @@ + + #define SUN8I_I2S_TX_CHAN_MAP_REG 0x44 + #define SUN8I_I2S_TX_CHAN_SEL_REG 0x34 +-#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 11) ++#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 12) + #define SUN8I_I2S_TX_CHAN_OFFSET(offset) (offset << 12) + #define SUN8I_I2S_TX_CHAN_EN_MASK GENMASK(11, 4) + #define SUN8I_I2S_TX_CHAN_EN(num_chan) (((1 << num_chan) - 1) << 4) +-- +2.20.1 + diff --git a/queue-5.1/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch b/queue-5.1/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch new file mode 100644 index 00000000000..d794b82d61d --- /dev/null +++ b/queue-5.1/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch @@ -0,0 +1,143 @@ +From 07fa85e9c92fbf9bfb598b7be513c5645167901e Mon Sep 17 00:00:00 2001 +From: Joel Savitz +Date: Wed, 12 Jun 2019 11:50:48 -0400 +Subject: cpuset: restore sanity to cpuset_cpus_allowed_fallback() + +[ Upstream commit d477f8c202d1f0d4791ab1263ca7657bbe5cf79e ] + +In the case that a process is constrained by taskset(1) (i.e. +sched_setaffinity(2)) to a subset of available cpus, and all of those are +subsequently offlined, the scheduler will set tsk->cpus_allowed to +the current value of task_cs(tsk)->effective_cpus. + +This is done via a call to do_set_cpus_allowed() in the context of +cpuset_cpus_allowed_fallback() made by the scheduler when this case is +detected. This is the only call made to cpuset_cpus_allowed_fallback() +in the latest mainline kernel. + +However, this is not sane behavior. + +I will demonstrate this on a system running the latest upstream kernel +with the following initial configuration: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,fffffff + Cpus_allowed_list: 0-63 + +(Where cpus 32-63 are provided via smt.) + +If we limit our current shell process to cpu2 only and then offline it +and reonline it: + + # taskset -p 4 $$ + pid 2272's current affinity mask: ffffffffffffffff + pid 2272's new affinity mask: 4 + + # echo off > /sys/devices/system/cpu/cpu2/online + # dmesg | tail -3 + [ 2195.866089] process 2272 (bash) no longer affine to cpu2 + [ 2195.872700] IRQ 114: no longer affine to CPU2 + [ 2195.879128] smpboot: CPU 2 is now offline + + # echo on > /sys/devices/system/cpu/cpu2/online + # dmesg | tail -1 + [ 2617.043572] smpboot: Booting Node 0 Processor 2 APIC 0x4 + +We see that our current process now has an affinity mask containing +every cpu available on the system _except_ the one we originally +constrained it to: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,fffffffb + Cpus_allowed_list: 0-1,3-63 + +This is not sane behavior, as the scheduler can now not only place the +process on previously forbidden cpus, it can't even schedule it on +the cpu it was originally constrained to! + +Other cases result in even more exotic affinity masks. Take for instance +a process with an affinity mask containing only cpus provided by smt at +the moment that smt is toggled, in a configuration such as the following: + + # taskset -p f000000000 $$ + # grep -i cpu /proc/$$/status + Cpus_allowed: 000000f0,00000000 + Cpus_allowed_list: 36-39 + +A double toggle of smt results in the following behavior: + + # echo off > /sys/devices/system/cpu/smt/control + # echo on > /sys/devices/system/cpu/smt/control + # grep -i cpus /proc/$$/status + Cpus_allowed: ffffff00,ffffffff + Cpus_allowed_list: 0-31,40-63 + +This is even less sane than the previous case, as the new affinity mask +excludes all smt-provided cpus with ids less than those that were +previously in the affinity mask, as well as those that were actually in +the mask. + +With this patch applied, both of these cases end in the following state: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,ffffffff + Cpus_allowed_list: 0-63 + +The original policy is discarded. Though not ideal, it is the simplest way +to restore sanity to this fallback case without reinventing the cpuset +wheel that rolls down the kernel just fine in cgroup v2. A user who wishes +for the previous affinity mask to be restored in this fallback case can use +that mechanism instead. + +This patch modifies scheduler behavior by instead resetting the mask to +task_cs(tsk)->cpus_allowed by default, and cpu_possible mask in legacy +mode. I tested the cases above on both modes. + +Note that the scheduler uses this fallback mechanism if and only if +_every_ other valid avenue has been traveled, and it is the last resort +before calling BUG(). + +Suggested-by: Waiman Long +Suggested-by: Phil Auld +Signed-off-by: Joel Savitz +Acked-by: Phil Auld +Acked-by: Waiman Long +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 4834c4214e9c..6c9deb2cc687 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -3255,10 +3255,23 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask) + spin_unlock_irqrestore(&callback_lock, flags); + } + ++/** ++ * cpuset_cpus_allowed_fallback - final fallback before complete catastrophe. ++ * @tsk: pointer to task_struct with which the scheduler is struggling ++ * ++ * Description: In the case that the scheduler cannot find an allowed cpu in ++ * tsk->cpus_allowed, we fall back to task_cs(tsk)->cpus_allowed. In legacy ++ * mode however, this value is the same as task_cs(tsk)->effective_cpus, ++ * which will not contain a sane cpumask during cases such as cpu hotplugging. ++ * This is the absolute last resort for the scheduler and it is only used if ++ * _every_ other avenue has been traveled. ++ **/ ++ + void cpuset_cpus_allowed_fallback(struct task_struct *tsk) + { + rcu_read_lock(); +- do_set_cpus_allowed(tsk, task_cs(tsk)->effective_cpus); ++ do_set_cpus_allowed(tsk, is_in_v2_mode() ? ++ task_cs(tsk)->cpus_allowed : cpu_possible_mask); + rcu_read_unlock(); + + /* +-- +2.20.1 + diff --git a/queue-5.1/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch b/queue-5.1/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch new file mode 100644 index 00000000000..601417ca9ca --- /dev/null +++ b/queue-5.1/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch @@ -0,0 +1,32 @@ +From c69da6945276b842428b3ba1be14cfad09de223e Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:54 +0800 +Subject: drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver + +[ Upstream commit cf49b24ffa62766f8f04cd1c4cf17b75d29b240a ] + +shutdown all CRTC when unbinding drm driver. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index e7362bdafa82..8718d123ccaa 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -311,6 +311,7 @@ err_config_cleanup: + static void mtk_drm_kms_deinit(struct drm_device *drm) + { + drm_kms_helper_poll_fini(drm); ++ drm_atomic_helper_shutdown(drm); + + component_unbind_all(drm->dev, drm); + drm_mode_config_cleanup(drm); +-- +2.20.1 + diff --git a/queue-5.1/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch b/queue-5.1/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch new file mode 100644 index 00000000000..55ccc8516db --- /dev/null +++ b/queue-5.1/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch @@ -0,0 +1,69 @@ +From 28a4f2975ea5685837105d0c1219a4c62b31f298 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Thu, 30 May 2019 17:18:47 +0800 +Subject: drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable() + +[ Upstream commit 2458d9d6d94be982b917e93c61a89b4426f32e31 ] + +mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), which +needs ovl irq for drm_crtc_wait_one_vblank(), since after mtk_dsi_stop() is +called, ovl irq will be disabled. If drm_crtc_wait_one_vblank() is called +after last irq, it will timeout with this message: "vblank wait timed out +on crtc 0". This happens sometimes when turning off the screen. + +In drm_atomic_helper.c#disable_outputs(), +the calling sequence when turning off the screen is: + +1. mtk_dsi_encoder_disable() + --> mtk_output_dsi_disable() + --> mtk_dsi_stop(); /* sometimes make vblank timeout in + atomic_disable */ + --> mtk_dsi_poweroff(); +2. mtk_drm_crtc_atomic_disable() + --> drm_crtc_wait_one_vblank(); + ... + --> mtk_dsi_ddp_stop() + --> mtk_dsi_poweroff(); + +mtk_dsi_poweroff() has reference count design, change to make +mtk_dsi_stop() called in mtk_dsi_poweroff() when refcount is 0. + +Fixes: 0707632b5bac ("drm/mediatek: update DSI sub driver flow for sending commands to panel") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 1ae3be99e0ff..179f2b080342 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -630,6 +630,15 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + if (--dsi->refcount != 0) + return; + ++ /* ++ * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since ++ * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), ++ * which needs irq for vblank, and mtk_dsi_stop() will disable irq. ++ * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(), ++ * after dsi is fully set. ++ */ ++ mtk_dsi_stop(dsi); ++ + if (!mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500)) { + if (dsi->panel) { + if (drm_panel_unprepare(dsi->panel)) { +@@ -696,7 +705,6 @@ static void mtk_output_dsi_disable(struct mtk_dsi *dsi) + } + } + +- mtk_dsi_stop(dsi); + mtk_dsi_poweroff(dsi); + + dsi->enabled = false; +-- +2.20.1 + diff --git a/queue-5.1/drm-mediatek-clear-num_pipes-when-unbind-driver.patch b/queue-5.1/drm-mediatek-clear-num_pipes-when-unbind-driver.patch new file mode 100644 index 00000000000..b791950f5f4 --- /dev/null +++ b/queue-5.1/drm-mediatek-clear-num_pipes-when-unbind-driver.patch @@ -0,0 +1,35 @@ +From 4d2db5b71cc98d9824764984dcc8f7c322e6ab4d Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:55 +0800 +Subject: drm/mediatek: clear num_pipes when unbind driver + +[ Upstream commit a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396 ] + +num_pipes is used for mutex created in mtk_drm_crtc_create(). If we +don't clear num_pipes count, when rebinding driver, the count will +be accumulated. From mtk_disp_mutex_get(), there can only be at most +10 mutex id. Clear this number so it starts from 0 in every rebind. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 8718d123ccaa..bbfe3a464aea 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -400,6 +400,7 @@ static void mtk_drm_unbind(struct device *dev) + drm_dev_unregister(private->drm); + mtk_drm_kms_deinit(private->drm); + drm_dev_put(private->drm); ++ private->num_pipes = 0; + private->drm = NULL; + } + +-- +2.20.1 + diff --git a/queue-5.1/drm-mediatek-fix-unbind-functions.patch b/queue-5.1/drm-mediatek-fix-unbind-functions.patch new file mode 100644 index 00000000000..2a4de76f9a5 --- /dev/null +++ b/queue-5.1/drm-mediatek-fix-unbind-functions.patch @@ -0,0 +1,34 @@ +From 8ad796d1eb388f065172884fbaa36747394d0cde Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:52 +0800 +Subject: drm/mediatek: fix unbind functions + +[ Upstream commit 8fd7a37b191f93737f6280a9b5de65f98acc12c9 ] + +detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to +attach it again. + +Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index b00eb2d2e086..1ae3be99e0ff 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -844,6 +844,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi) + /* Skip connector cleanup if creation was delegated to the bridge */ + if (dsi->conn.dev) + drm_connector_cleanup(&dsi->conn); ++ if (dsi->panel) ++ drm_panel_detach(dsi->panel); + } + + static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp) +-- +2.20.1 + diff --git a/queue-5.1/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch b/queue-5.1/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch new file mode 100644 index 00000000000..0128257152e --- /dev/null +++ b/queue-5.1/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch @@ -0,0 +1,55 @@ +From 2aa9618c9d9a21ceaa422c45a6f4bac395ff84b2 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:53 +0800 +Subject: drm/mediatek: unbind components in mtk_drm_unbind() + +[ Upstream commit f0fd848342802bc0f74620d387eead53e8905804 ] + +Unbinding components (i.e. mtk_dsi and mtk_disp_ovl/rdma/color) will +trigger master(mtk_drm)'s .unbind(), and currently mtk_drm's unbind +won't actually unbind components. During the next bind, +mtk_drm_kms_init() is called, and the components are added back. + +.unbind() should call mtk_drm_kms_deinit() to unbind components. + +And since component_master_del() in .remove() will trigger .unbind(), +which will also unregister device, it's fine to remove original functions +called here. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 57ce4708ef1b..e7362bdafa82 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -397,6 +397,7 @@ static void mtk_drm_unbind(struct device *dev) + struct mtk_drm_private *private = dev_get_drvdata(dev); + + drm_dev_unregister(private->drm); ++ mtk_drm_kms_deinit(private->drm); + drm_dev_put(private->drm); + private->drm = NULL; + } +@@ -568,13 +569,8 @@ err_node: + static int mtk_drm_remove(struct platform_device *pdev) + { + struct mtk_drm_private *private = platform_get_drvdata(pdev); +- struct drm_device *drm = private->drm; + int i; + +- drm_dev_unregister(drm); +- mtk_drm_kms_deinit(drm); +- drm_dev_put(drm); +- + component_master_del(&pdev->dev, &mtk_drm_ops); + pm_runtime_disable(&pdev->dev); + of_node_put(private->mutex_node); +-- +2.20.1 + diff --git a/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch b/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch new file mode 100644 index 00000000000..9c84cd17f8c --- /dev/null +++ b/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch @@ -0,0 +1,60 @@ +From 74d1b078b8b1465d15fde8e33fbe86eb6268bb36 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 24 May 2019 14:57:59 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD MicroPC + +[ Upstream commit 652b8b086538c8a10de5aa5cbdaef79333b46358 ] + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_micropc data struct may very well need to be updated +with some extra bios-dates in the future. + +Acked-by: Maxime Ripard +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-2-hdegoede@redhat.com +(cherry picked from commit f2f2bb60d998abde10de7e483ef9e17639892450) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 019f148d5a78..dd982563304d 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_micropc = { ++ .width = 720, ++ .height = 1280, ++ .bios_dates = (const char * const []){ "04/26/2019", ++ NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .width = 1200, + .height = 1920, +@@ -101,6 +109,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, + .driver_data = (void *)&asus_t100ha, ++ }, { /* GPD MicroPC (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_micropc, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +-- +2.20.1 + diff --git a/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch b/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch new file mode 100644 index 00000000000..b654f0e16df --- /dev/null +++ b/queue-5.1/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch @@ -0,0 +1,65 @@ +From 629c249ca3135d154c41d709e66f9d9ee8090fd5 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 24 May 2019 14:57:58 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD pocket2 + +[ Upstream commit 15abc7110a77555d3bf72aaef46d1557db0a4ac5 ] + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_pocket2 data struct may very well need to be updated +with some extra bios-dates in the future. + +Changes in v2: +-Add one more known BIOS date to the list of BIOS dates + +Cc: Jurgen Kramer +Reported-by: Jurgen Kramer +Acked-by: Maxime Ripard +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-1-hdegoede@redhat.com +(cherry picked from commit 6dab9102dd7b144e5723915438e0d6c473018cd0) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 52e445bb1aa5..019f148d5a78 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -50,6 +50,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = { ++ .width = 1200, ++ .height = 1920, ++ .bios_dates = (const char * const []){ "06/28/2018", "08/28/2018", ++ "12/07/2018", NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_win = { + .width = 720, + .height = 1280, +@@ -106,6 +114,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_pocket, ++ }, { /* GPD Pocket 2 (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_pocket2, + }, { /* GPD Win (same note on DMI match as GPD Pocket) */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), +-- +2.20.1 + diff --git a/queue-5.1/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch b/queue-5.1/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch new file mode 100644 index 00000000000..b261e313fcb --- /dev/null +++ b/queue-5.1/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch @@ -0,0 +1,112 @@ +From 9e8a3a69ea2e690d38cffbff77da364cadc64cd5 Mon Sep 17 00:00:00 2001 +From: Wei Li +Date: Thu, 6 Jun 2019 11:17:54 +0800 +Subject: ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() + +[ Upstream commit 04e03d9a616c19a47178eaca835358610e63a1dd ] + +The mapper may be NULL when called from register_ftrace_function_probe() +with probe->data == NULL. + +This issue can be reproduced as follow (it may be covered by compiler +optimization sometime): + +/ # cat /sys/kernel/debug/tracing/set_ftrace_filter +#### all functions enabled #### +/ # echo foo_bar:dump > /sys/kernel/debug/tracing/set_ftrace_filter +[ 206.949100] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 206.952402] Mem abort info: +[ 206.952819] ESR = 0x96000006 +[ 206.955326] Exception class = DABT (current EL), IL = 32 bits +[ 206.955844] SET = 0, FnV = 0 +[ 206.956272] EA = 0, S1PTW = 0 +[ 206.956652] Data abort info: +[ 206.957320] ISV = 0, ISS = 0x00000006 +[ 206.959271] CM = 0, WnR = 0 +[ 206.959938] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000419f3a000 +[ 206.960483] [0000000000000000] pgd=0000000411a87003, pud=0000000411a83003, pmd=0000000000000000 +[ 206.964953] Internal error: Oops: 96000006 [#1] SMP +[ 206.971122] Dumping ftrace buffer: +[ 206.973677] (ftrace buffer empty) +[ 206.975258] Modules linked in: +[ 206.976631] Process sh (pid: 281, stack limit = 0x(____ptrval____)) +[ 206.978449] CPU: 10 PID: 281 Comm: sh Not tainted 5.2.0-rc1+ #17 +[ 206.978955] Hardware name: linux,dummy-virt (DT) +[ 206.979883] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 206.980499] pc : free_ftrace_func_mapper+0x2c/0x118 +[ 206.980874] lr : ftrace_count_free+0x68/0x80 +[ 206.982539] sp : ffff0000182f3ab0 +[ 206.983102] x29: ffff0000182f3ab0 x28: ffff8003d0ec1700 +[ 206.983632] x27: ffff000013054b40 x26: 0000000000000001 +[ 206.984000] x25: ffff00001385f000 x24: 0000000000000000 +[ 206.984394] x23: ffff000013453000 x22: ffff000013054000 +[ 206.984775] x21: 0000000000000000 x20: ffff00001385fe28 +[ 206.986575] x19: ffff000013872c30 x18: 0000000000000000 +[ 206.987111] x17: 0000000000000000 x16: 0000000000000000 +[ 206.987491] x15: ffffffffffffffb0 x14: 0000000000000000 +[ 206.987850] x13: 000000000017430e x12: 0000000000000580 +[ 206.988251] x11: 0000000000000000 x10: cccccccccccccccc +[ 206.988740] x9 : 0000000000000000 x8 : ffff000013917550 +[ 206.990198] x7 : ffff000012fac2e8 x6 : ffff000012fac000 +[ 206.991008] x5 : ffff0000103da588 x4 : 0000000000000001 +[ 206.991395] x3 : 0000000000000001 x2 : ffff000013872a28 +[ 206.991771] x1 : 0000000000000000 x0 : 0000000000000000 +[ 206.992557] Call trace: +[ 206.993101] free_ftrace_func_mapper+0x2c/0x118 +[ 206.994827] ftrace_count_free+0x68/0x80 +[ 206.995238] release_probe+0xfc/0x1d0 +[ 206.995555] register_ftrace_function_probe+0x4a8/0x868 +[ 206.995923] ftrace_trace_probe_callback.isra.4+0xb8/0x180 +[ 206.996330] ftrace_dump_callback+0x50/0x70 +[ 206.996663] ftrace_regex_write.isra.29+0x290/0x3a8 +[ 206.997157] ftrace_filter_write+0x44/0x60 +[ 206.998971] __vfs_write+0x64/0xf0 +[ 206.999285] vfs_write+0x14c/0x2f0 +[ 206.999591] ksys_write+0xbc/0x1b0 +[ 206.999888] __arm64_sys_write+0x3c/0x58 +[ 207.000246] el0_svc_common.constprop.0+0x408/0x5f0 +[ 207.000607] el0_svc_handler+0x144/0x1c8 +[ 207.000916] el0_svc+0x8/0xc +[ 207.003699] Code: aa0003f8 a9025bf5 aa0103f5 f946ea80 (f9400303) +[ 207.008388] ---[ end trace 7b6d11b5f542bdf1 ]--- +[ 207.010126] Kernel panic - not syncing: Fatal exception +[ 207.011322] SMP: stopping secondary CPUs +[ 207.013956] Dumping ftrace buffer: +[ 207.014595] (ftrace buffer empty) +[ 207.015632] Kernel Offset: disabled +[ 207.017187] CPU features: 0x002,20006008 +[ 207.017985] Memory Limit: none +[ 207.019825] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +Link: http://lkml.kernel.org/r/20190606031754.10798-1-liwei391@huawei.com + +Signed-off-by: Wei Li +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 045e7f46a74a..2469d54b3e43 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4230,10 +4230,13 @@ void free_ftrace_func_mapper(struct ftrace_func_mapper *mapper, + struct ftrace_func_entry *entry; + struct ftrace_func_map *map; + struct hlist_head *hhd; +- int size = 1 << mapper->hash.size_bits; +- int i; ++ int size, i; ++ ++ if (!mapper) ++ return; + + if (free_func && mapper->hash.count) { ++ size = 1 << mapper->hash.size_bits; + for (i = 0; i < size; i++) { + hhd = &mapper->hash.buckets[i]; + hlist_for_each_entry(entry, hhd, hlist) { +-- +2.20.1 + diff --git a/queue-5.1/gpio-pca953x-hack-to-fix-24-bit-gpio-expanders.patch b/queue-5.1/gpio-pca953x-hack-to-fix-24-bit-gpio-expanders.patch new file mode 100644 index 00000000000..c1407f4f5a4 --- /dev/null +++ b/queue-5.1/gpio-pca953x-hack-to-fix-24-bit-gpio-expanders.patch @@ -0,0 +1,56 @@ +From 040c08b8952ac619c0750ad17ca3138bf8148f89 Mon Sep 17 00:00:00 2001 +From: "H. Nikolaus Schaller" +Date: Tue, 4 Jun 2019 14:35:58 +0200 +Subject: gpio: pca953x: hack to fix 24 bit gpio expanders + +[ Upstream commit 3b00691cc46a4089368a008b30655a8343411715 ] + +24 bit expanders use REG_ADDR_AI in combination with register addressing. This +conflicts with regmap which takes this bit as part of the register number, +i.e. a second cache entry is defined for accessed with REG_ADDR_AI being +set although on the chip it is the same register as with REG_ADDR_AI being +cleared. + +The problem was introduced by + + commit b32cecb46bdc ("gpio: pca953x: Extract the register address mangling to single function") + +but only became visible by + + commit 8b9f9d4dc511 ("regmap: verify if register is writeable before writing operations") + +because before, the regmap size was effectively ignored and +pca953x_writeable_register() did know to ignore REG_ADDR_AI. Still, there +were two separate cache entries created. + +Since the use of REG_ADDR_AI seems to be static we can work around this +issue by simply increasing the size of the regmap to cover the "virtual" +registers with REG_ADDR_AI being set. This only means that half of the +regmap buffer will be unused. + +Reported-by: H. Nikolaus Schaller +Suggested-by: Linus Walleij +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 7e76830b3368..b6f10e56dfa0 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -306,7 +306,8 @@ static const struct regmap_config pca953x_i2c_regmap = { + .volatile_reg = pca953x_volatile_register, + + .cache_type = REGCACHE_RBTREE, +- .max_register = 0x7f, ++ /* REVISIT: should be 0x7f but some 24 bit chips use REG_ADDR_AI */ ++ .max_register = 0xff, + }; + + static u8 pca953x_recalc_addr(struct pca953x_chip *chip, int reg, int off, +-- +2.20.1 + diff --git a/queue-5.1/hid-a4tech-fix-horizontal-scrolling.patch b/queue-5.1/hid-a4tech-fix-horizontal-scrolling.patch new file mode 100644 index 00000000000..c53cc876cf4 --- /dev/null +++ b/queue-5.1/hid-a4tech-fix-horizontal-scrolling.patch @@ -0,0 +1,70 @@ +From 7dda87a8f7d9724b55446914f1ca1fc460945e14 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= +Date: Sun, 12 May 2019 22:33:13 +0200 +Subject: HID: a4tech: fix horizontal scrolling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit abf82e8f7e9af40a49e3d905187c662a43c96c8f ] + +Since recent high resolution scrolling changes the A4Tech driver must +check for the "REL_WHEEL_HI_RES" usage code. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=203369 +Fixes: 2dc702c991e3774af9d7ce410eef410ca9e2357e ("HID: input: use the Resolution Multiplier for high-resolution scrolling") +Signed-off-by: Błażej Szczygieł +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-a4tech.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c +index 9428ea7cdf8a..c3a6ce3613fe 100644 +--- a/drivers/hid/hid-a4tech.c ++++ b/drivers/hid/hid-a4tech.c +@@ -38,8 +38,10 @@ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi, + { + struct a4tech_sc *a4 = hid_get_drvdata(hdev); + +- if (usage->type == EV_REL && usage->code == REL_WHEEL) ++ if (usage->type == EV_REL && usage->code == REL_WHEEL_HI_RES) { + set_bit(REL_HWHEEL, *bit); ++ set_bit(REL_HWHEEL_HI_RES, *bit); ++ } + + if ((a4->quirks & A4_2WHEEL_MOUSE_HACK_7) && usage->hid == 0x00090007) + return -1; +@@ -60,7 +62,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field, + input = field->hidinput->input; + + if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8) { +- if (usage->type == EV_REL && usage->code == REL_WHEEL) { ++ if (usage->type == EV_REL && usage->code == REL_WHEEL_HI_RES) { + a4->delayed_value = value; + return 1; + } +@@ -68,6 +70,8 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field, + if (usage->hid == 0x000100b8) { + input_event(input, EV_REL, value ? REL_HWHEEL : + REL_WHEEL, a4->delayed_value); ++ input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES : ++ REL_WHEEL_HI_RES, a4->delayed_value * 120); + return 1; + } + } +@@ -77,8 +81,9 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field, + return 1; + } + +- if (usage->code == REL_WHEEL && a4->hw_wheel) { ++ if (usage->code == REL_WHEEL_HI_RES && a4->hw_wheel) { + input_event(input, usage->type, REL_HWHEEL, value); ++ input_event(input, usage->type, REL_HWHEEL_HI_RES, value * 120); + return 1; + } + +-- +2.20.1 + diff --git a/queue-5.1/hid-i2c-hid-add-iball-aer3-to-descriptor-override.patch b/queue-5.1/hid-i2c-hid-add-iball-aer3-to-descriptor-override.patch new file mode 100644 index 00000000000..d9c3658c023 --- /dev/null +++ b/queue-5.1/hid-i2c-hid-add-iball-aer3-to-descriptor-override.patch @@ -0,0 +1,41 @@ +From c9eaa1952cc4489049c5ecda3088ba7844a1c417 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 22 Apr 2019 14:57:04 +0800 +Subject: HID: i2c-hid: add iBall Aer3 to descriptor override + +[ Upstream commit eb6964fa6509b4f1152313f1e0bb67f0c54a6046 ] + +This device uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override +list. + +BugLink: https://bugs.launchpad.net/bugs/1825718 +Signed-off-by: Kai-Heng Feng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index fd1b6eea6d2f..75078c83be1a 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -354,6 +354,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "iBall Aer3", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "iBall"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Aer3"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { } /* Terminate list */ + }; + +-- +2.20.1 + diff --git a/queue-5.1/i2c-pca-platform-fix-gpio-lookup-code.patch b/queue-5.1/i2c-pca-platform-fix-gpio-lookup-code.patch new file mode 100644 index 00000000000..3b4688bf4d8 --- /dev/null +++ b/queue-5.1/i2c-pca-platform-fix-gpio-lookup-code.patch @@ -0,0 +1,50 @@ +From 73cbda38ec24bffdd52aa072e8a6c8b009594017 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 30 May 2019 22:24:24 +0200 +Subject: i2c: pca-platform: Fix GPIO lookup code + +[ Upstream commit a0cac264a86fbf4d6cb201fbbb73c1d335e3248a ] + +The devm_gpiod_request_gpiod() call will add "-gpios" to +any passed connection ID before looking it up. + +I do not think the reset GPIO on this platform is named +"reset-gpios-gpios" but rather "reset-gpios" in the device +tree, so fix this up so that we get a proper reset GPIO +handle. + +Also drop the inclusion of the legacy GPIO header. + +Fixes: 0e8ce93bdceb ("i2c: pca-platform: add devicetree awareness") +Signed-off-by: Linus Walleij +Reviewed-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pca-platform.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c +index de3fe6e828cb..f50afa8e3cba 100644 +--- a/drivers/i2c/busses/i2c-pca-platform.c ++++ b/drivers/i2c/busses/i2c-pca-platform.c +@@ -21,7 +21,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -173,7 +172,7 @@ static int i2c_pca_pf_probe(struct platform_device *pdev) + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = np; + +- i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset-gpios", GPIOD_OUT_LOW); ++ i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(i2c->gpio)) + return PTR_ERR(i2c->gpio); + +-- +2.20.1 + diff --git a/queue-5.1/iommu-vt-d-set-the-right-field-for-page-walk-snoop.patch b/queue-5.1/iommu-vt-d-set-the-right-field-for-page-walk-snoop.patch new file mode 100644 index 00000000000..1669ef6faa2 --- /dev/null +++ b/queue-5.1/iommu-vt-d-set-the-right-field-for-page-walk-snoop.patch @@ -0,0 +1,35 @@ +From 5af6605cbc3297fb9670378f1a373b75bf3337d1 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Tue, 21 May 2019 15:30:16 +0800 +Subject: iommu/vt-d: Set the right field for Page Walk Snoop + +[ Upstream commit 66d78ad316b0e1ca5ae19663468554e2c0e31c26 ] + +Set the page walk snoop to the right bit, otherwise the domain +id field will be overlapped. + +Reported-by: Dave Jiang +Fixes: 6f7db75e1c469 ("iommu/vt-d: Add second level page table interface") +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-pasid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c +index 03b12d2ee213..fdf05c45d516 100644 +--- a/drivers/iommu/intel-pasid.c ++++ b/drivers/iommu/intel-pasid.c +@@ -387,7 +387,7 @@ static inline void pasid_set_present(struct pasid_entry *pe) + */ + static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value) + { +- pasid_set_bits(&pe->val[1], 1 << 23, value); ++ pasid_set_bits(&pe->val[1], 1 << 23, value << 23); + } + + /* +-- +2.20.1 + diff --git a/queue-5.1/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch b/queue-5.1/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch new file mode 100644 index 00000000000..363a8274936 --- /dev/null +++ b/queue-5.1/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch @@ -0,0 +1,45 @@ +From 444e505bcdb8509aa3706c9c71ed798f2b3e8621 Mon Sep 17 00:00:00 2001 +From: swkhack +Date: Thu, 13 Jun 2019 15:56:08 -0700 +Subject: mm/mlock.c: change count_mm_mlocked_page_nr return type + +[ Upstream commit 0874bb49bb21bf24deda853e8bf61b8325e24bcb ] + +On a 64-bit machine the value of "vma->vm_end - vma->vm_start" may be +negative when using 32 bit ints and the "count >> PAGE_SHIFT"'s result +will be wrong. So change the local variable and return value to +unsigned long to fix the problem. + +Link: http://lkml.kernel.org/r/20190513023701.83056-1-swkhack@gmail.com +Fixes: 0cf2f6f6dc60 ("mm: mlock: check against vma for actual mlock() size") +Signed-off-by: swkhack +Acked-by: Michal Hocko +Reviewed-by: Andrew Morton +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/mlock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/mlock.c b/mm/mlock.c +index 080f3b36415b..d614163f569b 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -636,11 +636,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, + * is also counted. + * Return value: previously mlocked page counts + */ +-static int count_mm_mlocked_page_nr(struct mm_struct *mm, ++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm, + unsigned long start, size_t len) + { + struct vm_area_struct *vma; +- int count = 0; ++ unsigned long count = 0; + + if (mm == NULL) + mm = current->mm; +-- +2.20.1 + diff --git a/queue-5.1/module-fix-livepatch-ftrace-module-text-permissions-.patch b/queue-5.1/module-fix-livepatch-ftrace-module-text-permissions-.patch new file mode 100644 index 00000000000..ec468b3a3fd --- /dev/null +++ b/queue-5.1/module-fix-livepatch-ftrace-module-text-permissions-.patch @@ -0,0 +1,177 @@ +From ca7631feb071b87e7c40a365c16cf9e72b537e48 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Thu, 13 Jun 2019 20:07:22 -0500 +Subject: module: Fix livepatch/ftrace module text permissions race + +[ Upstream commit 9f255b632bf12c4dd7fc31caee89aa991ef75176 ] + +It's possible for livepatch and ftrace to be toggling a module's text +permissions at the same time, resulting in the following panic: + + BUG: unable to handle page fault for address: ffffffffc005b1d9 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0003) - permissions violation + PGD 3ea0c067 P4D 3ea0c067 PUD 3ea0e067 PMD 3cc13067 PTE 3b8a1061 + Oops: 0003 [#1] PREEMPT SMP PTI + CPU: 1 PID: 453 Comm: insmod Tainted: G O K 5.2.0-rc1-a188339ca5 #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014 + RIP: 0010:apply_relocate_add+0xbe/0x14c + Code: fa 0b 74 21 48 83 fa 18 74 38 48 83 fa 0a 75 40 eb 08 48 83 38 00 74 33 eb 53 83 38 00 75 4e 89 08 89 c8 eb 0a 83 38 00 75 43 <89> 08 48 63 c1 48 39 c8 74 2e eb 48 83 38 00 75 32 48 29 c1 89 08 + RSP: 0018:ffffb223c00dbb10 EFLAGS: 00010246 + RAX: ffffffffc005b1d9 RBX: 0000000000000000 RCX: ffffffff8b200060 + RDX: 000000000000000b RSI: 0000004b0000000b RDI: ffff96bdfcd33000 + RBP: ffffb223c00dbb38 R08: ffffffffc005d040 R09: ffffffffc005c1f0 + R10: ffff96bdfcd33c40 R11: ffff96bdfcd33b80 R12: 0000000000000018 + R13: ffffffffc005c1f0 R14: ffffffffc005e708 R15: ffffffff8b2fbc74 + FS: 00007f5f447beba8(0000) GS:ffff96bdff900000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffc005b1d9 CR3: 000000003cedc002 CR4: 0000000000360ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + klp_init_object_loaded+0x10f/0x219 + ? preempt_latency_start+0x21/0x57 + klp_enable_patch+0x662/0x809 + ? virt_to_head_page+0x3a/0x3c + ? kfree+0x8c/0x126 + patch_init+0x2ed/0x1000 [livepatch_test02] + ? 0xffffffffc0060000 + do_one_initcall+0x9f/0x1c5 + ? kmem_cache_alloc_trace+0xc4/0xd4 + ? do_init_module+0x27/0x210 + do_init_module+0x5f/0x210 + load_module+0x1c41/0x2290 + ? fsnotify_path+0x3b/0x42 + ? strstarts+0x2b/0x2b + ? kernel_read+0x58/0x65 + __do_sys_finit_module+0x9f/0xc3 + ? __do_sys_finit_module+0x9f/0xc3 + __x64_sys_finit_module+0x1a/0x1c + do_syscall_64+0x52/0x61 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The above panic occurs when loading two modules at the same time with +ftrace enabled, where at least one of the modules is a livepatch module: + +CPU0 CPU1 +klp_enable_patch() + klp_init_object_loaded() + module_disable_ro() + ftrace_module_enable() + ftrace_arch_code_modify_post_process() + set_all_modules_text_ro() + klp_write_object_relocations() + apply_relocate_add() + *patches read-only code* - BOOM + +A similar race exists when toggling ftrace while loading a livepatch +module. + +Fix it by ensuring that the livepatch and ftrace code patching +operations -- and their respective permissions changes -- are protected +by the text_mutex. + +Link: http://lkml.kernel.org/r/ab43d56ab909469ac5d2520c5d944ad6d4abd476.1560474114.git.jpoimboe@redhat.com + +Reported-by: Johannes Erdfelt +Fixes: 444d13ff10fb ("modules: add ro_after_init support") +Acked-by: Jessica Yu +Reviewed-by: Petr Mladek +Reviewed-by: Miroslav Benes +Signed-off-by: Josh Poimboeuf +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/livepatch/core.c | 6 ++++++ + kernel/trace/ftrace.c | 10 +++++++++- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c +index eb0ee10a1981..05d5b0afc864 100644 +--- a/kernel/livepatch/core.c ++++ b/kernel/livepatch/core.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + #include "core.h" + #include "patch.h" +@@ -746,16 +747,21 @@ static int klp_init_object_loaded(struct klp_patch *patch, + struct klp_func *func; + int ret; + ++ mutex_lock(&text_mutex); ++ + module_disable_ro(patch->mod); + ret = klp_write_object_relocations(patch->mod, obj); + if (ret) { + module_enable_ro(patch->mod, true); ++ mutex_unlock(&text_mutex); + return ret; + } + + arch_klp_init_object_loaded(patch, obj); + module_enable_ro(patch->mod, true); + ++ mutex_unlock(&text_mutex); ++ + klp_for_each_func(obj, func) { + ret = klp_find_object_symbol(obj->name, func->old_name, + func->old_sympos, +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 538f0b1c7ea2..045e7f46a74a 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2614,10 +2615,12 @@ static void ftrace_run_update_code(int command) + { + int ret; + ++ mutex_lock(&text_mutex); ++ + ret = ftrace_arch_code_modify_prepare(); + FTRACE_WARN_ON(ret); + if (ret) +- return; ++ goto out_unlock; + + /* + * By default we use stop_machine() to modify the code. +@@ -2629,6 +2632,9 @@ static void ftrace_run_update_code(int command) + + ret = ftrace_arch_code_modify_post_process(); + FTRACE_WARN_ON(ret); ++ ++out_unlock: ++ mutex_unlock(&text_mutex); + } + + static void ftrace_run_modify_code(struct ftrace_ops *ops, int command, +@@ -5779,6 +5785,7 @@ void ftrace_module_enable(struct module *mod) + struct ftrace_page *pg; + + mutex_lock(&ftrace_lock); ++ mutex_lock(&text_mutex); + + if (ftrace_disabled) + goto out_unlock; +@@ -5840,6 +5847,7 @@ void ftrace_module_enable(struct module *mod) + ftrace_arch_code_modify_post_process(); + + out_unlock: ++ mutex_unlock(&text_mutex); + mutex_unlock(&ftrace_lock); + + process_cached_mods(mod->name); +-- +2.20.1 + diff --git a/queue-5.1/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch b/queue-5.1/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch new file mode 100644 index 00000000000..2c3cdee1fc6 --- /dev/null +++ b/queue-5.1/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch @@ -0,0 +1,92 @@ +From 10850ad0bfc2a15bbe576f90db9b57998d18ebb3 Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Thu, 23 May 2019 16:41:52 +0000 +Subject: platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove + flow + +[ Upstream commit 8c2eb7b6468ad4aa5600aed01aa0715f921a3f8b ] + +Add devm_free_irq() call to mlxreg-hotplug remove() for clean release +of devices irq resource. Fix debugobjects warning triggered by rmmod +It prevents of use-after-free memory, related to +mlxreg_hotplug_work_handler. + +Issue has been reported as debugobjects warning triggered by +'rmmod mlxtreg-hotplug' flow, while running kernel with +CONFIG_DEBUG_OBJECTS* options. + +[ 2489.623551] ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler+0x0/0x7f0 [mlxreg_hotplug] +[ 2489.637097] WARNING: CPU: 5 PID: 3924 at lib/debugobjects.c:328 debug_print_object+0xfe/0x180 +[ 2489.637165] RIP: 0010:debug_print_object+0xfe/0x180 +? +[ 2489.637214] Call Trace: +[ 2489.637225] __debug_check_no_obj_freed+0x25e/0x320 +[ 2489.637231] kfree+0x82/0x110 +[ 2489.637238] release_nodes+0x33c/0x4e0 +[ 2489.637242] ? devres_remove_group+0x1b0/0x1b0 +[ 2489.637247] device_release_driver_internal+0x146/0x270 +[ 2489.637251] driver_detach+0x73/0xe0 +[ 2489.637254] bus_remove_driver+0xa1/0x170 +[ 2489.637261] __x64_sys_delete_module+0x29e/0x320 +[ 2489.637265] ? __ia32_sys_delete_module+0x320/0x320 +[ 2489.637268] ? blkcg_exit_queue+0x20/0x20 +[ 2489.637273] ? task_work_run+0x7d/0x100 +[ 2489.637278] ? exit_to_usermode_loop+0x5b/0xf0 +[ 2489.637281] do_syscall_64+0x73/0x160 +[ 2489.637287] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 2489.637290] RIP: 0033:0x7f95c3596fd7 + +The difference in release flow with and with no devm_free_irq is listed +below: + +bus: 'platform': remove driver mlxreg-hotplug + mlxreg_hotplug_remove(start) + -> devm_free_irq (with new code) + mlxreg_hotplug_remove (end) + release_nodes (start) + mlxreg-hotplug: DEVRES REL devm_hwmon_release (8 bytes) + device: 'hwmon3': device_unregister + PM: Removing info for No Bus:hwmon3 + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (88 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (6 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_irq_release (16 bytes) (no new code) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (1376 bytes) + ------------[ cut here ]------------ (no new code): + ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler + + release_nodes(end) +driver: 'mlxreg-hotplug': driver_release + +Fixes: 1f976f6978bf ("platform/x86: Move Mellanox platform hotplug driver to platform/mellanox") +Signed-off-by: Vadim Pasternak +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxreg-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c +index 687ce6817d0d..f85a1b9d129b 100644 +--- a/drivers/platform/mellanox/mlxreg-hotplug.c ++++ b/drivers/platform/mellanox/mlxreg-hotplug.c +@@ -694,6 +694,7 @@ static int mlxreg_hotplug_remove(struct platform_device *pdev) + + /* Clean interrupts setup. */ + mlxreg_hotplug_unset_irq(priv); ++ devm_free_irq(&pdev->dev, priv->irq, priv); + + return 0; + } +-- +2.20.1 + diff --git a/queue-5.1/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch b/queue-5.1/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch new file mode 100644 index 00000000000..74428fc9fcb --- /dev/null +++ b/queue-5.1/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch @@ -0,0 +1,110 @@ +From 38789c41817903237aeb3abce999a2f4d5b7d7f3 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 12 Jun 2019 09:02:02 +0200 +Subject: platform/x86: asus-wmi: Only Tell EC the OS will handle display + hotkeys from asus_nb_wmi +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 401fee8195d401b2b94dee57383f627050724d5b ] + +Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will +handle the display off hotkey") causes the backlight to be permanently off +on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC +1015BX, Asus EeePC 1025C). + +The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added +by that commit is made conditional in this commit and only enabled in +the quirk_entry structs in the asus-nb-wmi driver fixing the broken +display / backlight on various EeePC laptop models. + +Cc: João Paulo Rechi Vita +Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey") +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++ + drivers/platform/x86/asus-wmi.c | 2 +- + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index b6f2ff95c3ed..59f3a37a44d7 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str, + + static struct quirk_entry quirk_asus_unknown = { + .wapf = 0, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_q500a = { + .i8042_filter = asus_q500a_i8042_filter, ++ .wmi_backlight_set_devstate = true, + }; + + /* +@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = { + static struct quirk_entry quirk_asus_x55u = { + .wapf = 4, + .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, + .no_display_toggle = true, + }; + + static struct quirk_entry quirk_asus_wapf4 = { + .wapf = 4, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x200ca = { + .wapf = 2, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_ux303ub = { + .wmi_backlight_native = true, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x550lb = { ++ .wmi_backlight_set_devstate = true, + .xusb2pr = 0x01D9, + }; + + static struct quirk_entry quirk_asus_forceals = { ++ .wmi_backlight_set_devstate = true, + .wmi_force_als_set = true, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index ee1fa93708ec..a66e99500c12 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2131,7 +2131,7 @@ static int asus_wmi_add(struct platform_device *pdev) + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) + goto fail_backlight; +- } else ++ } else if (asus->driver->quirks->wmi_backlight_set_devstate) + err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL); + + status = wmi_install_notify_handler(asus->driver->event_guid, +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 6c1311f4b04d..57a79bddb286 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -44,6 +44,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_power; + bool wmi_backlight_native; ++ bool wmi_backlight_set_devstate; + bool wmi_force_als_set; + int wapf; + /* +-- +2.20.1 + diff --git a/queue-5.1/platform-x86-intel-vbtn-report-switch-events-when-ev.patch b/queue-5.1/platform-x86-intel-vbtn-report-switch-events-when-ev.patch new file mode 100644 index 00000000000..8c6dc33470c --- /dev/null +++ b/queue-5.1/platform-x86-intel-vbtn-report-switch-events-when-ev.patch @@ -0,0 +1,62 @@ +From 9b2e888ddec6beb2ad94e78476fb0a2286eb3a55 Mon Sep 17 00:00:00 2001 +From: Mathew King +Date: Mon, 20 May 2019 16:41:24 -0600 +Subject: platform/x86: intel-vbtn: Report switch events when event wakes + device + +[ Upstream commit cb1921b17adbe6509538098ac431033378cd7165 ] + +When a switch event, such as tablet mode/laptop mode or docked/undocked, +wakes a device make sure that the value of the swich is reported. +Without when a device is put in tablet mode from laptop mode when it is +suspended or vice versa the device will wake up but mode will be +incorrect. + +Tested by suspending a device in laptop mode and putting it in tablet +mode, the device resumes and is in tablet mode. When suspending the +device in tablet mode and putting it in laptop mode the device resumes +and is in laptop mode. + +Signed-off-by: Mathew King +Reviewed-by: Jett Rink +Reviewed-by: Mario Limonciello +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel-vbtn.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index 06cd7e818ed5..a0d0cecff55f 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -76,12 +76,24 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + struct platform_device *device = context; + struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); + unsigned int val = !(event & 1); /* Even=press, Odd=release */ +- const struct key_entry *ke_rel; ++ const struct key_entry *ke, *ke_rel; + bool autorelease; + + if (priv->wakeup_mode) { +- if (sparse_keymap_entry_from_scancode(priv->input_dev, event)) { ++ ke = sparse_keymap_entry_from_scancode(priv->input_dev, event); ++ if (ke) { + pm_wakeup_hard_event(&device->dev); ++ ++ /* ++ * Switch events like tablet mode will wake the device ++ * and report the new switch position to the input ++ * subsystem. ++ */ ++ if (ke->type == KE_SW) ++ sparse_keymap_report_event(priv->input_dev, ++ event, ++ val, ++ 0); + return; + } + goto out_unknown; +-- +2.20.1 + diff --git a/queue-5.1/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch b/queue-5.1/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch new file mode 100644 index 00000000000..1a72c5e9df4 --- /dev/null +++ b/queue-5.1/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch @@ -0,0 +1,159 @@ +From d483636c0db5cd4848cc5164a09e0d4c0bafd1a6 Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Wed, 5 Jun 2019 07:51:03 +0000 +Subject: platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device + registration + +[ Upstream commit 160da20b254dd4bfc5828f12c208fa831ad4be6c ] + +Fix the issue found while running kernel with the option +CONFIG_DEBUG_TEST_DRIVER_REMOVE. +Driver 'mlx-platform' registers 'i2c_mlxcpld' device and then registers +few underlying 'i2c-mux-reg' devices: + priv->pdev_i2c = platform_device_register_simple("i2c_mlxcpld", nr, + NULL, 0); + ... + for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) { + priv->pdev_mux[i] = platform_device_register_resndata( + &mlxplat_dev->dev, + "i2c-mux-reg", i, NULL, + 0, &mlxplat_mux_data[i], + sizeof(mlxplat_mux_data[i])); + +But actual parent of "i2c-mux-reg" device is priv->pdev_i2c->dev and +not mlxplat_dev->dev. +Patch fixes parent device parameter in a call to +platform_device_register_resndata() for "i2c-mux-reg". + +It solves the race during initialization flow while 'i2c_mlxcpld.1' is +removing after probe, while 'i2c-mux-reg.0' is still in probing flow: +'i2c_mlxcpld.1' flow: probe -> remove -> probe. +'i2c-mux-reg.0' flow: probe -> ... + +[ 12:621096] Registering platform device 'i2c_mlxcpld.1'. Parent at platform +[ 12:621117] device: 'i2c_mlxcpld.1': device_add +[ 12:621155] bus: 'platform': add device i2c_mlxcpld.1 +[ 12:621384] Registering platform device 'i2c-mux-reg.0'. Parent at mlxplat +[ 12:621395] device: 'i2c-mux-reg.0': device_add +[ 12:621425] bus: 'platform': add device i2c-mux-reg.0 +[ 12:621806] Registering platform device 'i2c-mux-reg.1'. Parent at mlxplat +[ 12:621828] device: 'i2c-mux-reg.1': device_add +[ 12:621892] bus: 'platform': add device i2c-mux-reg.1 +[ 12:621906] bus: 'platform': add driver i2c_mlxcpld +[ 12:621996] bus: 'platform': driver_probe_device: matched device i2c_mlxcpld.1 with driver i2c_mlxcpld +[ 12:622003] bus: 'platform': really_probe: probing driver i2c_mlxcpld with device i2c_mlxcpld.1 +[ 12:622100] i2c_mlxcpld i2c_mlxcpld.1: no default pinctrl state +[ 12:622293] device: 'i2c-1': device_add +[ 12:627280] bus: 'i2c': add device i2c-1 +[ 12:627692] device: 'i2c-1': device_add +[ 12.629639] bus: 'platform': add driver i2c-mux-reg +[ 12.629718] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.629723] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.629818] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.629981] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral +[ 12.629986] platform i2c-mux-reg.0: Added to deferred list +[ 12.629992] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg +[ 12.629997] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1 +[ 12.630091] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state +[ 12.630247] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral +[ 12.630252] platform i2c-mux-reg.1: Added to deferred list +[ 12.640892] devices_kset: Moving i2c-mux-reg.0 to end of list +[ 12.640900] platform i2c-mux-reg.0: Retrying from deferred list +[ 12.640911] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.640919] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.640999] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.641177] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral +[ 12.641187] platform i2c-mux-reg.0: Added to deferred list +[ 12.641198] devices_kset: Moving i2c-mux-reg.1 to end of list +[ 12.641219] platform i2c-mux-reg.1: Retrying from deferred list +[ 12.641237] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg +[ 12.641247] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1 +[ 12.641331] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state +[ 12.641465] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral +[ 12.641469] platform i2c-mux-reg.1: Added to deferred list +[ 12.646427] device: 'i2c-1': device_add +[ 12.646647] bus: 'i2c': add device i2c-1 +[ 12.647104] device: 'i2c-1': device_add +[ 12.669231] devices_kset: Moving i2c-mux-reg.0 to end of list +[ 12.669240] platform i2c-mux-reg.0: Retrying from deferred list +[ 12.669258] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.669263] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.669343] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.669585] device: 'i2c-2': device_add +[ 12.669795] bus: 'i2c': add device i2c-2 +[ 12.670201] device: 'i2c-2': device_add +[ 12.671427] i2c i2c-1: Added multiplexed i2c bus 2 +[ 12.671514] device: 'i2c-3': device_add +[ 12.671724] bus: 'i2c': add device i2c-3 +[ 12.672136] device: 'i2c-3': device_add +[ 12.673378] i2c i2c-1: Added multiplexed i2c bus 3 +[ 12.673472] device: 'i2c-4': device_add +[ 12.673676] bus: 'i2c': add device i2c-4 +[ 12.674060] device: 'i2c-4': device_add +[ 12.675861] i2c i2c-1: Added multiplexed i2c bus 4 +[ 12.675941] device: 'i2c-5': device_add +[ 12.676150] bus: 'i2c': add device i2c-5 +[ 12.676550] device: 'i2c-5': device_add +[ 12.678103] i2c i2c-1: Added multiplexed i2c bus 5 +[ 12.678193] device: 'i2c-6': device_add +[ 12.678395] bus: 'i2c': add device i2c-6 +[ 12.678774] device: 'i2c-6': device_add +[ 12.679969] i2c i2c-1: Added multiplexed i2c bus 6 +[ 12.680065] device: 'i2c-7': device_add +[ 12.680275] bus: 'i2c': add device i2c-7 +[ 12.680913] device: 'i2c-7': device_add +[ 12.682506] i2c i2c-1: Added multiplexed i2c bus 7 +[ 12.682600] device: 'i2c-8': device_add +[ 12.682808] bus: 'i2c': add device i2c-8 +[ 12.683189] device: 'i2c-8': device_add +[ 12.683907] device: 'i2c-1': device_unregister +[ 12.683945] device: 'i2c-1': device_unregister +[ 12.684387] device: 'i2c-1': device_create_release +[ 12.684536] bus: 'i2c': remove device i2c-1 +[ 12.686019] i2c i2c-8: Failed to create compatibility class link +[ 12.686086] ------------[ cut here ]------------ +[ 12.686087] can't create symlink to mux device +[ 12.686224] Workqueue: events deferred_probe_work_func +[ 12.686135] WARNING: CPU: 7 PID: 436 at drivers/i2c/i2c-mux.c:416 i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux] +[ 12.686232] RIP: 0010:i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux] +[ 0x190/0x190 [i2c_mux] +[ 12.686300] ? i2c_mux_alloc+0xac/0x110 [i2c_mux] +[ 12.686306] ? i2c_mux_reg_set+0x200/0x200 [i2c_mux_reg] +[ 12.686313] i2c_mux_reg_probe+0x22c/0x731 [i2c_mux_reg] +[ 12.686322] ? i2c_mux_reg_deselect+0x60/0x60 [i2c_mux_reg] +[ 12.686346] platform_drv_probe+0xa8/0x110 +[ 12.686351] really_probe+0x185/0x720 +[ 12.686358] driver_probe_device+0xdf/0x1f0 +... +[ 12.686522] i2c i2c-1: Added multiplexed i2c bus 8 +[ 12.686621] device: 'i2c-9': device_add +[ 12.686626] kobject_add_internal failed for i2c-9 (error: -2 parent: i2c-1) +[ 12.694729] i2c-core: adapter 'i2c-1-mux (chan_id 8)': can't register device (-2) +[ 12.705726] i2c i2c-1: failed to add mux-adapter 8 as bus 9 (error=-2) +[ 12.714494] device: 'i2c-8': device_unregister +[ 12.714537] device: 'i2c-8': device_unregister + +Fixes: 6613d18e9038 ("platform/x86: mlx-platform: Move module from arch/x86") +Signed-off-by: Vadim Pasternak +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index 48fa7573e29b..0e5f073e51bc 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -1828,7 +1828,7 @@ static int __init mlxplat_init(void) + + for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) { + priv->pdev_mux[i] = platform_device_register_resndata( +- &mlxplat_dev->dev, ++ &priv->pdev_i2c->dev, + "i2c-mux-reg", i, NULL, + 0, &mlxplat_mux_data[i], + sizeof(mlxplat_mux_data[i])); +-- +2.20.1 + diff --git a/queue-5.1/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch b/queue-5.1/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch new file mode 100644 index 00000000000..3b532e58b44 --- /dev/null +++ b/queue-5.1/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch @@ -0,0 +1,48 @@ +From 179ff5afab80a5d4028a121c3ea221d3b9c9e9f5 Mon Sep 17 00:00:00 2001 +From: Manuel Traut +Date: Thu, 13 Jun 2019 15:55:52 -0700 +Subject: scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE + +[ Upstream commit c04e32e911653442fc834be6e92e072aeebe01a1 ] + +At least for ARM64 kernels compiled with the crosstoolchain from +Debian/stretch or with the toolchain from kernel.org the line number is +not decoded correctly by 'decode_stacktrace.sh': + + $ echo "[ 136.513051] f1+0x0/0xc [kcrash]" | \ + CROSS_COMPILE=/opt/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- \ + ./scripts/decode_stacktrace.sh /scratch/linux-arm64/vmlinux \ + /scratch/linux-arm64 \ + /nfs/debian/lib/modules/4.20.0-devel + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:68) kcrash + +If addr2line from the toolchain is used the decoded line number is correct: + + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:57) kcrash + +Link: http://lkml.kernel.org/r/20190527083425.3763-1-manut@linutronix.de +Signed-off-by: Manuel Traut +Acked-by: Konstantin Khlebnikov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index bcdd45df3f51..a7a36209a193 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -73,7 +73,7 @@ parse_symbol() { + if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then + local code=${cache[$module,$address]} + else +- local code=$(addr2line -i -e "$objfile" "$address") ++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address") + cache[$module,$address]=$code + fi + +-- +2.20.1 + diff --git a/queue-5.1/scsi-hpsa-correct-ioaccel2-chaining.patch b/queue-5.1/scsi-hpsa-correct-ioaccel2-chaining.patch new file mode 100644 index 00000000000..61113a359a9 --- /dev/null +++ b/queue-5.1/scsi-hpsa-correct-ioaccel2-chaining.patch @@ -0,0 +1,64 @@ +From 929878cb4aeac59624c97b5bb7f529161662749f Mon Sep 17 00:00:00 2001 +From: Don Brace +Date: Mon, 3 Jun 2019 16:43:29 -0500 +Subject: scsi: hpsa: correct ioaccel2 chaining + +[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ] + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for + the last s/g element. + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when + chaining. + +Reviewed-by: Bader Ali - Saleh +Reviewed-by: Scott Teel +Reviewed-by: Matt Perricone +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 7 ++++++- + drivers/scsi/hpsa_cmd.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index f044e7d10d63..2d181e5e65ff 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4925,7 +4925,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg->reserved[0] = 0; + curr_sg->reserved[1] = 0; + curr_sg->reserved[2] = 0; +- curr_sg->chain_indicator = 0x80; ++ curr_sg->chain_indicator = IOACCEL2_CHAIN; + + curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; + } +@@ -4942,6 +4942,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg++; + } + ++ /* ++ * Set the last s/g element bit ++ */ ++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; ++ + switch (cmd->sc_data_direction) { + case DMA_TO_DEVICE: + cp->direction &= ~IOACCEL2_DIRECTION_MASK; +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index 21a726e2eec6..f6afca4b2319 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -517,6 +517,7 @@ struct ioaccel2_sg_element { + u8 reserved[3]; + u8 chain_indicator; + #define IOACCEL2_CHAIN 0x80 ++#define IOACCEL2_LAST_SG 0x40 + }; + + /* +-- +2.20.1 + diff --git a/queue-5.1/series b/queue-5.1/series index e58faf8d242..f1493d858b0 100644 --- a/queue-5.1/series +++ b/queue-5.1/series @@ -5,3 +5,51 @@ netfilter-nft_flow_offload-set-liberal-tracking-mode-for-tcp.patch netfilter-nft_flow_offload-don-t-offload-when-sequence-numbers-need-adjustment.patch netfilter-nft_flow_offload-ipcb-is-only-valid-for-ipv4-family.patch idr-fix-idr_get_next-race-with-idr_remove.patch +hid-i2c-hid-add-iball-aer3-to-descriptor-override.patch +asoc-cs4265-readable-register-too-low.patch +asoc-ak4458-add-return-value-for-ak4458_probe.patch +asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch +asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch +spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch +asoc-core-lock-client_mutex-while-removing-link-comp.patch +iommu-vt-d-set-the-right-field-for-page-walk-snoop.patch +hid-a4tech-fix-horizontal-scrolling.patch +asoc-intel-baytrail-add-quirk-for-aegex-10-ru2-table.patch +asoc-hda-fix-unbalanced-codec-dev-refcount-for-hda_d.patch +drm-mediatek-fix-unbind-functions.patch +drm-mediatek-unbind-components-in-mtk_drm_unbind.patch +drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch +drm-mediatek-clear-num_pipes-when-unbind-driver.patch +drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch +asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch +asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch +asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch +x86-cpu-add-more-icelake-model-numbers.patch +usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch +usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch +usb-gadget-dwc2-fix-zlp-handling.patch +asoc-intel-cht_bsw_max98090-fix-kernel-oops-with-pla.patch +asoc-intel-bytcht_es8316-fix-kernel-oops-with-platfo.patch +asoc-intel-cht_bsw_nau8824-fix-kernel-oops-with-plat.patch +asoc-intel-cht_bsw_rt5672-fix-kernel-oops-with-platf.patch +asoc-core-move-dai-pre-links-initiation-to-snd_soc_i.patch +alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch +soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch +scsi-hpsa-correct-ioaccel2-chaining.patch +gpio-pca953x-hack-to-fix-24-bit-gpio-expanders.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch +asoc-core-fix-deadlock-in-snd_soc_instantiate_card.patch +asoc-intel-sst-fix-kmalloc-call-with-wrong-flags.patch +platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch +platform-x86-intel-vbtn-report-switch-events-when-ev.patch +platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch +platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch +i2c-pca-platform-fix-gpio-lookup-code.patch +arm64-tlbflush-ensure-start-end-of-address-range-are.patch +cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch +scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch +mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch +tracing-avoid-build-warning-with-have_nop_mcount.patch +module-fix-livepatch-ftrace-module-text-permissions-.patch +ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch diff --git a/queue-5.1/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch b/queue-5.1/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch new file mode 100644 index 00000000000..7cb859d5a09 --- /dev/null +++ b/queue-5.1/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch @@ -0,0 +1,57 @@ +From 89b2d3e98f09c4c17f63ac70ab110e1c794e3d37 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Wed, 5 Jun 2019 15:45:52 +0200 +Subject: SoC: rt274: Fix internal jack assignment in set_jack callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 04268bf2757a125616b6c2140e6250f43b7b737a ] + +When we call snd_soc_component_set_jack(component, NULL, NULL) we should +set rt274->jack to passed jack, so when interrupt is triggered it calls +snd_soc_jack_report(rt274->jack, ...) with proper value. + +This fixes problem in machine where in register, we call +snd_soc_register(component, &headset, NULL), which just calls +rt274_mic_detect via callback. +Now when machine driver is removed "headset" will be gone, so we +need to tell codec driver that it's gone with: +snd_soc_register(component, NULL, NULL), but we also need to be able +to handle NULL jack argument here gracefully. +If we don't set it to NULL, next time the rt274_irq runs it will call +snd_soc_jack_report with first argument being invalid pointer and there +will be Oops. + +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt274.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c +index adf59039a3b6..cdd312db3e78 100644 +--- a/sound/soc/codecs/rt274.c ++++ b/sound/soc/codecs/rt274.c +@@ -405,6 +405,8 @@ static int rt274_mic_detect(struct snd_soc_component *component, + { + struct rt274_priv *rt274 = snd_soc_component_get_drvdata(component); + ++ rt274->jack = jack; ++ + if (jack == NULL) { + /* Disable jack detection */ + regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL, +@@ -412,7 +414,6 @@ static int rt274_mic_detect(struct snd_soc_component *component, + + return 0; + } +- rt274->jack = jack; + + regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL, + RT274_IRQ_EN, RT274_IRQ_EN); +-- +2.20.1 + diff --git a/queue-5.1/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch b/queue-5.1/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch new file mode 100644 index 00000000000..f71e6dfbe44 --- /dev/null +++ b/queue-5.1/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch @@ -0,0 +1,86 @@ +From 566344b56665d2b190cd215624dba680d53e99ea Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 16 May 2019 15:56:56 +0800 +Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master + +[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ] + +If spi_register_master fails in spi_bitbang_start +because device_add failure, We should return the +error code other than 0, otherwise calling +spi_bitbang_stop may trigger NULL pointer dereference +like this: + +BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0 +Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661 + +CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +Call Trace: + dump_stack+0xa9/0x10e + ? __list_del_entry_valid+0x45/0xd0 + ? __list_del_entry_valid+0x45/0xd0 + __kasan_report+0x171/0x18d + ? __list_del_entry_valid+0x45/0xd0 + kasan_report+0xe/0x20 + __list_del_entry_valid+0x45/0xd0 + spi_unregister_controller+0x99/0x1b0 + spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp] + ? 0xffffffffc1128000 + ? klist_next+0x131/0x1e0 + ? driver_detach+0x40/0x40 [parport] + port_check+0x3b/0x50 [parport] + bus_for_each_dev+0x115/0x180 + ? subsys_dev_iter_exit+0x20/0x20 + __parport_register_driver+0x1f0/0x210 [parport] + ? 0xffffffffc1150000 + do_one_initcall+0xb9/0x3b5 + ? perf_trace_initcall_level+0x270/0x270 + ? kasan_unpoison_shadow+0x30/0x40 + ? kasan_unpoison_shadow+0x30/0x40 + do_init_module+0xe0/0x330 + load_module+0x38eb/0x4270 + ? module_frob_arch_sections+0x20/0x20 + ? kernel_read_file+0x188/0x3f0 + ? find_held_lock+0x6d/0xd0 + ? fput_many+0x1a/0xe0 + ? __do_sys_finit_module+0x162/0x190 + __do_sys_finit_module+0x162/0x190 + ? __ia32_sys_init_module+0x40/0x40 + ? __mutex_unlock_slowpath+0xb4/0x3f0 + ? wait_for_completion+0x240/0x240 + ? vfs_write+0x160/0x2a0 + ? lockdep_hardirqs_off+0xb5/0x100 + ? mark_held_locks+0x1a/0x90 + ? do_syscall_64+0x14/0x2a0 + do_syscall_64+0x72/0x2a0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: Hulk Robot +Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master") +Signed-off-by: YueHaibing +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Axel Lin +Reviewed-by: Mukesh Ojha +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index dd9a8c54a693..be95be4fe985 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -403,7 +403,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) + if (ret) + spi_master_put(master); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(spi_bitbang_start); + +-- +2.20.1 + diff --git a/queue-5.1/tracing-avoid-build-warning-with-have_nop_mcount.patch b/queue-5.1/tracing-avoid-build-warning-with-have_nop_mcount.patch new file mode 100644 index 00000000000..d69cee50709 --- /dev/null +++ b/queue-5.1/tracing-avoid-build-warning-with-have_nop_mcount.patch @@ -0,0 +1,52 @@ +From dc6af5be5479f77f28e2492cf9739a79fa138e78 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Wed, 5 Jun 2019 13:11:58 +0200 +Subject: tracing: avoid build warning with HAVE_NOP_MCOUNT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit cbdaeaf050b730ea02e9ab4ff844ce54d85dbe1d ] + +Selecting HAVE_NOP_MCOUNT enables -mnop-mcount (if gcc supports it) +and sets CC_USING_NOP_MCOUNT. Reuse __is_defined (which is suitable for +testing CC_USING_* defines) to avoid conditional compilation and fix +the following gcc 9 warning on s390: + +kernel/trace/ftrace.c:2514:1: warning: ‘ftrace_code_disable’ defined +but not used [-Wunused-function] + +Link: http://lkml.kernel.org/r/patch.git-1a82d13f33ac.your-ad-here.call-01559732716-ext-6629@work.hours + +Fixes: 2f4df0017baed ("tracing: Add -mcount-nop option support") +Signed-off-by: Vasily Gorbik +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index b920358dd8f7..538f0b1c7ea2 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -2939,14 +2939,13 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs) + p = &pg->records[i]; + p->flags = rec_flags; + +-#ifndef CC_USING_NOP_MCOUNT + /* + * Do the initial record conversion from mcount jump + * to the NOP instructions. + */ +- if (!ftrace_code_disable(mod, p)) ++ if (!__is_defined(CC_USING_NOP_MCOUNT) && ++ !ftrace_code_disable(mod, p)) + break; +-#endif + + update_cnt++; + } +-- +2.20.1 + diff --git a/queue-5.1/usb-gadget-dwc2-fix-zlp-handling.patch b/queue-5.1/usb-gadget-dwc2-fix-zlp-handling.patch new file mode 100644 index 00000000000..005b0fc5e63 --- /dev/null +++ b/queue-5.1/usb-gadget-dwc2-fix-zlp-handling.patch @@ -0,0 +1,91 @@ +From cf595dd886985ae1bd570bcd8967eb9d11c8177b Mon Sep 17 00:00:00 2001 +From: Andrzej Pietrasiewicz +Date: Mon, 1 Apr 2019 12:50:45 +0200 +Subject: usb: gadget: dwc2: fix zlp handling + +[ Upstream commit 066cfd0770aba8a9ac79b59d99530653885d919d ] + +The patch 10209abe87f5ebfd482a00323f5236d6094d0865 +usb: dwc2: gadget: Add scatter-gather mode + +avoided a NULL pointer dereference (hs_ep->req == NULL) by +calling dwc2_gadget_fill_nonisoc_xfer_dma_one() directly instead of through +the dwc2_gadget_config_nonisoc_xfer_ddma() wrapper, which unconditionally +dereferenced the said pointer. + +However, this was based on an incorrect assumption that in the context of +dwc2_hsotg_program_zlp() the pointer is always NULL, which is not the case. +The result were SB CV MSC tests failing starting from Test Case 6. + +Instead, this patch reverts to calling the wrapper and adds a check for +the pointer being NULL inside the wrapper. + +Fixes: 10209abe87f5 (usb: dwc2: gadget: Add scatter-gather mode) +Acked-by: Minas Harutyunyan +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index a749de7604c6..c99ef9753930 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -833,19 +833,22 @@ static void dwc2_gadget_fill_nonisoc_xfer_ddma_one(struct dwc2_hsotg_ep *hs_ep, + * with corresponding information based on transfer data. + */ + static void dwc2_gadget_config_nonisoc_xfer_ddma(struct dwc2_hsotg_ep *hs_ep, +- struct usb_request *ureq, +- unsigned int offset, ++ dma_addr_t dma_buff, + unsigned int len) + { ++ struct usb_request *ureq = NULL; + struct dwc2_dma_desc *desc = hs_ep->desc_list; + struct scatterlist *sg; + int i; + u8 desc_count = 0; + ++ if (hs_ep->req) ++ ureq = &hs_ep->req->req; ++ + /* non-DMA sg buffer */ +- if (!ureq->num_sgs) { ++ if (!ureq || !ureq->num_sgs) { + dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc, +- ureq->dma + offset, len, true); ++ dma_buff, len, true); + return; + } + +@@ -1133,7 +1136,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg, + offset = ureq->actual; + + /* Fill DDMA chain entries */ +- dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, ureq, offset, ++ dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, ureq->dma + offset, + length); + + /* write descriptor chain address to control register */ +@@ -2026,12 +2029,13 @@ static void dwc2_hsotg_program_zlp(struct dwc2_hsotg *hsotg, + dev_dbg(hsotg->dev, "Receiving zero-length packet on ep%d\n", + index); + if (using_desc_dma(hsotg)) { ++ /* Not specific buffer needed for ep0 ZLP */ ++ dma_addr_t dma = hs_ep->desc_list_dma; ++ + if (!index) + dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep); + +- /* Not specific buffer needed for ep0 ZLP */ +- dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &hs_ep->desc_list, +- hs_ep->desc_list_dma, 0, true); ++ dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, dma, 0); + } else { + dwc2_writel(hsotg, DXEPTSIZ_MC(1) | DXEPTSIZ_PKTCNT(1) | + DXEPTSIZ_XFERSIZE(0), +-- +2.20.1 + diff --git a/queue-5.1/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch b/queue-5.1/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch new file mode 100644 index 00000000000..8e10670f2ca --- /dev/null +++ b/queue-5.1/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch @@ -0,0 +1,51 @@ +From 6ed093a7f7875b0f318ec953e671e953af4f8ec5 Mon Sep 17 00:00:00 2001 +From: Young Xiao <92siuyang@gmail.com> +Date: Tue, 28 May 2019 20:17:54 +0800 +Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] + +[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ] + +There is no deallocation of fusb300->ep[i] elements, allocated at +fusb300_probe. + +The patch adds deallocation of fusb300->ep array elements. + +Signed-off-by: Young Xiao <92siuyang@gmail.com> +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 263804d154a7..00e3f66836a9 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { + static int fusb300_remove(struct platform_device *pdev) + { + struct fusb300 *fusb300 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + + return 0; +@@ -1491,6 +1494,8 @@ clean_up: + if (fusb300->ep0_req) + fusb300_free_request(&fusb300->ep[0]->ep, + fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + } + if (reg) +-- +2.20.1 + diff --git a/queue-5.1/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch b/queue-5.1/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch new file mode 100644 index 00000000000..937e6316894 --- /dev/null +++ b/queue-5.1/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch @@ -0,0 +1,39 @@ +From 0b06ae982033f8960bafa23cace4bcbe4ccac760 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Wed, 22 May 2019 14:07:36 +0200 +Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC + +[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ] + +Gadget drivers may queue request in interrupt context. This would lead to +a descriptor allocation in that context. In that case we would hit +BUG_ON(in_interrupt()) in __get_vm_area_node. + +Also remove the unnecessary cast. + +Acked-by: Sylvain Lemieux +Tested-by: James Grant +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index b0781771704e..eafc2a00c96a 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -922,8 +922,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) + dma_addr_t dma; + struct lpc32xx_usbd_dd_gad *dd; + +- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( +- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); ++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); + if (dd) + dd->this_dma = dma; + +-- +2.20.1 + diff --git a/queue-5.1/x86-cpu-add-more-icelake-model-numbers.patch b/queue-5.1/x86-cpu-add-more-icelake-model-numbers.patch new file mode 100644 index 00000000000..cd4bd6960c1 --- /dev/null +++ b/queue-5.1/x86-cpu-add-more-icelake-model-numbers.patch @@ -0,0 +1,47 @@ +From 01c7acdcff6fd16ad9f4f5617b18c0ee52b23554 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Mon, 3 Jun 2019 06:41:20 -0700 +Subject: x86/CPU: Add more Icelake model numbers + +[ Upstream commit e35faeb64146f2015f2aec14b358ae508e4066db ] + +Add the CPUID model numbers of Icelake (ICL) desktop and server +processors to the Intel family list. + + [ Qiuxu: Sort the macros by model number. ] + +Signed-off-by: Kan Liang +Signed-off-by: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: Andy Shevchenko +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: Qiuxu Zhuo +Cc: Rajneesh Bhardwaj +Cc: rui.zhang@intel.com +Cc: Thomas Gleixner +Cc: Tony Luck +Cc: x86-ml +Link: https://lkml.kernel.org/r/20190603134122.13853-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/intel-family.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 9f15384c504a..310118805f57 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -52,6 +52,9 @@ + + #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66 + ++#define INTEL_FAM6_ICELAKE_X 0x6A ++#define INTEL_FAM6_ICELAKE_XEON_D 0x6C ++#define INTEL_FAM6_ICELAKE_DESKTOP 0x7D + #define INTEL_FAM6_ICELAKE_MOBILE 0x7E + + /* "Small Core" Processors (Atom) */ +-- +2.20.1 +