From: Sasha Levin Date: Wed, 3 Jul 2019 18:13:18 +0000 (-0400) Subject: fixes for 4.19 X-Git-Tag: v5.1.17~49 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=79a3bed5e77fdc663a15c4e946709a0e7fe12fae;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch b/queue-4.19/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch new file mode 100644 index 00000000000..a783c6b942f --- /dev/null +++ b/queue-4.19/alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch @@ -0,0 +1,46 @@ +From 8e79ccf558d33b37804e602895c448a85c8d6780 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Wed, 22 May 2019 11:21:41 -0500 +Subject: ALSA: hdac: fix memory release for SST and SOF drivers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 6d647b736a6b1cbf2f8deab0e6a94c34a6ea9d60 ] + +During the integration of HDaudio support, we changed the way in which +we get hdev in snd_hdac_ext_bus_device_init() to use one preallocated +with devm_kzalloc(), however it still left kfree(hdev) in +snd_hdac_ext_bus_device_exit(). It leads to oopses when trying to +rmmod and modprobe. Fix it, by just removing kfree call. + +SOF also uses some of the snd_hdac_ functions for HDAudio support but +allocated the memory with kzalloc. A matching fix is provided +separately to align all users of the snd_hdac_ library. + +Fixes: 6298542fa33b ("ALSA: hdac: remove memory allocation from snd_hdac_ext_bus_device_init") +Reviewed-by: Takashi Iwai +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/hda/ext/hdac_ext_bus.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c +index 9c37d9af3023..08cc0ce3b924 100644 +--- a/sound/hda/ext/hdac_ext_bus.c ++++ b/sound/hda/ext/hdac_ext_bus.c +@@ -173,7 +173,6 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_init); + void snd_hdac_ext_bus_device_exit(struct hdac_device *hdev) + { + snd_hdac_device_exit(hdev); +- kfree(hdev); + } + EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_exit); + +-- +2.20.1 + diff --git a/queue-4.19/asoc-ak4458-add-return-value-for-ak4458_probe.patch b/queue-4.19/asoc-ak4458-add-return-value-for-ak4458_probe.patch new file mode 100644 index 00000000000..7ea97e89b2b --- /dev/null +++ b/queue-4.19/asoc-ak4458-add-return-value-for-ak4458_probe.patch @@ -0,0 +1,65 @@ +From aac85bf8322001fb461236a3c1636e24b0b966fb Mon Sep 17 00:00:00 2001 +From: Viorel Suman +Date: Thu, 9 May 2019 13:30:36 +0000 +Subject: ASoC: ak4458: add return value for ak4458_probe + +[ Upstream commit a8dee20d792432740509237943700fbcfc230bad ] + +AK4458 is probed successfully even if AK4458 is not present - this +is caused by probe function returning no error on i2c access failure. +Return an error on probe if i2c access has failed. + +Signed-off-by: Shengjiu Wang +Signed-off-by: Viorel Suman +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index 299ada4dfaa0..58b6ca1de993 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -492,9 +492,10 @@ static void ak4458_power_on(struct ak4458_priv *ak4458) + } + } + +-static void ak4458_init(struct snd_soc_component *component) ++static int ak4458_init(struct snd_soc_component *component) + { + struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component); ++ int ret; + + /* External Mute ON */ + if (ak4458->mute_gpiod) +@@ -502,21 +503,21 @@ static void ak4458_init(struct snd_soc_component *component) + + ak4458_power_on(ak4458); + +- snd_soc_component_update_bits(component, AK4458_00_CONTROL1, ++ ret = snd_soc_component_update_bits(component, AK4458_00_CONTROL1, + 0x80, 0x80); /* ACKS bit = 1; 10000000 */ ++ if (ret < 0) ++ return ret; + +- ak4458_rstn_control(component, 1); ++ return ak4458_rstn_control(component, 1); + } + + static int ak4458_probe(struct snd_soc_component *component) + { + struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component); + +- ak4458_init(component); +- + ak4458->fs = 48000; + +- return 0; ++ return ak4458_init(component); + } + + static void ak4458_remove(struct snd_soc_component *component) +-- +2.20.1 + diff --git a/queue-4.19/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch b/queue-4.19/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch new file mode 100644 index 00000000000..a55b0fc3543 --- /dev/null +++ b/queue-4.19/asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch @@ -0,0 +1,39 @@ +From 9cd6be3893b2015726ac08acd808c53510054bda Mon Sep 17 00:00:00 2001 +From: Viorel Suman +Date: Mon, 13 May 2019 10:02:42 +0000 +Subject: ASoC: ak4458: rstn_control - return a non-zero on error only + +[ Upstream commit 176a11834b65ec35e3b7a953f87fb9cc41309497 ] + +snd_soc_component_update_bits() may return 1 if operation +was successful and the value of the register changed. +Return a non-zero in ak4458_rstn_control for an error only. + +Signed-off-by: Shengjiu Wang +Signed-off-by: Viorel Suman +Reviewed-by: Daniel Baluta +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index 58b6ca1de993..3bd57c02e6fd 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -272,7 +272,10 @@ static int ak4458_rstn_control(struct snd_soc_component *component, int bit) + AK4458_00_CONTROL1, + AK4458_RSTN_MASK, + 0x0); +- return ret; ++ if (ret < 0) ++ return ret; ++ ++ return 0; + } + + static int ak4458_hw_params(struct snd_pcm_substream *substream, +-- +2.20.1 + diff --git a/queue-4.19/asoc-cs4265-readable-register-too-low.patch b/queue-4.19/asoc-cs4265-readable-register-too-low.patch new file mode 100644 index 00000000000..b3db5e473a7 --- /dev/null +++ b/queue-4.19/asoc-cs4265-readable-register-too-low.patch @@ -0,0 +1,43 @@ +From 36e71b5b74da5ac51ab464dd18fee4a6ff8c1373 Mon Sep 17 00:00:00 2001 +From: Matt Flax +Date: Wed, 8 May 2019 16:33:13 +1000 +Subject: ASoC : cs4265 : readable register too low + +[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ] + +The cs4265_readable_register function stopped short of the maximum +register. + +An example bug is taken from : +https://github.com/Audio-Injector/Ultra/issues/25 + +Where alsactl store fails with : +Cannot read control '2,0,0,C Data Buffer,0': Input/output error + +This patch fixes the bug by setting the cs4265 to have readable +registers up to the maximum hardware register CS4265_MAX_REGISTER. + +Signed-off-by: Matt Flax +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4265.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index 407554175282..68d18aca397d 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { + static bool cs4265_readable_register(struct device *dev, unsigned int reg) + { + switch (reg) { +- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: ++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: + return true; + default: + return false; +-- +2.20.1 + diff --git a/queue-4.19/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch b/queue-4.19/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch new file mode 100644 index 00000000000..dacd9a7e83a --- /dev/null +++ b/queue-4.19/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch @@ -0,0 +1,56 @@ +From 254261e6fd06a9fce3e3a3d641efbc862a0c04f8 Mon Sep 17 00:00:00 2001 +From: Yu-Hsuan Hsu +Date: Tue, 4 Jun 2019 18:49:09 +0800 +Subject: ASoC: max98090: remove 24-bit format support if RJ is 0 + +[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ] + +The supported formats are S16_LE and S24_LE now. However, by datasheet +of max98090, S24_LE is only supported when it is in the right justified +mode. We should remove 24-bit format if it is not in that mode to avoid +triggering error. + +Signed-off-by: Yu-Hsuan Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index f06ae43650a3..c3b28b2f4b10 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, + return 0; + } + ++static int max98090_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct snd_soc_component *component = dai->component; ++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); ++ unsigned int fmt = max98090->dai_fmt; ++ ++ /* Remove 24-bit format support if it is not in right justified mode. */ ++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { ++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); ++ } ++ return 0; ++} ++ + static int max98090_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); + #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) + + static const struct snd_soc_dai_ops max98090_dai_ops = { ++ .startup = max98090_dai_startup, + .set_sysclk = max98090_dai_set_sysclk, + .set_fmt = max98090_dai_set_fmt, + .set_tdm_slot = max98090_set_tdm_slot, +-- +2.20.1 + diff --git a/queue-4.19/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch b/queue-4.19/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch new file mode 100644 index 00000000000..db96668575d --- /dev/null +++ b/queue-4.19/asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch @@ -0,0 +1,47 @@ +From 722b47c144cd3d892684790c237dd6053da4b4a1 Mon Sep 17 00:00:00 2001 +From: Libin Yang +Date: Wed, 8 May 2019 10:32:41 +0800 +Subject: ASoC: soc-pcm: BE dai needs prepare when pause release after resume + +[ Upstream commit 5087a8f17df868601cd7568299e91c28086d2b45 ] + +If playback/capture is paused and system enters S3, after system returns +from suspend, BE dai needs to call prepare() callback when playback/capture +is released from pause if RESUME_INFO flag is not set. + +Currently, the dpcm_be_dai_prepare() function will block calling prepare() +if the pcm is in SND_SOC_DPCM_STATE_PAUSED state. This will cause the +following test case fail if the pcm uses BE: + +playback -> pause -> S3 suspend -> S3 resume -> pause release + +The playback may exit abnormally when pause is released because the BE dai +prepare() is not called. + +This patch allows dpcm_be_dai_prepare() to call dai prepare() callback in +SND_SOC_DPCM_STATE_PAUSED state. + +Signed-off-by: Libin Yang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 33060af18b5a..6566c8831a96 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2451,7 +2451,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) && ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED)) + continue; + + dev_dbg(be->dev, "ASoC: prepare BE %s\n", +-- +2.20.1 + diff --git a/queue-4.19/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch b/queue-4.19/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch new file mode 100644 index 00000000000..053f8abdd0d --- /dev/null +++ b/queue-4.19/asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch @@ -0,0 +1,39 @@ +From 3b70ad0d169c0b91ead4dbbb192b7f1d6e910c77 Mon Sep 17 00:00:00 2001 +From: Marcus Cooper +Date: Mon, 3 Jun 2019 19:47:28 +0200 +Subject: ASoC: sun4i-i2s: Add offset to RX channel select + +[ Upstream commit f9927000cb35f250051f0f1878db12ee2626eea1 ] + +Whilst testing the capture functionality of the i2s on the newer +SoCs it was noticed that the recording was somewhat distorted. +This was due to the offset not being set correctly on the receiver +side. + +Signed-off-by: Marcus Cooper +Acked-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index 5750738b6ac0..6173dd86c62c 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -460,6 +460,10 @@ static int sun4i_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + regmap_update_bits(i2s->regmap, SUN8I_I2S_TX_CHAN_SEL_REG, + SUN8I_I2S_TX_CHAN_OFFSET_MASK, + SUN8I_I2S_TX_CHAN_OFFSET(offset)); ++ ++ regmap_update_bits(i2s->regmap, SUN8I_I2S_RX_CHAN_SEL_REG, ++ SUN8I_I2S_TX_CHAN_OFFSET_MASK, ++ SUN8I_I2S_TX_CHAN_OFFSET(offset)); + } + + regmap_field_write(i2s->field_fmt_mode, val); +-- +2.20.1 + diff --git a/queue-4.19/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch b/queue-4.19/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch new file mode 100644 index 00000000000..03fe1d43a50 --- /dev/null +++ b/queue-4.19/asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch @@ -0,0 +1,35 @@ +From 4dd7de8dd587b20cff9d31fb3ff735c09bdcf8dd Mon Sep 17 00:00:00 2001 +From: Marcus Cooper +Date: Mon, 3 Jun 2019 19:47:27 +0200 +Subject: ASoC: sun4i-i2s: Fix sun8i tx channel offset mask + +[ Upstream commit 7e46169a5f35762f335898a75d1b8a242f2ae0f5 ] + +Although not causing any noticeable issues, the mask for the +channel offset is covering too many bits. + +Signed-off-by: Marcus Cooper +Acked-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index a4aa931ebfae..5750738b6ac0 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -110,7 +110,7 @@ + + #define SUN8I_I2S_TX_CHAN_MAP_REG 0x44 + #define SUN8I_I2S_TX_CHAN_SEL_REG 0x34 +-#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 11) ++#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 12) + #define SUN8I_I2S_TX_CHAN_OFFSET(offset) (offset << 12) + #define SUN8I_I2S_TX_CHAN_EN_MASK GENMASK(11, 4) + #define SUN8I_I2S_TX_CHAN_EN(num_chan) (((1 << num_chan) - 1) << 4) +-- +2.20.1 + diff --git a/queue-4.19/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch b/queue-4.19/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch new file mode 100644 index 00000000000..d09642c7810 --- /dev/null +++ b/queue-4.19/cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch @@ -0,0 +1,143 @@ +From 9cfb37080b38f3fb737a5a425bae01aa84e53d9a Mon Sep 17 00:00:00 2001 +From: Joel Savitz +Date: Wed, 12 Jun 2019 11:50:48 -0400 +Subject: cpuset: restore sanity to cpuset_cpus_allowed_fallback() + +[ Upstream commit d477f8c202d1f0d4791ab1263ca7657bbe5cf79e ] + +In the case that a process is constrained by taskset(1) (i.e. +sched_setaffinity(2)) to a subset of available cpus, and all of those are +subsequently offlined, the scheduler will set tsk->cpus_allowed to +the current value of task_cs(tsk)->effective_cpus. + +This is done via a call to do_set_cpus_allowed() in the context of +cpuset_cpus_allowed_fallback() made by the scheduler when this case is +detected. This is the only call made to cpuset_cpus_allowed_fallback() +in the latest mainline kernel. + +However, this is not sane behavior. + +I will demonstrate this on a system running the latest upstream kernel +with the following initial configuration: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,fffffff + Cpus_allowed_list: 0-63 + +(Where cpus 32-63 are provided via smt.) + +If we limit our current shell process to cpu2 only and then offline it +and reonline it: + + # taskset -p 4 $$ + pid 2272's current affinity mask: ffffffffffffffff + pid 2272's new affinity mask: 4 + + # echo off > /sys/devices/system/cpu/cpu2/online + # dmesg | tail -3 + [ 2195.866089] process 2272 (bash) no longer affine to cpu2 + [ 2195.872700] IRQ 114: no longer affine to CPU2 + [ 2195.879128] smpboot: CPU 2 is now offline + + # echo on > /sys/devices/system/cpu/cpu2/online + # dmesg | tail -1 + [ 2617.043572] smpboot: Booting Node 0 Processor 2 APIC 0x4 + +We see that our current process now has an affinity mask containing +every cpu available on the system _except_ the one we originally +constrained it to: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,fffffffb + Cpus_allowed_list: 0-1,3-63 + +This is not sane behavior, as the scheduler can now not only place the +process on previously forbidden cpus, it can't even schedule it on +the cpu it was originally constrained to! + +Other cases result in even more exotic affinity masks. Take for instance +a process with an affinity mask containing only cpus provided by smt at +the moment that smt is toggled, in a configuration such as the following: + + # taskset -p f000000000 $$ + # grep -i cpu /proc/$$/status + Cpus_allowed: 000000f0,00000000 + Cpus_allowed_list: 36-39 + +A double toggle of smt results in the following behavior: + + # echo off > /sys/devices/system/cpu/smt/control + # echo on > /sys/devices/system/cpu/smt/control + # grep -i cpus /proc/$$/status + Cpus_allowed: ffffff00,ffffffff + Cpus_allowed_list: 0-31,40-63 + +This is even less sane than the previous case, as the new affinity mask +excludes all smt-provided cpus with ids less than those that were +previously in the affinity mask, as well as those that were actually in +the mask. + +With this patch applied, both of these cases end in the following state: + + # grep -i cpu /proc/$$/status + Cpus_allowed: ffffffff,ffffffff + Cpus_allowed_list: 0-63 + +The original policy is discarded. Though not ideal, it is the simplest way +to restore sanity to this fallback case without reinventing the cpuset +wheel that rolls down the kernel just fine in cgroup v2. A user who wishes +for the previous affinity mask to be restored in this fallback case can use +that mechanism instead. + +This patch modifies scheduler behavior by instead resetting the mask to +task_cs(tsk)->cpus_allowed by default, and cpu_possible mask in legacy +mode. I tested the cases above on both modes. + +Note that the scheduler uses this fallback mechanism if and only if +_every_ other valid avenue has been traveled, and it is the last resort +before calling BUG(). + +Suggested-by: Waiman Long +Suggested-by: Phil Auld +Signed-off-by: Joel Savitz +Acked-by: Phil Auld +Acked-by: Waiman Long +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 266f10cb7222..ff956ccbb6df 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2432,10 +2432,23 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask) + spin_unlock_irqrestore(&callback_lock, flags); + } + ++/** ++ * cpuset_cpus_allowed_fallback - final fallback before complete catastrophe. ++ * @tsk: pointer to task_struct with which the scheduler is struggling ++ * ++ * Description: In the case that the scheduler cannot find an allowed cpu in ++ * tsk->cpus_allowed, we fall back to task_cs(tsk)->cpus_allowed. In legacy ++ * mode however, this value is the same as task_cs(tsk)->effective_cpus, ++ * which will not contain a sane cpumask during cases such as cpu hotplugging. ++ * This is the absolute last resort for the scheduler and it is only used if ++ * _every_ other avenue has been traveled. ++ **/ ++ + void cpuset_cpus_allowed_fallback(struct task_struct *tsk) + { + rcu_read_lock(); +- do_set_cpus_allowed(tsk, task_cs(tsk)->effective_cpus); ++ do_set_cpus_allowed(tsk, is_in_v2_mode() ? ++ task_cs(tsk)->cpus_allowed : cpu_possible_mask); + rcu_read_unlock(); + + /* +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch b/queue-4.19/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch new file mode 100644 index 00000000000..1991264084c --- /dev/null +++ b/queue-4.19/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch @@ -0,0 +1,32 @@ +From b54383f24ceea5907c8f973b254d903fd1db0c1a Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:54 +0800 +Subject: drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver + +[ Upstream commit cf49b24ffa62766f8f04cd1c4cf17b75d29b240a ] + +shutdown all CRTC when unbinding drm driver. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index bbe57ad9acf1..3df8a9dbccfe 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -310,6 +310,7 @@ err_config_cleanup: + static void mtk_drm_kms_deinit(struct drm_device *drm) + { + drm_kms_helper_poll_fini(drm); ++ drm_atomic_helper_shutdown(drm); + + component_unbind_all(drm->dev, drm); + drm_mode_config_cleanup(drm); +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch b/queue-4.19/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch new file mode 100644 index 00000000000..247ff0c3584 --- /dev/null +++ b/queue-4.19/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch @@ -0,0 +1,69 @@ +From 275b2374985ab288146d8ee068be9f8c167df8ea Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Thu, 30 May 2019 17:18:47 +0800 +Subject: drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable() + +[ Upstream commit 2458d9d6d94be982b917e93c61a89b4426f32e31 ] + +mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), which +needs ovl irq for drm_crtc_wait_one_vblank(), since after mtk_dsi_stop() is +called, ovl irq will be disabled. If drm_crtc_wait_one_vblank() is called +after last irq, it will timeout with this message: "vblank wait timed out +on crtc 0". This happens sometimes when turning off the screen. + +In drm_atomic_helper.c#disable_outputs(), +the calling sequence when turning off the screen is: + +1. mtk_dsi_encoder_disable() + --> mtk_output_dsi_disable() + --> mtk_dsi_stop(); /* sometimes make vblank timeout in + atomic_disable */ + --> mtk_dsi_poweroff(); +2. mtk_drm_crtc_atomic_disable() + --> drm_crtc_wait_one_vblank(); + ... + --> mtk_dsi_ddp_stop() + --> mtk_dsi_poweroff(); + +mtk_dsi_poweroff() has reference count design, change to make +mtk_dsi_stop() called in mtk_dsi_poweroff() when refcount is 0. + +Fixes: 0707632b5bac ("drm/mediatek: update DSI sub driver flow for sending commands to panel") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 84bb66866631..0dd317ac5fe5 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -630,6 +630,15 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + if (--dsi->refcount != 0) + return; + ++ /* ++ * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since ++ * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), ++ * which needs irq for vblank, and mtk_dsi_stop() will disable irq. ++ * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(), ++ * after dsi is fully set. ++ */ ++ mtk_dsi_stop(dsi); ++ + if (!mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500)) { + if (dsi->panel) { + if (drm_panel_unprepare(dsi->panel)) { +@@ -696,7 +705,6 @@ static void mtk_output_dsi_disable(struct mtk_dsi *dsi) + } + } + +- mtk_dsi_stop(dsi); + mtk_dsi_poweroff(dsi); + + dsi->enabled = false; +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-clear-num_pipes-when-unbind-driver.patch b/queue-4.19/drm-mediatek-clear-num_pipes-when-unbind-driver.patch new file mode 100644 index 00000000000..1148c400b9c --- /dev/null +++ b/queue-4.19/drm-mediatek-clear-num_pipes-when-unbind-driver.patch @@ -0,0 +1,35 @@ +From 87e71ea88267b7c9074043acbde26b6e4632cae5 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:55 +0800 +Subject: drm/mediatek: clear num_pipes when unbind driver + +[ Upstream commit a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396 ] + +num_pipes is used for mutex created in mtk_drm_crtc_create(). If we +don't clear num_pipes count, when rebinding driver, the count will +be accumulated. From mtk_disp_mutex_get(), there can only be at most +10 mutex id. Clear this number so it starts from 0 in every rebind. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 3df8a9dbccfe..fd83046d8376 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -393,6 +393,7 @@ static void mtk_drm_unbind(struct device *dev) + drm_dev_unregister(private->drm); + mtk_drm_kms_deinit(private->drm); + drm_dev_put(private->drm); ++ private->num_pipes = 0; + private->drm = NULL; + } + +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-fix-unbind-functions.patch b/queue-4.19/drm-mediatek-fix-unbind-functions.patch new file mode 100644 index 00000000000..d9e674cb955 --- /dev/null +++ b/queue-4.19/drm-mediatek-fix-unbind-functions.patch @@ -0,0 +1,34 @@ +From ec11f216d9b100792ee212d8be8905de0cdcc5cc Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:52 +0800 +Subject: drm/mediatek: fix unbind functions + +[ Upstream commit 8fd7a37b191f93737f6280a9b5de65f98acc12c9 ] + +detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to +attach it again. + +Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 66df1b177959..84bb66866631 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -841,6 +841,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi) + /* Skip connector cleanup if creation was delegated to the bridge */ + if (dsi->conn.dev) + drm_connector_cleanup(&dsi->conn); ++ if (dsi->panel) ++ drm_panel_detach(dsi->panel); + } + + static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp) +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch b/queue-4.19/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch new file mode 100644 index 00000000000..02519e0cfef --- /dev/null +++ b/queue-4.19/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch @@ -0,0 +1,55 @@ +From b3326e6afa7ed821035941f52e584af034a6f1ea Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Wed, 29 May 2019 18:25:53 +0800 +Subject: drm/mediatek: unbind components in mtk_drm_unbind() + +[ Upstream commit f0fd848342802bc0f74620d387eead53e8905804 ] + +Unbinding components (i.e. mtk_dsi and mtk_disp_ovl/rdma/color) will +trigger master(mtk_drm)'s .unbind(), and currently mtk_drm's unbind +won't actually unbind components. During the next bind, +mtk_drm_kms_init() is called, and the components are added back. + +.unbind() should call mtk_drm_kms_deinit() to unbind components. + +And since component_master_del() in .remove() will trigger .unbind(), +which will also unregister device, it's fine to remove original functions +called here. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsin-Yi Wang +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 47ec604289b7..bbe57ad9acf1 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -390,6 +390,7 @@ static void mtk_drm_unbind(struct device *dev) + struct mtk_drm_private *private = dev_get_drvdata(dev); + + drm_dev_unregister(private->drm); ++ mtk_drm_kms_deinit(private->drm); + drm_dev_put(private->drm); + private->drm = NULL; + } +@@ -559,13 +560,8 @@ err_node: + static int mtk_drm_remove(struct platform_device *pdev) + { + struct mtk_drm_private *private = platform_get_drvdata(pdev); +- struct drm_device *drm = private->drm; + int i; + +- drm_dev_unregister(drm); +- mtk_drm_kms_deinit(drm); +- drm_dev_put(drm); +- + component_master_del(&pdev->dev, &mtk_drm_ops); + pm_runtime_disable(&pdev->dev); + of_node_put(private->mutex_node); +-- +2.20.1 + diff --git a/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch b/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch new file mode 100644 index 00000000000..3b6d31ca19e --- /dev/null +++ b/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch @@ -0,0 +1,60 @@ +From 5f5640e79d70cae1c268bcc3fb0b9becd6ad1d31 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 24 May 2019 14:57:59 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD MicroPC + +[ Upstream commit 652b8b086538c8a10de5aa5cbdaef79333b46358 ] + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_micropc data struct may very well need to be updated +with some extra bios-dates in the future. + +Acked-by: Maxime Ripard +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-2-hdegoede@redhat.com +(cherry picked from commit f2f2bb60d998abde10de7e483ef9e17639892450) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 088363675940..b44bed554211 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_micropc = { ++ .width = 720, ++ .height = 1280, ++ .bios_dates = (const char * const []){ "04/26/2019", ++ NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .width = 1200, + .height = 1920, +@@ -93,6 +101,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, + .driver_data = (void *)&asus_t100ha, ++ }, { /* GPD MicroPC (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_micropc, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +-- +2.20.1 + diff --git a/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch b/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch new file mode 100644 index 00000000000..6b76e3244d4 --- /dev/null +++ b/queue-4.19/drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch @@ -0,0 +1,65 @@ +From 0b77ce487471b0785e20a083bfaba8e7f85ce2f8 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 24 May 2019 14:57:58 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for GPD pocket2 + +[ Upstream commit 15abc7110a77555d3bf72aaef46d1557db0a4ac5 ] + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_pocket2 data struct may very well need to be updated +with some extra bios-dates in the future. + +Changes in v2: +-Add one more known BIOS date to the list of BIOS dates + +Cc: Jurgen Kramer +Reported-by: Jurgen Kramer +Acked-by: Maxime Ripard +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-1-hdegoede@redhat.com +(cherry picked from commit 6dab9102dd7b144e5723915438e0d6c473018cd0) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index ee4a5e1221f1..088363675940 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -50,6 +50,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = { ++ .width = 1200, ++ .height = 1920, ++ .bios_dates = (const char * const []){ "06/28/2018", "08/28/2018", ++ "12/07/2018", NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_win = { + .width = 720, + .height = 1280, +@@ -98,6 +106,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_pocket, ++ }, { /* GPD Pocket 2 (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_pocket2, + }, { /* GPD Win (same note on DMI match as GPD Pocket) */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), +-- +2.20.1 + diff --git a/queue-4.19/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch b/queue-4.19/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch new file mode 100644 index 00000000000..be32d2b0df7 --- /dev/null +++ b/queue-4.19/ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch @@ -0,0 +1,112 @@ +From 1663f35197904264382745bdadad862017fd83e4 Mon Sep 17 00:00:00 2001 +From: Wei Li +Date: Thu, 6 Jun 2019 11:17:54 +0800 +Subject: ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() + +[ Upstream commit 04e03d9a616c19a47178eaca835358610e63a1dd ] + +The mapper may be NULL when called from register_ftrace_function_probe() +with probe->data == NULL. + +This issue can be reproduced as follow (it may be covered by compiler +optimization sometime): + +/ # cat /sys/kernel/debug/tracing/set_ftrace_filter +#### all functions enabled #### +/ # echo foo_bar:dump > /sys/kernel/debug/tracing/set_ftrace_filter +[ 206.949100] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 206.952402] Mem abort info: +[ 206.952819] ESR = 0x96000006 +[ 206.955326] Exception class = DABT (current EL), IL = 32 bits +[ 206.955844] SET = 0, FnV = 0 +[ 206.956272] EA = 0, S1PTW = 0 +[ 206.956652] Data abort info: +[ 206.957320] ISV = 0, ISS = 0x00000006 +[ 206.959271] CM = 0, WnR = 0 +[ 206.959938] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000419f3a000 +[ 206.960483] [0000000000000000] pgd=0000000411a87003, pud=0000000411a83003, pmd=0000000000000000 +[ 206.964953] Internal error: Oops: 96000006 [#1] SMP +[ 206.971122] Dumping ftrace buffer: +[ 206.973677] (ftrace buffer empty) +[ 206.975258] Modules linked in: +[ 206.976631] Process sh (pid: 281, stack limit = 0x(____ptrval____)) +[ 206.978449] CPU: 10 PID: 281 Comm: sh Not tainted 5.2.0-rc1+ #17 +[ 206.978955] Hardware name: linux,dummy-virt (DT) +[ 206.979883] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 206.980499] pc : free_ftrace_func_mapper+0x2c/0x118 +[ 206.980874] lr : ftrace_count_free+0x68/0x80 +[ 206.982539] sp : ffff0000182f3ab0 +[ 206.983102] x29: ffff0000182f3ab0 x28: ffff8003d0ec1700 +[ 206.983632] x27: ffff000013054b40 x26: 0000000000000001 +[ 206.984000] x25: ffff00001385f000 x24: 0000000000000000 +[ 206.984394] x23: ffff000013453000 x22: ffff000013054000 +[ 206.984775] x21: 0000000000000000 x20: ffff00001385fe28 +[ 206.986575] x19: ffff000013872c30 x18: 0000000000000000 +[ 206.987111] x17: 0000000000000000 x16: 0000000000000000 +[ 206.987491] x15: ffffffffffffffb0 x14: 0000000000000000 +[ 206.987850] x13: 000000000017430e x12: 0000000000000580 +[ 206.988251] x11: 0000000000000000 x10: cccccccccccccccc +[ 206.988740] x9 : 0000000000000000 x8 : ffff000013917550 +[ 206.990198] x7 : ffff000012fac2e8 x6 : ffff000012fac000 +[ 206.991008] x5 : ffff0000103da588 x4 : 0000000000000001 +[ 206.991395] x3 : 0000000000000001 x2 : ffff000013872a28 +[ 206.991771] x1 : 0000000000000000 x0 : 0000000000000000 +[ 206.992557] Call trace: +[ 206.993101] free_ftrace_func_mapper+0x2c/0x118 +[ 206.994827] ftrace_count_free+0x68/0x80 +[ 206.995238] release_probe+0xfc/0x1d0 +[ 206.995555] register_ftrace_function_probe+0x4a8/0x868 +[ 206.995923] ftrace_trace_probe_callback.isra.4+0xb8/0x180 +[ 206.996330] ftrace_dump_callback+0x50/0x70 +[ 206.996663] ftrace_regex_write.isra.29+0x290/0x3a8 +[ 206.997157] ftrace_filter_write+0x44/0x60 +[ 206.998971] __vfs_write+0x64/0xf0 +[ 206.999285] vfs_write+0x14c/0x2f0 +[ 206.999591] ksys_write+0xbc/0x1b0 +[ 206.999888] __arm64_sys_write+0x3c/0x58 +[ 207.000246] el0_svc_common.constprop.0+0x408/0x5f0 +[ 207.000607] el0_svc_handler+0x144/0x1c8 +[ 207.000916] el0_svc+0x8/0xc +[ 207.003699] Code: aa0003f8 a9025bf5 aa0103f5 f946ea80 (f9400303) +[ 207.008388] ---[ end trace 7b6d11b5f542bdf1 ]--- +[ 207.010126] Kernel panic - not syncing: Fatal exception +[ 207.011322] SMP: stopping secondary CPUs +[ 207.013956] Dumping ftrace buffer: +[ 207.014595] (ftrace buffer empty) +[ 207.015632] Kernel Offset: disabled +[ 207.017187] CPU features: 0x002,20006008 +[ 207.017985] Memory Limit: none +[ 207.019825] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +Link: http://lkml.kernel.org/r/20190606031754.10798-1-liwei391@huawei.com + +Signed-off-by: Wei Li +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 50ba14591996..0a0bb839ac5e 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4213,10 +4213,13 @@ void free_ftrace_func_mapper(struct ftrace_func_mapper *mapper, + struct ftrace_func_entry *entry; + struct ftrace_func_map *map; + struct hlist_head *hhd; +- int size = 1 << mapper->hash.size_bits; +- int i; ++ int size, i; ++ ++ if (!mapper) ++ return; + + if (free_func && mapper->hash.count) { ++ size = 1 << mapper->hash.size_bits; + for (i = 0; i < size; i++) { + hhd = &mapper->hash.buckets[i]; + hlist_for_each_entry(entry, hhd, hlist) { +-- +2.20.1 + diff --git a/queue-4.19/i2c-pca-platform-fix-gpio-lookup-code.patch b/queue-4.19/i2c-pca-platform-fix-gpio-lookup-code.patch new file mode 100644 index 00000000000..d3af1d716cd --- /dev/null +++ b/queue-4.19/i2c-pca-platform-fix-gpio-lookup-code.patch @@ -0,0 +1,50 @@ +From 505327093833f6b913259b3d1b70652b2e62d1e3 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 30 May 2019 22:24:24 +0200 +Subject: i2c: pca-platform: Fix GPIO lookup code + +[ Upstream commit a0cac264a86fbf4d6cb201fbbb73c1d335e3248a ] + +The devm_gpiod_request_gpiod() call will add "-gpios" to +any passed connection ID before looking it up. + +I do not think the reset GPIO on this platform is named +"reset-gpios-gpios" but rather "reset-gpios" in the device +tree, so fix this up so that we get a proper reset GPIO +handle. + +Also drop the inclusion of the legacy GPIO header. + +Fixes: 0e8ce93bdceb ("i2c: pca-platform: add devicetree awareness") +Signed-off-by: Linus Walleij +Reviewed-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pca-platform.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c +index de3fe6e828cb..f50afa8e3cba 100644 +--- a/drivers/i2c/busses/i2c-pca-platform.c ++++ b/drivers/i2c/busses/i2c-pca-platform.c +@@ -21,7 +21,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -173,7 +172,7 @@ static int i2c_pca_pf_probe(struct platform_device *pdev) + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = np; + +- i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset-gpios", GPIOD_OUT_LOW); ++ i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(i2c->gpio)) + return PTR_ERR(i2c->gpio); + +-- +2.20.1 + diff --git a/queue-4.19/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch b/queue-4.19/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch new file mode 100644 index 00000000000..05d932d6ae9 --- /dev/null +++ b/queue-4.19/mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch @@ -0,0 +1,45 @@ +From e7fd2d9e8d31621abfb053e9e7bcec87681aa9b5 Mon Sep 17 00:00:00 2001 +From: swkhack +Date: Thu, 13 Jun 2019 15:56:08 -0700 +Subject: mm/mlock.c: change count_mm_mlocked_page_nr return type + +[ Upstream commit 0874bb49bb21bf24deda853e8bf61b8325e24bcb ] + +On a 64-bit machine the value of "vma->vm_end - vma->vm_start" may be +negative when using 32 bit ints and the "count >> PAGE_SHIFT"'s result +will be wrong. So change the local variable and return value to +unsigned long to fix the problem. + +Link: http://lkml.kernel.org/r/20190513023701.83056-1-swkhack@gmail.com +Fixes: 0cf2f6f6dc60 ("mm: mlock: check against vma for actual mlock() size") +Signed-off-by: swkhack +Acked-by: Michal Hocko +Reviewed-by: Andrew Morton +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/mlock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/mlock.c b/mm/mlock.c +index 41cc47e28ad6..0ab8250af1f8 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -636,11 +636,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, + * is also counted. + * Return value: previously mlocked page counts + */ +-static int count_mm_mlocked_page_nr(struct mm_struct *mm, ++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm, + unsigned long start, size_t len) + { + struct vm_area_struct *vma; +- int count = 0; ++ unsigned long count = 0; + + if (mm == NULL) + mm = current->mm; +-- +2.20.1 + diff --git a/queue-4.19/module-fix-livepatch-ftrace-module-text-permissions-.patch b/queue-4.19/module-fix-livepatch-ftrace-module-text-permissions-.patch new file mode 100644 index 00000000000..b7b01d52125 --- /dev/null +++ b/queue-4.19/module-fix-livepatch-ftrace-module-text-permissions-.patch @@ -0,0 +1,177 @@ +From 721881c264a84472b0fb8e6a7ad095bac366b520 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Thu, 13 Jun 2019 20:07:22 -0500 +Subject: module: Fix livepatch/ftrace module text permissions race + +[ Upstream commit 9f255b632bf12c4dd7fc31caee89aa991ef75176 ] + +It's possible for livepatch and ftrace to be toggling a module's text +permissions at the same time, resulting in the following panic: + + BUG: unable to handle page fault for address: ffffffffc005b1d9 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0003) - permissions violation + PGD 3ea0c067 P4D 3ea0c067 PUD 3ea0e067 PMD 3cc13067 PTE 3b8a1061 + Oops: 0003 [#1] PREEMPT SMP PTI + CPU: 1 PID: 453 Comm: insmod Tainted: G O K 5.2.0-rc1-a188339ca5 #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014 + RIP: 0010:apply_relocate_add+0xbe/0x14c + Code: fa 0b 74 21 48 83 fa 18 74 38 48 83 fa 0a 75 40 eb 08 48 83 38 00 74 33 eb 53 83 38 00 75 4e 89 08 89 c8 eb 0a 83 38 00 75 43 <89> 08 48 63 c1 48 39 c8 74 2e eb 48 83 38 00 75 32 48 29 c1 89 08 + RSP: 0018:ffffb223c00dbb10 EFLAGS: 00010246 + RAX: ffffffffc005b1d9 RBX: 0000000000000000 RCX: ffffffff8b200060 + RDX: 000000000000000b RSI: 0000004b0000000b RDI: ffff96bdfcd33000 + RBP: ffffb223c00dbb38 R08: ffffffffc005d040 R09: ffffffffc005c1f0 + R10: ffff96bdfcd33c40 R11: ffff96bdfcd33b80 R12: 0000000000000018 + R13: ffffffffc005c1f0 R14: ffffffffc005e708 R15: ffffffff8b2fbc74 + FS: 00007f5f447beba8(0000) GS:ffff96bdff900000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffc005b1d9 CR3: 000000003cedc002 CR4: 0000000000360ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + klp_init_object_loaded+0x10f/0x219 + ? preempt_latency_start+0x21/0x57 + klp_enable_patch+0x662/0x809 + ? virt_to_head_page+0x3a/0x3c + ? kfree+0x8c/0x126 + patch_init+0x2ed/0x1000 [livepatch_test02] + ? 0xffffffffc0060000 + do_one_initcall+0x9f/0x1c5 + ? kmem_cache_alloc_trace+0xc4/0xd4 + ? do_init_module+0x27/0x210 + do_init_module+0x5f/0x210 + load_module+0x1c41/0x2290 + ? fsnotify_path+0x3b/0x42 + ? strstarts+0x2b/0x2b + ? kernel_read+0x58/0x65 + __do_sys_finit_module+0x9f/0xc3 + ? __do_sys_finit_module+0x9f/0xc3 + __x64_sys_finit_module+0x1a/0x1c + do_syscall_64+0x52/0x61 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The above panic occurs when loading two modules at the same time with +ftrace enabled, where at least one of the modules is a livepatch module: + +CPU0 CPU1 +klp_enable_patch() + klp_init_object_loaded() + module_disable_ro() + ftrace_module_enable() + ftrace_arch_code_modify_post_process() + set_all_modules_text_ro() + klp_write_object_relocations() + apply_relocate_add() + *patches read-only code* - BOOM + +A similar race exists when toggling ftrace while loading a livepatch +module. + +Fix it by ensuring that the livepatch and ftrace code patching +operations -- and their respective permissions changes -- are protected +by the text_mutex. + +Link: http://lkml.kernel.org/r/ab43d56ab909469ac5d2520c5d944ad6d4abd476.1560474114.git.jpoimboe@redhat.com + +Reported-by: Johannes Erdfelt +Fixes: 444d13ff10fb ("modules: add ro_after_init support") +Acked-by: Jessica Yu +Reviewed-by: Petr Mladek +Reviewed-by: Miroslav Benes +Signed-off-by: Josh Poimboeuf +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/livepatch/core.c | 6 ++++++ + kernel/trace/ftrace.c | 10 +++++++++- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c +index 5b77a7314e01..722c27c40e5b 100644 +--- a/kernel/livepatch/core.c ++++ b/kernel/livepatch/core.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + #include "core.h" + #include "patch.h" +@@ -708,16 +709,21 @@ static int klp_init_object_loaded(struct klp_patch *patch, + struct klp_func *func; + int ret; + ++ mutex_lock(&text_mutex); ++ + module_disable_ro(patch->mod); + ret = klp_write_object_relocations(patch->mod, obj); + if (ret) { + module_enable_ro(patch->mod, true); ++ mutex_unlock(&text_mutex); + return ret; + } + + arch_klp_init_object_loaded(patch, obj); + module_enable_ro(patch->mod, true); + ++ mutex_unlock(&text_mutex); ++ + klp_for_each_func(obj, func) { + ret = klp_find_object_symbol(obj->name, func->old_name, + func->old_sympos, +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 90348b343460..50ba14591996 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2627,10 +2628,12 @@ static void ftrace_run_update_code(int command) + { + int ret; + ++ mutex_lock(&text_mutex); ++ + ret = ftrace_arch_code_modify_prepare(); + FTRACE_WARN_ON(ret); + if (ret) +- return; ++ goto out_unlock; + + /* + * By default we use stop_machine() to modify the code. +@@ -2642,6 +2645,9 @@ static void ftrace_run_update_code(int command) + + ret = ftrace_arch_code_modify_post_process(); + FTRACE_WARN_ON(ret); ++ ++out_unlock: ++ mutex_unlock(&text_mutex); + } + + static void ftrace_run_modify_code(struct ftrace_ops *ops, int command, +@@ -5762,6 +5768,7 @@ void ftrace_module_enable(struct module *mod) + struct ftrace_page *pg; + + mutex_lock(&ftrace_lock); ++ mutex_lock(&text_mutex); + + if (ftrace_disabled) + goto out_unlock; +@@ -5823,6 +5830,7 @@ void ftrace_module_enable(struct module *mod) + ftrace_arch_code_modify_post_process(); + + out_unlock: ++ mutex_unlock(&text_mutex); + mutex_unlock(&ftrace_lock); + + process_cached_mods(mod->name); +-- +2.20.1 + diff --git a/queue-4.19/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch b/queue-4.19/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch new file mode 100644 index 00000000000..b8c10ffead1 --- /dev/null +++ b/queue-4.19/platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch @@ -0,0 +1,92 @@ +From bf75622a878117be68dee6de7dffca7a636737da Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Thu, 23 May 2019 16:41:52 +0000 +Subject: platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove + flow + +[ Upstream commit 8c2eb7b6468ad4aa5600aed01aa0715f921a3f8b ] + +Add devm_free_irq() call to mlxreg-hotplug remove() for clean release +of devices irq resource. Fix debugobjects warning triggered by rmmod +It prevents of use-after-free memory, related to +mlxreg_hotplug_work_handler. + +Issue has been reported as debugobjects warning triggered by +'rmmod mlxtreg-hotplug' flow, while running kernel with +CONFIG_DEBUG_OBJECTS* options. + +[ 2489.623551] ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler+0x0/0x7f0 [mlxreg_hotplug] +[ 2489.637097] WARNING: CPU: 5 PID: 3924 at lib/debugobjects.c:328 debug_print_object+0xfe/0x180 +[ 2489.637165] RIP: 0010:debug_print_object+0xfe/0x180 +? +[ 2489.637214] Call Trace: +[ 2489.637225] __debug_check_no_obj_freed+0x25e/0x320 +[ 2489.637231] kfree+0x82/0x110 +[ 2489.637238] release_nodes+0x33c/0x4e0 +[ 2489.637242] ? devres_remove_group+0x1b0/0x1b0 +[ 2489.637247] device_release_driver_internal+0x146/0x270 +[ 2489.637251] driver_detach+0x73/0xe0 +[ 2489.637254] bus_remove_driver+0xa1/0x170 +[ 2489.637261] __x64_sys_delete_module+0x29e/0x320 +[ 2489.637265] ? __ia32_sys_delete_module+0x320/0x320 +[ 2489.637268] ? blkcg_exit_queue+0x20/0x20 +[ 2489.637273] ? task_work_run+0x7d/0x100 +[ 2489.637278] ? exit_to_usermode_loop+0x5b/0xf0 +[ 2489.637281] do_syscall_64+0x73/0x160 +[ 2489.637287] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 2489.637290] RIP: 0033:0x7f95c3596fd7 + +The difference in release flow with and with no devm_free_irq is listed +below: + +bus: 'platform': remove driver mlxreg-hotplug + mlxreg_hotplug_remove(start) + -> devm_free_irq (with new code) + mlxreg_hotplug_remove (end) + release_nodes (start) + mlxreg-hotplug: DEVRES REL devm_hwmon_release (8 bytes) + device: 'hwmon3': device_unregister + PM: Removing info for No Bus:hwmon3 + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (88 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (6 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes) + mlxreg-hotplug: DEVRES REL devm_irq_release (16 bytes) (no new code) + mlxreg-hotplug: DEVRES REL devm_kzalloc_release (1376 bytes) + ------------[ cut here ]------------ (no new code): + ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler + + release_nodes(end) +driver: 'mlxreg-hotplug': driver_release + +Fixes: 1f976f6978bf ("platform/x86: Move Mellanox platform hotplug driver to platform/mellanox") +Signed-off-by: Vadim Pasternak +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxreg-hotplug.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c +index eca16d00e310..d52c821b8584 100644 +--- a/drivers/platform/mellanox/mlxreg-hotplug.c ++++ b/drivers/platform/mellanox/mlxreg-hotplug.c +@@ -673,6 +673,7 @@ static int mlxreg_hotplug_remove(struct platform_device *pdev) + + /* Clean interrupts setup. */ + mlxreg_hotplug_unset_irq(priv); ++ devm_free_irq(&pdev->dev, priv->irq, priv); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch b/queue-4.19/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch new file mode 100644 index 00000000000..c9e6a6bc26a --- /dev/null +++ b/queue-4.19/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch @@ -0,0 +1,110 @@ +From dac8986aa553f267d1730fa5da5d70776263203d Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 12 Jun 2019 09:02:02 +0200 +Subject: platform/x86: asus-wmi: Only Tell EC the OS will handle display + hotkeys from asus_nb_wmi +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 401fee8195d401b2b94dee57383f627050724d5b ] + +Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will +handle the display off hotkey") causes the backlight to be permanently off +on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC +1015BX, Asus EeePC 1025C). + +The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added +by that commit is made conditional in this commit and only enabled in +the quirk_entry structs in the asus-nb-wmi driver fixing the broken +display / backlight on various EeePC laptop models. + +Cc: João Paulo Rechi Vita +Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey") +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++ + drivers/platform/x86/asus-wmi.c | 2 +- + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index b6f2ff95c3ed..59f3a37a44d7 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str, + + static struct quirk_entry quirk_asus_unknown = { + .wapf = 0, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_q500a = { + .i8042_filter = asus_q500a_i8042_filter, ++ .wmi_backlight_set_devstate = true, + }; + + /* +@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = { + static struct quirk_entry quirk_asus_x55u = { + .wapf = 4, + .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, + .no_display_toggle = true, + }; + + static struct quirk_entry quirk_asus_wapf4 = { + .wapf = 4, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x200ca = { + .wapf = 2, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_ux303ub = { + .wmi_backlight_native = true, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x550lb = { ++ .wmi_backlight_set_devstate = true, + .xusb2pr = 0x01D9, + }; + + static struct quirk_entry quirk_asus_forceals = { ++ .wmi_backlight_set_devstate = true, + .wmi_force_als_set = true, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index db3556dc90d1..22eac449d3a3 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2231,7 +2231,7 @@ static int asus_wmi_add(struct platform_device *pdev) + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) + goto fail_backlight; +- } else ++ } else if (asus->driver->quirks->wmi_backlight_set_devstate) + err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL); + + status = wmi_install_notify_handler(asus->driver->event_guid, +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 6c1311f4b04d..57a79bddb286 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -44,6 +44,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_power; + bool wmi_backlight_native; ++ bool wmi_backlight_set_devstate; + bool wmi_force_als_set; + int wapf; + /* +-- +2.20.1 + diff --git a/queue-4.19/platform-x86-intel-vbtn-report-switch-events-when-ev.patch b/queue-4.19/platform-x86-intel-vbtn-report-switch-events-when-ev.patch new file mode 100644 index 00000000000..b031bf9b17d --- /dev/null +++ b/queue-4.19/platform-x86-intel-vbtn-report-switch-events-when-ev.patch @@ -0,0 +1,62 @@ +From 37c991ad04d0c72f88492b094d970d115767b468 Mon Sep 17 00:00:00 2001 +From: Mathew King +Date: Mon, 20 May 2019 16:41:24 -0600 +Subject: platform/x86: intel-vbtn: Report switch events when event wakes + device + +[ Upstream commit cb1921b17adbe6509538098ac431033378cd7165 ] + +When a switch event, such as tablet mode/laptop mode or docked/undocked, +wakes a device make sure that the value of the swich is reported. +Without when a device is put in tablet mode from laptop mode when it is +suspended or vice versa the device will wake up but mode will be +incorrect. + +Tested by suspending a device in laptop mode and putting it in tablet +mode, the device resumes and is in tablet mode. When suspending the +device in tablet mode and putting it in laptop mode the device resumes +and is in laptop mode. + +Signed-off-by: Mathew King +Reviewed-by: Jett Rink +Reviewed-by: Mario Limonciello +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel-vbtn.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c +index 06cd7e818ed5..a0d0cecff55f 100644 +--- a/drivers/platform/x86/intel-vbtn.c ++++ b/drivers/platform/x86/intel-vbtn.c +@@ -76,12 +76,24 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + struct platform_device *device = context; + struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); + unsigned int val = !(event & 1); /* Even=press, Odd=release */ +- const struct key_entry *ke_rel; ++ const struct key_entry *ke, *ke_rel; + bool autorelease; + + if (priv->wakeup_mode) { +- if (sparse_keymap_entry_from_scancode(priv->input_dev, event)) { ++ ke = sparse_keymap_entry_from_scancode(priv->input_dev, event); ++ if (ke) { + pm_wakeup_hard_event(&device->dev); ++ ++ /* ++ * Switch events like tablet mode will wake the device ++ * and report the new switch position to the input ++ * subsystem. ++ */ ++ if (ke->type == KE_SW) ++ sparse_keymap_report_event(priv->input_dev, ++ event, ++ val, ++ 0); + return; + } + goto out_unknown; +-- +2.20.1 + diff --git a/queue-4.19/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch b/queue-4.19/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch new file mode 100644 index 00000000000..fffe1ea1b6c --- /dev/null +++ b/queue-4.19/platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch @@ -0,0 +1,159 @@ +From 5ba8ad11409d0e90ac6f1a4d37979004daccac4f Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Wed, 5 Jun 2019 07:51:03 +0000 +Subject: platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device + registration + +[ Upstream commit 160da20b254dd4bfc5828f12c208fa831ad4be6c ] + +Fix the issue found while running kernel with the option +CONFIG_DEBUG_TEST_DRIVER_REMOVE. +Driver 'mlx-platform' registers 'i2c_mlxcpld' device and then registers +few underlying 'i2c-mux-reg' devices: + priv->pdev_i2c = platform_device_register_simple("i2c_mlxcpld", nr, + NULL, 0); + ... + for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) { + priv->pdev_mux[i] = platform_device_register_resndata( + &mlxplat_dev->dev, + "i2c-mux-reg", i, NULL, + 0, &mlxplat_mux_data[i], + sizeof(mlxplat_mux_data[i])); + +But actual parent of "i2c-mux-reg" device is priv->pdev_i2c->dev and +not mlxplat_dev->dev. +Patch fixes parent device parameter in a call to +platform_device_register_resndata() for "i2c-mux-reg". + +It solves the race during initialization flow while 'i2c_mlxcpld.1' is +removing after probe, while 'i2c-mux-reg.0' is still in probing flow: +'i2c_mlxcpld.1' flow: probe -> remove -> probe. +'i2c-mux-reg.0' flow: probe -> ... + +[ 12:621096] Registering platform device 'i2c_mlxcpld.1'. Parent at platform +[ 12:621117] device: 'i2c_mlxcpld.1': device_add +[ 12:621155] bus: 'platform': add device i2c_mlxcpld.1 +[ 12:621384] Registering platform device 'i2c-mux-reg.0'. Parent at mlxplat +[ 12:621395] device: 'i2c-mux-reg.0': device_add +[ 12:621425] bus: 'platform': add device i2c-mux-reg.0 +[ 12:621806] Registering platform device 'i2c-mux-reg.1'. Parent at mlxplat +[ 12:621828] device: 'i2c-mux-reg.1': device_add +[ 12:621892] bus: 'platform': add device i2c-mux-reg.1 +[ 12:621906] bus: 'platform': add driver i2c_mlxcpld +[ 12:621996] bus: 'platform': driver_probe_device: matched device i2c_mlxcpld.1 with driver i2c_mlxcpld +[ 12:622003] bus: 'platform': really_probe: probing driver i2c_mlxcpld with device i2c_mlxcpld.1 +[ 12:622100] i2c_mlxcpld i2c_mlxcpld.1: no default pinctrl state +[ 12:622293] device: 'i2c-1': device_add +[ 12:627280] bus: 'i2c': add device i2c-1 +[ 12:627692] device: 'i2c-1': device_add +[ 12.629639] bus: 'platform': add driver i2c-mux-reg +[ 12.629718] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.629723] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.629818] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.629981] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral +[ 12.629986] platform i2c-mux-reg.0: Added to deferred list +[ 12.629992] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg +[ 12.629997] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1 +[ 12.630091] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state +[ 12.630247] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral +[ 12.630252] platform i2c-mux-reg.1: Added to deferred list +[ 12.640892] devices_kset: Moving i2c-mux-reg.0 to end of list +[ 12.640900] platform i2c-mux-reg.0: Retrying from deferred list +[ 12.640911] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.640919] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.640999] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.641177] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral +[ 12.641187] platform i2c-mux-reg.0: Added to deferred list +[ 12.641198] devices_kset: Moving i2c-mux-reg.1 to end of list +[ 12.641219] platform i2c-mux-reg.1: Retrying from deferred list +[ 12.641237] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg +[ 12.641247] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1 +[ 12.641331] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state +[ 12.641465] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral +[ 12.641469] platform i2c-mux-reg.1: Added to deferred list +[ 12.646427] device: 'i2c-1': device_add +[ 12.646647] bus: 'i2c': add device i2c-1 +[ 12.647104] device: 'i2c-1': device_add +[ 12.669231] devices_kset: Moving i2c-mux-reg.0 to end of list +[ 12.669240] platform i2c-mux-reg.0: Retrying from deferred list +[ 12.669258] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg +[ 12.669263] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0 +[ 12.669343] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state +[ 12.669585] device: 'i2c-2': device_add +[ 12.669795] bus: 'i2c': add device i2c-2 +[ 12.670201] device: 'i2c-2': device_add +[ 12.671427] i2c i2c-1: Added multiplexed i2c bus 2 +[ 12.671514] device: 'i2c-3': device_add +[ 12.671724] bus: 'i2c': add device i2c-3 +[ 12.672136] device: 'i2c-3': device_add +[ 12.673378] i2c i2c-1: Added multiplexed i2c bus 3 +[ 12.673472] device: 'i2c-4': device_add +[ 12.673676] bus: 'i2c': add device i2c-4 +[ 12.674060] device: 'i2c-4': device_add +[ 12.675861] i2c i2c-1: Added multiplexed i2c bus 4 +[ 12.675941] device: 'i2c-5': device_add +[ 12.676150] bus: 'i2c': add device i2c-5 +[ 12.676550] device: 'i2c-5': device_add +[ 12.678103] i2c i2c-1: Added multiplexed i2c bus 5 +[ 12.678193] device: 'i2c-6': device_add +[ 12.678395] bus: 'i2c': add device i2c-6 +[ 12.678774] device: 'i2c-6': device_add +[ 12.679969] i2c i2c-1: Added multiplexed i2c bus 6 +[ 12.680065] device: 'i2c-7': device_add +[ 12.680275] bus: 'i2c': add device i2c-7 +[ 12.680913] device: 'i2c-7': device_add +[ 12.682506] i2c i2c-1: Added multiplexed i2c bus 7 +[ 12.682600] device: 'i2c-8': device_add +[ 12.682808] bus: 'i2c': add device i2c-8 +[ 12.683189] device: 'i2c-8': device_add +[ 12.683907] device: 'i2c-1': device_unregister +[ 12.683945] device: 'i2c-1': device_unregister +[ 12.684387] device: 'i2c-1': device_create_release +[ 12.684536] bus: 'i2c': remove device i2c-1 +[ 12.686019] i2c i2c-8: Failed to create compatibility class link +[ 12.686086] ------------[ cut here ]------------ +[ 12.686087] can't create symlink to mux device +[ 12.686224] Workqueue: events deferred_probe_work_func +[ 12.686135] WARNING: CPU: 7 PID: 436 at drivers/i2c/i2c-mux.c:416 i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux] +[ 12.686232] RIP: 0010:i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux] +[ 0x190/0x190 [i2c_mux] +[ 12.686300] ? i2c_mux_alloc+0xac/0x110 [i2c_mux] +[ 12.686306] ? i2c_mux_reg_set+0x200/0x200 [i2c_mux_reg] +[ 12.686313] i2c_mux_reg_probe+0x22c/0x731 [i2c_mux_reg] +[ 12.686322] ? i2c_mux_reg_deselect+0x60/0x60 [i2c_mux_reg] +[ 12.686346] platform_drv_probe+0xa8/0x110 +[ 12.686351] really_probe+0x185/0x720 +[ 12.686358] driver_probe_device+0xdf/0x1f0 +... +[ 12.686522] i2c i2c-1: Added multiplexed i2c bus 8 +[ 12.686621] device: 'i2c-9': device_add +[ 12.686626] kobject_add_internal failed for i2c-9 (error: -2 parent: i2c-1) +[ 12.694729] i2c-core: adapter 'i2c-1-mux (chan_id 8)': can't register device (-2) +[ 12.705726] i2c i2c-1: failed to add mux-adapter 8 as bus 9 (error=-2) +[ 12.714494] device: 'i2c-8': device_unregister +[ 12.714537] device: 'i2c-8': device_unregister + +Fixes: 6613d18e9038 ("platform/x86: mlx-platform: Move module from arch/x86") +Signed-off-by: Vadim Pasternak +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index 78b4aa4410fb..742a0c217925 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -1626,7 +1626,7 @@ static int __init mlxplat_init(void) + + for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) { + priv->pdev_mux[i] = platform_device_register_resndata( +- &mlxplat_dev->dev, ++ &priv->pdev_i2c->dev, + "i2c-mux-reg", i, NULL, + 0, &mlxplat_mux_data[i], + sizeof(mlxplat_mux_data[i])); +-- +2.20.1 + diff --git a/queue-4.19/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch b/queue-4.19/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch new file mode 100644 index 00000000000..1e26112520d --- /dev/null +++ b/queue-4.19/scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch @@ -0,0 +1,48 @@ +From 1e6797fcea5bb9aa97ea08f5d1fbf2899b8b6b42 Mon Sep 17 00:00:00 2001 +From: Manuel Traut +Date: Thu, 13 Jun 2019 15:55:52 -0700 +Subject: scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE + +[ Upstream commit c04e32e911653442fc834be6e92e072aeebe01a1 ] + +At least for ARM64 kernels compiled with the crosstoolchain from +Debian/stretch or with the toolchain from kernel.org the line number is +not decoded correctly by 'decode_stacktrace.sh': + + $ echo "[ 136.513051] f1+0x0/0xc [kcrash]" | \ + CROSS_COMPILE=/opt/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- \ + ./scripts/decode_stacktrace.sh /scratch/linux-arm64/vmlinux \ + /scratch/linux-arm64 \ + /nfs/debian/lib/modules/4.20.0-devel + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:68) kcrash + +If addr2line from the toolchain is used the decoded line number is correct: + + [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:57) kcrash + +Link: http://lkml.kernel.org/r/20190527083425.3763-1-manut@linutronix.de +Signed-off-by: Manuel Traut +Acked-by: Konstantin Khlebnikov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 98a7d63a723e..c4a9ddb174bc 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -66,7 +66,7 @@ parse_symbol() { + if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then + local code=${cache[$module,$address]} + else +- local code=$(addr2line -i -e "$objfile" "$address") ++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address") + cache[$module,$address]=$code + fi + +-- +2.20.1 + diff --git a/queue-4.19/scsi-hpsa-correct-ioaccel2-chaining.patch b/queue-4.19/scsi-hpsa-correct-ioaccel2-chaining.patch new file mode 100644 index 00000000000..1773eacaf63 --- /dev/null +++ b/queue-4.19/scsi-hpsa-correct-ioaccel2-chaining.patch @@ -0,0 +1,64 @@ +From 22dac35b6a68e25858ea8fd5ab3e902e8160ca4a Mon Sep 17 00:00:00 2001 +From: Don Brace +Date: Mon, 3 Jun 2019 16:43:29 -0500 +Subject: scsi: hpsa: correct ioaccel2 chaining + +[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ] + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for + the last s/g element. + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when + chaining. + +Reviewed-by: Bader Ali - Saleh +Reviewed-by: Scott Teel +Reviewed-by: Matt Perricone +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 7 ++++++- + drivers/scsi/hpsa_cmd.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index c120929d4ffe..c43eccdea65d 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4923,7 +4923,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg->reserved[0] = 0; + curr_sg->reserved[1] = 0; + curr_sg->reserved[2] = 0; +- curr_sg->chain_indicator = 0x80; ++ curr_sg->chain_indicator = IOACCEL2_CHAIN; + + curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; + } +@@ -4940,6 +4940,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg++; + } + ++ /* ++ * Set the last s/g element bit ++ */ ++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; ++ + switch (cmd->sc_data_direction) { + case DMA_TO_DEVICE: + cp->direction &= ~IOACCEL2_DIRECTION_MASK; +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index 21a726e2eec6..f6afca4b2319 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -517,6 +517,7 @@ struct ioaccel2_sg_element { + u8 reserved[3]; + u8 chain_indicator; + #define IOACCEL2_CHAIN 0x80 ++#define IOACCEL2_LAST_SG 0x40 + }; + + /* +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 1aed859a2ee..c4fc0e41d66 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -5,3 +5,35 @@ netfilter-nf_flow_table-ignore-df-bit-setting.patch netfilter-nft_flow_offload-set-liberal-tracking-mode-for-tcp.patch netfilter-nft_flow_offload-don-t-offload-when-sequence-numbers-need-adjustment.patch netfilter-nft_flow_offload-ipcb-is-only-valid-for-ipv4-family.patch +asoc-cs4265-readable-register-too-low.patch +asoc-ak4458-add-return-value-for-ak4458_probe.patch +asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch +asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch +spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch +drm-mediatek-fix-unbind-functions.patch +drm-mediatek-unbind-components-in-mtk_drm_unbind.patch +drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch +drm-mediatek-clear-num_pipes-when-unbind-driver.patch +drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch +asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch +asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch +asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch +x86-cpu-add-more-icelake-model-numbers.patch +usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch +usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch +alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch +soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch +scsi-hpsa-correct-ioaccel2-chaining.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch +platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch +platform-x86-intel-vbtn-report-switch-events-when-ev.patch +platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch +platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch +i2c-pca-platform-fix-gpio-lookup-code.patch +cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch +scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch +mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch +tracing-avoid-build-warning-with-have_nop_mcount.patch +module-fix-livepatch-ftrace-module-text-permissions-.patch +ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch diff --git a/queue-4.19/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch b/queue-4.19/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch new file mode 100644 index 00000000000..dcf44c08e62 --- /dev/null +++ b/queue-4.19/soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch @@ -0,0 +1,57 @@ +From 384c54bf4d506cbff3dcfb1255eab3d208f14398 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Wed, 5 Jun 2019 15:45:52 +0200 +Subject: SoC: rt274: Fix internal jack assignment in set_jack callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 04268bf2757a125616b6c2140e6250f43b7b737a ] + +When we call snd_soc_component_set_jack(component, NULL, NULL) we should +set rt274->jack to passed jack, so when interrupt is triggered it calls +snd_soc_jack_report(rt274->jack, ...) with proper value. + +This fixes problem in machine where in register, we call +snd_soc_register(component, &headset, NULL), which just calls +rt274_mic_detect via callback. +Now when machine driver is removed "headset" will be gone, so we +need to tell codec driver that it's gone with: +snd_soc_register(component, NULL, NULL), but we also need to be able +to handle NULL jack argument here gracefully. +If we don't set it to NULL, next time the rt274_irq runs it will call +snd_soc_jack_report with first argument being invalid pointer and there +will be Oops. + +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt274.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c +index 18a931c25ca5..f09f2d87ac60 100644 +--- a/sound/soc/codecs/rt274.c ++++ b/sound/soc/codecs/rt274.c +@@ -398,6 +398,8 @@ static int rt274_mic_detect(struct snd_soc_component *component, + { + struct rt274_priv *rt274 = snd_soc_component_get_drvdata(component); + ++ rt274->jack = jack; ++ + if (jack == NULL) { + /* Disable jack detection */ + regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL, +@@ -405,7 +407,6 @@ static int rt274_mic_detect(struct snd_soc_component *component, + + return 0; + } +- rt274->jack = jack; + + regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL, + RT274_IRQ_EN, RT274_IRQ_EN); +-- +2.20.1 + diff --git a/queue-4.19/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch b/queue-4.19/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch new file mode 100644 index 00000000000..f9d24c15269 --- /dev/null +++ b/queue-4.19/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch @@ -0,0 +1,86 @@ +From 07fe48aad3444f269ec07f05902b9cdf67efbba5 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 16 May 2019 15:56:56 +0800 +Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master + +[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ] + +If spi_register_master fails in spi_bitbang_start +because device_add failure, We should return the +error code other than 0, otherwise calling +spi_bitbang_stop may trigger NULL pointer dereference +like this: + +BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0 +Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661 + +CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +Call Trace: + dump_stack+0xa9/0x10e + ? __list_del_entry_valid+0x45/0xd0 + ? __list_del_entry_valid+0x45/0xd0 + __kasan_report+0x171/0x18d + ? __list_del_entry_valid+0x45/0xd0 + kasan_report+0xe/0x20 + __list_del_entry_valid+0x45/0xd0 + spi_unregister_controller+0x99/0x1b0 + spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp] + ? 0xffffffffc1128000 + ? klist_next+0x131/0x1e0 + ? driver_detach+0x40/0x40 [parport] + port_check+0x3b/0x50 [parport] + bus_for_each_dev+0x115/0x180 + ? subsys_dev_iter_exit+0x20/0x20 + __parport_register_driver+0x1f0/0x210 [parport] + ? 0xffffffffc1150000 + do_one_initcall+0xb9/0x3b5 + ? perf_trace_initcall_level+0x270/0x270 + ? kasan_unpoison_shadow+0x30/0x40 + ? kasan_unpoison_shadow+0x30/0x40 + do_init_module+0xe0/0x330 + load_module+0x38eb/0x4270 + ? module_frob_arch_sections+0x20/0x20 + ? kernel_read_file+0x188/0x3f0 + ? find_held_lock+0x6d/0xd0 + ? fput_many+0x1a/0xe0 + ? __do_sys_finit_module+0x162/0x190 + __do_sys_finit_module+0x162/0x190 + ? __ia32_sys_init_module+0x40/0x40 + ? __mutex_unlock_slowpath+0xb4/0x3f0 + ? wait_for_completion+0x240/0x240 + ? vfs_write+0x160/0x2a0 + ? lockdep_hardirqs_off+0xb5/0x100 + ? mark_held_locks+0x1a/0x90 + ? do_syscall_64+0x14/0x2a0 + do_syscall_64+0x72/0x2a0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: Hulk Robot +Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master") +Signed-off-by: YueHaibing +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Axel Lin +Reviewed-by: Mukesh Ojha +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index f29176000b8d..06cf9388e74f 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -416,7 +416,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) + if (ret) + spi_master_put(master); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(spi_bitbang_start); + +-- +2.20.1 + diff --git a/queue-4.19/tracing-avoid-build-warning-with-have_nop_mcount.patch b/queue-4.19/tracing-avoid-build-warning-with-have_nop_mcount.patch new file mode 100644 index 00000000000..863b17848e8 --- /dev/null +++ b/queue-4.19/tracing-avoid-build-warning-with-have_nop_mcount.patch @@ -0,0 +1,52 @@ +From ed283b86301e1d32697e6156b5d3a0a8c0e12e39 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Wed, 5 Jun 2019 13:11:58 +0200 +Subject: tracing: avoid build warning with HAVE_NOP_MCOUNT +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit cbdaeaf050b730ea02e9ab4ff844ce54d85dbe1d ] + +Selecting HAVE_NOP_MCOUNT enables -mnop-mcount (if gcc supports it) +and sets CC_USING_NOP_MCOUNT. Reuse __is_defined (which is suitable for +testing CC_USING_* defines) to avoid conditional compilation and fix +the following gcc 9 warning on s390: + +kernel/trace/ftrace.c:2514:1: warning: ‘ftrace_code_disable’ defined +but not used [-Wunused-function] + +Link: http://lkml.kernel.org/r/patch.git-1a82d13f33ac.your-ad-here.call-01559732716-ext-6629@work.hours + +Fixes: 2f4df0017baed ("tracing: Add -mcount-nop option support") +Signed-off-by: Vasily Gorbik +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 1688782f3dfb..90348b343460 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -2952,14 +2952,13 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs) + p = &pg->records[i]; + p->flags = rec_flags; + +-#ifndef CC_USING_NOP_MCOUNT + /* + * Do the initial record conversion from mcount jump + * to the NOP instructions. + */ +- if (!ftrace_code_disable(mod, p)) ++ if (!__is_defined(CC_USING_NOP_MCOUNT) && ++ !ftrace_code_disable(mod, p)) + break; +-#endif + + update_cnt++; + } +-- +2.20.1 + diff --git a/queue-4.19/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch b/queue-4.19/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch new file mode 100644 index 00000000000..4a270291848 --- /dev/null +++ b/queue-4.19/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch @@ -0,0 +1,51 @@ +From 5a08c38db16134a9f050db4fb527bae3834047a5 Mon Sep 17 00:00:00 2001 +From: Young Xiao <92siuyang@gmail.com> +Date: Tue, 28 May 2019 20:17:54 +0800 +Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] + +[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ] + +There is no deallocation of fusb300->ep[i] elements, allocated at +fusb300_probe. + +The patch adds deallocation of fusb300->ep array elements. + +Signed-off-by: Young Xiao <92siuyang@gmail.com> +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 263804d154a7..00e3f66836a9 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { + static int fusb300_remove(struct platform_device *pdev) + { + struct fusb300 *fusb300 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + + return 0; +@@ -1491,6 +1494,8 @@ clean_up: + if (fusb300->ep0_req) + fusb300_free_request(&fusb300->ep[0]->ep, + fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + } + if (reg) +-- +2.20.1 + diff --git a/queue-4.19/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch b/queue-4.19/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch new file mode 100644 index 00000000000..8b276486e04 --- /dev/null +++ b/queue-4.19/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch @@ -0,0 +1,39 @@ +From 664f5cf065a75cf1e1b8bad5872f67efda8e709c Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Wed, 22 May 2019 14:07:36 +0200 +Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC + +[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ] + +Gadget drivers may queue request in interrupt context. This would lead to +a descriptor allocation in that context. In that case we would hit +BUG_ON(in_interrupt()) in __get_vm_area_node. + +Also remove the unnecessary cast. + +Acked-by: Sylvain Lemieux +Tested-by: James Grant +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index b0781771704e..eafc2a00c96a 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -922,8 +922,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) + dma_addr_t dma; + struct lpc32xx_usbd_dd_gad *dd; + +- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( +- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); ++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); + if (dd) + dd->this_dma = dma; + +-- +2.20.1 + diff --git a/queue-4.19/x86-cpu-add-more-icelake-model-numbers.patch b/queue-4.19/x86-cpu-add-more-icelake-model-numbers.patch new file mode 100644 index 00000000000..34790428f9c --- /dev/null +++ b/queue-4.19/x86-cpu-add-more-icelake-model-numbers.patch @@ -0,0 +1,47 @@ +From ef8e0be5150d2505eb9fb8d469970c786b8e419b Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Mon, 3 Jun 2019 06:41:20 -0700 +Subject: x86/CPU: Add more Icelake model numbers + +[ Upstream commit e35faeb64146f2015f2aec14b358ae508e4066db ] + +Add the CPUID model numbers of Icelake (ICL) desktop and server +processors to the Intel family list. + + [ Qiuxu: Sort the macros by model number. ] + +Signed-off-by: Kan Liang +Signed-off-by: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: Andy Shevchenko +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: Qiuxu Zhuo +Cc: Rajneesh Bhardwaj +Cc: rui.zhang@intel.com +Cc: Thomas Gleixner +Cc: Tony Luck +Cc: x86-ml +Link: https://lkml.kernel.org/r/20190603134122.13853-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/intel-family.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 058b1a1994c4..2e38fb82b91d 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -52,6 +52,9 @@ + + #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66 + ++#define INTEL_FAM6_ICELAKE_X 0x6A ++#define INTEL_FAM6_ICELAKE_XEON_D 0x6C ++#define INTEL_FAM6_ICELAKE_DESKTOP 0x7D + #define INTEL_FAM6_ICELAKE_MOBILE 0x7E + + /* "Small Core" Processors (Atom) */ +-- +2.20.1 +