From: Sasha Levin Date: Tue, 1 Oct 2019 17:13:38 +0000 (-0400) Subject: fixes for 4.19 X-Git-Tag: v4.4.195~63^2~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=921eb21f8405d65bf7b4399fe2839295b6545324;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-cppc-do-not-require-the-_psd-method.patch b/queue-4.19/acpi-cppc-do-not-require-the-_psd-method.patch new file mode 100644 index 00000000000..2c585fb76be --- /dev/null +++ b/queue-4.19/acpi-cppc-do-not-require-the-_psd-method.patch @@ -0,0 +1,55 @@ +From a58f7e1a3ba0e9efbe0feea59828773d4502dbb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 18:21:20 -0600 +Subject: ACPI / CPPC: do not require the _PSD method + +From: Al Stone + +[ Upstream commit 4c4cdc4c63853fee48c02e25c8605fb65a6c9924 ] + +According to the ACPI 6.3 specification, the _PSD method is optional +when using CPPC. The underlying assumption is that each CPU can change +frequency independently from all other CPUs; _PSD is provided to tell +the OS that some processors can NOT do that. + +However, the acpi_get_psd() function returns ENODEV if there is no _PSD +method present, or an ACPI error status if an error occurs when evaluating +_PSD, if present. This makes _PSD mandatory when using CPPC, in violation +of the specification, and only on Linux. + +This has forced some firmware writers to provide a dummy _PSD, even though +it is irrelevant, but only because Linux requires it; other OSPMs follow +the spec. We really do not want to have OS specific ACPI tables, though. + +So, correct acpi_get_psd() so that it does not return an error if there +is no _PSD method present, but does return a failure when the method can +not be executed properly. This allows _PSD to be optional as it should +be. + +Signed-off-by: Al Stone +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index d9ce4b162e2ce..a1aa59849b964 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -369,8 +369,10 @@ static int acpi_get_psd(struct cpc_desc *cpc_ptr, acpi_handle handle) + union acpi_object *psd = NULL; + struct acpi_psd_package *pdomain; + +- status = acpi_evaluate_object_typed(handle, "_PSD", NULL, &buffer, +- ACPI_TYPE_PACKAGE); ++ status = acpi_evaluate_object_typed(handle, "_PSD", NULL, ++ &buffer, ACPI_TYPE_PACKAGE); ++ if (status == AE_NOT_FOUND) /* _PSD is optional */ ++ return 0; + if (ACPI_FAILURE(status)) + return -ENODEV; + +-- +2.20.1 + diff --git a/queue-4.19/acpi-custom_method-fix-memory-leaks.patch b/queue-4.19/acpi-custom_method-fix-memory-leaks.patch new file mode 100644 index 00000000000..c611fb07c07 --- /dev/null +++ b/queue-4.19/acpi-custom_method-fix-memory-leaks.patch @@ -0,0 +1,48 @@ +From ccbdb9a9826ed148b925cf8f53d298583bec2b81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 00:08:27 -0500 +Subject: ACPI: custom_method: fix memory leaks + +From: Wenwen Wang + +[ Upstream commit 03d1571d9513369c17e6848476763ebbd10ec2cb ] + +In cm_write(), 'buf' is allocated through kzalloc(). In the following +execution, if an error occurs, 'buf' is not deallocated, leading to memory +leaks. To fix this issue, free 'buf' before returning the error. + +Fixes: 526b4af47f44 ("ACPI: Split out custom_method functionality into an own driver") +Signed-off-by: Wenwen Wang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/custom_method.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index e967c1173ba32..222ea3f12f41e 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -48,8 +48,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + if ((*ppos > max_size) || + (*ppos + count > max_size) || + (*ppos + count < count) || +- (count > uncopied_bytes)) ++ (count > uncopied_bytes)) { ++ kfree(buf); + return -EINVAL; ++ } + + if (copy_from_user(buf + (*ppos), user_buf, count)) { + kfree(buf); +@@ -69,6 +71,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); + } + ++ kfree(buf); + return count; + } + +-- +2.20.1 + diff --git a/queue-4.19/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch b/queue-4.19/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch new file mode 100644 index 00000000000..fae90622bf2 --- /dev/null +++ b/queue-4.19/acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch @@ -0,0 +1,41 @@ +From e7420dd2fe15efa9528894af4d8e53ae5b572e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 22:44:19 -0500 +Subject: ACPI / PCI: fix acpi_pci_irq_enable() memory leak + +From: Wenwen Wang + +[ Upstream commit 29b49958cf73b439b17fa29e9a25210809a6c01c ] + +In acpi_pci_irq_enable(), 'entry' is allocated by kzalloc() in +acpi_pci_irq_check_entry() (invoked from acpi_pci_irq_lookup()). However, +it is not deallocated if acpi_pci_irq_valid() returns false, leading to a +memory leak. To fix this issue, free 'entry' before returning 0. + +Fixes: e237a5518425 ("x86/ACPI/PCI: Recognize that Interrupt Line 255 means "not connected"") +Signed-off-by: Wenwen Wang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_irq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c +index c576a6fe4ebb3..94ded9513c73b 100644 +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -462,8 +462,10 @@ int acpi_pci_irq_enable(struct pci_dev *dev) + * No IRQ known to the ACPI subsystem - maybe the BIOS / + * driver reported one, then use it. Exit in any case. + */ +- if (!acpi_pci_irq_valid(dev, pin)) ++ if (!acpi_pci_irq_valid(dev, pin)) { ++ kfree(entry); + return 0; ++ } + + if (acpi_isa_register_gsi(dev)) + dev_warn(&dev->dev, "PCI INT %c: no GSI\n", +-- +2.20.1 + diff --git a/queue-4.19/acpi-processor-don-t-print-errors-for-processorids-0.patch b/queue-4.19/acpi-processor-don-t-print-errors-for-processorids-0.patch new file mode 100644 index 00000000000..9abe1e7334e --- /dev/null +++ b/queue-4.19/acpi-processor-don-t-print-errors-for-processorids-0.patch @@ -0,0 +1,68 @@ +From 4da53a947bd5cc37cc096bd5daf8b9d04cb840bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 13:10:37 +0200 +Subject: ACPI / processor: don't print errors for processorIDs == 0xff + +From: Jiri Slaby + +[ Upstream commit 2c2b005f549544c13ef4cfb0e4842949066889bc ] + +Some platforms define their processors in this manner: + Device (SCK0) + { + Name (_HID, "ACPI0004" /* Module Device */) // _HID: Hardware ID + Name (_UID, "CPUSCK0") // _UID: Unique ID + Processor (CP00, 0x00, 0x00000410, 0x06){} + Processor (CP01, 0x02, 0x00000410, 0x06){} + Processor (CP02, 0x04, 0x00000410, 0x06){} + Processor (CP03, 0x06, 0x00000410, 0x06){} + Processor (CP04, 0x01, 0x00000410, 0x06){} + Processor (CP05, 0x03, 0x00000410, 0x06){} + Processor (CP06, 0x05, 0x00000410, 0x06){} + Processor (CP07, 0x07, 0x00000410, 0x06){} + Processor (CP08, 0xFF, 0x00000410, 0x06){} + Processor (CP09, 0xFF, 0x00000410, 0x06){} + Processor (CP0A, 0xFF, 0x00000410, 0x06){} + Processor (CP0B, 0xFF, 0x00000410, 0x06){} +... + +The processors marked as 0xff are invalid, there are only 8 of them in +this case. + +So do not print an error on ids == 0xff, just print an info message. +Actually, we could return ENODEV even on the first CPU with ID 0xff, but +ACPI spec does not forbid the 0xff value to be a processor ID. Given +0xff could be a correct one, we would break working systems if we +returned ENODEV. + +Signed-off-by: Jiri Slaby +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_processor.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c +index fc447410ae4d1..a448cdf567188 100644 +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -282,9 +282,13 @@ static int acpi_processor_get_info(struct acpi_device *device) + } + + if (acpi_duplicate_processor_id(pr->acpi_id)) { +- dev_err(&device->dev, +- "Failed to get unique processor _UID (0x%x)\n", +- pr->acpi_id); ++ if (pr->acpi_id == 0xff) ++ dev_info_once(&device->dev, ++ "Entry not well-defined, consider updating BIOS\n"); ++ else ++ dev_err(&device->dev, ++ "Failed to get unique processor _UID (0x%x)\n", ++ pr->acpi_id); + return -ENODEV; + } + +-- +2.20.1 + diff --git a/queue-4.19/alsa-firewire-motu-add-support-for-motu-4pre.patch b/queue-4.19/alsa-firewire-motu-add-support-for-motu-4pre.patch new file mode 100644 index 00000000000..55c368f66b0 --- /dev/null +++ b/queue-4.19/alsa-firewire-motu-add-support-for-motu-4pre.patch @@ -0,0 +1,93 @@ +From edead15103961cc8f07181d8cc96c56829d5491e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 10:14:56 +0900 +Subject: ALSA: firewire-motu: add support for MOTU 4pre + +From: Takashi Sakamoto + +[ Upstream commit 6af86bdb8ad41f4cf1292d3b10857dc322758328 ] + +MOTU 4pre was launched in 2012 by MOTU, Inc. This commit allows userspace +applications can transmit and receive PCM frames and MIDI messages for +this model via ALSA PCM interface and RawMidi/Sequencer interfaces. + +The device supports MOTU protocol version 3. Unlike the other devices, the +device is simply designed. The size of data block is fixed to 10 quadlets +during available sampling rates (44.1 - 96.0 kHz). Each data block +includes 1 source packet header, 2 data chunks for messages, 8 data chunks +for PCM samples and 2 data chunks for padding to quadlet alignment. The +device has no MIDI, optical, BNC and AES/EBU interfaces. + +Like support for the other MOTU devices, the quality of playback sound +is not enough good with periodical noise yet. + +$ python2 crpp < ~/git/am-config-rom/motu/motu-4pre.img + ROM header and bus information block + ----------------------------------------------------------------- +400 041078cc bus_info_length 4, crc_length 16, crc 30924 +404 31333934 bus_name "1394" +408 20ff7000 irmc 0, cmc 0, isc 1, bmc 0, cyc_clk_acc 255, max_rec 7 (256) +40c 0001f200 company_id 0001f2 | +410 000a41c5 device_id 00000a41c5 | EUI-64 0001f200000a41c5 + + root directory + ----------------------------------------------------------------- +414 0004ef04 directory_length 4, crc 61188 +418 030001f2 vendor +41c 0c0083c0 node capabilities per IEEE 1394 +420 d1000002 --> unit directory at 428 +424 8d000005 --> eui-64 leaf at 438 + + unit directory at 428 + ----------------------------------------------------------------- +428 0003ceda directory_length 3, crc 52954 +42c 120001f2 specifier id +430 13000045 version +434 17103800 model + + eui-64 leaf at 438 + ----------------------------------------------------------------- +438 0002d248 leaf_length 2, crc 53832 +43c 0001f200 company_id 0001f2 | +440 000a41c5 device_id 00000a41c5 | EUI-64 0001f200000a41c5 + +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/motu/motu.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c +index 743015e87a960..e240fdfcae31d 100644 +--- a/sound/firewire/motu/motu.c ++++ b/sound/firewire/motu/motu.c +@@ -255,6 +255,17 @@ static const struct snd_motu_spec motu_audio_express = { + .analog_out_ports = 4, + }; + ++static const struct snd_motu_spec motu_4pre = { ++ .name = "4pre", ++ .protocol = &snd_motu_protocol_v3, ++ .flags = SND_MOTU_SPEC_SUPPORT_CLOCK_X2 | ++ SND_MOTU_SPEC_TX_MICINST_CHUNK | ++ SND_MOTU_SPEC_TX_RETURN_CHUNK | ++ SND_MOTU_SPEC_RX_SEPARETED_MAIN, ++ .analog_in_ports = 2, ++ .analog_out_ports = 2, ++}; ++ + #define SND_MOTU_DEV_ENTRY(model, data) \ + { \ + .match_flags = IEEE1394_MATCH_VENDOR_ID | \ +@@ -272,6 +283,7 @@ static const struct ieee1394_device_id motu_id_table[] = { + SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */ + SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */ + SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express), ++ SND_MOTU_DEV_ENTRY(0x000045, &motu_4pre), + { } + }; + MODULE_DEVICE_TABLE(ieee1394, motu_id_table); +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-drop-unsol-event-handler-for-intel-hdmi-cod.patch b/queue-4.19/alsa-hda-drop-unsol-event-handler-for-intel-hdmi-cod.patch new file mode 100644 index 00000000000..9806ff62c90 --- /dev/null +++ b/queue-4.19/alsa-hda-drop-unsol-event-handler-for-intel-hdmi-cod.patch @@ -0,0 +1,51 @@ +From 5892563156925076b17b27811a16735842fb4643 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2019 17:11:28 +0200 +Subject: ALSA: hda - Drop unsol event handler for Intel HDMI codecs + +From: Takashi Iwai + +[ Upstream commit f2dbe87c5ac1f88e6007ba1f1374f4bd8a197fb6 ] + +We don't need to deal with the unsol events for Intel chips that are +tied with the graphics via audio component notifier. Although the +presence of the audio component is checked at the beginning of +hdmi_unsol_event(), better to short cut by dropping unsol_event ops. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204565 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_hdmi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index e4fbfb5557ab7..107ec7f3e2214 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2583,6 +2583,8 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec, + /* precondition and allocation for Intel codecs */ + static int alloc_intel_hdmi(struct hda_codec *codec) + { ++ int err; ++ + /* requires i915 binding */ + if (!codec->bus->core.audio_component) { + codec_info(codec, "No i915 binding for Intel HDMI/DP codec\n"); +@@ -2591,7 +2593,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec) + return -ENODEV; + } + +- return alloc_generic_hdmi(codec); ++ err = alloc_generic_hdmi(codec); ++ if (err < 0) ++ return err; ++ /* no need to handle unsol events */ ++ codec->patch_ops.unsol_event = NULL; ++ return 0; + } + + /* parse and post-process for Intel codecs */ +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-flush-interrupts-on-disabling.patch b/queue-4.19/alsa-hda-flush-interrupts-on-disabling.patch new file mode 100644 index 00000000000..f482498c803 --- /dev/null +++ b/queue-4.19/alsa-hda-flush-interrupts-on-disabling.patch @@ -0,0 +1,77 @@ +From 0bbb7cc480be87d3c88f05ce57e9608ba7351c7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jul 2019 12:33:37 +0100 +Subject: ALSA: hda: Flush interrupts on disabling + +From: Chris Wilson + +[ Upstream commit caa8422d01e983782548648e125fd617cadcec3f ] + +I was looking at + +<4> [241.835158] general protection fault: 0000 [#1] PREEMPT SMP PTI +<4> [241.835181] CPU: 1 PID: 214 Comm: kworker/1:3 Tainted: G U 5.2.0-CI-CI_DRM_6509+ #1 +<4> [241.835199] Hardware name: Dell Inc. OptiPlex 745 /0GW726, BIOS 2.3.1 05/21/2007 +<4> [241.835234] Workqueue: events snd_hdac_bus_process_unsol_events [snd_hda_core] +<4> [241.835256] RIP: 0010:input_handle_event+0x16d/0x5e0 +<4> [241.835270] Code: 48 8b 93 58 01 00 00 8b 52 08 89 50 04 8b 83 f8 06 00 00 48 8b 93 00 07 00 00 8d 70 01 48 8d 04 c2 83 e1 08 89 b3 f8 06 00 00 <66> 89 28 66 44 89 60 02 44 89 68 04 8b 93 f8 06 00 00 0f 84 fd fe +<4> [241.835304] RSP: 0018:ffffc9000019fda0 EFLAGS: 00010046 +<4> [241.835317] RAX: 6b6b6b6ec6c6c6c3 RBX: ffff8880290fefc8 RCX: 0000000000000000 +<4> [241.835332] RDX: 000000006b6b6b6b RSI: 000000006b6b6b6c RDI: 0000000000000046 +<4> [241.835347] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000001 +<4> [241.835362] R10: ffffc9000019faa0 R11: 0000000000000000 R12: 0000000000000004 +<4> [241.835377] R13: 0000000000000000 R14: ffff8880290ff1d0 R15: 0000000000000293 +<4> [241.835392] FS: 0000000000000000(0000) GS:ffff88803de80000(0000) knlGS:0000000000000000 +<4> [241.835409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +<4> [241.835422] CR2: 00007ffe9a99e9b7 CR3: 000000002f588000 CR4: 00000000000006e0 +<4> [241.835436] Call Trace: +<4> [241.835449] input_event+0x45/0x70 +<4> [241.835464] snd_jack_report+0xdc/0x100 +<4> [241.835490] snd_hda_jack_report_sync+0x83/0xc0 [snd_hda_codec] +<4> [241.835512] snd_hdac_bus_process_unsol_events+0x5a/0x70 [snd_hda_core] +<4> [241.835530] process_one_work+0x245/0x610 + +which has the hallmarks of a worker queued from interrupt after it was +supposedly cancelled (note the POISON_FREE), and I could not see where +the interrupt would be flushed on shutdown so added the likely suspects. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111174 +Signed-off-by: Chris Wilson +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_controller.c | 2 ++ + sound/pci/hda/hda_intel.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c +index 74244d8e29090..e858b6fa0c3ad 100644 +--- a/sound/hda/hdac_controller.c ++++ b/sound/hda/hdac_controller.c +@@ -443,6 +443,8 @@ static void azx_int_disable(struct hdac_bus *bus) + list_for_each_entry(azx_dev, &bus->stream_list, list) + snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); + ++ synchronize_irq(bus->irq); ++ + /* disable SIE for all streams */ + snd_hdac_chip_writeb(bus, INTCTL, 0); + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 0b24c5ce2fd6a..bfc45086cf793 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1455,9 +1455,9 @@ static int azx_free(struct azx *chip) + } + + if (bus->chip_init) { ++ azx_stop_chip(chip); + azx_clear_irq_pending(chip); + azx_stop_all_streams(chip); +- azx_stop_chip(chip); + } + + if (bus->irq >= 0) +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch b/queue-4.19/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch new file mode 100644 index 00000000000..cc275db5fdd --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch @@ -0,0 +1,37 @@ +From f446777a142a328cdbdcbf0af19d03eeb10dc30b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 09:58:07 +0200 +Subject: ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 + +From: Takashi Iwai + +[ Upstream commit 051c78af14fcd74a22b5af45548ad9d588247cc7 ] + +Lenovo ThinkCentre M73 and M93 don't seem to have a proper beep +although the driver tries to probe and set up blindly. +Blacklist these machines for suppressing the beep creation. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204635 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7f74ebee8c2d1..e791379439be0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1057,6 +1057,9 @@ static const struct snd_pci_quirk beep_white_list[] = { + SND_PCI_QUIRK(0x1043, 0x834a, "EeePC", 1), + SND_PCI_QUIRK(0x1458, 0xa002, "GA-MA790X", 1), + SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1), ++ /* blacklist -- no beep available */ ++ SND_PCI_QUIRK(0x17aa, 0x309e, "Lenovo ThinkCentre M73", 0), ++ SND_PCI_QUIRK(0x17aa, 0x30a3, "Lenovo ThinkCentre M93", 0), + {} + }; + +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch b/queue-4.19/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch new file mode 100644 index 00000000000..614fb4acaed --- /dev/null +++ b/queue-4.19/alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch @@ -0,0 +1,44 @@ +From b093d2cd7ee756e3da0f4383923b5882cd936c17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 11:42:34 +0200 +Subject: ALSA: hda - Show the fatal CORB/RIRB error more clearly + +From: Takashi Iwai + +[ Upstream commit dd65f7e19c6961ba6a69f7c925021b7a270cb950 ] + +The last fallback of CORB/RIRB communication error recovery is to turn +on the single command mode, and this last resort usually means that +something is really screwed up. Instead of a normal dev_err(), show +the error more clearly with dev_WARN() with the caller stack trace. + +Also, show the bus-reset fallback also as an error, too. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_controller.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index a41c1bec7c88c..8fcb421193e02 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -877,10 +877,13 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, + */ + if (hbus->allow_bus_reset && !hbus->response_reset && !hbus->in_reset) { + hbus->response_reset = 1; ++ dev_err(chip->card->dev, ++ "No response from codec, resetting bus: last cmd=0x%08x\n", ++ bus->last_cmd[addr]); + return -EAGAIN; /* give a chance to retry */ + } + +- dev_err(chip->card->dev, ++ dev_WARN(chip->card->dev, + "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", + bus->last_cmd[addr]); + chip->single_cmd = 1; +-- +2.20.1 + diff --git a/queue-4.19/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch b/queue-4.19/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch new file mode 100644 index 00000000000..a92e2f63225 --- /dev/null +++ b/queue-4.19/alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch @@ -0,0 +1,55 @@ +From d30673b8b1ba39f09cf03e844afe727b9c9e910e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 10:14:42 +0800 +Subject: ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in + build_adc_controls() + +From: Jia-Ju Bai + +[ Upstream commit 2127c01b7f63b06a21559f56a8c81a3c6535bd1a ] + +In build_adc_controls(), there is an if statement on line 773 to check +whether ak->adc_info is NULL: + if (! ak->adc_info || + ! ak->adc_info[mixer_ch].switch_name) + +When ak->adc_info is NULL, it is used on line 792: + knew.name = ak->adc_info[mixer_ch].selector_name; + +Thus, a possible null-pointer dereference may occur. + +To fix this bug, referring to lines 773 and 774, ak->adc_info +and ak->adc_info[mixer_ch].selector_name are checked before being used. + +This bug is found by a static analysis tool STCheck written by us. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/i2c/other/ak4xxx-adda.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c +index 7f2761a2e7c8c..971197c34fcef 100644 +--- a/sound/i2c/other/ak4xxx-adda.c ++++ b/sound/i2c/other/ak4xxx-adda.c +@@ -789,11 +789,12 @@ static int build_adc_controls(struct snd_akm4xxx *ak) + return err; + + memset(&knew, 0, sizeof(knew)); +- knew.name = ak->adc_info[mixer_ch].selector_name; +- if (!knew.name) { ++ if (!ak->adc_info || ++ !ak->adc_info[mixer_ch].selector_name) { + knew.name = "Capture Channel"; + knew.index = mixer_ch + ak->idx_offset * 2; +- } ++ } else ++ knew.name = ak->adc_info[mixer_ch].selector_name; + + knew.iface = SNDRV_CTL_ELEM_IFACE_MIXER; + knew.info = ak4xxx_capture_source_info; +-- +2.20.1 + diff --git a/queue-4.19/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch b/queue-4.19/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch new file mode 100644 index 00000000000..4fabf648b4e --- /dev/null +++ b/queue-4.19/alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch @@ -0,0 +1,39 @@ +From cf6add59f388dbccb93ac509ddce67d0001171df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Aug 2019 13:52:14 +0200 +Subject: ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid + +From: Ard van Breemen + +[ Upstream commit 1b34121d9f26d272b0b2334209af6b6fc82d4bf1 ] + +The Linux kernel assumes that get_endpoint(alts,0) and +get_endpoint(alts,1) are eachothers feedback endpoints. +To reassure that validity it will test bsynchaddress to comply with that +assumption. But if the bsyncaddress is 0 (invalid), it will flag that as +a wrong assumption and return an error. +Fix: Skip the test if bSynchAddress is 0. +Note: those with a valid bSynchAddress should have a code quirck added. + +Signed-off-by: Ard van Breemen +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 35c57a4204a8a..13ea63c959d39 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -464,6 +464,7 @@ static int set_sync_endpoint(struct snd_usb_substream *subs, + } + ep = get_endpoint(alts, 1)->bEndpointAddress; + if (get_endpoint(alts, 0)->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE && ++ get_endpoint(alts, 0)->bSynchAddress != 0 && + ((is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress | USB_DIR_IN)) || + (!is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress & ~USB_DIR_IN)))) { + dev_err(&dev->dev, +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch b/queue-4.19/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch new file mode 100644 index 00000000000..73fb1aaf46e --- /dev/null +++ b/queue-4.19/arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch @@ -0,0 +1,60 @@ +From f52141289da6074d7d4962e65971b83242e26aba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 14:52:42 +0200 +Subject: ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks + +From: Marek Szyprowski + +[ Upstream commit 5b0eeeaa37615df37a9a30929b73e9defe61ca84 ] + +Commit aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply +for Peach boards") assigned LDO10 to Exynos Thermal Measurement Unit, +but it turned out that it supplies also some other critical parts and +board freezes/crashes when it is turned off. + +The mentioned commit made Exynos TMU a consumer of that regulator and in +typical case Exynos TMU driver keeps it enabled from early boot. However +there are such configurations (example is multi_v7_defconfig), in which +some of the regulators are compiled as modules and are not available +from early boot. In such case it may happen that LDO10 is turned off by +regulator core, because it has no consumers yet (in this case consumer +drivers cannot get it, because the supply regulators for it are not yet +available). This in turn causes the board to crash. This patch restores +'always-on' property for the LDO10 regulator. + +Fixes: aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply for Peach boards") +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420-peach-pit.dts | 1 + + arch/arm/boot/dts/exynos5800-peach-pi.dts | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts +index 57c2332bf2824..25bdc9d97a4df 100644 +--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts ++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts +@@ -437,6 +437,7 @@ + regulator-name = "vdd_ldo10"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-state-mem { + regulator-off-in-suspend; + }; +diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts +index d80ab9085da19..7989631b39ccf 100644 +--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts ++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts +@@ -437,6 +437,7 @@ + regulator-name = "vdd_ldo10"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-state-mem { + regulator-off-in-suspend; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-imx7-colibri-disable-hs400.patch b/queue-4.19/arm-dts-imx7-colibri-disable-hs400.patch new file mode 100644 index 00000000000..a38fbaca9b3 --- /dev/null +++ b/queue-4.19/arm-dts-imx7-colibri-disable-hs400.patch @@ -0,0 +1,44 @@ +From 2a27c5459aa70a0d7a2b04f04b67f7d2a1b38519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2019 14:21:17 +0000 +Subject: ARM: dts: imx7-colibri: disable HS400 + +From: Stefan Agner + +[ Upstream commit a95fbda08ee20cd063ce5826e0df95a2c22ea8c5 ] + +Force HS200 by masking bit 63 of the SDHCI capability register. +The i.MX ESDHC driver uses SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400. With +that the stack checks bit 63 to descide whether HS400 is available. +Using sdhci-caps-mask allows to mask bit 63. The stack then selects +HS200 as operating mode. + +This prevents rare communication errors with minimal effect on +performance: + sdhci-esdhc-imx 30b60000.usdhc: warning! HS400 strobe DLL + status REF not lock! + +Signed-off-by: Stefan Agner +Signed-off-by: Philippe Schenker +Reviewed-by: Oleksandr Suvorov +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7-colibri.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi +index 895fbde4d4333..c1ed83131b495 100644 +--- a/arch/arm/boot/dts/imx7-colibri.dtsi ++++ b/arch/arm/boot/dts/imx7-colibri.dtsi +@@ -323,6 +323,7 @@ + vmmc-supply = <®_module_3v3>; + vqmmc-supply = <®_DCDC3>; + non-removable; ++ sdhci-caps-mask = <0x80000000 0x0>; + }; + + &iomuxc { +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch b/queue-4.19/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch new file mode 100644 index 00000000000..74137873662 --- /dev/null +++ b/queue-4.19/arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch @@ -0,0 +1,79 @@ +From 05207c72f28dd7c084a0034777c189e34d7f6325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 04:12:27 +0100 +Subject: ARM: dts: imx7d: cl-som-imx7: make ethernet work again +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Draszik + +[ Upstream commit 9846a4524ac90b63496580b7ad50674b40d92a8f ] + +Recent changes to the atheros at803x driver caused +ethernet to stop working on this board. +In particular commit 6d4cd041f0af +("net: phy: at803x: disable delay only for RGMII mode") +and commit cd28d1d6e52e +("net: phy: at803x: Disable phy delay for RGMII mode") +fix the AR8031 driver to configure the phy's (RX/TX) +delays as per the 'phy-mode' in the device tree. + +This now prevents ethernet from working on this board. + +It used to work before those commits, because the +AR8031 comes out of reset with RX delay enabled, and +the at803x driver didn't touch the delay configuration +at all when "rgmii" mode was selected, and because +arch/arm/mach-imx/mach-imx7d.c:ar8031_phy_fixup() +unconditionally enables TX delay. + +Since above commits ar8031_phy_fixup() also has no +effect anymore, and the end-result is that all delays +are disabled in the phy, no ethernet. + +Update the device tree to restore functionality. + +Signed-off-by: André Draszik +CC: Ilya Ledvich +CC: Igor Grinberg +CC: Rob Herring +CC: Mark Rutland +CC: Shawn Guo +CC: Sascha Hauer +CC: Pengutronix Kernel Team +CC: Fabio Estevam +CC: NXP Linux Team +CC: devicetree@vger.kernel.org +CC: linux-arm-kernel@lists.infradead.org +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7d-cl-som-imx7.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +index 8bf365d28cacf..584418f517a88 100644 +--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts ++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +@@ -43,7 +43,7 @@ + <&clks IMX7D_ENET1_TIME_ROOT_CLK>; + assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>; + assigned-clock-rates = <0>, <100000000>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <ðphy0>; + fsl,magic-packet; + status = "okay"; +@@ -69,7 +69,7 @@ + <&clks IMX7D_ENET2_TIME_ROOT_CLK>; + assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>; + assigned-clock-rates = <0>, <100000000>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <ðphy1>; + fsl,magic-packet; + status = "okay"; +-- +2.20.1 + diff --git a/queue-4.19/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch b/queue-4.19/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch new file mode 100644 index 00000000000..472f7c19f27 --- /dev/null +++ b/queue-4.19/arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch @@ -0,0 +1,61 @@ +From 3c9340998f08b6587cce8441e939886fba7934f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 18:12:57 +0100 +Subject: arm64: kpti: ensure patched kernel text is fetched from PoU + +From: Mark Rutland + +[ Upstream commit f32c7a8e45105bd0af76872bf6eef0438ff12fb2 ] + +While the MMUs is disabled, I-cache speculation can result in +instructions being fetched from the PoC. During boot we may patch +instructions (e.g. for alternatives and jump labels), and these may be +dirty at the PoU (and stale at the PoC). + +Thus, while the MMU is disabled in the KPTI pagetable fixup code we may +load stale instructions into the I-cache, potentially leading to +subsequent crashes when executing regions of code which have been +modified at runtime. + +Similarly to commit: + + 8ec41987436d566f ("arm64: mm: ensure patched kernel text is fetched from PoU") + +... we can invalidate the I-cache after enabling the MMU to prevent such +issues. + +The KPTI pagetable fixup code itself should be clean to the PoC per the +boot protocol, so no maintenance is required for this code. + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Reviewed-by: James Morse +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/proc.S | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 8cce091b6c21e..ec6aa18633162 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -294,6 +294,15 @@ skip_pgd: + msr sctlr_el1, x18 + isb + ++ /* ++ * Invalidate the local I-cache so that any instructions fetched ++ * speculatively from the PoC are discarded, since they may have ++ * been dynamically patched at the PoU. ++ */ ++ ic iallu ++ dsb nsh ++ isb ++ + /* Set the flag to zero to indicate that we're all done */ + str wzr, [flag_ptr] + ret +-- +2.20.1 + diff --git a/queue-4.19/arm64-lse-make-arm64_lse_atomics-depend-on-jump_labe.patch b/queue-4.19/arm64-lse-make-arm64_lse_atomics-depend-on-jump_labe.patch new file mode 100644 index 00000000000..d4e065bf6c7 --- /dev/null +++ b/queue-4.19/arm64-lse-make-arm64_lse_atomics-depend-on-jump_labe.patch @@ -0,0 +1,66 @@ +From d7c6dbdbbdb3a71233fd3487667dcd41526b826a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 11:52:47 +0100 +Subject: arm64: lse: Make ARM64_LSE_ATOMICS depend on JUMP_LABEL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Will Deacon + +[ Upstream commit b32baf91f60fb9c7010bff87e68132f2ce31d9a8 ] + +Support for LSE atomic instructions (CONFIG_ARM64_LSE_ATOMICS) relies on +a static key to select between the legacy LL/SC implementation which is +available on all arm64 CPUs and the super-duper LSE implementation which +is available on CPUs implementing v8.1 and later. + +Unfortunately, when building a kernel with CONFIG_JUMP_LABEL disabled +(e.g. because the toolchain doesn't support 'asm goto'), the static key +inside the atomics code tries to use atomics itself. This results in a +mess of circular includes and a build failure: + +In file included from ./arch/arm64/include/asm/lse.h:11, + from ./arch/arm64/include/asm/atomic.h:16, + from ./include/linux/atomic.h:7, + from ./include/asm-generic/bitops/atomic.h:5, + from ./arch/arm64/include/asm/bitops.h:26, + from ./include/linux/bitops.h:19, + from ./include/linux/kernel.h:12, + from ./include/asm-generic/bug.h:18, + from ./arch/arm64/include/asm/bug.h:26, + from ./include/linux/bug.h:5, + from ./include/linux/page-flags.h:10, + from kernel/bounds.c:10: +./include/linux/jump_label.h: In function ‘static_key_count’: +./include/linux/jump_label.h:254:9: error: implicit declaration of function ‘atomic_read’ [-Werror=implicit-function-declaration] + return atomic_read(&key->enabled); + ^~~~~~~~~~~ + +[ ... more of the same ... ] + +Since LSE atomic instructions are not critical to the operation of the +kernel, make them depend on JUMP_LABEL at compile time. + +Reviewed-by: Andrew Murray +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index e3ebece79617b..36b3de45c97e1 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1073,6 +1073,7 @@ config ARM64_PAN + + config ARM64_LSE_ATOMICS + bool "Atomic instructions" ++ depends on JUMP_LABEL + default y + help + As part of the Large System Extensions, ARMv8.1 introduces new +-- +2.20.1 + diff --git a/queue-4.19/arm64-prefetch-fix-a-wtype-limits-warning.patch b/queue-4.19/arm64-prefetch-fix-a-wtype-limits-warning.patch new file mode 100644 index 00000000000..baf850aa637 --- /dev/null +++ b/queue-4.19/arm64-prefetch-fix-a-wtype-limits-warning.patch @@ -0,0 +1,98 @@ +From c8d5e4f1788be9a617658a67e0b9b0d741fb0a91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 23:05:03 -0400 +Subject: arm64/prefetch: fix a -Wtype-limits warning + +From: Qian Cai + +[ Upstream commit b99286b088ea843b935dcfb29f187697359fe5cd ] + +The commit d5370f754875 ("arm64: prefetch: add alternative pattern for +CPUs without a prefetcher") introduced MIDR_IS_CPU_MODEL_RANGE() to be +used in has_no_hw_prefetch() with rv_min=0 which generates a compilation +warning from GCC, + +In file included from ./arch/arm64/include/asm/cache.h:8, + from ./include/linux/cache.h:6, + from ./include/linux/printk.h:9, + from ./include/linux/kernel.h:15, + from ./include/linux/cpumask.h:10, + from arch/arm64/kernel/cpufeature.c:11: +arch/arm64/kernel/cpufeature.c: In function 'has_no_hw_prefetch': +./arch/arm64/include/asm/cputype.h:59:26: warning: comparison of +unsigned expression >= 0 is always true [-Wtype-limits] +_model == (model) && rv >= (rv_min) && rv <= (rv_max); \ + ^~ +arch/arm64/kernel/cpufeature.c:889:9: note: in expansion of macro +'MIDR_IS_CPU_MODEL_RANGE' +return MIDR_IS_CPU_MODEL_RANGE(midr, MIDR_THUNDERX, + ^~~~~~~~~~~~~~~~~~~~~~~ + +Fix it by converting MIDR_IS_CPU_MODEL_RANGE to a static inline +function. + +Signed-off-by: Qian Cai +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 21 +++++++++++---------- + arch/arm64/kernel/cpufeature.c | 2 +- + 2 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index b4a48419769f2..9b7d5abd04afd 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -62,14 +62,6 @@ + #define MIDR_CPU_MODEL_MASK (MIDR_IMPLEMENTOR_MASK | MIDR_PARTNUM_MASK | \ + MIDR_ARCHITECTURE_MASK) + +-#define MIDR_IS_CPU_MODEL_RANGE(midr, model, rv_min, rv_max) \ +-({ \ +- u32 _model = (midr) & MIDR_CPU_MODEL_MASK; \ +- u32 rv = (midr) & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK); \ +- \ +- _model == (model) && rv >= (rv_min) && rv <= (rv_max); \ +- }) +- + #define ARM_CPU_IMP_ARM 0x41 + #define ARM_CPU_IMP_APM 0x50 + #define ARM_CPU_IMP_CAVIUM 0x43 +@@ -153,10 +145,19 @@ struct midr_range { + + #define MIDR_ALL_VERSIONS(m) MIDR_RANGE(m, 0, 0, 0xf, 0xf) + ++static inline bool midr_is_cpu_model_range(u32 midr, u32 model, u32 rv_min, ++ u32 rv_max) ++{ ++ u32 _model = midr & MIDR_CPU_MODEL_MASK; ++ u32 rv = midr & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK); ++ ++ return _model == model && rv >= rv_min && rv <= rv_max; ++} ++ + static inline bool is_midr_in_range(u32 midr, struct midr_range const *range) + { +- return MIDR_IS_CPU_MODEL_RANGE(midr, range->model, +- range->rv_min, range->rv_max); ++ return midr_is_cpu_model_range(midr, range->model, ++ range->rv_min, range->rv_max); + } + + static inline bool +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 859d63cc99a31..a897efdb3dddd 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -846,7 +846,7 @@ static bool has_no_hw_prefetch(const struct arm64_cpu_capabilities *entry, int _ + u32 midr = read_cpuid_id(); + + /* Cavium ThunderX pass 1.x and 2.x */ +- return MIDR_IS_CPU_MODEL_RANGE(midr, MIDR_THUNDERX, ++ return midr_is_cpu_model_range(midr, MIDR_THUNDERX, + MIDR_CPU_VAR_REV(0, 0), + MIDR_CPU_VAR_REV(1, MIDR_REVISION_MASK)); + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch b/queue-4.19/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch new file mode 100644 index 00000000000..5c99f7b4c94 --- /dev/null +++ b/queue-4.19/asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch @@ -0,0 +1,47 @@ +From 8b2d81437d4c0319f6629c91b9437d75925ced22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2019 08:55:24 +0300 +Subject: ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is + not set + +From: Peter Ujfalusi + +[ Upstream commit 2ec42f3147e1610716f184b02e65d7f493eed925 ] + +Some tools use the snd_pcm_info_get_name() to try to identify PCMs or for +other purposes. + +Currently it is left empty with the dmaengine-pcm, in this case copy the +pcm->id string as pcm->name. + +For example IGT is using this to find the HDMI PCM for testing audio on it. + +Signed-off-by: Peter Ujfalusi +Reported-by: Arthur She +Link: https://lore.kernel.org/r/20190906055524.7393-1-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-generic-dmaengine-pcm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 30e791a533528..232df04ca5866 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -313,6 +313,12 @@ static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd) + + if (!dmaengine_pcm_can_report_residue(dev, pcm->chan[i])) + pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE; ++ ++ if (rtd->pcm->streams[i].pcm->name[0] == '\0') { ++ strncpy(rtd->pcm->streams[i].pcm->name, ++ rtd->pcm->streams[i].pcm->id, ++ sizeof(rtd->pcm->streams[i].pcm->name)); ++ } + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.19/asoc-es8316-fix-headphone-mixer-volume-table.patch b/queue-4.19/asoc-es8316-fix-headphone-mixer-volume-table.patch new file mode 100644 index 00000000000..a5e08040fcf --- /dev/null +++ b/queue-4.19/asoc-es8316-fix-headphone-mixer-volume-table.patch @@ -0,0 +1,60 @@ +From c2c9e889b685b5389517a67409a4968f2c342a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 00:38:59 +0900 +Subject: ASoC: es8316: fix headphone mixer volume table + +From: Katsuhiro Suzuki + +[ Upstream commit f972d02fee2496024cfd6f59021c9d89d54922a6 ] + +This patch fix setting table of Headphone mixer volume. +Current code uses 4 ... 7 values but these values are prohibited. + +Correct settings are the following: + 0000 -12dB + 0001 -10.5dB + 0010 -9dB + 0011 -7.5dB + 0100 -6dB + 1000 -4.5dB + 1001 -3dB + 1010 -1.5dB + 1011 0dB + +Signed-off-by: Katsuhiro Suzuki +Reviewed-by: Daniel Drake +Link: https://lore.kernel.org/r/20190826153900.25969-1-katsuhiro@katsuster.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index e97d12d578b00..9ebe77c3784a8 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -46,7 +46,10 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0); + static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0); +-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(hpmixer_gain_tlv, -1200, 150, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv, ++ 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0), ++ 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0), ++); + + static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(adc_pga_gain_tlv, + 0, 0, TLV_DB_SCALE_ITEM(-350, 0, 0), +@@ -84,7 +87,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = { + SOC_DOUBLE_TLV("Headphone Playback Volume", ES8316_CPHP_ICAL_VOL, + 4, 0, 3, 1, hpout_vol_tlv), + SOC_DOUBLE_TLV("Headphone Mixer Volume", ES8316_HPMIX_VOL, +- 0, 4, 7, 0, hpmixer_gain_tlv), ++ 0, 4, 11, 0, hpmixer_gain_tlv), + + SOC_ENUM("Playback Polarity", dacpol), + SOC_DOUBLE_R_TLV("DAC Playback Volume", ES8316_DAC_VOLL, +-- +2.20.1 + diff --git a/queue-4.19/asoc-fsl_ssi-fix-clock-control-issue-in-master-mode.patch b/queue-4.19/asoc-fsl_ssi-fix-clock-control-issue-in-master-mode.patch new file mode 100644 index 00000000000..8dca1ea2902 --- /dev/null +++ b/queue-4.19/asoc-fsl_ssi-fix-clock-control-issue-in-master-mode.patch @@ -0,0 +1,75 @@ +From 59e260b38a9cae5130f0bb8eefd222d07d314150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 13:20:17 -0400 +Subject: ASoC: fsl_ssi: Fix clock control issue in master mode + +From: Shengjiu Wang + +[ Upstream commit 696d05225cebffd172008d212657be90e823eac0 ] + +The test case is +arecord -Dhw:0 -d 10 -f S16_LE -r 48000 -c 2 temp.wav & +aplay -Dhw:0 -d 30 -f S16_LE -r 48000 -c 2 test.wav + +There will be error after end of arecord: +aplay: pcm_write:2051: write error: Input/output error + +Capture and Playback work in parallel in master mode, one +substream stops, the other substream is impacted, the +reason is that clock is disabled wrongly. + +The clock's reference count is not increased when second +substream starts, the hw_param() function returns in the +beginning because first substream is enabled, then in end +of first substream, the hw_free() disables the clock. + +This patch is to move the clock enablement to the place +before checking of the device enablement in hw_param(). + +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1567012817-12625-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_ssi.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c +index 09b2967befd96..d83be26d64467 100644 +--- a/sound/soc/fsl/fsl_ssi.c ++++ b/sound/soc/fsl/fsl_ssi.c +@@ -799,15 +799,6 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream, + u32 wl = SSI_SxCCR_WL(sample_size); + int ret; + +- /* +- * SSI is properly configured if it is enabled and running in +- * the synchronous mode; Note that AC97 mode is an exception +- * that should set separate configurations for STCCR and SRCCR +- * despite running in the synchronous mode. +- */ +- if (ssi->streams && ssi->synchronous) +- return 0; +- + if (fsl_ssi_is_i2s_master(ssi)) { + ret = fsl_ssi_set_bclk(substream, dai, hw_params); + if (ret) +@@ -823,6 +814,15 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream, + } + } + ++ /* ++ * SSI is properly configured if it is enabled and running in ++ * the synchronous mode; Note that AC97 mode is an exception ++ * that should set separate configurations for STCCR and SRCCR ++ * despite running in the synchronous mode. ++ */ ++ if (ssi->streams && ssi->synchronous) ++ return 0; ++ + if (!fsl_ssi_is_ac97(ssi)) { + /* + * Keep the ssi->i2s_net intact while having a local variable +-- +2.20.1 + diff --git a/queue-4.19/asoc-rsnd-don-t-call-clk_get_rate-under-atomic-conte.patch b/queue-4.19/asoc-rsnd-don-t-call-clk_get_rate-under-atomic-conte.patch new file mode 100644 index 00000000000..58ee33ae8ab --- /dev/null +++ b/queue-4.19/asoc-rsnd-don-t-call-clk_get_rate-under-atomic-conte.patch @@ -0,0 +1,89 @@ +From 76f323a0004eba39434155c6bfa51bea36559496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2019 12:45:38 +0900 +Subject: ASoC: rsnd: don't call clk_get_rate() under atomic context + +From: Kuninori Morimoto + +[ Upstream commit 06e8f5c842f2dbb232897ba967ea7b422745c271 ] + +ADG is using clk_get_rate() under atomic context, thus, we might +have scheduling issue. +To avoid this issue, we need to get/keep clk rate under +non atomic context. + +We need to handle ADG as special device at Renesas Sound driver. +From SW point of view, we want to impletent it as +rsnd_mod_ops :: prepare, but it makes code just complicate. + +To avoid complicated code/patch, this patch adds new clk_rate[] array, +and keep clk IN rate when rsnd_adg_clk_enable() was called. + +Reported-by: Leon Kong +Signed-off-by: Kuninori Morimoto +Tested-by: Leon Kong +Link: https://lore.kernel.org/r/87v9vb0xkp.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/adg.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index 051f96405346b..549a137878a65 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -30,6 +30,7 @@ struct rsnd_adg { + struct clk *clkout[CLKOUTMAX]; + struct clk_onecell_data onecell; + struct rsnd_mod mod; ++ int clk_rate[CLKMAX]; + u32 flags; + u32 ckr; + u32 rbga; +@@ -113,9 +114,9 @@ static void __rsnd_adg_get_timesel_ratio(struct rsnd_priv *priv, + unsigned int val, en; + unsigned int min, diff; + unsigned int sel_rate[] = { +- clk_get_rate(adg->clk[CLKA]), /* 0000: CLKA */ +- clk_get_rate(adg->clk[CLKB]), /* 0001: CLKB */ +- clk_get_rate(adg->clk[CLKC]), /* 0010: CLKC */ ++ adg->clk_rate[CLKA], /* 0000: CLKA */ ++ adg->clk_rate[CLKB], /* 0001: CLKB */ ++ adg->clk_rate[CLKC], /* 0010: CLKC */ + adg->rbga_rate_for_441khz, /* 0011: RBGA */ + adg->rbgb_rate_for_48khz, /* 0100: RBGB */ + }; +@@ -331,7 +332,7 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate) + * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI. + */ + for_each_rsnd_clk(clk, adg, i) { +- if (rate == clk_get_rate(clk)) ++ if (rate == adg->clk_rate[i]) + return sel_table[i]; + } + +@@ -398,10 +399,18 @@ void rsnd_adg_clk_control(struct rsnd_priv *priv, int enable) + + for_each_rsnd_clk(clk, adg, i) { + ret = 0; +- if (enable) ++ if (enable) { + ret = clk_prepare_enable(clk); +- else ++ ++ /* ++ * We shouldn't use clk_get_rate() under ++ * atomic context. Let's keep it when ++ * rsnd_adg_clk_enable() was called ++ */ ++ adg->clk_rate[i] = clk_get_rate(adg->clk[i]); ++ } else { + clk_disable_unprepare(clk); ++ } + + if (ret < 0) + dev_warn(dev, "can't use clk %d\n", i); +-- +2.20.1 + diff --git a/queue-4.19/asoc-sgtl5000-fix-charge-pump-source-assignment.patch b/queue-4.19/asoc-sgtl5000-fix-charge-pump-source-assignment.patch new file mode 100644 index 00000000000..caee7f1042f --- /dev/null +++ b/queue-4.19/asoc-sgtl5000-fix-charge-pump-source-assignment.patch @@ -0,0 +1,55 @@ +From aa710404bd45f148bf1bea3a5cb3d75d18743cde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 10:05:37 +0000 +Subject: ASoC: sgtl5000: Fix charge pump source assignment + +From: Oleksandr Suvorov + +[ Upstream commit b6319b061ba279577fd7030a9848fbd6a17151e3 ] + +If VDDA != VDDIO and any of them is greater than 3.1V, charge pump +source can be assigned automatically [1]. + +[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Marcel Ziswiler +Reviewed-by: Igor Opaniuk +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20190719100524.23300-7-oleksandr.suvorov@toradex.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index f9817029bffbb..18cddf1729a65 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1165,12 +1165,17 @@ static int sgtl5000_set_power_regs(struct snd_soc_component *component) + SGTL5000_INT_OSC_EN); + /* Enable VDDC charge pump */ + ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; +- } else if (vddio >= 3100 && vdda >= 3100) { ++ } else { + ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; +- /* VDDC use VDDIO rail */ +- lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; +- lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << +- SGTL5000_VDDC_MAN_ASSN_SHIFT; ++ /* ++ * if vddio == vdda the source of charge pump should be ++ * assigned manually to VDDIO ++ */ ++ if (vddio == vdda) { ++ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; ++ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << ++ SGTL5000_VDDC_MAN_ASSN_SHIFT; ++ } + } + + snd_soc_component_write(component, SGTL5000_CHIP_LINREG_CTRL, lreg_ctrl); +-- +2.20.1 + diff --git a/queue-4.19/asoc-sgtl5000-fix-of-unmute-outputs-on-probe.patch b/queue-4.19/asoc-sgtl5000-fix-of-unmute-outputs-on-probe.patch new file mode 100644 index 00000000000..86fee93fdcf --- /dev/null +++ b/queue-4.19/asoc-sgtl5000-fix-of-unmute-outputs-on-probe.patch @@ -0,0 +1,51 @@ +From 09b176e776e64436c1d5f64d5de4dc5da4afd8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 10:05:35 +0000 +Subject: ASoC: sgtl5000: Fix of unmute outputs on probe + +From: Oleksandr Suvorov + +[ Upstream commit 631bc8f0134ae9620d86a96b8c5f9445d91a2dca ] + +To enable "zero cross detect" for ADC/HP, change +HP_ZCD_EN/ADC_ZCD_EN bits only instead of writing the whole +CHIP_ANA_CTRL register. + +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Marcel Ziswiler +Reviewed-by: Igor Opaniuk +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20190719100524.23300-6-oleksandr.suvorov@toradex.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 60764f6201b19..f9817029bffbb 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1280,6 +1280,7 @@ static int sgtl5000_probe(struct snd_soc_component *component) + int ret; + u16 reg; + struct sgtl5000_priv *sgtl5000 = snd_soc_component_get_drvdata(component); ++ unsigned int zcd_mask = SGTL5000_HP_ZCD_EN | SGTL5000_ADC_ZCD_EN; + + /* power up sgtl5000 */ + ret = sgtl5000_set_power_regs(component); +@@ -1305,9 +1306,8 @@ static int sgtl5000_probe(struct snd_soc_component *component) + reg = ((sgtl5000->lrclk_strength) << SGTL5000_PAD_I2S_LRCLK_SHIFT | 0x5f); + snd_soc_component_write(component, SGTL5000_CHIP_PAD_STRENGTH, reg); + +- snd_soc_component_write(component, SGTL5000_CHIP_ANA_CTRL, +- SGTL5000_HP_ZCD_EN | +- SGTL5000_ADC_ZCD_EN); ++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL, ++ zcd_mask, zcd_mask); + + snd_soc_component_update_bits(component, SGTL5000_CHIP_MIC_CTRL, + SGTL5000_BIAS_R_MASK, +-- +2.20.1 + diff --git a/queue-4.19/asoc-sun4i-i2s-don-t-use-the-oversample-to-calculate.patch b/queue-4.19/asoc-sun4i-i2s-don-t-use-the-oversample-to-calculate.patch new file mode 100644 index 00000000000..83f57ac8bc5 --- /dev/null +++ b/queue-4.19/asoc-sun4i-i2s-don-t-use-the-oversample-to-calculate.patch @@ -0,0 +1,72 @@ +From e1307bbe5939b39bc924fc8a04d23b896ae3d260 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 21:25:14 +0200 +Subject: ASoC: sun4i-i2s: Don't use the oversample to calculate BCLK + +From: Maxime Ripard + +[ Upstream commit 7df8f9a20196072162d9dc8fe99943f2d35f23d5 ] + +The BCLK divider should be calculated using the parameters that actually +make the BCLK rate: the number of channels, the sampling rate and the +sample width. + +We've been using the oversample_rate previously because in the former SoCs, +the BCLK's parent is MCLK, which in turn is being used to generate the +oversample rate, so we end up with something like this: + +oversample = mclk_rate / sampling_rate +bclk_div = oversample / word_size / channels + +So, bclk_div = mclk_rate / sampling_rate / word_size / channels. + +And this is actually better, since the oversampling ratio only plays a role +because the MCLK is its parent, not because of what BCLK is supposed to be. + +Furthermore, that assumption of MCLK being the parent has been broken on +newer SoCs, so let's use the proper formula, and have the parent rate as an +argument. + +Fixes: 7d2993811a1e ("ASoC: sun4i-i2s: Add support for H3") +Fixes: 21faaea1343f ("ASoC: sun4i-i2s: Add support for A83T") +Fixes: 66ecce332538 ("ASoC: sun4i-i2s: Add compatibility with A64 codec I2S") +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/c3595e3a9788c2ef2dcc30aa3c8c4953bb5cc249.1566242458.git-series.maxime.ripard@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index 6173dd86c62ce..18cf8404d27ca 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -223,10 +223,11 @@ static const struct sun4i_i2s_clk_div sun4i_i2s_mclk_div[] = { + }; + + static int sun4i_i2s_get_bclk_div(struct sun4i_i2s *i2s, +- unsigned int oversample_rate, ++ unsigned long parent_rate, ++ unsigned int sampling_rate, + unsigned int word_size) + { +- int div = oversample_rate / word_size / 2; ++ int div = parent_rate / sampling_rate / word_size / 2; + int i; + + for (i = 0; i < ARRAY_SIZE(sun4i_i2s_bclk_div); i++) { +@@ -316,8 +317,8 @@ static int sun4i_i2s_set_clk_rate(struct snd_soc_dai *dai, + return -EINVAL; + } + +- bclk_div = sun4i_i2s_get_bclk_div(i2s, oversample_rate, +- word_size); ++ bclk_div = sun4i_i2s_get_bclk_div(i2s, i2s->mclk_freq, ++ rate, word_size); + if (bclk_div < 0) { + dev_err(dai->dev, "Unsupported BCLK divider: %d\n", bclk_div); + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.19/asoc-tlv320aic31xx-suppress-error-message-for-eprobe.patch b/queue-4.19/asoc-tlv320aic31xx-suppress-error-message-for-eprobe.patch new file mode 100644 index 00000000000..9f61cbddd02 --- /dev/null +++ b/queue-4.19/asoc-tlv320aic31xx-suppress-error-message-for-eprobe.patch @@ -0,0 +1,50 @@ +From 6a64937aa4e73cff026e9ff49edfbfdaf73180fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 16:36:37 +0200 +Subject: ASoC: tlv320aic31xx: suppress error message for EPROBE_DEFER + +From: Lucas Stach + +[ Upstream commit b7e814deae33eb30f8f8c6528e8e69b107978d88 ] + +Both the supplies and reset GPIO might need a probe deferral for the +resource to be available. Don't print a error message in that case, as +it is a normal operating condition. + +Signed-off-by: Lucas Stach +Acked-by: Andrew F. Davis +Link: https://lore.kernel.org/r/20190719143637.2018-1-l.stach@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic31xx.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c +index bf92d36b8f8ab..3c75dcf917417 100644 +--- a/sound/soc/codecs/tlv320aic31xx.c ++++ b/sound/soc/codecs/tlv320aic31xx.c +@@ -1441,7 +1441,8 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c, + aic31xx->gpio_reset = devm_gpiod_get_optional(aic31xx->dev, "reset", + GPIOD_OUT_LOW); + if (IS_ERR(aic31xx->gpio_reset)) { +- dev_err(aic31xx->dev, "not able to acquire gpio\n"); ++ if (PTR_ERR(aic31xx->gpio_reset) != -EPROBE_DEFER) ++ dev_err(aic31xx->dev, "not able to acquire gpio\n"); + return PTR_ERR(aic31xx->gpio_reset); + } + +@@ -1452,7 +1453,9 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c, + ARRAY_SIZE(aic31xx->supplies), + aic31xx->supplies); + if (ret) { +- dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret); ++ if (ret != -EPROBE_DEFER) ++ dev_err(aic31xx->dev, ++ "Failed to request supplies: %d\n", ret); + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.19/asoc-uniphier-fix-double-reset-assersion-when-transi.patch b/queue-4.19/asoc-uniphier-fix-double-reset-assersion-when-transi.patch new file mode 100644 index 00000000000..4f002a8f71d --- /dev/null +++ b/queue-4.19/asoc-uniphier-fix-double-reset-assersion-when-transi.patch @@ -0,0 +1,124 @@ +From 2cf27a3c23693123bb4bf2d622a4d4a14135b79b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 15:16:04 +0900 +Subject: ASoC: uniphier: Fix double reset assersion when transitioning to + suspend state + +From: Kunihiko Hayashi + +[ Upstream commit c372a35550c8d60f673b20210eea58a06d6d38cb ] + +When transitioning to supend state, uniphier_aio_dai_suspend() is called +and asserts reset lines and disables clocks. + +However, if there are two or more DAIs, uniphier_aio_dai_suspend() are +called multiple times, and double reset assersion will cause. + +This patch defines the counter that has the number of DAIs at first, and +whenever uniphier_aio_dai_suspend() are called, it decrements the +counter. And only if the counter is zero, it asserts reset lines and +disables clocks. + +In the same way, uniphier_aio_dai_resume() are called, it increments the +counter after deasserting reset lines and enabling clocks. + +Fixes: 139a34200233 ("ASoC: uniphier: add support for UniPhier AIO CPU DAI driver") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/1566281764-14059-1-git-send-email-hayashi.kunihiko@socionext.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/uniphier/aio-cpu.c | 31 +++++++++++++++++++++---------- + sound/soc/uniphier/aio.h | 1 + + 2 files changed, 22 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/uniphier/aio-cpu.c b/sound/soc/uniphier/aio-cpu.c +index ee90e6c3937ce..2ae582a99b636 100644 +--- a/sound/soc/uniphier/aio-cpu.c ++++ b/sound/soc/uniphier/aio-cpu.c +@@ -424,8 +424,11 @@ int uniphier_aio_dai_suspend(struct snd_soc_dai *dai) + { + struct uniphier_aio *aio = uniphier_priv(dai); + +- reset_control_assert(aio->chip->rst); +- clk_disable_unprepare(aio->chip->clk); ++ aio->chip->num_wup_aios--; ++ if (!aio->chip->num_wup_aios) { ++ reset_control_assert(aio->chip->rst); ++ clk_disable_unprepare(aio->chip->clk); ++ } + + return 0; + } +@@ -439,13 +442,15 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai) + if (!aio->chip->active) + return 0; + +- ret = clk_prepare_enable(aio->chip->clk); +- if (ret) +- return ret; ++ if (!aio->chip->num_wup_aios) { ++ ret = clk_prepare_enable(aio->chip->clk); ++ if (ret) ++ return ret; + +- ret = reset_control_deassert(aio->chip->rst); +- if (ret) +- goto err_out_clock; ++ ret = reset_control_deassert(aio->chip->rst); ++ if (ret) ++ goto err_out_clock; ++ } + + aio_iecout_set_enable(aio->chip, true); + aio_chip_init(aio->chip); +@@ -458,7 +463,7 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai) + + ret = aio_init(sub); + if (ret) +- goto err_out_clock; ++ goto err_out_reset; + + if (!sub->setting) + continue; +@@ -466,11 +471,16 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai) + aio_port_reset(sub); + aio_src_reset(sub); + } ++ aio->chip->num_wup_aios++; + + return 0; + ++err_out_reset: ++ if (!aio->chip->num_wup_aios) ++ reset_control_assert(aio->chip->rst); + err_out_clock: +- clk_disable_unprepare(aio->chip->clk); ++ if (!aio->chip->num_wup_aios) ++ clk_disable_unprepare(aio->chip->clk); + + return ret; + } +@@ -619,6 +629,7 @@ int uniphier_aio_probe(struct platform_device *pdev) + return PTR_ERR(chip->rst); + + chip->num_aios = chip->chip_spec->num_dais; ++ chip->num_wup_aios = chip->num_aios; + chip->aios = devm_kcalloc(dev, + chip->num_aios, sizeof(struct uniphier_aio), + GFP_KERNEL); +diff --git a/sound/soc/uniphier/aio.h b/sound/soc/uniphier/aio.h +index ca6ccbae0ee8c..a7ff7e556429b 100644 +--- a/sound/soc/uniphier/aio.h ++++ b/sound/soc/uniphier/aio.h +@@ -285,6 +285,7 @@ struct uniphier_aio_chip { + + struct uniphier_aio *aios; + int num_aios; ++ int num_wup_aios; + struct uniphier_aio_pll *plls; + int num_plls; + +-- +2.20.1 + diff --git a/queue-4.19/base-soc-export-soc_device_register-unregister-apis.patch b/queue-4.19/base-soc-export-soc_device_register-unregister-apis.patch new file mode 100644 index 00000000000..a198cf06738 --- /dev/null +++ b/queue-4.19/base-soc-export-soc_device_register-unregister-apis.patch @@ -0,0 +1,47 @@ +From f8783dde07476cb0f52124320df2e58f76b74854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 04:05:12 +0530 +Subject: base: soc: Export soc_device_register/unregister APIs + +From: Vinod Koul + +[ Upstream commit f7ccc7a397cf2ef64aebb2f726970b93203858d2 ] + +Qcom Socinfo driver can be built as a module, so +export these two APIs. + +Tested-by: Vinod Koul +Signed-off-by: Vinod Koul +Signed-off-by: Vaishali Thakkar +Reviewed-by: Greg Kroah-Hartman +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/base/soc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/base/soc.c b/drivers/base/soc.c +index 10b280f30217b..7e91894a380b5 100644 +--- a/drivers/base/soc.c ++++ b/drivers/base/soc.c +@@ -157,6 +157,7 @@ struct soc_device *soc_device_register(struct soc_device_attribute *soc_dev_attr + out1: + return ERR_PTR(ret); + } ++EXPORT_SYMBOL_GPL(soc_device_register); + + /* Ensure soc_dev->attr is freed prior to calling soc_device_unregister. */ + void soc_device_unregister(struct soc_device *soc_dev) +@@ -166,6 +167,7 @@ void soc_device_unregister(struct soc_device *soc_dev) + device_unregister(&soc_dev->dev); + early_soc_dev_attr = NULL; + } ++EXPORT_SYMBOL_GPL(soc_device_unregister); + + static int __init soc_bus_register(void) + { +-- +2.20.1 + diff --git a/queue-4.19/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch b/queue-4.19/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch new file mode 100644 index 00000000000..b5626750e83 --- /dev/null +++ b/queue-4.19/btrfs-extent-tree-make-sure-we-only-allocate-extents.patch @@ -0,0 +1,115 @@ +From ea2f92665ff02323a2851f2e709c7a6b7fc3f2fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2019 17:00:33 +0800 +Subject: btrfs: extent-tree: Make sure we only allocate extents from block + groups with the same type + +From: Qu Wenruo + +[ Upstream commit 2a28468e525f3924efed7f29f2bc5a2926e7e19a ] + +[BUG] +With fuzzed image and MIXED_GROUPS super flag, we can hit the following +BUG_ON(): + + kernel BUG at fs/btrfs/delayed-ref.c:491! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 0 PID: 1849 Comm: sync Tainted: G O 5.2.0-custom #27 + RIP: 0010:update_existing_head_ref.cold+0x44/0x46 [btrfs] + Call Trace: + add_delayed_ref_head+0x20c/0x2d0 [btrfs] + btrfs_add_delayed_tree_ref+0x1fc/0x490 [btrfs] + btrfs_free_tree_block+0x123/0x380 [btrfs] + __btrfs_cow_block+0x435/0x500 [btrfs] + btrfs_cow_block+0x110/0x240 [btrfs] + btrfs_search_slot+0x230/0xa00 [btrfs] + ? __lock_acquire+0x105e/0x1e20 + btrfs_insert_empty_items+0x67/0xc0 [btrfs] + alloc_reserved_file_extent+0x9e/0x340 [btrfs] + __btrfs_run_delayed_refs+0x78e/0x1240 [btrfs] + ? kvm_clock_read+0x18/0x30 + ? __sched_clock_gtod_offset+0x21/0x50 + btrfs_run_delayed_refs.part.0+0x4e/0x180 [btrfs] + btrfs_run_delayed_refs+0x23/0x30 [btrfs] + btrfs_commit_transaction+0x53/0x9f0 [btrfs] + btrfs_sync_fs+0x7c/0x1c0 [btrfs] + ? __ia32_sys_fdatasync+0x20/0x20 + sync_fs_one_sb+0x23/0x30 + iterate_supers+0x95/0x100 + ksys_sync+0x62/0xb0 + __ia32_sys_sync+0xe/0x20 + do_syscall_64+0x65/0x240 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +[CAUSE] +This situation is caused by several factors: +- Fuzzed image + The extent tree of this fs missed one backref for extent tree root. + So we can allocated space from that slot. + +- MIXED_BG feature + Super block has MIXED_BG flag. + +- No mixed block groups exists + All block groups are just regular ones. + +This makes data space_info->block_groups[] contains metadata block +groups. And when we reserve space for data, we can use space in +metadata block group. + +Then we hit the following file operations: + +- fallocate + We need to allocate data extents. + find_free_extent() choose to use the metadata block to allocate space + from, and choose the space of extent tree root, since its backref is + missing. + + This generate one delayed ref head with is_data = 1. + +- extent tree update + We need to update extent tree at run_delayed_ref time. + + This generate one delayed ref head with is_data = 0, for the same + bytenr of old extent tree root. + +Then we trigger the BUG_ON(). + +[FIX] +The quick fix here is to check block_group->flags before using it. + +The problem can only happen for MIXED_GROUPS fs. Regular filesystems +won't have space_info with DATA|METADATA flag, and no way to hit the +bug. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203255 +Reported-by: Jungyeon Yoon +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-tree.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 88c939f7aad96..e49e29288049a 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -7367,6 +7367,14 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info, + */ + if ((flags & extra) && !(block_group->flags & extra)) + goto loop; ++ ++ /* ++ * This block group has different flags than we want. ++ * It's possible that we have MIXED_GROUP flag but no ++ * block group is mixed. Just skip such block group. ++ */ ++ btrfs_release_block_group(block_group, delalloc); ++ continue; + } + + have_block_group: +-- +2.20.1 + diff --git a/queue-4.19/closures-fix-a-race-on-wakeup-from-closure_sync.patch b/queue-4.19/closures-fix-a-race-on-wakeup-from-closure_sync.patch new file mode 100644 index 00000000000..74f7db3251a --- /dev/null +++ b/queue-4.19/closures-fix-a-race-on-wakeup-from-closure_sync.patch @@ -0,0 +1,50 @@ +From 6f7e8942d898c73f3c4caee8fd8dd3c4e145429e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 21:25:45 +0800 +Subject: closures: fix a race on wakeup from closure_sync + +From: Kent Overstreet + +[ Upstream commit a22a9602b88fabf10847f238ff81fde5f906fef7 ] + +The race was when a thread using closure_sync() notices cl->s->done == 1 +before the thread calling closure_put() calls wake_up_process(). Then, +it's possible for that thread to return and exit just before +wake_up_process() is called - so we're trying to wake up a process that +no longer exists. + +rcu_read_lock() is sufficient to protect against this, as there's an rcu +barrier somewhere in the process teardown path. + +Signed-off-by: Kent Overstreet +Acked-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/closure.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c +index 73f5319295bc9..c12cd809ab193 100644 +--- a/drivers/md/bcache/closure.c ++++ b/drivers/md/bcache/closure.c +@@ -105,8 +105,14 @@ struct closure_syncer { + + static void closure_sync_fn(struct closure *cl) + { +- cl->s->done = 1; +- wake_up_process(cl->s->task); ++ struct closure_syncer *s = cl->s; ++ struct task_struct *p; ++ ++ rcu_read_lock(); ++ p = READ_ONCE(s->task); ++ s->done = 1; ++ wake_up_process(p); ++ rcu_read_unlock(); + } + + void __sched __closure_sync(struct closure *cl) +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch b/queue-4.19/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch new file mode 100644 index 00000000000..1a4e3fbbbbc --- /dev/null +++ b/queue-4.19/dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch @@ -0,0 +1,39 @@ +From 2eb418f34e97db4076ed16203a014ac24514221c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2019 19:15:18 +0200 +Subject: dmaengine: bcm2835: Print error in case setting DMA mask fails + +From: Stefan Wahren + +[ Upstream commit 72503b25ee363827aafffc3e8d872e6a92a7e422 ] + +During enabling of the RPi 4, we found out that the driver doesn't provide +a helpful error message in case setting DMA mask fails. So add one. + +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/1563297318-4900-1-git-send-email-wahrenst@gmx.net +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/bcm2835-dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c +index 2b11d967acd02..9d782cc95c6a0 100644 +--- a/drivers/dma/bcm2835-dma.c ++++ b/drivers/dma/bcm2835-dma.c +@@ -898,8 +898,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev) + pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask; + + rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); +- if (rc) ++ if (rc) { ++ dev_err(&pdev->dev, "Unable to set DMA mask\n"); + return rc; ++ } + + od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL); + if (!od) +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-iop-adma-use-correct-printk-format-strings.patch b/queue-4.19/dmaengine-iop-adma-use-correct-printk-format-strings.patch new file mode 100644 index 00000000000..29bb762da5a --- /dev/null +++ b/queue-4.19/dmaengine-iop-adma-use-correct-printk-format-strings.patch @@ -0,0 +1,108 @@ +From 70f0ae47fb2d867457798d9732a8f6dac23729fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 18:33:17 +0200 +Subject: dmaengine: iop-adma: use correct printk format strings + +From: Arnd Bergmann + +[ Upstream commit 00c9755524fbaa28117be774d7c92fddb5ca02f3 ] + +When compile-testing on other architectures, we get lots of warnings +about incorrect format strings, like: + + drivers/dma/iop-adma.c: In function 'iop_adma_alloc_slots': + drivers/dma/iop-adma.c:307:6: warning: format '%x' expects argument of type 'unsigned int', but argument 6 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=] + + drivers/dma/iop-adma.c: In function 'iop_adma_prep_dma_memcpy': +>> drivers/dma/iop-adma.c:518:40: warning: format '%u' expects argument of type 'unsigned int', but argument 5 has type 'size_t {aka long unsigned int}' [-Wformat=] + +Use %zu for printing size_t as required, and cast the dma_addr_t +arguments to 'u64' for printing with %llx. Ideally this should use +the %pad format string, but that requires an lvalue argument that +doesn't work here. + +Link: https://lore.kernel.org/r/20190809163334.489360-3-arnd@arndb.de +Signed-off-by: Arnd Bergmann +Acked-by: Vinod Koul +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/dma/iop-adma.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c +index a410657f7bcd6..012584cf3c17b 100644 +--- a/drivers/dma/iop-adma.c ++++ b/drivers/dma/iop-adma.c +@@ -125,9 +125,9 @@ static void __iop_adma_slot_cleanup(struct iop_adma_chan *iop_chan) + list_for_each_entry_safe(iter, _iter, &iop_chan->chain, + chain_node) { + pr_debug("\tcookie: %d slot: %d busy: %d " +- "this_desc: %#x next_desc: %#x ack: %d\n", ++ "this_desc: %#x next_desc: %#llx ack: %d\n", + iter->async_tx.cookie, iter->idx, busy, +- iter->async_tx.phys, iop_desc_get_next_desc(iter), ++ iter->async_tx.phys, (u64)iop_desc_get_next_desc(iter), + async_tx_test_ack(&iter->async_tx)); + prefetch(_iter); + prefetch(&_iter->async_tx); +@@ -315,9 +315,9 @@ iop_adma_alloc_slots(struct iop_adma_chan *iop_chan, int num_slots, + int i; + dev_dbg(iop_chan->device->common.dev, + "allocated slot: %d " +- "(desc %p phys: %#x) slots_per_op %d\n", ++ "(desc %p phys: %#llx) slots_per_op %d\n", + iter->idx, iter->hw_desc, +- iter->async_tx.phys, slots_per_op); ++ (u64)iter->async_tx.phys, slots_per_op); + + /* pre-ack all but the last descriptor */ + if (num_slots != slots_per_op) +@@ -525,7 +525,7 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest, + return NULL; + BUG_ON(len > IOP_ADMA_MAX_BYTE_COUNT); + +- dev_dbg(iop_chan->device->common.dev, "%s len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s len: %zu\n", + __func__, len); + + spin_lock_bh(&iop_chan->lock); +@@ -558,7 +558,7 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest, + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + + dev_dbg(iop_chan->device->common.dev, +- "%s src_cnt: %d len: %u flags: %lx\n", ++ "%s src_cnt: %d len: %zu flags: %lx\n", + __func__, src_cnt, len, flags); + + spin_lock_bh(&iop_chan->lock); +@@ -591,7 +591,7 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src, + if (unlikely(!len)) + return NULL; + +- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", + __func__, src_cnt, len); + + spin_lock_bh(&iop_chan->lock); +@@ -629,7 +629,7 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src, + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + + dev_dbg(iop_chan->device->common.dev, +- "%s src_cnt: %d len: %u flags: %lx\n", ++ "%s src_cnt: %d len: %zu flags: %lx\n", + __func__, src_cnt, len, flags); + + if (dmaf_p_disabled_continue(flags)) +@@ -692,7 +692,7 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src, + return NULL; + BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); + +- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", ++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", + __func__, src_cnt, len); + + spin_lock_bh(&iop_chan->lock); +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch b/queue-4.19/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch new file mode 100644 index 00000000000..a065f84a78c --- /dev/null +++ b/queue-4.19/dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch @@ -0,0 +1,50 @@ +From a14fa3624455ac54228e14ecf968c626af235ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2019 15:56:14 +0300 +Subject: dmaengine: ti: edma: Do not reset reserved paRAM slots + +From: Peter Ujfalusi + +[ Upstream commit c5dbe60664b3660f5ac5854e21273ea2e7ff698f ] + +Skip resetting paRAM slots marked as reserved as they might be used by +other cores. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20190823125618.8133-2-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index ceabdea40ae0f..982631d4e1f8a 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -2273,9 +2273,6 @@ static int edma_probe(struct platform_device *pdev) + + ecc->default_queue = info->default_queue; + +- for (i = 0; i < ecc->num_slots; i++) +- edma_write_slot(ecc, i, &dummy_paramset); +- + if (info->rsv) { + /* Set the reserved slots in inuse list */ + rsv_slots = info->rsv->rsv_slots; +@@ -2288,6 +2285,12 @@ static int edma_probe(struct platform_device *pdev) + } + } + ++ for (i = 0; i < ecc->num_slots; i++) { ++ /* Reset only unused - not reserved - paRAM slots */ ++ if (!test_bit(i, ecc->slot_inuse)) ++ edma_write_slot(ecc, i, &dummy_paramset); ++ } ++ + /* Clear the xbar mapped channels in unused list */ + xbar_chans = info->xbar_chans; + if (xbar_chans) { +-- +2.20.1 + diff --git a/queue-4.19/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch b/queue-4.19/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch new file mode 100644 index 00000000000..119a3f2accf --- /dev/null +++ b/queue-4.19/drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch @@ -0,0 +1,41 @@ +From 3b141fe13e758641a51299649efa9acda908a8ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 21:14:18 +0200 +Subject: drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) + +From: Ahzo + +[ Upstream commit f659bb6dae58c113805f92822e4c16ddd3156b79 ] + +This fixes screen corruption/flickering on 75 Hz displays. + +v2: make print statement debug only (Alex) + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102646 +Reviewed-by: Evan Quan +Signed-off-by: Ahzo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index b52ccab428a9e..c7c505095402d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -4052,6 +4052,11 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr) + + data->frame_time_x2 = frame_time_in_us * 2 / 100; + ++ if (data->frame_time_x2 < 280) { ++ pr_debug("%s: enforce minimal VBITimeout: %d -> 280\n", __func__, data->frame_time_x2); ++ data->frame_time_x2 = 280; ++ } ++ + display_gap2 = pre_vbi_time_in_us * (ref_clock / 100); + + cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2); +-- +2.20.1 + diff --git a/queue-4.19/e1000e-add-workaround-for-possible-stalled-packet.patch b/queue-4.19/e1000e-add-workaround-for-possible-stalled-packet.patch new file mode 100644 index 00000000000..138da5e7013 --- /dev/null +++ b/queue-4.19/e1000e-add-workaround-for-possible-stalled-packet.patch @@ -0,0 +1,61 @@ +From 41ef0102e110f9e4ec9d1c28d6bdc209485b3c70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2019 12:55:45 +0800 +Subject: e1000e: add workaround for possible stalled packet + +From: Kai-Heng Feng + +[ Upstream commit e5e9a2ecfe780975820e157b922edee715710b66 ] + +This works around a possible stalled packet issue, which may occur due to +clock recovery from the PCH being too slow, when the LAN is transitioning +from K1 at 1G link speed. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204057 + +Signed-off-by: Kai-Heng Feng +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 10 ++++++++++ + drivers/net/ethernet/intel/e1000e/ich8lan.h | 2 +- + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index cdae0efde8e64..7998a73b6a0fa 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1429,6 +1429,16 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + else + phy_reg |= 0xFA; + e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg); ++ ++ if (speed == SPEED_1000) { ++ hw->phy.ops.read_reg_locked(hw, HV_PM_CTRL, ++ &phy_reg); ++ ++ phy_reg |= HV_PM_CTRL_K1_CLK_REQ; ++ ++ hw->phy.ops.write_reg_locked(hw, HV_PM_CTRL, ++ phy_reg); ++ } + } + hw->phy.ops.release(hw); + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index eb09c755fa172..1502895eb45dd 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -210,7 +210,7 @@ + + /* PHY Power Management Control */ + #define HV_PM_CTRL PHY_REG(770, 17) +-#define HV_PM_CTRL_PLL_STOP_IN_K1_GIGA 0x100 ++#define HV_PM_CTRL_K1_CLK_REQ 0x200 + #define HV_PM_CTRL_K1_ENABLE 0x4000 + + #define I217_PLL_CLOCK_GATE_REG PHY_REG(772, 28) +-- +2.20.1 + diff --git a/queue-4.19/edac-altera-use-the-proper-type-for-the-irq-status-b.patch b/queue-4.19/edac-altera-use-the-proper-type-for-the-irq-status-b.patch new file mode 100644 index 00000000000..9c3bb940e7c --- /dev/null +++ b/queue-4.19/edac-altera-use-the-proper-type-for-the-irq-status-b.patch @@ -0,0 +1,59 @@ +From 8c906d64856e287cb1ab6ebb0b103e3c95aa5250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2019 16:47:17 +0300 +Subject: EDAC/altera: Use the proper type for the IRQ status bits + +From: Dan Carpenter + +[ Upstream commit 8faa1cf6ed82f33009f63986c3776cc48af1b7b2 ] + +Smatch complains about the cast of a u32 pointer to unsigned long: + + drivers/edac/altera_edac.c:1878 altr_edac_a10_irq_handler() + warn: passing casted pointer '&irq_status' to 'find_first_bit()' + +This code wouldn't work on a 64 bit big endian system because it would +read past the end of &irq_status. + + [ bp: massage. ] + +Fixes: 13ab8448d2c9 ("EDAC, altera: Add ECC Manager IRQ controller support") +Signed-off-by: Dan Carpenter +Signed-off-by: Borislav Petkov +Reviewed-by: Thor Thayer +Cc: James Morse +Cc: kernel-janitors@vger.kernel.org +Cc: linux-edac +Cc: Mauro Carvalho Chehab +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20190624134717.GA1754@mwanda +Signed-off-by: Sasha Levin +--- + drivers/edac/altera_edac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c +index 5762c3c383f2e..56de378ad13dc 100644 +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1956,6 +1956,7 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc) + struct altr_arria10_edac *edac = irq_desc_get_handler_data(desc); + struct irq_chip *chip = irq_desc_get_chip(desc); + int irq = irq_desc_get_irq(desc); ++ unsigned long bits; + + dberr = (irq == edac->db_irq) ? 1 : 0; + sm_offset = dberr ? A10_SYSMGR_ECC_INTSTAT_DERR_OFST : +@@ -1965,7 +1966,8 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc) + + regmap_read(edac->ecc_mgr_map, sm_offset, &irq_status); + +- for_each_set_bit(bit, (unsigned long *)&irq_status, 32) { ++ bits = irq_status; ++ for_each_set_bit(bit, &bits, 32) { + irq = irq_linear_revmap(edac->domain, dberr * 32 + bit); + if (irq) + generic_handle_irq(irq); +-- +2.20.1 + diff --git a/queue-4.19/edac-amd64-decode-syndrome-before-translating-addres.patch b/queue-4.19/edac-amd64-decode-syndrome-before-translating-addres.patch new file mode 100644 index 00000000000..60a5b4f3909 --- /dev/null +++ b/queue-4.19/edac-amd64-decode-syndrome-before-translating-addres.patch @@ -0,0 +1,70 @@ +From 221f0ba2d6070a1a14d0ab2d4351163f6ca55d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 00:00:00 +0000 +Subject: EDAC/amd64: Decode syndrome before translating address + +From: Yazen Ghannam + +[ Upstream commit 8a2eaab7daf03b23ac902481218034ae2fae5e16 ] + +AMD Family 17h systems currently require address translation in order to +report the system address of a DRAM ECC error. This is currently done +before decoding the syndrome information. The syndrome information does +not depend on the address translation, so the proper EDAC csrow/channel +reporting can function without the address. However, the syndrome +information will not be decoded if the address translation fails. + +Decode the syndrome information before doing the address translation. +The syndrome information is architecturally defined in MCA_SYND and can +be considered robust. The address translation is system-specific and may +fail on newer systems without proper updates to the translation +algorithm. + +Fixes: 713ad54675fd ("EDAC, amd64: Define and register UMC error decode function") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Cc: "linux-edac@vger.kernel.org" +Cc: James Morse +Cc: Mauro Carvalho Chehab +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20190821235938.118710-6-Yazen.Ghannam@amd.com +Signed-off-by: Sasha Levin +--- + drivers/edac/amd64_edac.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index 1613df20774f9..94265e4385146 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -2501,13 +2501,6 @@ static void decode_umc_error(int node_id, struct mce *m) + goto log_error; + } + +- if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) { +- err.err_code = ERR_NORM_ADDR; +- goto log_error; +- } +- +- error_address_to_page_and_offset(sys_addr, &err); +- + if (!(m->status & MCI_STATUS_SYNDV)) { + err.err_code = ERR_SYND; + goto log_error; +@@ -2524,6 +2517,13 @@ static void decode_umc_error(int node_id, struct mce *m) + + err.csrow = m->synd & 0x7; + ++ if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) { ++ err.err_code = ERR_NORM_ADDR; ++ goto log_error; ++ } ++ ++ error_address_to_page_and_offset(sys_addr, &err); ++ + log_error: + __log_ecc_error(mci, &err, ecc_type); + } +-- +2.20.1 + diff --git a/queue-4.19/edac-amd64-recognize-dram-device-type-ecc-capability.patch b/queue-4.19/edac-amd64-recognize-dram-device-type-ecc-capability.patch new file mode 100644 index 00000000000..079cdb565ed --- /dev/null +++ b/queue-4.19/edac-amd64-recognize-dram-device-type-ecc-capability.patch @@ -0,0 +1,72 @@ +From 388200e9d90dc6a0ae111deb7abf9e1bf97b26a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 23:59:56 +0000 +Subject: EDAC/amd64: Recognize DRAM device type ECC capability + +From: Yazen Ghannam + +[ Upstream commit f8be8e5680225ac9caf07d4545f8529b7395327f ] + +AMD Family 17h systems support x4 and x16 DRAM devices. However, the +device type is not checked when setting mci.edac_ctl_cap. + +Set the appropriate capability flag based on the device type. + +Default to x8 DRAM device when neither the x4 or x16 bits are set. + + [ bp: reverse cpk_en check to save an indentation level. ] + +Fixes: 2d09d8f301f5 ("EDAC, amd64: Determine EDAC MC capabilities on Fam17h") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Cc: "linux-edac@vger.kernel.org" +Cc: James Morse +Cc: Mauro Carvalho Chehab +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20190821235938.118710-3-Yazen.Ghannam@amd.com +Signed-off-by: Sasha Levin +--- + drivers/edac/amd64_edac.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index e2addb2bca296..1613df20774f9 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -3101,12 +3101,15 @@ static bool ecc_enabled(struct pci_dev *F3, u16 nid) + static inline void + f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt) + { +- u8 i, ecc_en = 1, cpk_en = 1; ++ u8 i, ecc_en = 1, cpk_en = 1, dev_x4 = 1, dev_x16 = 1; + + for (i = 0; i < NUM_UMCS; i++) { + if (pvt->umc[i].sdp_ctrl & UMC_SDP_INIT) { + ecc_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_ENABLED); + cpk_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_CHIPKILL_CAP); ++ ++ dev_x4 &= !!(pvt->umc[i].dimm_cfg & BIT(6)); ++ dev_x16 &= !!(pvt->umc[i].dimm_cfg & BIT(7)); + } + } + +@@ -3114,8 +3117,15 @@ f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt) + if (ecc_en) { + mci->edac_ctl_cap |= EDAC_FLAG_SECDED; + +- if (cpk_en) ++ if (!cpk_en) ++ return; ++ ++ if (dev_x4) + mci->edac_ctl_cap |= EDAC_FLAG_S4ECD4ED; ++ else if (dev_x16) ++ mci->edac_ctl_cap |= EDAC_FLAG_S16ECD16ED; ++ else ++ mci->edac_ctl_cap |= EDAC_FLAG_S8ECD8ED; + } + } + +-- +2.20.1 + diff --git a/queue-4.19/edac-mc-fix-grain_bits-calculation.patch b/queue-4.19/edac-mc-fix-grain_bits-calculation.patch new file mode 100644 index 00000000000..2280142526b --- /dev/null +++ b/queue-4.19/edac-mc-fix-grain_bits-calculation.patch @@ -0,0 +1,80 @@ +From 0efd3c7b397407c6ad2f3b8a8f9a95750413a21c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2019 15:08:55 +0000 +Subject: EDAC/mc: Fix grain_bits calculation + +From: Robert Richter + +[ Upstream commit 3724ace582d9f675134985727fd5e9811f23c059 ] + +The grain in EDAC is defined as "minimum granularity for an error +report, in bytes". The following calculation of the grain_bits in +edac_mc is wrong: + + grain_bits = fls_long(e->grain) + 1; + +Where grain_bits is defined as: + + grain = 1 << grain_bits + +Example: + + grain = 8 # 64 bit (8 bytes) + grain_bits = fls_long(8) + 1 + grain_bits = 4 + 1 = 5 + + grain = 1 << grain_bits + grain = 1 << 5 = 32 + +Replace it with the correct calculation: + + grain_bits = fls_long(e->grain - 1); + +The example gives now: + + grain_bits = fls_long(8 - 1) + grain_bits = fls_long(7) + grain_bits = 3 + + grain = 1 << 3 = 8 + +Also, check if the hardware reports a reasonable grain != 0 and fallback +with a warning to 1 byte granularity otherwise. + + [ bp: massage a bit. ] + +Signed-off-by: Robert Richter +Signed-off-by: Borislav Petkov +Cc: "linux-edac@vger.kernel.org" +Cc: James Morse +Cc: Mauro Carvalho Chehab +Cc: Tony Luck +Link: https://lkml.kernel.org/r/20190624150758.6695-2-rrichter@marvell.com +Signed-off-by: Sasha Levin +--- + drivers/edac/edac_mc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index 7d3edd7139328..f59511bd99261 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -1246,9 +1246,13 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type, + if (p > e->location) + *(p - 1) = '\0'; + +- /* Report the error via the trace interface */ +- grain_bits = fls_long(e->grain) + 1; ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); + ++ /* Report the error via the trace interface */ + if (IS_ENABLED(CONFIG_RAS)) + trace_mc_event(type, e->msg, e->label, e->error_count, + mci->mc_idx, e->top_layer, e->mid_layer, +-- +2.20.1 + diff --git a/queue-4.19/edac-pnd2-fix-ioremap-size-in-dnv_rd_reg.patch b/queue-4.19/edac-pnd2-fix-ioremap-size-in-dnv_rd_reg.patch new file mode 100644 index 00000000000..d7184a16532 --- /dev/null +++ b/queue-4.19/edac-pnd2-fix-ioremap-size-in-dnv_rd_reg.patch @@ -0,0 +1,67 @@ +From 44e111a8237d3729390b330bdd406443dfc359fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 14:18:02 +0000 +Subject: EDAC, pnd2: Fix ioremap() size in dnv_rd_reg() + +From: Stephen Douthit + +[ Upstream commit 29a3388bfcce7a6d087051376ea02bf8326a957b ] + +Depending on how BIOS has marked the reserved region containing the 32KB +MCHBAR you can get warnings like: + +resource sanity check: requesting [mem 0xfed10000-0xfed1ffff], which spans more than reserved [mem 0xfed10000-0xfed17fff] +caller dnv_rd_reg+0xc8/0x240 [pnd2_edac] mapping multiple BARs + +Not all of the mmio regions used in dnv_rd_reg() are the same size. The +MCHBAR window is 32KB and the sideband ports are 64KB. Pass the correct +size to ioremap() depending on which resource we're reading from. + +Signed-off-by: Stephen Douthit +Signed-off-by: Tony Luck +Signed-off-by: Sasha Levin +--- + drivers/edac/pnd2_edac.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c +index 903a4f1fadcc3..0153c730750e5 100644 +--- a/drivers/edac/pnd2_edac.c ++++ b/drivers/edac/pnd2_edac.c +@@ -268,11 +268,14 @@ static u64 get_sideband_reg_base_addr(void) + } + } + ++#define DNV_MCHBAR_SIZE 0x8000 ++#define DNV_SB_PORT_SIZE 0x10000 + static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name) + { + struct pci_dev *pdev; + char *base; + u64 addr; ++ unsigned long size; + + if (op == 4) { + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL); +@@ -287,15 +290,17 @@ static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *na + addr = get_mem_ctrl_hub_base_addr(); + if (!addr) + return -ENODEV; ++ size = DNV_MCHBAR_SIZE; + } else { + /* MMIO via sideband register base address */ + addr = get_sideband_reg_base_addr(); + if (!addr) + return -ENODEV; + addr += (port << 16); ++ size = DNV_SB_PORT_SIZE; + } + +- base = ioremap((resource_size_t)addr, 0x10000); ++ base = ioremap((resource_size_t)addr, size); + if (!base) + return -ENODEV; + +-- +2.20.1 + diff --git a/queue-4.19/efi-cper-print-aer-info-of-pcie-fatal-error.patch b/queue-4.19/efi-cper-print-aer-info-of-pcie-fatal-error.patch new file mode 100644 index 00000000000..94470a507d7 --- /dev/null +++ b/queue-4.19/efi-cper-print-aer-info-of-pcie-fatal-error.patch @@ -0,0 +1,89 @@ +From 2c8c121c8c03528230622e7628fcf7aa5cb84046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 09:43:37 +0800 +Subject: efi: cper: print AER info of PCIe fatal error + +From: Xiaofei Tan + +[ Upstream commit b194a77fcc4001dc40aecdd15d249648e8a436d1 ] + +AER info of PCIe fatal error is not printed in the current driver. +Because APEI driver will panic directly for fatal error, and can't +run to the place of printing AER info. + +An example log is as following: +{763}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 11 +{763}[Hardware Error]: event severity: fatal +{763}[Hardware Error]: Error 0, type: fatal +{763}[Hardware Error]: section_type: PCIe error +{763}[Hardware Error]: port_type: 0, PCIe end point +{763}[Hardware Error]: version: 4.0 +{763}[Hardware Error]: command: 0x0000, status: 0x0010 +{763}[Hardware Error]: device_id: 0000:82:00.0 +{763}[Hardware Error]: slot: 0 +{763}[Hardware Error]: secondary_bus: 0x00 +{763}[Hardware Error]: vendor_id: 0x8086, device_id: 0x10fb +{763}[Hardware Error]: class_code: 000002 +Kernel panic - not syncing: Fatal hardware error! + +This issue was imported by the patch, '37448adfc7ce ("aerdrv: Move +cper_print_aer() call out of interrupt context")'. To fix this issue, +this patch adds print of AER info in cper_print_pcie() for fatal error. + +Here is the example log after this patch applied: +{24}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 10 +{24}[Hardware Error]: event severity: fatal +{24}[Hardware Error]: Error 0, type: fatal +{24}[Hardware Error]: section_type: PCIe error +{24}[Hardware Error]: port_type: 0, PCIe end point +{24}[Hardware Error]: version: 4.0 +{24}[Hardware Error]: command: 0x0546, status: 0x4010 +{24}[Hardware Error]: device_id: 0000:01:00.0 +{24}[Hardware Error]: slot: 0 +{24}[Hardware Error]: secondary_bus: 0x00 +{24}[Hardware Error]: vendor_id: 0x15b3, device_id: 0x1019 +{24}[Hardware Error]: class_code: 000002 +{24}[Hardware Error]: aer_uncor_status: 0x00040000, aer_uncor_mask: 0x00000000 +{24}[Hardware Error]: aer_uncor_severity: 0x00062010 +{24}[Hardware Error]: TLP Header: 000000c0 01010000 00000001 00000000 +Kernel panic - not syncing: Fatal hardware error! + +Fixes: 37448adfc7ce ("aerdrv: Move cper_print_aer() call out of interrupt context") +Signed-off-by: Xiaofei Tan +Reviewed-by: James Morse +[ardb: put parens around terms of && operator] +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/cper.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 6090d25dce85e..4045098ddb860 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -402,6 +402,21 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie, + printk( + "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n", + pfx, pcie->bridge.secondary_status, pcie->bridge.control); ++ ++ /* Fatal errors call __ghes_panic() before AER handler prints this */ ++ if ((pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) && ++ (gdata->error_severity & CPER_SEV_FATAL)) { ++ struct aer_capability_regs *aer; ++ ++ aer = (struct aer_capability_regs *)pcie->aer_info; ++ printk("%saer_uncor_status: 0x%08x, aer_uncor_mask: 0x%08x\n", ++ pfx, aer->uncor_status, aer->uncor_mask); ++ printk("%saer_uncor_severity: 0x%08x\n", ++ pfx, aer->uncor_severity); ++ printk("%sTLP Header: %08x %08x %08x %08x\n", pfx, ++ aer->header_log.dw0, aer->header_log.dw1, ++ aer->header_log.dw2, aer->header_log.dw3); ++ } + } + + static void cper_print_tstamp(const char *pfx, +-- +2.20.1 + diff --git a/queue-4.19/firmware-arm_scmi-check-if-platform-has-released-shm.patch b/queue-4.19/firmware-arm_scmi-check-if-platform-has-released-shm.patch new file mode 100644 index 00000000000..dde34299eac --- /dev/null +++ b/queue-4.19/firmware-arm_scmi-check-if-platform-has-released-shm.patch @@ -0,0 +1,54 @@ +From 498274e7447ded076291b4de0cbe05a621b6c1b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2019 15:48:36 +0100 +Subject: firmware: arm_scmi: Check if platform has released shmem before using + +From: Sudeep Holla + +[ Upstream commit 9dc34d635c67e57051853855c43249408641a5ab ] + +Sometimes platfom may take too long to respond to the command and OS +might timeout before platform transfer the ownership of the shared +memory region to the OS with the response. + +Since the mailbox channel associated with the channel is freed and new +commands are dispatch on the same channel, OS needs to wait until it +gets back the ownership. If not, either OS may end up overwriting the +platform response for the last command(which is fine as OS timed out +that command) or platform might overwrite the payload for the next +command with the response for the old. + +The latter is problematic as platform may end up interpretting the +response as the payload. In order to avoid such race, let's wait until +the OS gets back the ownership before we prepare the shared memory with +the payload for the next command. + +Reported-by: Jim Quinlan +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 8f952f2f1a292..09119e3f5c018 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -271,6 +271,14 @@ static void scmi_tx_prepare(struct mbox_client *cl, void *m) + struct scmi_chan_info *cinfo = client_to_scmi_chan_info(cl); + struct scmi_shared_mem __iomem *mem = cinfo->payload; + ++ /* ++ * Ideally channel must be free by now unless OS timeout last ++ * request and platform continued to process the same, wait ++ * until it releases the shared memory, otherwise we may endup ++ * overwriting its response with new message payload or vice-versa ++ */ ++ spin_until_cond(ioread32(&mem->channel_status) & ++ SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE); + /* Mark channel busy + clear error */ + iowrite32(0x0, &mem->channel_status); + iowrite32(t->hdr.poll_completion ? 0 : SCMI_SHMEM_FLAG_INTR_ENABLED, +-- +2.20.1 + diff --git a/queue-4.19/firmware-qcom_scm-use-proper-types-for-dma-mappings.patch b/queue-4.19/firmware-qcom_scm-use-proper-types-for-dma-mappings.patch new file mode 100644 index 00000000000..976510c7e82 --- /dev/null +++ b/queue-4.19/firmware-qcom_scm-use-proper-types-for-dma-mappings.patch @@ -0,0 +1,80 @@ +From 9b3d89df83251ecde34e6c29d26a82f8fe168a4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2019 14:09:21 -0700 +Subject: firmware: qcom_scm: Use proper types for dma mappings + +From: Stephen Boyd + +[ Upstream commit 6e37ccf78a53296c6c7bf426065762c27829eb84 ] + +We need to use the proper types and convert between physical addresses +and dma addresses here to avoid mismatch warnings. This is especially +important on systems with a different size for dma addresses and +physical addresses. Otherwise, we get the following warning: + + drivers/firmware/qcom_scm.c: In function "qcom_scm_assign_mem": + drivers/firmware/qcom_scm.c:469:47: error: passing argument 3 of "dma_alloc_coherent" from incompatible pointer type [-Werror=incompatible-pointer-types] + +We also fix the size argument to dma_free_coherent() because that size +doesn't need to be aligned after it's already aligned on the allocation +size. In fact, dma debugging expects the same arguments to be passed to +both the allocation and freeing sides of the functions so changing the +size is incorrect regardless. + +Reported-by: Ian Jackson +Cc: Ian Jackson +Cc: Julien Grall +Cc: Bjorn Andersson +Cc: Avaneesh Kumar Dwivedi +Tested-by: Bjorn Andersson +Signed-off-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index e778af766fae3..98c987188835b 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -449,6 +450,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz, + phys_addr_t mem_to_map_phys; + phys_addr_t dest_phys; + phys_addr_t ptr_phys; ++ dma_addr_t ptr_dma; + size_t mem_to_map_sz; + size_t dest_sz; + size_t src_sz; +@@ -466,9 +468,10 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz, + ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) + + ALIGN(dest_sz, SZ_64); + +- ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_phys, GFP_KERNEL); ++ ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_dma, GFP_KERNEL); + if (!ptr) + return -ENOMEM; ++ ptr_phys = dma_to_phys(__scm->dev, ptr_dma); + + /* Fill source vmid detail */ + src = ptr; +@@ -498,7 +501,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz, + + ret = __qcom_scm_assign_mem(__scm->dev, mem_to_map_phys, mem_to_map_sz, + ptr_phys, src_sz, dest_phys, dest_sz); +- dma_free_coherent(__scm->dev, ALIGN(ptr_sz, SZ_64), ptr, ptr_phys); ++ dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_dma); + if (ret) { + dev_err(__scm->dev, + "Assign memory protection call failed %d.\n", ret); +-- +2.20.1 + diff --git a/queue-4.19/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch b/queue-4.19/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch new file mode 100644 index 00000000000..d714db21000 --- /dev/null +++ b/queue-4.19/hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch @@ -0,0 +1,51 @@ +From 602965c2704b96168c9b6798f073b70060b7f8aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:01:10 +0300 +Subject: hwmon: (acpi_power_meter) Change log level for 'unsafe software power + cap' + +From: Wang Shenran + +[ Upstream commit 6e4d91aa071810deac2cd052161aefb376ecf04e ] + +At boot time, the acpi_power_meter driver logs the following error level +message: "Ignoring unsafe software power cap". Having read about it from +a few sources, it seems that the error message can be quite misleading. + +While the message can imply that Linux is ignoring the fact that the +system is operating in potentially dangerous conditions, the truth is +the driver found an ACPI_PMC object that supports software power +capping. The driver simply decides not to use it, perhaps because it +doesn't support the object. + +The best solution is probably changing the log level from error to warning. +All sources I have found, regarding the error, have downplayed its +significance. There is not much of a reason for it to be on error level, +while causing potential confusions or misinterpretations. + +Signed-off-by: Wang Shenran +Link: https://lore.kernel.org/r/20190724080110.6952-1-shenran268@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/acpi_power_meter.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c +index 34e45b97629ed..2f2fb19669580 100644 +--- a/drivers/hwmon/acpi_power_meter.c ++++ b/drivers/hwmon/acpi_power_meter.c +@@ -694,8 +694,8 @@ static int setup_attrs(struct acpi_power_meter_resource *resource) + + if (resource->caps.flags & POWER_METER_CAN_CAP) { + if (!can_cap_in_hardware()) { +- dev_err(&resource->acpi_dev->dev, +- "Ignoring unsafe software power cap!\n"); ++ dev_warn(&resource->acpi_dev->dev, ++ "Ignoring unsafe software power cap!\n"); + goto skip_unsafe_cap; + } + +-- +2.20.1 + diff --git a/queue-4.19/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch b/queue-4.19/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch new file mode 100644 index 00000000000..69aa813003d --- /dev/null +++ b/queue-4.19/ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch @@ -0,0 +1,56 @@ +From 3ced255d67d3df11695100bfa2743cef3c12d699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2019 15:46:33 +0800 +Subject: ia64:unwind: fix double free for mod->arch.init_unw_table + +From: chenzefeng + +[ Upstream commit c5e5c48c16422521d363c33cfb0dcf58f88c119b ] + +The function free_module in file kernel/module.c as follow: + +void free_module(struct module *mod) { + ...... + module_arch_cleanup(mod); + ...... + module_arch_freeing_init(mod); + ...... +} + +Both module_arch_cleanup and module_arch_freeing_init function +would free the mod->arch.init_unw_table, which cause double free. + +Here, set mod->arch.init_unw_table = NULL after remove the unwind +table to avoid double free. + +Signed-off-by: chenzefeng +Signed-off-by: Tony Luck +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/module.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c +index 326448f9df160..1a42ba885188a 100644 +--- a/arch/ia64/kernel/module.c ++++ b/arch/ia64/kernel/module.c +@@ -914,10 +914,14 @@ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mo + void + module_arch_cleanup (struct module *mod) + { +- if (mod->arch.init_unw_table) ++ if (mod->arch.init_unw_table) { + unw_remove_unwind_table(mod->arch.init_unw_table); +- if (mod->arch.core_unw_table) ++ mod->arch.init_unw_table = NULL; ++ } ++ if (mod->arch.core_unw_table) { + unw_remove_unwind_table(mod->arch.core_unw_table); ++ mod->arch.core_unw_table = NULL; ++ } + } + + void *dereference_module_function_descriptor(struct module *mod, void *ptr) +-- +2.20.1 + diff --git a/queue-4.19/idle-prevent-late-arriving-interrupts-from-disruptin.patch b/queue-4.19/idle-prevent-late-arriving-interrupts-from-disruptin.patch new file mode 100644 index 00000000000..5f9dcad8a8b --- /dev/null +++ b/queue-4.19/idle-prevent-late-arriving-interrupts-from-disruptin.patch @@ -0,0 +1,111 @@ +From 82dd15ee674cc6bc973184c9db5e09aab69e4637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2019 07:46:43 -0700 +Subject: idle: Prevent late-arriving interrupts from disrupting offline + +From: Peter Zijlstra + +[ Upstream commit e78a7614f3876ac649b3df608789cb6ef74d0480 ] + +Scheduling-clock interrupts can arrive late in the CPU-offline process, +after idle entry and the subsequent call to cpuhp_report_idle_dead(). +Once execution passes the call to rcu_report_dead(), RCU is ignoring +the CPU, which results in lockdep complaints when the interrupt handler +uses RCU: + +------------------------------------------------------------------------ + +============================= +WARNING: suspicious RCU usage +5.2.0-rc1+ #681 Not tainted +----------------------------- +kernel/sched/fair.c:9542 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +RCU used illegally from offline CPU! +rcu_scheduler_active = 2, debug_locks = 1 +no locks held by swapper/5/0. + +stack backtrace: +CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.2.0-rc1+ #681 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Bochs 01/01/2011 +Call Trace: + + dump_stack+0x5e/0x8b + trigger_load_balance+0xa8/0x390 + ? tick_sched_do_timer+0x60/0x60 + update_process_times+0x3b/0x50 + tick_sched_handle+0x2f/0x40 + tick_sched_timer+0x32/0x70 + __hrtimer_run_queues+0xd3/0x3b0 + hrtimer_interrupt+0x11d/0x270 + ? sched_clock_local+0xc/0x74 + smp_apic_timer_interrupt+0x79/0x200 + apic_timer_interrupt+0xf/0x20 + +RIP: 0010:delay_tsc+0x22/0x50 +Code: ff 0f 1f 80 00 00 00 00 65 44 8b 05 18 a7 11 48 0f ae e8 0f 31 48 89 d6 48 c1 e6 20 48 09 c6 eb 0e f3 90 65 8b 05 fe a6 11 48 <41> 39 c0 75 18 0f ae e8 0f 31 48 c1 e2 20 48 09 c2 48 89 d0 48 29 +RSP: 0000:ffff8f92c0157ed0 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 +RAX: 0000000000000005 RBX: ffff8c861f356400 RCX: ffff8f92c0157e64 +RDX: 000000321214c8cc RSI: 00000032120daa7f RDI: 0000000000260f15 +RBP: 0000000000000005 R08: 0000000000000005 R09: 0000000000000000 +R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 +R13: 0000000000000000 R14: ffff8c861ee18000 R15: ffff8c861ee18000 + cpuhp_report_idle_dead+0x31/0x60 + do_idle+0x1d5/0x200 + ? _raw_spin_unlock_irqrestore+0x2d/0x40 + cpu_startup_entry+0x14/0x20 + start_secondary+0x151/0x170 + secondary_startup_64+0xa4/0xb0 + +------------------------------------------------------------------------ + +This happens rarely, but can be forced by happen more often by +placing delays in cpuhp_report_idle_dead() following the call to +rcu_report_dead(). With this in place, the following rcutorture +scenario reproduces the problem within a few minutes: + +tools/testing/selftests/rcutorture/bin/kvm.sh --cpus 8 --duration 5 --kconfig "CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y" --configs "TREE04" + +This commit uses the crude but effective expedient of moving the disabling +of interrupts within the idle loop to precede the cpu_is_offline() +check. It also invokes tick_nohz_idle_stop_tick() instead of +tick_nohz_idle_stop_tick_protected() to shut off the scheduling-clock +interrupt. + +Signed-off-by: Peter Zijlstra +Cc: Frederic Weisbecker +Cc: Thomas Gleixner +Cc: Ingo Molnar +[ paulmck: Revert tick_nohz_idle_stop_tick_protected() removal, new callers. ] +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/sched/idle.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c +index 16f84142f2f49..44a17366c8ec2 100644 +--- a/kernel/sched/idle.c ++++ b/kernel/sched/idle.c +@@ -240,13 +240,14 @@ static void do_idle(void) + check_pgt_cache(); + rmb(); + ++ local_irq_disable(); ++ + if (cpu_is_offline(cpu)) { +- tick_nohz_idle_stop_tick_protected(); ++ tick_nohz_idle_stop_tick(); + cpuhp_report_idle_dead(); + arch_cpu_idle_dead(); + } + +- local_irq_disable(); + arch_cpu_idle_enter(); + + /* +-- +2.20.1 + diff --git a/queue-4.19/iommu-amd-override-wrong-ivrs-ioapic-on-raven-ridge-.patch b/queue-4.19/iommu-amd-override-wrong-ivrs-ioapic-on-raven-ridge-.patch new file mode 100644 index 00000000000..4690d9da3fa --- /dev/null +++ b/queue-4.19/iommu-amd-override-wrong-ivrs-ioapic-on-raven-ridge-.patch @@ -0,0 +1,194 @@ +From 8b173f939740dede6f3ff13a3c1f215252b1bf36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 13:10:04 +0800 +Subject: iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems + +From: Kai-Heng Feng + +[ Upstream commit 93d051550ee02eaff9a2541d825605a7bd778027 ] + +Raven Ridge systems may have malfunction touchpad or hang at boot if +incorrect IVRS IOAPIC is provided by BIOS. + +Users already found correct "ivrs_ioapic=" values, let's put them inside +kernel to workaround buggy BIOS. + +BugLink: https://bugs.launchpad.net/bugs/1795292 +BugLink: https://bugs.launchpad.net/bugs/1837688 +Reported-by: kbuild test robot +Signed-off-by: Kai-Heng Feng +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/Makefile | 2 +- + drivers/iommu/amd_iommu.h | 14 +++++ + drivers/iommu/amd_iommu_init.c | 5 +- + drivers/iommu/amd_iommu_quirks.c | 92 ++++++++++++++++++++++++++++++++ + 4 files changed, 111 insertions(+), 2 deletions(-) + create mode 100644 drivers/iommu/amd_iommu.h + create mode 100644 drivers/iommu/amd_iommu_quirks.c + +diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile +index ab5eba6edf82b..e13ea199f5896 100644 +--- a/drivers/iommu/Makefile ++++ b/drivers/iommu/Makefile +@@ -10,7 +10,7 @@ obj-$(CONFIG_IOMMU_IO_PGTABLE_LPAE) += io-pgtable-arm.o + obj-$(CONFIG_IOMMU_IOVA) += iova.o + obj-$(CONFIG_OF_IOMMU) += of_iommu.o + obj-$(CONFIG_MSM_IOMMU) += msm_iommu.o +-obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o ++obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o amd_iommu_quirks.o + obj-$(CONFIG_AMD_IOMMU_DEBUGFS) += amd_iommu_debugfs.o + obj-$(CONFIG_AMD_IOMMU_V2) += amd_iommu_v2.o + obj-$(CONFIG_ARM_SMMU) += arm-smmu.o +diff --git a/drivers/iommu/amd_iommu.h b/drivers/iommu/amd_iommu.h +new file mode 100644 +index 0000000000000..12d540d9b59b0 +--- /dev/null ++++ b/drivers/iommu/amd_iommu.h +@@ -0,0 +1,14 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++#ifndef AMD_IOMMU_H ++#define AMD_IOMMU_H ++ ++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line); ++ ++#ifdef CONFIG_DMI ++void amd_iommu_apply_ivrs_quirks(void); ++#else ++static void amd_iommu_apply_ivrs_quirks(void) { } ++#endif ++ ++#endif +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 66b4800bcdd8b..1e9a5da562f0d 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -39,6 +39,7 @@ + #include + + #include ++#include "amd_iommu.h" + #include "amd_iommu_proto.h" + #include "amd_iommu_types.h" + #include "irq_remapping.h" +@@ -1002,7 +1003,7 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu, + set_iommu_for_device(iommu, devid); + } + +-static int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line) ++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line) + { + struct devid_map *entry; + struct list_head *list; +@@ -1153,6 +1154,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + if (ret) + return ret; + ++ amd_iommu_apply_ivrs_quirks(); ++ + /* + * First save the recommended feature enable bits from ACPI + */ +diff --git a/drivers/iommu/amd_iommu_quirks.c b/drivers/iommu/amd_iommu_quirks.c +new file mode 100644 +index 0000000000000..c235f79b7a200 +--- /dev/null ++++ b/drivers/iommu/amd_iommu_quirks.c +@@ -0,0 +1,92 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++/* ++ * Quirks for AMD IOMMU ++ * ++ * Copyright (C) 2019 Kai-Heng Feng ++ */ ++ ++#ifdef CONFIG_DMI ++#include ++ ++#include "amd_iommu.h" ++ ++#define IVHD_SPECIAL_IOAPIC 1 ++ ++struct ivrs_quirk_entry { ++ u8 id; ++ u16 devid; ++}; ++ ++enum { ++ DELL_INSPIRON_7375 = 0, ++ DELL_LATITUDE_5495, ++ LENOVO_IDEAPAD_330S_15ARR, ++}; ++ ++static const struct ivrs_quirk_entry ivrs_ioapic_quirks[][3] __initconst = { ++ /* ivrs_ioapic[4]=00:14.0 ivrs_ioapic[5]=00:00.2 */ ++ [DELL_INSPIRON_7375] = { ++ { .id = 4, .devid = 0xa0 }, ++ { .id = 5, .devid = 0x2 }, ++ {} ++ }, ++ /* ivrs_ioapic[4]=00:14.0 */ ++ [DELL_LATITUDE_5495] = { ++ { .id = 4, .devid = 0xa0 }, ++ {} ++ }, ++ /* ivrs_ioapic[32]=00:14.0 */ ++ [LENOVO_IDEAPAD_330S_15ARR] = { ++ { .id = 32, .devid = 0xa0 }, ++ {} ++ }, ++ {} ++}; ++ ++static int __init ivrs_ioapic_quirk_cb(const struct dmi_system_id *d) ++{ ++ const struct ivrs_quirk_entry *i; ++ ++ for (i = d->driver_data; i->id != 0 && i->devid != 0; i++) ++ add_special_device(IVHD_SPECIAL_IOAPIC, i->id, (u16 *)&i->devid, 0); ++ ++ return 0; ++} ++ ++static const struct dmi_system_id ivrs_quirks[] __initconst = { ++ { ++ .callback = ivrs_ioapic_quirk_cb, ++ .ident = "Dell Inspiron 7375", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7375"), ++ }, ++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_INSPIRON_7375], ++ }, ++ { ++ .callback = ivrs_ioapic_quirk_cb, ++ .ident = "Dell Latitude 5495", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 5495"), ++ }, ++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495], ++ }, ++ { ++ .callback = ivrs_ioapic_quirk_cb, ++ .ident = "Lenovo ideapad 330S-15ARR", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "81FB"), ++ }, ++ .driver_data = (void *)&ivrs_ioapic_quirks[LENOVO_IDEAPAD_330S_15ARR], ++ }, ++ {} ++}; ++ ++void __init amd_iommu_apply_ivrs_quirks(void) ++{ ++ dmi_check_system(ivrs_quirks); ++} ++#endif +-- +2.20.1 + diff --git a/queue-4.19/iommu-amd-silence-warnings-under-memory-pressure.patch b/queue-4.19/iommu-amd-silence-warnings-under-memory-pressure.patch new file mode 100644 index 00000000000..3ad84de1294 --- /dev/null +++ b/queue-4.19/iommu-amd-silence-warnings-under-memory-pressure.patch @@ -0,0 +1,64 @@ +From d41098ae4df03a760fc54a83397d1d68b1c5a42a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 17:39:43 -0400 +Subject: iommu/amd: Silence warnings under memory pressure + +From: Qian Cai + +[ Upstream commit 3d708895325b78506e8daf00ef31549476e8586a ] + +When running heavy memory pressure workloads, the system is throwing +endless warnings, + +smartpqi 0000:23:00.0: AMD-Vi: IOMMU mapping error in map_sg (io-pages: +5 reason: -12) +Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 +07/10/2019 +swapper/10: page allocation failure: order:0, mode:0xa20(GFP_ATOMIC), +nodemask=(null),cpuset=/,mems_allowed=0,4 +Call Trace: + + dump_stack+0x62/0x9a + warn_alloc.cold.43+0x8a/0x148 + __alloc_pages_nodemask+0x1a5c/0x1bb0 + get_zeroed_page+0x16/0x20 + iommu_map_page+0x477/0x540 + map_sg+0x1ce/0x2f0 + scsi_dma_map+0xc6/0x160 + pqi_raid_submit_scsi_cmd_with_io_request+0x1c3/0x470 [smartpqi] + do_IRQ+0x81/0x170 + common_interrupt+0xf/0xf + + +because the allocation could fail from iommu_map_page(), and the volume +of this call could be huge which may generate a lot of serial console +output and cosumes all CPUs. + +Fix it by silencing the warning in this call site, and there is still a +dev_err() later to notify the failure. + +Signed-off-by: Qian Cai +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 69c269dc4f1bf..1f2ed44de2438 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2563,7 +2563,9 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, + + bus_addr = address + s->dma_address + (j << PAGE_SHIFT); + phys_addr = (sg_phys(s) & PAGE_MASK) + (j << PAGE_SHIFT); +- ret = iommu_map_page(domain, bus_addr, phys_addr, PAGE_SIZE, prot, GFP_ATOMIC); ++ ret = iommu_map_page(domain, bus_addr, phys_addr, ++ PAGE_SIZE, prot, ++ GFP_ATOMIC | __GFP_NOWARN); + if (ret) + goto out_unmap; + +-- +2.20.1 + diff --git a/queue-4.19/iommu-iova-avoid-false-sharing-on-fq_timer_on.patch b/queue-4.19/iommu-iova-avoid-false-sharing-on-fq_timer_on.patch new file mode 100644 index 00000000000..f7a23a655f3 --- /dev/null +++ b/queue-4.19/iommu-iova-avoid-false-sharing-on-fq_timer_on.patch @@ -0,0 +1,51 @@ +From ccdd53ccea85a41a6a792e0753c0dc6e3cdaed8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 06:13:38 -0700 +Subject: iommu/iova: Avoid false sharing on fq_timer_on + +From: Eric Dumazet + +[ Upstream commit 0d87308cca2c124f9bce02383f1d9632c9be89c4 ] + +In commit 14bd9a607f90 ("iommu/iova: Separate atomic variables +to improve performance") Jinyu Qi identified that the atomic_cmpxchg() +in queue_iova() was causing a performance loss and moved critical fields +so that the false sharing would not impact them. + +However, avoiding the false sharing in the first place seems easy. +We should attempt the atomic_cmpxchg() no more than 100 times +per second. Adding an atomic_read() will keep the cache +line mostly shared. + +This false sharing came with commit 9a005a800ae8 +("iommu/iova: Add flush timer"). + +Signed-off-by: Eric Dumazet +Fixes: 9a005a800ae8 ('iommu/iova: Add flush timer') +Cc: Jinyu Qi +Cc: Joerg Roedel +Acked-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iova.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 9a576ae837dcb..da4516fbf5425 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -580,7 +580,9 @@ void queue_iova(struct iova_domain *iovad, + + spin_unlock_irqrestore(&fq->lock, flags); + +- if (atomic_cmpxchg(&iovad->fq_timer_on, 0, 1) == 0) ++ /* Avoid false sharing as much as possible. */ ++ if (!atomic_read(&iovad->fq_timer_on) && ++ !atomic_cmpxchg(&iovad->fq_timer_on, 0, 1)) + mod_timer(&iovad->fq_timer, + jiffies + msecs_to_jiffies(IOVA_FQ_TIMEOUT)); + } +-- +2.20.1 + diff --git a/queue-4.19/kprobes-prohibit-probing-on-bug-and-warn-address.patch b/queue-4.19/kprobes-prohibit-probing-on-bug-and-warn-address.patch new file mode 100644 index 00000000000..430eeca1694 --- /dev/null +++ b/queue-4.19/kprobes-prohibit-probing-on-bug-and-warn-address.patch @@ -0,0 +1,70 @@ +From c94f342cc90b987bf8076af4f9ab982957ef8628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 20:08:21 +0900 +Subject: kprobes: Prohibit probing on BUG() and WARN() address + +From: Masami Hiramatsu + +[ Upstream commit e336b4027775cb458dc713745e526fa1a1996b2a ] + +Since BUG() and WARN() may use a trap (e.g. UD2 on x86) to +get the address where the BUG() has occurred, kprobes can not +do single-step out-of-line that instruction. So prohibit +probing on such address. + +Without this fix, if someone put a kprobe on WARN(), the +kernel will crash with invalid opcode error instead of +outputing warning message, because kernel can not find +correct bug address. + +Signed-off-by: Masami Hiramatsu +Acked-by: Steven Rostedt (VMware) +Acked-by: Naveen N. Rao +Cc: Anil S Keshavamurthy +Cc: David S . Miller +Cc: Linus Torvalds +Cc: Naveen N . Rao +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/156750890133.19112.3393666300746167111.stgit@devnote2 +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + include/linux/bug.h | 5 +++++ + kernel/kprobes.c | 3 ++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/bug.h b/include/linux/bug.h +index fe5916550da8c..f639bd0122f39 100644 +--- a/include/linux/bug.h ++++ b/include/linux/bug.h +@@ -47,6 +47,11 @@ void generic_bug_clear_once(void); + + #else /* !CONFIG_GENERIC_BUG */ + ++static inline void *find_bug(unsigned long bugaddr) ++{ ++ return NULL; ++} ++ + static inline enum bug_trap_type report_bug(unsigned long bug_addr, + struct pt_regs *regs) + { +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 714d63f60460b..b8efca9dc2cbb 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1505,7 +1505,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + /* Ensure it is not in reserved area nor out of text */ + if (!kernel_text_address((unsigned long) p->addr) || + within_kprobe_blacklist((unsigned long) p->addr) || +- jump_label_text_reserved(p->addr, p->addr)) { ++ jump_label_text_reserved(p->addr, p->addr) || ++ find_bug((unsigned long)p->addr)) { + ret = -EINVAL; + goto out; + } +-- +2.20.1 + diff --git a/queue-4.19/led-triggers-fix-a-memory-leak-bug.patch b/queue-4.19/led-triggers-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..d306cd305bb --- /dev/null +++ b/queue-4.19/led-triggers-fix-a-memory-leak-bug.patch @@ -0,0 +1,38 @@ +From 0dacba1a1b75f177c0e3b112374afef9ae55f5d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 15:41:42 -0500 +Subject: led: triggers: Fix a memory leak bug + +From: Wenwen Wang + +[ Upstream commit 60e2dde1e91ae0addb21ac380cc36ebee7534e49 ] + +In led_trigger_set(), 'event' is allocated in kasprintf(). However, it is +not deallocated in the following execution if the label 'err_activate' or +'err_add_groups' is entered, leading to memory leaks. To fix this issue, +free 'event' before returning the error. + +Fixes: 52c47742f79d ("leds: triggers: send uevent when changing triggers") +Signed-off-by: Wenwen Wang +Acked-by: Pavel Machek +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +--- + drivers/leds/led-triggers.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c +index 17d73db1456eb..e4cb3811e82a3 100644 +--- a/drivers/leds/led-triggers.c ++++ b/drivers/leds/led-triggers.c +@@ -177,6 +177,7 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) + list_del(&led_cdev->trig_list); + write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags); + led_set_brightness(led_cdev, LED_OFF); ++ kfree(event); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.19/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch b/queue-4.19/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch new file mode 100644 index 00000000000..961048920f9 --- /dev/null +++ b/queue-4.19/leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch @@ -0,0 +1,43 @@ +From 547ba175cb50c09c0f5ea1dd32c81fe6b5be8591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2019 14:56:06 -0700 +Subject: leds: leds-lp5562 allow firmware files up to the maximum length + +From: Nick Stoughton + +[ Upstream commit ed2abfebb041473092b41527903f93390d38afa7 ] + +Firmware files are in ASCII, using 2 hex characters per byte. The +maximum length of a firmware string is therefore + +16 (commands) * 2 (bytes per command) * 2 (characters per byte) = 64 + +Fixes: ff45262a85db ("leds: add new LP5562 LED driver") +Signed-off-by: Nick Stoughton +Acked-by: Pavel Machek +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp5562.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c +index 2a9009fe5545d..18edc8bdc9f77 100644 +--- a/drivers/leds/leds-lp5562.c ++++ b/drivers/leds/leds-lp5562.c +@@ -263,7 +263,11 @@ static void lp5562_firmware_loaded(struct lp55xx_chip *chip) + { + const struct firmware *fw = chip->fw; + +- if (fw->size > LP5562_PROGRAM_LENGTH) { ++ /* ++ * the firmware is encoded in ascii hex character, with 2 chars ++ * per byte ++ */ ++ if (fw->size > (LP5562_PROGRAM_LENGTH * 2)) { + dev_err(&chip->cl->dev, "firmware data size overflow: %zu\n", + fw->size); + return; +-- +2.20.1 + diff --git a/queue-4.19/libata-ahci-drop-pcs-quirk-for-denverton-and-beyond.patch b/queue-4.19/libata-ahci-drop-pcs-quirk-for-denverton-and-beyond.patch new file mode 100644 index 00000000000..eb427ed2518 --- /dev/null +++ b/queue-4.19/libata-ahci-drop-pcs-quirk-for-denverton-and-beyond.patch @@ -0,0 +1,246 @@ +From 0ab62b8ada53ae58476dab9d063eebb0fac336fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 16:30:34 -0700 +Subject: libata/ahci: Drop PCS quirk for Denverton and beyond + +From: Dan Williams + +[ Upstream commit c312ef176399e04fc5f7f2809d9a589751fbf6d9 ] + +The Linux ahci driver has historically implemented a configuration fixup +for platforms / platform-firmware that fails to enable the ports prior +to OS hand-off at boot. The fixup was originally implemented way back +before ahci moved from drivers/scsi/ to drivers/ata/, and was updated in +2007 via commit 49f290903935 "ahci: update PCS programming". The quirk +sets a port-enable bitmap in the PCS register at offset 0x92. + +This quirk could be applied generically up until the arrival of the +Denverton (DNV) platform. The DNV AHCI controller architecture supports +more than 6 ports and along with that the PCS register location and +format were updated to allow for more possible ports in the bitmap. DNV +AHCI expands the register to 32-bits and moves it to offset 0x94. + +As it stands there are no known problem reports with existing Linux +trying to set bits at offset 0x92 which indicates that the quirk is not +applicable. Likely it is not applicable on a wider range of platforms, +but it is difficult to discern which platforms if any still depend on +the quirk. + +Rather than try to fix the PCS quirk to consider the DNV register layout +instead require explicit opt-in. The assumption is that the OS driver +need not touch this register, and platforms can be added with a new +boad_ahci_pcs7 board-id when / if problematic platforms are found in the +future. The logic in ahci_intel_pcs_quirk() looks for all Intel AHCI +instances with "legacy" board-ids and otherwise skips the quirk if the +board was matched by class-code. + +Reported-by: Stephen Douthit +Cc: Christoph Hellwig +Reviewed-by: Stephen Douthit +Signed-off-by: Dan Williams +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 116 +++++++++++++++++++++++++++------------------ + drivers/ata/ahci.h | 2 + + 2 files changed, 71 insertions(+), 47 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 021ce46e2e573..5d110b1362e74 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -81,6 +81,12 @@ enum board_ids { + board_ahci_sb700, /* for SB700 and SB800 */ + board_ahci_vt8251, + ++ /* ++ * board IDs for Intel chipsets that support more than 6 ports ++ * *and* end up needing the PCS quirk. ++ */ ++ board_ahci_pcs7, ++ + /* aliases */ + board_ahci_mcp_linux = board_ahci_mcp65, + board_ahci_mcp67 = board_ahci_mcp65, +@@ -236,6 +242,12 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_vt8251_ops, + }, ++ [board_ahci_pcs7] = { ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + }; + + static const struct pci_device_id ahci_pci_tbl[] = { +@@ -280,26 +292,26 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ + { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci_mobile }, /* PCH M RAID */ + { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ +- { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b0), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b1), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b2), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b3), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b4), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b5), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b6), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19b7), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19bE), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19bF), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c0), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c1), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c2), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c3), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c4), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c5), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c6), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19c7), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19cE), board_ahci_pcs7 }, /* DNV AHCI */ ++ { PCI_VDEVICE(INTEL, 0x19cF), board_ahci_pcs7 }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ + { PCI_VDEVICE(INTEL, 0x1c03), board_ahci_mobile }, /* CPT M AHCI */ + { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */ +@@ -639,30 +651,6 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev, + ahci_save_initial_config(&pdev->dev, hpriv); + } + +-static int ahci_pci_reset_controller(struct ata_host *host) +-{ +- struct pci_dev *pdev = to_pci_dev(host->dev); +- int rc; +- +- rc = ahci_reset_controller(host); +- if (rc) +- return rc; +- +- if (pdev->vendor == PCI_VENDOR_ID_INTEL) { +- struct ahci_host_priv *hpriv = host->private_data; +- u16 tmp16; +- +- /* configure PCS */ +- pci_read_config_word(pdev, 0x92, &tmp16); +- if ((tmp16 & hpriv->port_map) != hpriv->port_map) { +- tmp16 |= hpriv->port_map; +- pci_write_config_word(pdev, 0x92, tmp16); +- } +- } +- +- return 0; +-} +- + static void ahci_pci_init_controller(struct ata_host *host) + { + struct ahci_host_priv *hpriv = host->private_data; +@@ -865,7 +853,7 @@ static int ahci_pci_device_runtime_resume(struct device *dev) + struct ata_host *host = pci_get_drvdata(pdev); + int rc; + +- rc = ahci_pci_reset_controller(host); ++ rc = ahci_reset_controller(host); + if (rc) + return rc; + ahci_pci_init_controller(host); +@@ -900,7 +888,7 @@ static int ahci_pci_device_resume(struct device *dev) + ahci_mcp89_apple_enable(pdev); + + if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) { +- rc = ahci_pci_reset_controller(host); ++ rc = ahci_reset_controller(host); + if (rc) + return rc; + +@@ -1635,6 +1623,34 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap, + ap->target_lpm_policy = policy; + } + ++static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hpriv) ++{ ++ const struct pci_device_id *id = pci_match_id(ahci_pci_tbl, pdev); ++ u16 tmp16; ++ ++ /* ++ * Only apply the 6-port PCS quirk for known legacy platforms. ++ */ ++ if (!id || id->vendor != PCI_VENDOR_ID_INTEL) ++ return; ++ if (((enum board_ids) id->driver_data) < board_ahci_pcs7) ++ return; ++ ++ /* ++ * port_map is determined from PORTS_IMPL PCI register which is ++ * implemented as write or write-once register. If the register ++ * isn't programmed, ahci automatically generates it from number ++ * of ports, which is good enough for PCS programming. It is ++ * otherwise expected that platform firmware enables the ports ++ * before the OS boots. ++ */ ++ pci_read_config_word(pdev, PCS_6, &tmp16); ++ if ((tmp16 & hpriv->port_map) != hpriv->port_map) { ++ tmp16 |= hpriv->port_map; ++ pci_write_config_word(pdev, PCS_6, tmp16); ++ } ++} ++ + static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + { + unsigned int board_id = ent->driver_data; +@@ -1747,6 +1763,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + /* save initial config */ + ahci_pci_save_initial_config(pdev, hpriv); + ++ /* ++ * If platform firmware failed to enable ports, try to enable ++ * them here. ++ */ ++ ahci_intel_pcs_quirk(pdev, hpriv); ++ + /* prepare host */ + if (hpriv->cap & HOST_CAP_NCQ) { + pi.flags |= ATA_FLAG_NCQ; +@@ -1856,7 +1878,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (rc) + return rc; + +- rc = ahci_pci_reset_controller(host); ++ rc = ahci_reset_controller(host); + if (rc) + return rc; + +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 6a1515f0da402..9290e787abdc4 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -261,6 +261,8 @@ enum { + ATA_FLAG_ACPI_SATA | ATA_FLAG_AN, + + ICH_MAP = 0x90, /* ICH MAP register */ ++ PCS_6 = 0x92, /* 6 port PCS */ ++ PCS_7 = 0x94, /* 7+ port PCS (Denverton) */ + + /* em constants */ + EM_MAX_SLOTS = 8, +-- +2.20.1 + diff --git a/queue-4.19/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch b/queue-4.19/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch new file mode 100644 index 00000000000..e6d345e9f48 --- /dev/null +++ b/queue-4.19/libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch @@ -0,0 +1,36 @@ +From 6261f8d8949b7fa994821b6b6fda9258af705e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2019 13:31:38 +0000 +Subject: libertas: Add missing sentinel at end of if_usb.c fw_table + +From: Kevin Easton + +[ Upstream commit 764f3f1ecffc434096e0a2b02f1a6cc964a89df6 ] + +This sentinel tells the firmware loading process when to stop. + +Reported-and-tested-by: syzbot+98156c174c5a2cad9f8f@syzkaller.appspotmail.com +Signed-off-by: Kevin Easton +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 3dbfce972c56b..9e82ec12564bb 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -49,7 +49,8 @@ static const struct lbs_fw_table fw_table[] = { + { MODEL_8388, "libertas/usb8388_v5.bin", NULL }, + { MODEL_8388, "libertas/usb8388.bin", NULL }, + { MODEL_8388, "usb8388.bin", NULL }, +- { MODEL_8682, "libertas/usb8682.bin", NULL } ++ { MODEL_8682, "libertas/usb8682.bin", NULL }, ++ { 0, NULL, NULL } + }; + + static const struct usb_device_id if_usb_table[] = { +-- +2.20.1 + diff --git a/queue-4.19/libperf-fix-alignment-trap-with-xyarray-contents-in-.patch b/queue-4.19/libperf-fix-alignment-trap-with-xyarray-contents-in-.patch new file mode 100644 index 00000000000..1df647fd7c3 --- /dev/null +++ b/queue-4.19/libperf-fix-alignment-trap-with-xyarray-contents-in-.patch @@ -0,0 +1,58 @@ +From b3bba0cca284a13105f7dd8bf3e0017a086e5bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 09:07:01 +0000 +Subject: libperf: Fix alignment trap with xyarray contents in 'perf stat' + +From: Gerald BAEZA + +[ Upstream commit d9c5c083416500e95da098c01be092b937def7fa ] + +Following the patch 'perf stat: Fix --no-scale', an alignment trap +happens in process_counter_values() on ARMv7 platforms due to the +attempt to copy non 64 bits aligned double words (pointed by 'count') +via a NEON vectored instruction ('vld1' with 64 bits alignment +constraint). + +This patch sets a 64 bits alignment constraint on 'contents[]' field in +'struct xyarray' since the 'count' pointer used above points to such a +structure. + +Signed-off-by: Gerald Baeza +Cc: Alexander Shishkin +Cc: Alexandre Torgue +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Mathieu Poirier +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1566464769-16374-1-git-send-email-gerald.baeza@st.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/xyarray.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/xyarray.h b/tools/perf/util/xyarray.h +index 7ffe562e7ae7f..2627b038b6f2a 100644 +--- a/tools/perf/util/xyarray.h ++++ b/tools/perf/util/xyarray.h +@@ -2,6 +2,7 @@ + #ifndef _PERF_XYARRAY_H_ + #define _PERF_XYARRAY_H_ 1 + ++#include + #include + + struct xyarray { +@@ -10,7 +11,7 @@ struct xyarray { + size_t entries; + size_t max_x; + size_t max_y; +- char contents[]; ++ char contents[] __aligned(8); + }; + + struct xyarray *xyarray__new(int xlen, int ylen, size_t entry_size); +-- +2.20.1 + diff --git a/queue-4.19/libtraceevent-change-users-plugin-directory.patch b/queue-4.19/libtraceevent-change-users-plugin-directory.patch new file mode 100644 index 00000000000..d2de9801df4 --- /dev/null +++ b/queue-4.19/libtraceevent-change-users-plugin-directory.patch @@ -0,0 +1,70 @@ +From c20f9c92d7626da81eceec81bc3ffa01ba6a8d23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 16:43:15 -0400 +Subject: libtraceevent: Change users plugin directory + +From: Tzvetomir Stoyanov + +[ Upstream commit e97fd1383cd77c467d2aed7fa4e596789df83977 ] + +To be compliant with XDG user directory layout, the user's plugin +directory is changed from ~/.traceevent/plugins to +~/.local/lib/traceevent/plugins/ + +Suggested-by: Patrick McLean +Signed-off-by: Tzvetomir Stoyanov +Cc: Andrew Morton +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Patrick McLean +Cc: linux-trace-devel@vger.kernel.org +Link: https://lore.kernel.org/linux-trace-devel/20190313144206.41e75cf8@patrickm/ +Link: http://lore.kernel.org/linux-trace-devel/20190801074959.22023-4-tz.stoyanov@gmail.com +Link: http://lore.kernel.org/lkml/20190805204355.344622683@goodmis.org +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/traceevent/Makefile | 6 +++--- + tools/lib/traceevent/event-plugin.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile +index 0b4e833088a4d..95a43ccb6dd09 100644 +--- a/tools/lib/traceevent/Makefile ++++ b/tools/lib/traceevent/Makefile +@@ -55,15 +55,15 @@ set_plugin_dir := 1 + + # Set plugin_dir to preffered global plugin location + # If we install under $HOME directory we go under +-# $(HOME)/.traceevent/plugins ++# $(HOME)/.local/lib/traceevent/plugins + # + # We dont set PLUGIN_DIR in case we install under $HOME + # directory, because by default the code looks under: +-# $(HOME)/.traceevent/plugins by default. ++# $(HOME)/.local/lib/traceevent/plugins by default. + # + ifeq ($(plugin_dir),) + ifeq ($(prefix),$(HOME)) +-override plugin_dir = $(HOME)/.traceevent/plugins ++override plugin_dir = $(HOME)/.local/lib/traceevent/plugins + set_plugin_dir := 0 + else + override plugin_dir = $(libdir)/traceevent/plugins +diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c +index f17e25097e1e2..52874eb94acef 100644 +--- a/tools/lib/traceevent/event-plugin.c ++++ b/tools/lib/traceevent/event-plugin.c +@@ -16,7 +16,7 @@ + #include "event-parse.h" + #include "event-utils.h" + +-#define LOCAL_PLUGIN_DIR ".traceevent/plugins" ++#define LOCAL_PLUGIN_DIR ".local/lib/traceevent/plugins/" + + static struct registered_plugin_options { + struct registered_plugin_options *next; +-- +2.20.1 + diff --git a/queue-4.19/loop-add-loop_set_direct_io-to-compat-ioctl.patch b/queue-4.19/loop-add-loop_set_direct_io-to-compat-ioctl.patch new file mode 100644 index 00000000000..757f8844693 --- /dev/null +++ b/queue-4.19/loop-add-loop_set_direct_io-to-compat-ioctl.patch @@ -0,0 +1,42 @@ +From 55d801d4fd5aa6e4eea8ea2b0584964ff5a2bdb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 01:48:28 +0100 +Subject: loop: Add LOOP_SET_DIRECT_IO to compat ioctl + +From: Alessio Balsini + +[ Upstream commit fdbe4eeeb1aac219b14f10c0ed31ae5d1123e9b8 ] + +Enabling Direct I/O with loop devices helps reducing memory usage by +avoiding double caching. 32 bit applications running on 64 bits systems +are currently not able to request direct I/O because is missing from the +lo_compat_ioctl. + +This patch fixes the compatibility issue mentioned above by exporting +LOOP_SET_DIRECT_IO as additional lo_compat_ioctl() entry. +The input argument for this ioctl is a single long converted to a 1-bit +boolean, so compatibility is preserved. + +Cc: Jens Axboe +Signed-off-by: Alessio Balsini +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index cef8e00c9d9d6..126c2c5146732 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1719,6 +1719,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, + case LOOP_SET_FD: + case LOOP_CHANGE_FD: + case LOOP_SET_BLOCK_SIZE: ++ case LOOP_SET_DIRECT_IO: + err = lo_ioctl(bdev, mode, cmd, arg); + break; + default: +-- +2.20.1 + diff --git a/queue-4.19/m68k-prevent-some-compiler-warnings-in-coldfire-buil.patch b/queue-4.19/m68k-prevent-some-compiler-warnings-in-coldfire-buil.patch new file mode 100644 index 00000000000..4b7c4500760 --- /dev/null +++ b/queue-4.19/m68k-prevent-some-compiler-warnings-in-coldfire-buil.patch @@ -0,0 +1,114 @@ +From 85c4cf723909e686b9acb5330e0c46db5dd299a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Aug 2019 10:10:25 +1000 +Subject: m68k: Prevent some compiler warnings in Coldfire builds + +From: Finn Thain + +[ Upstream commit 94c04390225bcd8283103fd0c04be20cc30cc979 ] + +Since commit d3b41b6bb49e ("m68k: Dispatch nvram_ops calls to Atari or +Mac functions"), Coldfire builds generate compiler warnings due to the +unconditional inclusion of asm/atarihw.h and asm/macintosh.h. + +The inclusion of asm/atarihw.h causes warnings like this: + +In file included from ./arch/m68k/include/asm/atarihw.h:25:0, + from arch/m68k/kernel/setup_mm.c:41, + from arch/m68k/kernel/setup.c:3: +./arch/m68k/include/asm/raw_io.h:39:0: warning: "__raw_readb" redefined + #define __raw_readb in_8 + +In file included from ./arch/m68k/include/asm/io.h:6:0, + from arch/m68k/kernel/setup_mm.c:36, + from arch/m68k/kernel/setup.c:3: +./arch/m68k/include/asm/io_no.h:16:0: note: this is the location of the previous definition + #define __raw_readb(addr) \ +... + +This issue is resolved by dropping the asm/raw_io.h include. It turns out +that asm/io_mm.h already includes that header file. + +Moving the relevant macro definitions helps to clarify this dependency +and make it safe to include asm/atarihw.h. + +The other warnings look like this: + +In file included from arch/m68k/kernel/setup_mm.c:48:0, + from arch/m68k/kernel/setup.c:3: +./arch/m68k/include/asm/macintosh.h:19:35: warning: 'struct irq_data' declared inside parameter list will not be visible outside of this definition or declaration + extern void mac_irq_enable(struct irq_data *data); + ^~~~~~~~ +... + +This issue is resolved by adding the missing linux/irq.h include. + +Signed-off-by: Finn Thain +Acked-by: Greg Ungerer +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/atarihw.h | 9 --------- + arch/m68k/include/asm/io_mm.h | 6 +++++- + arch/m68k/include/asm/macintosh.h | 1 + + 3 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/arch/m68k/include/asm/atarihw.h b/arch/m68k/include/asm/atarihw.h +index 9000b249d225e..407a617fa3a2b 100644 +--- a/arch/m68k/include/asm/atarihw.h ++++ b/arch/m68k/include/asm/atarihw.h +@@ -22,7 +22,6 @@ + + #include + #include +-#include + #include + + extern u_long atari_mch_cookie; +@@ -126,14 +125,6 @@ extern struct atari_hw_present atari_hw_present; + */ + + +-#define atari_readb raw_inb +-#define atari_writeb raw_outb +- +-#define atari_inb_p raw_inb +-#define atari_outb_p raw_outb +- +- +- + #include + #include + +diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h +index 782b78f8a0489..e056feabbaf0b 100644 +--- a/arch/m68k/include/asm/io_mm.h ++++ b/arch/m68k/include/asm/io_mm.h +@@ -29,7 +29,11 @@ + #include + + #ifdef CONFIG_ATARI +-#include ++#define atari_readb raw_inb ++#define atari_writeb raw_outb ++ ++#define atari_inb_p raw_inb ++#define atari_outb_p raw_outb + #endif + + +diff --git a/arch/m68k/include/asm/macintosh.h b/arch/m68k/include/asm/macintosh.h +index 08cee11180e69..e441517785fda 100644 +--- a/arch/m68k/include/asm/macintosh.h ++++ b/arch/m68k/include/asm/macintosh.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + #include + +-- +2.20.1 + diff --git a/queue-4.19/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch b/queue-4.19/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch new file mode 100644 index 00000000000..e23c4de4a69 --- /dev/null +++ b/queue-4.19/md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch @@ -0,0 +1,46 @@ +From 2159f4c405abf359e150331e091781f41d4fce89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:09:21 +0200 +Subject: md: don't call spare_active in md_reap_sync_thread if all member + devices can't work + +From: Guoqing Jiang + +[ Upstream commit 0d8ed0e9bf9643f27f4816dca61081784dedb38d ] + +When add one disk to array, the md_reap_sync_thread is responsible +to activate the spare and set In_sync flag for the new member in +spare_active(). + +But if raid1 has one member disk A, and disk B is added to the array. +Then we offline A before all the datas are synchronized from A to B, +obviously B doesn't have the latest data as A, but B is still marked +with In_sync flag. + +So let's not call spare_active under the condition, otherwise B is +still showed with 'U' state which is not correct. + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index fb5d702e43b5b..73758b3679a11 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8948,7 +8948,8 @@ void md_reap_sync_thread(struct mddev *mddev) + /* resync has finished, collect result */ + md_unregister_thread(&mddev->sync_thread); + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) && +- !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { ++ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) && ++ mddev->degraded != mddev->raid_disks) { + /* success...*/ + /* activate any spares */ + if (mddev->pers->spare_active(mddev)) { +-- +2.20.1 + diff --git a/queue-4.19/md-don-t-set-in_sync-if-array-is-frozen.patch b/queue-4.19/md-don-t-set-in_sync-if-array-is-frozen.patch new file mode 100644 index 00000000000..9567d31a428 --- /dev/null +++ b/queue-4.19/md-don-t-set-in_sync-if-array-is-frozen.patch @@ -0,0 +1,55 @@ +From fcac5badd7b092158849eb30c898f0af04cae9c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 11:09:20 +0200 +Subject: md: don't set In_sync if array is frozen + +From: Guoqing Jiang + +[ Upstream commit 062f5b2ae12a153644c765e7ba3b0f825427be1d ] + +When a disk is added to array, the following path is called in mdadm. + +Manage_subdevs -> sysfs_freeze_array + -> Manage_add + -> sysfs_set_str(&info, NULL, "sync_action","idle") + +Then from kernel side, Manage_add invokes the path (add_new_disk -> +validate_super = super_1_validate) to set In_sync flag. + +Since In_sync means "device is in_sync with rest of array", and the new +added disk need to resync thread to help the synchronization of data. +And md_reap_sync_thread would call spare_active to set In_sync for the +new added disk finally. So don't set In_sync if array is in frozen. + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 73758b3679a11..277025784d6c0 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1770,8 +1770,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) + if (!(le32_to_cpu(sb->feature_map) & + MD_FEATURE_RECOVERY_BITMAP)) + rdev->saved_raid_disk = -1; +- } else +- set_bit(In_sync, &rdev->flags); ++ } else { ++ /* ++ * If the array is FROZEN, then the device can't ++ * be in_sync with rest of array. ++ */ ++ if (!test_bit(MD_RECOVERY_FROZEN, ++ &mddev->recovery)) ++ set_bit(In_sync, &rdev->flags); ++ } + rdev->raid_disk = role; + break; + } +-- +2.20.1 + diff --git a/queue-4.19/md-raid1-end-bio-when-the-device-faulty.patch b/queue-4.19/md-raid1-end-bio-when-the-device-faulty.patch new file mode 100644 index 00000000000..8824b7e2202 --- /dev/null +++ b/queue-4.19/md-raid1-end-bio-when-the-device-faulty.patch @@ -0,0 +1,75 @@ +From 30cb39562a9d19b37973678b962d6d82adff0957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 13:48:46 +0800 +Subject: md/raid1: end bio when the device faulty + +From: Yufen Yu + +[ Upstream commit eeba6809d8d58908b5ed1b5ceb5fcb09a98a7cad ] + +When write bio return error, it would be added to conf->retry_list +and wait for raid1d thread to retry write and acknowledge badblocks. + +In narrow_write_error(), the error bio will be split in the unit of +badblock shift (such as one sector) and raid1d thread issues them +one by one. Until all of the splited bio has finished, raid1d thread +can go on processing other things, which is time consuming. + +But, there is a scene for error handling that is not necessary. +When the device has been set faulty, flush_bio_list() may end +bios in pending_bio_list with error status. Since these bios +has not been issued to the device actually, error handlding to +retry write and acknowledge badblocks make no sense. + +Even without that scene, when the device is faulty, badblocks info +can not be written out to the device. Thus, we also no need to +handle the error IO. + +Signed-off-by: Yufen Yu +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index fa47249fa3e42..54010675df9a5 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -434,19 +434,21 @@ static void raid1_end_write_request(struct bio *bio) + /* We never try FailFast to WriteMostly devices */ + !test_bit(WriteMostly, &rdev->flags)) { + md_error(r1_bio->mddev, rdev); +- if (!test_bit(Faulty, &rdev->flags)) +- /* This is the only remaining device, +- * We need to retry the write without +- * FailFast +- */ +- set_bit(R1BIO_WriteError, &r1_bio->state); +- else { +- /* Finished with this branch */ +- r1_bio->bios[mirror] = NULL; +- to_put = bio; +- } +- } else ++ } ++ ++ /* ++ * When the device is faulty, it is not necessary to ++ * handle write error. ++ * For failfast, this is the only remaining device, ++ * We need to retry the write without FailFast. ++ */ ++ if (!test_bit(Faulty, &rdev->flags)) + set_bit(R1BIO_WriteError, &r1_bio->state); ++ else { ++ /* Finished with this branch */ ++ r1_bio->bios[mirror] = NULL; ++ to_put = bio; ++ } + } else { + /* + * Set R1BIO_Uptodate in our master bio, so that we +-- +2.20.1 + diff --git a/queue-4.19/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch b/queue-4.19/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch new file mode 100644 index 00000000000..3c480c2434d --- /dev/null +++ b/queue-4.19/md-raid1-fail-run-raid1-array-when-active-disk-less-.patch @@ -0,0 +1,78 @@ +From bf4fa9800d72b218b2eeca8668fe6e491eb99f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 21:12:41 +0800 +Subject: md/raid1: fail run raid1 array when active disk less than one + +From: Yufen Yu + +[ Upstream commit 07f1a6850c5d5a65c917c3165692b5179ac4cb6b ] + +When run test case: + mdadm -CR /dev/md1 -l 1 -n 4 /dev/sd[a-d] --assume-clean --bitmap=internal + mdadm -S /dev/md1 + mdadm -A /dev/md1 /dev/sd[b-c] --run --force + + mdadm --zero /dev/sda + mdadm /dev/md1 -a /dev/sda + + echo offline > /sys/block/sdc/device/state + echo offline > /sys/block/sdb/device/state + sleep 5 + mdadm -S /dev/md1 + + echo running > /sys/block/sdb/device/state + echo running > /sys/block/sdc/device/state + mdadm -A /dev/md1 /dev/sd[a-c] --run --force + +mdadm run fail with kernel message as follow: +[ 172.986064] md: kicking non-fresh sdb from array! +[ 173.004210] md: kicking non-fresh sdc from array! +[ 173.022383] md/raid1:md1: active with 0 out of 4 mirrors +[ 173.022406] md1: failed to create bitmap (-5) + +In fact, when active disk in raid1 array less than one, we +need to return fail in raid1_run(). + +Reviewed-by: NeilBrown +Signed-off-by: Yufen Yu +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 54010675df9a5..6929d110d8048 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3105,6 +3105,13 @@ static int raid1_run(struct mddev *mddev) + !test_bit(In_sync, &conf->mirrors[i].rdev->flags) || + test_bit(Faulty, &conf->mirrors[i].rdev->flags)) + mddev->degraded++; ++ /* ++ * RAID1 needs at least one disk in active ++ */ ++ if (conf->raid_disks - mddev->degraded < 1) { ++ ret = -EINVAL; ++ goto abort; ++ } + + if (conf->raid_disks - mddev->degraded == 1) + mddev->recovery_cp = MaxSector; +@@ -3138,8 +3145,12 @@ static int raid1_run(struct mddev *mddev) + ret = md_integrity_register(mddev); + if (ret) { + md_unregister_thread(&mddev->thread); +- raid1_free(mddev, conf); ++ goto abort; + } ++ return 0; ++ ++abort: ++ raid1_free(mddev, conf); + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-cec-notifier-clear-cec_adap-in-cec_notifier_un.patch b/queue-4.19/media-cec-notifier-clear-cec_adap-in-cec_notifier_un.patch new file mode 100644 index 00000000000..8a7c6039c12 --- /dev/null +++ b/queue-4.19/media-cec-notifier-clear-cec_adap-in-cec_notifier_un.patch @@ -0,0 +1,47 @@ +From 73859345827df7007c480368c70d92eda49274ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2019 08:12:59 -0300 +Subject: media: cec-notifier: clear cec_adap in cec_notifier_unregister + +From: Hans Verkuil + +[ Upstream commit 14d5511691e5290103bc480998bc322e68f139d4 ] + +If cec_notifier_cec_adap_unregister() is called before +cec_unregister_adapter() then everything is OK (and this is the +case today). But if it is the other way around, then +cec_notifier_unregister() is called first, and that doesn't +set n->cec_adap to NULL. + +So if e.g. cec_notifier_set_phys_addr() is called after +cec_notifier_unregister() but before cec_unregister_adapter() +then n->cec_adap points to an unregistered and likely deleted +cec adapter. So just set n->cec_adap->notifier and n->cec_adap +to NULL for rubustness. + +Eventually cec_notifier_unregister will disappear and this will +be simplified substantially. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/cec-notifier.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/cec-notifier.c b/drivers/media/cec/cec-notifier.c +index dd2078b27a419..2424680f71c3d 100644 +--- a/drivers/media/cec/cec-notifier.c ++++ b/drivers/media/cec/cec-notifier.c +@@ -123,6 +123,8 @@ void cec_notifier_unregister(struct cec_notifier *n) + { + mutex_lock(&n->lock); + n->callback = NULL; ++ n->cec_adap->notifier = NULL; ++ n->cec_adap = NULL; + mutex_unlock(&n->lock); + cec_notifier_put(n); + } +-- +2.20.1 + diff --git a/queue-4.19/media-cpia2_usb-fix-memory-leaks.patch b/queue-4.19/media-cpia2_usb-fix-memory-leaks.patch new file mode 100644 index 00000000000..1f11ef48197 --- /dev/null +++ b/queue-4.19/media-cpia2_usb-fix-memory-leaks.patch @@ -0,0 +1,39 @@ +From eeb7e0320872412214643dbd3816bd3107bee548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Aug 2019 02:27:46 -0300 +Subject: media: cpia2_usb: fix memory leaks + +From: Wenwen Wang + +[ Upstream commit 1c770f0f52dca1a2323c594f01f5ec6f1dddc97f ] + +In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array(). +However, it is not deallocated if the following allocation for urbs fails. +To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails. + +Signed-off-by: Wenwen Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cpia2/cpia2_usb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c +index f5b04594e2094..4c191fcd3a7f5 100644 +--- a/drivers/media/usb/cpia2/cpia2_usb.c ++++ b/drivers/media/usb/cpia2/cpia2_usb.c +@@ -685,6 +685,10 @@ static int submit_urbs(struct camera_data *cam) + if (!urb) { + for (j = 0; j < i; j++) + usb_free_urb(cam->sbuf[j].urb); ++ for (j = 0; j < NUM_SBUF; j++) { ++ kfree(cam->sbuf[j].data); ++ cam->sbuf[j].data = NULL; ++ } + return -ENOMEM; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch b/queue-4.19/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch new file mode 100644 index 00000000000..fcd2f429889 --- /dev/null +++ b/queue-4.19/media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch @@ -0,0 +1,69 @@ +From 681e321eeef0e9938f84d5d4d45cdc06a32f2f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 08:14:53 -0400 +Subject: media: dib0700: fix link error for dibx000_i2c_set_speed + +From: Arnd Bergmann + +[ Upstream commit 765bb8610d305ee488b35d07e2a04ae52fb2df9c ] + +When CONFIG_DVB_DIB9000 is disabled, we can still compile code that +now fails to link against dibx000_i2c_set_speed: + +drivers/media/usb/dvb-usb/dib0700_devices.o: In function `dib01x0_pmu_update.constprop.7': +dib0700_devices.c:(.text.unlikely+0x1c9c): undefined reference to `dibx000_i2c_set_speed' + +The call sites are both through dib01x0_pmu_update(), which gets passed +an 'i2c' pointer from dib9000_get_i2c_master(), which has returned +NULL. Checking this pointer seems to be a good idea anyway, and it avoids +the link failure in most cases. + +Sean Young found another case that is not fixed by that, where certain +gcc versions leave an unused function in place that causes the link error, +but adding an explict IS_ENABLED() check also solves this. + +Fixes: b7f54910ce01 ("V4L/DVB (4647): Added module for DiB0700 based devices") +Signed-off-by: Arnd Bergmann +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dib0700_devices.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c +index 091389fdf89ee..c8d79502827b7 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c +@@ -2442,9 +2442,13 @@ static int dib9090_tuner_attach(struct dvb_usb_adapter *adap) + 8, 0x0486, + }; + ++ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) ++ return -ENODEV; + if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &dib9090_dib0090_config) == NULL) + return -ENODEV; + i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); ++ if (!i2c) ++ return -ENODEV; + if (dib01x0_pmu_update(i2c, data_dib190, 10) != 0) + return -ENODEV; + dib0700_set_i2c_speed(adap->dev, 1500); +@@ -2520,10 +2524,14 @@ static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap) + 0, 0x00ef, + 8, 0x0406, + }; ++ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) ++ return -ENODEV; + i2c = dib9000_get_tuner_interface(adap->fe_adap[0].fe); + if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &nim9090md_dib0090_config[0]) == NULL) + return -ENODEV; + i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); ++ if (!i2c) ++ return -ENODEV; + if (dib01x0_pmu_update(i2c, data_dib190, 10) < 0) + return -ENODEV; + +-- +2.20.1 + diff --git a/queue-4.19/media-dvb-core-fix-a-memory-leak-bug.patch b/queue-4.19/media-dvb-core-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..cc0accd168f --- /dev/null +++ b/queue-4.19/media-dvb-core-fix-a-memory-leak-bug.patch @@ -0,0 +1,42 @@ +From df929733001f0e646415caafa5370d63cd824797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Aug 2019 00:45:40 -0300 +Subject: media: dvb-core: fix a memory leak bug + +From: Wenwen Wang + +[ Upstream commit fcd5ce4b3936242e6679875a4d3c3acfc8743e15 ] + +In dvb_create_media_entity(), 'dvbdev->entity' is allocated through +kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if +kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading +to a memory leak bug. To fix this issue, free 'dvbdev->entity' before +returning -ENOMEM. + +Signed-off-by: Wenwen Wang +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvbdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 3c87785703310..04dc2f4bc7aaf 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -339,8 +339,10 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev, + if (npads) { + dvbdev->pads = kcalloc(npads, sizeof(*dvbdev->pads), + GFP_KERNEL); +- if (!dvbdev->pads) ++ if (!dvbdev->pads) { ++ kfree(dvbdev->entity); + return -ENOMEM; ++ } + } + + switch (type) { +-- +2.20.1 + diff --git a/queue-4.19/media-dvb-frontends-use-ida-for-pll-number.patch b/queue-4.19/media-dvb-frontends-use-ida-for-pll-number.patch new file mode 100644 index 00000000000..e1da9c29e5f --- /dev/null +++ b/queue-4.19/media-dvb-frontends-use-ida-for-pll-number.patch @@ -0,0 +1,221 @@ +From ac3492ce00449fc87810f633de657e8aedf77227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Aug 2019 00:12:03 -0300 +Subject: media: dvb-frontends: use ida for pll number + +From: Sean Young + +[ Upstream commit c268e7adea52be0093de1164c425f3c8d8927770 ] + +KASAN: global-out-of-bounds Read in dvb_pll_attach + +Syzbot reported global-out-of-bounds Read in dvb_pll_attach, while +accessing id[dvb_pll_devcount], because dvb_pll_devcount was 65, +that is more than size of 'id' which is DVB_PLL_MAX(64). + +Rather than increasing dvb_pll_devcount every time, use ida so that +numbers are allocated correctly. This does mean that no more than +64 devices can be attached at the same time, but this is more than +sufficient. + +usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the +software demuxer +dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) +usb 1-1: media controller created +dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. +tc90522 0-0018: Toshiba TC90522 attached. +usb 1-1: DVB: registering adapter 0 frontend 0 (Toshiba TC90522 ISDB-T +module)... +dvbdev: dvb_create_media_entity: media entity 'Toshiba TC90522 ISDB-T +module' registered. +================================================================== +BUG: KASAN: global-out-of-bounds in dvb_pll_attach+0x6c5/0x830 +drivers/media/dvb-frontends/dvb-pll.c:798 +Read of size 4 at addr ffffffff89c9e5e0 by task kworker/0:1/12 + +CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc6+ #13 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Workqueue: usb_hub_wq hub_event +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xca/0x13e lib/dump_stack.c:113 + print_address_description+0x67/0x231 mm/kasan/report.c:188 + __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317 + kasan_report+0xe/0x20 mm/kasan/common.c:614 + dvb_pll_attach+0x6c5/0x830 drivers/media/dvb-frontends/dvb-pll.c:798 + dvb_pll_probe+0xfe/0x174 drivers/media/dvb-frontends/dvb-pll.c:877 + i2c_device_probe+0x790/0xaa0 drivers/i2c/i2c-core-base.c:389 + really_probe+0x281/0x660 drivers/base/dd.c:509 + driver_probe_device+0x104/0x210 drivers/base/dd.c:670 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:843 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2111 + i2c_new_client_device+0x5b3/0xc40 drivers/i2c/i2c-core-base.c:778 + i2c_new_device+0x19/0x50 drivers/i2c/i2c-core-base.c:821 + dvb_module_probe+0xf9/0x220 drivers/media/dvb-core/dvbdev.c:985 + friio_tuner_attach+0x125/0x1d0 drivers/media/usb/dvb-usb-v2/gl861.c:536 + dvb_usbv2_adapter_frontend_init +drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:675 [inline] + dvb_usbv2_adapter_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:804 +[inline] + dvb_usbv2_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:865 [inline] + dvb_usbv2_probe.cold+0x24dc/0x255d +drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:980 + usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 + really_probe+0x281/0x660 drivers/base/dd.c:509 + driver_probe_device+0x104/0x210 drivers/base/dd.c:670 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:843 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2111 + usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 + generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 + usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 + really_probe+0x281/0x660 drivers/base/dd.c:509 + driver_probe_device+0x104/0x210 drivers/base/dd.c:670 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:843 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2111 + usb_new_device.cold+0x8c1/0x1016 drivers/usb/core/hub.c:2534 + hub_port_connect drivers/usb/core/hub.c:5089 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] + port_event drivers/usb/core/hub.c:5350 [inline] + hub_event+0x1ada/0x3590 drivers/usb/core/hub.c:5432 + process_one_work+0x905/0x1570 kernel/workqueue.c:2269 + process_scheduled_works kernel/workqueue.c:2331 [inline] + worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417 + kthread+0x30b/0x410 kernel/kthread.c:255 + ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 + +The buggy address belongs to the variable: + id+0x100/0x120 + +Memory state around the buggy address: + ffffffff89c9e480: fa fa fa fa 00 00 fa fa fa fa fa fa 00 00 00 00 + ffffffff89c9e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +> ffffffff89c9e580: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + ^ + ffffffff89c9e600: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa + ffffffff89c9e680: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa +================================================================== + +Reported-by: syzbot+8a8f48672560c8ca59dd@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/dvb-pll.c | 40 ++++++++++++++++----------- + 1 file changed, 24 insertions(+), 16 deletions(-) + +diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c +index 29836c1a40e98..ee830c76e4b30 100644 +--- a/drivers/media/dvb-frontends/dvb-pll.c ++++ b/drivers/media/dvb-frontends/dvb-pll.c +@@ -18,6 +18,7 @@ + + #include + #include ++#include + #include + #include + +@@ -43,8 +44,7 @@ struct dvb_pll_priv { + }; + + #define DVB_PLL_MAX 64 +- +-static unsigned int dvb_pll_devcount; ++static DEFINE_IDA(pll_ida); + + static int debug; + module_param(debug, int, 0644); +@@ -796,6 +796,7 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, + struct dvb_pll_priv *priv = NULL; + int ret; + const struct dvb_pll_desc *desc; ++ int nr; + + b1 = kmalloc(1, GFP_KERNEL); + if (!b1) +@@ -804,9 +805,14 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, + b1[0] = 0; + msg.buf = b1; + +- if ((id[dvb_pll_devcount] > DVB_PLL_UNDEFINED) && +- (id[dvb_pll_devcount] < ARRAY_SIZE(pll_list))) +- pll_desc_id = id[dvb_pll_devcount]; ++ nr = ida_simple_get(&pll_ida, 0, DVB_PLL_MAX, GFP_KERNEL); ++ if (nr < 0) { ++ kfree(b1); ++ return NULL; ++ } ++ ++ if (id[nr] > DVB_PLL_UNDEFINED && id[nr] < ARRAY_SIZE(pll_list)) ++ pll_desc_id = id[nr]; + + BUG_ON(pll_desc_id < 1 || pll_desc_id >= ARRAY_SIZE(pll_list)); + +@@ -817,24 +823,20 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, + fe->ops.i2c_gate_ctrl(fe, 1); + + ret = i2c_transfer (i2c, &msg, 1); +- if (ret != 1) { +- kfree(b1); +- return NULL; +- } ++ if (ret != 1) ++ goto out; + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 0); + } + + priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL); +- if (!priv) { +- kfree(b1); +- return NULL; +- } ++ if (!priv) ++ goto out; + + priv->pll_i2c_address = pll_addr; + priv->i2c = i2c; + priv->pll_desc = desc; +- priv->nr = dvb_pll_devcount++; ++ priv->nr = nr; + + memcpy(&fe->ops.tuner_ops, &dvb_pll_tuner_ops, + sizeof(struct dvb_tuner_ops)); +@@ -867,6 +869,11 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, + kfree(b1); + + return fe; ++out: ++ kfree(b1); ++ ida_simple_remove(&pll_ida, nr); ++ ++ return NULL; + } + EXPORT_SYMBOL(dvb_pll_attach); + +@@ -903,9 +910,10 @@ dvb_pll_probe(struct i2c_client *client, const struct i2c_device_id *id) + + static int dvb_pll_remove(struct i2c_client *client) + { +- struct dvb_frontend *fe; ++ struct dvb_frontend *fe = i2c_get_clientdata(client); ++ struct dvb_pll_priv *priv = fe->tuner_priv; + +- fe = i2c_get_clientdata(client); ++ ida_simple_remove(&pll_ida, priv->nr); + dvb_pll_release(fe); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/media-em28xx-modules-workqueue-not-inited-for-2nd-de.patch b/queue-4.19/media-em28xx-modules-workqueue-not-inited-for-2nd-de.patch new file mode 100644 index 00000000000..05c2a46c492 --- /dev/null +++ b/queue-4.19/media-em28xx-modules-workqueue-not-inited-for-2nd-de.patch @@ -0,0 +1,91 @@ +From 66c4467a8208c5645c3fa6a52de1e076426b23d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2019 02:05:51 -0300 +Subject: media: em28xx: modules workqueue not inited for 2nd device + +From: Sean Young + +[ Upstream commit 46e4a26615cc7854340e4b69ca59ee78d6f20c8b ] + +syzbot reports an error on flush_request_modules() for the second device. +This workqueue was never initialised so simply remove the offending line. + +usb 1-1: USB disconnect, device number 2 +em28xx 1-1:1.153: Disconnecting em28xx #1 +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 12 at kernel/workqueue.c:3031 +__flush_work.cold+0x2c/0x36 kernel/workqueue.c:3031 +Kernel panic - not syncing: panic_on_warn set ... +CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Workqueue: usb_hub_wq hub_event +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xca/0x13e lib/dump_stack.c:113 + panic+0x2a3/0x6da kernel/panic.c:219 + __warn.cold+0x20/0x4a kernel/panic.c:576 + report_bug+0x262/0x2a0 lib/bug.c:186 + fixup_bug arch/x86/kernel/traps.c:179 [inline] + fixup_bug arch/x86/kernel/traps.c:174 [inline] + do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272 + do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291 + invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1026 +RIP: 0010:__flush_work.cold+0x2c/0x36 kernel/workqueue.c:3031 +Code: 9a 22 00 48 c7 c7 20 e4 c5 85 e8 d9 3a 0d 00 0f 0b 45 31 e4 e9 98 86 +ff ff e8 51 9a 22 00 48 c7 c7 20 e4 c5 85 e8 be 3a 0d 00 <0f> 0b 45 31 e4 +e9 7d 86 ff ff e8 36 9a 22 00 48 c7 c7 20 e4 c5 85 +RSP: 0018:ffff8881da20f720 EFLAGS: 00010286 +RAX: 0000000000000024 RBX: dffffc0000000000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffffffff8128a0fd RDI: ffffed103b441ed6 +RBP: ffff8881da20f888 R08: 0000000000000024 R09: fffffbfff11acd9a +R10: fffffbfff11acd99 R11: ffffffff88d66ccf R12: 0000000000000000 +R13: 0000000000000001 R14: ffff8881c6685df8 R15: ffff8881d2a85b78 + flush_request_modules drivers/media/usb/em28xx/em28xx-cards.c:3325 [inline] + em28xx_usb_disconnect.cold+0x280/0x2a6 +drivers/media/usb/em28xx/em28xx-cards.c:4023 + usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423 + __device_release_driver drivers/base/dd.c:1120 [inline] + device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151 + bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556 + device_del+0x420/0xb10 drivers/base/core.c:2288 + usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237 + usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199 + hub_port_connect drivers/usb/core/hub.c:4949 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] + port_event drivers/usb/core/hub.c:5359 [inline] + hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441 + process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 + process_scheduled_works kernel/workqueue.c:2331 [inline] + worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417 + kthread+0x318/0x420 kernel/kthread.c:255 + ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 +Kernel Offset: disabled +Rebooting in 86400 seconds.. + +Fixes: be7fd3c3a8c5e ("media: em28xx: Hauppauge DualHD second tuner functionality) +Reviewed-by: Ezequiel Garcia +Reviewed-by: Brad Love +Reported-by: syzbot+b7f57261c521087d89bb@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-cards.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 87b887b7604ef..3f59a98dbf9a1 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -4020,7 +4020,6 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + dev->dev_next->disconnected = 1; + dev_info(&dev->intf->dev, "Disconnecting %s\n", + dev->dev_next->name); +- flush_request_modules(dev->dev_next); + } + + dev->disconnected = 1; +-- +2.20.1 + diff --git a/queue-4.19/media-exynos4-is-fix-leaked-of_node-references.patch b/queue-4.19/media-exynos4-is-fix-leaked-of_node-references.patch new file mode 100644 index 00000000000..519eb5505cf --- /dev/null +++ b/queue-4.19/media-exynos4-is-fix-leaked-of_node-references.patch @@ -0,0 +1,65 @@ +From ebdc8dd2bb772448ae8d644d15dd0c136007be51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2019 23:01:15 -0400 +Subject: media: exynos4-is: fix leaked of_node references + +From: Wen Yang + +[ Upstream commit da79bf41a4d170ca93cc8f3881a70d734a071c37 ] + +The call to of_get_child_by_name returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +drivers/media/platform/exynos4-is/fimc-is.c:813:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/fimc-is.c:870:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/fimc-is.c:885:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:545:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 541, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:528:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function. +drivers/media/platform/exynos4-is/media-dev.c:534:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-is.c | 1 + + drivers/media/platform/exynos4-is/media-dev.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c +index 5ddb2321e9e48..0fe9be93fabe2 100644 +--- a/drivers/media/platform/exynos4-is/fimc-is.c ++++ b/drivers/media/platform/exynos4-is/fimc-is.c +@@ -819,6 +819,7 @@ static int fimc_is_probe(struct platform_device *pdev) + return -ENODEV; + + is->pmu_regs = of_iomap(node, 0); ++ of_node_put(node); + if (!is->pmu_regs) + return -ENOMEM; + +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index deb499f76412a..b5993532831da 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -498,6 +498,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) + continue; + + ret = fimc_md_parse_port_node(fmd, port, index); ++ of_node_put(port); + if (ret < 0) { + of_node_put(node); + goto rpm_put; +@@ -531,6 +532,7 @@ static int __of_get_csis_id(struct device_node *np) + if (!np) + return -EINVAL; + of_property_read_u32(np, "reg", ®); ++ of_node_put(np); + return reg - FIMC_INPUT_MIPI_CSI2_0; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-fdp1-reduce-fcp-not-found-message-level-to-deb.patch b/queue-4.19/media-fdp1-reduce-fcp-not-found-message-level-to-deb.patch new file mode 100644 index 00000000000..75252c6a3ea --- /dev/null +++ b/queue-4.19/media-fdp1-reduce-fcp-not-found-message-level-to-deb.patch @@ -0,0 +1,45 @@ +From a90c1dec327e1159e0c056e10471324327e3847e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2019 06:59:52 -0300 +Subject: media: fdp1: Reduce FCP not found message level to debug + +From: Geert Uytterhoeven + +[ Upstream commit 4fd22938569c14f6092c05880ca387409d78355f ] + +When support for the IPMMU is not enabled, the FDP driver may be +probe-deferred multiple times, causing several messages to be printed +like: + + rcar_fdp1 fe940000.fdp1: FCP not found (-517) + rcar_fdp1 fe944000.fdp1: FCP not found (-517) + +Fix this by reducing the message level to debug level, as is done in the +VSP1 driver. + +Fixes: 4710b752e029f3f8 ("[media] v4l: Add Renesas R-Car FDP1 Driver") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 0d14670288113..5a30f1d84fe17 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2306,7 +2306,7 @@ static int fdp1_probe(struct platform_device *pdev) + fdp1->fcp = rcar_fcp_get(fcp_node); + of_node_put(fcp_node); + if (IS_ERR(fdp1->fcp)) { +- dev_err(&pdev->dev, "FCP not found (%ld)\n", ++ dev_dbg(&pdev->dev, "FCP not found (%ld)\n", + PTR_ERR(fdp1->fcp)); + return PTR_ERR(fdp1->fcp); + } +-- +2.20.1 + diff --git a/queue-4.19/media-gspca-zero-usb_buf-on-error.patch b/queue-4.19/media-gspca-zero-usb_buf-on-error.patch new file mode 100644 index 00000000000..3cf0fab8d7e --- /dev/null +++ b/queue-4.19/media-gspca-zero-usb_buf-on-error.patch @@ -0,0 +1,279 @@ +From c26eed83af795a7958136705fbdacbc52c723ca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 03:38:13 -0300 +Subject: media: gspca: zero usb_buf on error + +From: Hans Verkuil + +[ Upstream commit 4843a543fad3bf8221cf14e5d5f32d15cee89e84 ] + +If reg_r() fails, then gspca_dev->usb_buf was left uninitialized, +and some drivers used the contents of that buffer in logic. + +This caused several syzbot errors: + +https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d +https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a +https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82 + +I analyzed the gspca drivers and zeroed the buffer where needed. + +Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/konica.c | 5 +++++ + drivers/media/usb/gspca/nw80x.c | 5 +++++ + drivers/media/usb/gspca/ov519.c | 10 ++++++++++ + drivers/media/usb/gspca/ov534.c | 5 +++++ + drivers/media/usb/gspca/ov534_9.c | 1 + + drivers/media/usb/gspca/se401.c | 5 +++++ + drivers/media/usb/gspca/sn9c20x.c | 5 +++++ + drivers/media/usb/gspca/sonixb.c | 5 +++++ + drivers/media/usb/gspca/sonixj.c | 5 +++++ + drivers/media/usb/gspca/spca1528.c | 5 +++++ + drivers/media/usb/gspca/sq930x.c | 5 +++++ + drivers/media/usb/gspca/sunplus.c | 5 +++++ + drivers/media/usb/gspca/vc032x.c | 5 +++++ + drivers/media/usb/gspca/w996Xcf.c | 5 +++++ + 14 files changed, 71 insertions(+) + +diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c +index 989ae997f66de..89b9293b31bef 100644 +--- a/drivers/media/usb/gspca/konica.c ++++ b/drivers/media/usb/gspca/konica.c +@@ -123,6 +123,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index) + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, 2); + } + } + +diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c +index bedc04a72e97e..bde4441f935e7 100644 +--- a/drivers/media/usb/gspca/nw80x.c ++++ b/drivers/media/usb/gspca/nw80x.c +@@ -1581,6 +1581,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + return; + } + if (len == 1) +diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c +index 10fcbe9e8614b..cb41e61d50dd3 100644 +--- a/drivers/media/usb/gspca/ov519.c ++++ b/drivers/media/usb/gspca/ov519.c +@@ -2083,6 +2083,11 @@ static int reg_r(struct sd *sd, u16 index) + } else { + gspca_err(gspca_dev, "reg_r %02x failed %d\n", index, ret); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + + return ret; +@@ -2111,6 +2116,11 @@ static int reg_r8(struct sd *sd, + } else { + gspca_err(gspca_dev, "reg_r8 %02x failed %d\n", index, ret); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, 8); + } + + return ret; +diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c +index d06dc0755b9a5..9e3326b66c792 100644 +--- a/drivers/media/usb/gspca/ov534.c ++++ b/drivers/media/usb/gspca/ov534.c +@@ -642,6 +642,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg) + if (ret < 0) { + pr_err("read failed %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + return gspca_dev->usb_buf[0]; + } +diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c +index 3d1364d2f83e6..4d4ae22e96406 100644 +--- a/drivers/media/usb/gspca/ov534_9.c ++++ b/drivers/media/usb/gspca/ov534_9.c +@@ -1154,6 +1154,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg) + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ return 0; + } + return gspca_dev->usb_buf[0]; + } +diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c +index 477da0664b7da..40b87717bb5c5 100644 +--- a/drivers/media/usb/gspca/se401.c ++++ b/drivers/media/usb/gspca/se401.c +@@ -111,6 +111,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent) + pr_err("read req failed req %#04x error %d\n", + req, err); + gspca_dev->usb_err = err; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE); + } + } + +diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c +index cfa2a04d9f3f6..a4ae029818586 100644 +--- a/drivers/media/usb/gspca/sn9c20x.c ++++ b/drivers/media/usb/gspca/sn9c20x.c +@@ -918,6 +918,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length) + if (unlikely(result < 0 || result != length)) { + pr_err("Read register %02x failed %d\n", reg, result); + gspca_dev->usb_err = result; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c +index 5f3f2979540a6..22de65d840dd3 100644 +--- a/drivers/media/usb/gspca/sonixb.c ++++ b/drivers/media/usb/gspca/sonixb.c +@@ -462,6 +462,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + dev_err(gspca_dev->v4l2_dev.dev, + "Error reading register %02x: %d\n", value, res); + gspca_dev->usb_err = res; ++ /* ++ * Make sure the result is zeroed to avoid uninitialized ++ * values. ++ */ ++ gspca_dev->usb_buf[0] = 0; + } + } + +diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c +index df8d8482b7959..fa108ce000ad6 100644 +--- a/drivers/media/usb/gspca/sonixj.c ++++ b/drivers/media/usb/gspca/sonixj.c +@@ -1171,6 +1171,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c +index d25924e430f37..a20eb8580db2e 100644 +--- a/drivers/media/usb/gspca/spca1528.c ++++ b/drivers/media/usb/gspca/spca1528.c +@@ -80,6 +80,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c +index d7cbcf2b39479..3521f5ff428e9 100644 +--- a/drivers/media/usb/gspca/sq930x.c ++++ b/drivers/media/usb/gspca/sq930x.c +@@ -434,6 +434,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r %04x failed %d\n", value, ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c +index 437a3367ab974..26eae69a2562f 100644 +--- a/drivers/media/usb/gspca/sunplus.c ++++ b/drivers/media/usb/gspca/sunplus.c +@@ -264,6 +264,11 @@ static void reg_r(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + +diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c +index 52d0716596343..6e32264d3825a 100644 +--- a/drivers/media/usb/gspca/vc032x.c ++++ b/drivers/media/usb/gspca/vc032x.c +@@ -2915,6 +2915,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev, + if (ret < 0) { + pr_err("reg_r err %d\n", ret); + gspca_dev->usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); + } + } + static void reg_r(struct gspca_dev *gspca_dev, +diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c +index abfab3de18662..ef0a839f9b8ae 100644 +--- a/drivers/media/usb/gspca/w996Xcf.c ++++ b/drivers/media/usb/gspca/w996Xcf.c +@@ -143,6 +143,11 @@ static int w9968cf_read_sb(struct sd *sd) + } else { + pr_err("Read SB reg [01] failed\n"); + sd->gspca_dev.usb_err = ret; ++ /* ++ * Make sure the buffer is zeroed to avoid uninitialized ++ * values. ++ */ ++ memset(sd->gspca_dev.usb_buf, 0, 2); + } + + udelay(W9968CF_I2C_BUS_DELAY); +-- +2.20.1 + diff --git a/queue-4.19/media-hdpvr-add-device-num-check-and-handling.patch b/queue-4.19/media-hdpvr-add-device-num-check-and-handling.patch new file mode 100644 index 00000000000..f9411afdbea --- /dev/null +++ b/queue-4.19/media-hdpvr-add-device-num-check-and-handling.patch @@ -0,0 +1,59 @@ +From 61a93a726cf13492e4e71a266264d21e94ed1c00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2019 10:19:46 -0400 +Subject: media: hdpvr: Add device num check and handling + +From: Luke Nowakowski-Krijger + +[ Upstream commit d4a6a9537bc32811486282206ecfb7c53754b74d ] + +Add hdpvr device num check and error handling + +We need to increment the device count atomically before we checkout a +device to make sure that we do not reach the max count, otherwise we get +out-of-bounds errors as reported by syzbot. + +Reported-and-tested-by: syzbot+aac8d0d7205f112045d2@syzkaller.appspotmail.com + +Signed-off-by: Luke Nowakowski-Krijger +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c +index 29ac7fc5b039f..46adee95f89d5 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-core.c ++++ b/drivers/media/usb/hdpvr/hdpvr-core.c +@@ -275,6 +275,7 @@ static int hdpvr_probe(struct usb_interface *interface, + #endif + size_t buffer_size; + int i; ++ int dev_num; + int retval = -ENOMEM; + + /* allocate memory for our device state and initialize it */ +@@ -372,8 +373,17 @@ static int hdpvr_probe(struct usb_interface *interface, + } + #endif + ++ dev_num = atomic_inc_return(&dev_nr); ++ if (dev_num >= HDPVR_MAX) { ++ v4l2_err(&dev->v4l2_dev, ++ "max device number reached, device register failed\n"); ++ atomic_dec(&dev_nr); ++ retval = -ENODEV; ++ goto reg_fail; ++ } ++ + retval = hdpvr_register_videodev(dev, &interface->dev, +- video_nr[atomic_inc_return(&dev_nr)]); ++ video_nr[dev_num]); + if (retval < 0) { + v4l2_err(&dev->v4l2_dev, "registering videodev failed\n"); + goto reg_fail; +-- +2.20.1 + diff --git a/queue-4.19/media-hdpvr-add-terminating-0-at-end-of-string.patch b/queue-4.19/media-hdpvr-add-terminating-0-at-end-of-string.patch new file mode 100644 index 00000000000..bbd16c5ea15 --- /dev/null +++ b/queue-4.19/media-hdpvr-add-terminating-0-at-end-of-string.patch @@ -0,0 +1,40 @@ +From 2aa8169a871ecac41c173135547a2fe496d33a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 10:00:33 -0300 +Subject: media: hdpvr: add terminating 0 at end of string + +From: Hans Verkuil + +[ Upstream commit 8b8900b729e4f31f12ac1127bde137c775c327e6 ] + +dev->usbc_buf was passed as argument for %s, but it was not safeguarded +by a terminating 0. + +This caused this syzbot issue: + +https://syzkaller.appspot.com/bug?extid=79d18aac4bf1770dd050 + +Reported-and-tested-by: syzbot+79d18aac4bf1770dd050@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c +index 46adee95f89d5..3316a17c141be 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-core.c ++++ b/drivers/media/usb/hdpvr/hdpvr-core.c +@@ -141,6 +141,7 @@ static int device_authorization(struct hdpvr_device *dev) + + dev->fw_ver = dev->usbc_buf[1]; + ++ dev->usbc_buf[46] = '\0'; + v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n", + dev->fw_ver, &dev->usbc_buf[2]); + +-- +2.20.1 + diff --git a/queue-4.19/media-i2c-ov5640-check-for-devm_gpiod_get_optional-e.patch b/queue-4.19/media-i2c-ov5640-check-for-devm_gpiod_get_optional-e.patch new file mode 100644 index 00000000000..27a04f64b83 --- /dev/null +++ b/queue-4.19/media-i2c-ov5640-check-for-devm_gpiod_get_optional-e.patch @@ -0,0 +1,43 @@ +From 1624fa7b82c7ef050369909db3b1248c6b2b5d27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 07:00:34 -0400 +Subject: media: i2c: ov5640: Check for devm_gpiod_get_optional() error + +From: Fabio Estevam + +[ Upstream commit 8791a102ce579346cea9d2f911afef1c1985213c ] + +The power down and reset GPIO are optional, but the return value +from devm_gpiod_get_optional() needs to be checked and propagated +in the case of error, so that probe deferral can work. + +Signed-off-by: Fabio Estevam +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index d5c0ffc55d46a..a3bbef682fb8e 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2787,9 +2787,14 @@ static int ov5640_probe(struct i2c_client *client, + /* request optional power down pin */ + sensor->pwdn_gpio = devm_gpiod_get_optional(dev, "powerdown", + GPIOD_OUT_HIGH); ++ if (IS_ERR(sensor->pwdn_gpio)) ++ return PTR_ERR(sensor->pwdn_gpio); ++ + /* request optional reset pin */ + sensor->reset_gpio = devm_gpiod_get_optional(dev, "reset", + GPIOD_OUT_HIGH); ++ if (IS_ERR(sensor->reset_gpio)) ++ return PTR_ERR(sensor->reset_gpio); + + v4l2_i2c_subdev_init(&sensor->sd, client, &ov5640_subdev_ops); + +-- +2.20.1 + diff --git a/queue-4.19/media-i2c-ov5645-fix-power-sequence.patch b/queue-4.19/media-i2c-ov5645-fix-power-sequence.patch new file mode 100644 index 00000000000..3532ff051a1 --- /dev/null +++ b/queue-4.19/media-i2c-ov5645-fix-power-sequence.patch @@ -0,0 +1,122 @@ +From 72419732c0cdad61c587aea90d6708a974c66272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 08:05:40 -0300 +Subject: media: i2c: ov5645: Fix power sequence + +From: Ezequiel Garcia + +[ Upstream commit 092e8eb90a7dc7dd210cd4e2ea36075d0a7f96af ] + +This is mostly a port of Jacopo's fix: + + commit aa4bb8b8838ffcc776a79f49a4d7476b82405349 + Author: Jacopo Mondi + Date: Fri Jul 6 05:51:52 2018 -0400 + + media: ov5640: Re-work MIPI startup sequence + +In the OV5645 case, the changes are: + +- At set_power(1) time power up MIPI Tx/Rx and set data and clock lanes in + LP11 during 'sleep' and 'idle' with MIPI clock in non-continuous mode. +- At set_power(0) time power down MIPI Tx/Rx (in addition to the current + power down of regulators and clock gating). +- At s_stream time enable/disable the MIPI interface output. + +With this commit the sensor is able to enter LP-11 mode during power up, +as expected by some CSI-2 controllers. + +Many thanks to Fabio Estevam for his help debugging this issue. + +Tested-by: Fabio Estevam +Signed-off-by: Ezequiel Garcia +Reviewed-by: Philipp Zabel +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5645.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c +index 1722cdab0daf2..34343bc100078 100644 +--- a/drivers/media/i2c/ov5645.c ++++ b/drivers/media/i2c/ov5645.c +@@ -53,6 +53,8 @@ + #define OV5645_CHIP_ID_HIGH_BYTE 0x56 + #define OV5645_CHIP_ID_LOW 0x300b + #define OV5645_CHIP_ID_LOW_BYTE 0x45 ++#define OV5645_IO_MIPI_CTRL00 0x300e ++#define OV5645_PAD_OUTPUT00 0x3019 + #define OV5645_AWB_MANUAL_CONTROL 0x3406 + #define OV5645_AWB_MANUAL_ENABLE BIT(0) + #define OV5645_AEC_PK_MANUAL 0x3503 +@@ -63,6 +65,7 @@ + #define OV5645_ISP_VFLIP BIT(2) + #define OV5645_TIMING_TC_REG21 0x3821 + #define OV5645_SENSOR_MIRROR BIT(1) ++#define OV5645_MIPI_CTRL00 0x4800 + #define OV5645_PRE_ISP_TEST_SETTING_1 0x503d + #define OV5645_TEST_PATTERN_MASK 0x3 + #define OV5645_SET_TEST_PATTERN(x) ((x) & OV5645_TEST_PATTERN_MASK) +@@ -129,7 +132,6 @@ static const struct reg_value ov5645_global_init_setting[] = { + { 0x3503, 0x07 }, + { 0x3002, 0x1c }, + { 0x3006, 0xc3 }, +- { 0x300e, 0x45 }, + { 0x3017, 0x00 }, + { 0x3018, 0x00 }, + { 0x302e, 0x0b }, +@@ -358,7 +360,10 @@ static const struct reg_value ov5645_global_init_setting[] = { + { 0x3a1f, 0x14 }, + { 0x0601, 0x02 }, + { 0x3008, 0x42 }, +- { 0x3008, 0x02 } ++ { 0x3008, 0x02 }, ++ { OV5645_IO_MIPI_CTRL00, 0x40 }, ++ { OV5645_MIPI_CTRL00, 0x24 }, ++ { OV5645_PAD_OUTPUT00, 0x70 } + }; + + static const struct reg_value ov5645_setting_sxga[] = { +@@ -745,13 +750,9 @@ static int ov5645_s_power(struct v4l2_subdev *sd, int on) + goto exit; + } + +- ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0, +- OV5645_SYSTEM_CTRL0_STOP); +- if (ret < 0) { +- ov5645_set_power_off(ov5645); +- goto exit; +- } ++ usleep_range(500, 1000); + } else { ++ ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x58); + ov5645_set_power_off(ov5645); + } + } +@@ -1057,11 +1058,20 @@ static int ov5645_s_stream(struct v4l2_subdev *subdev, int enable) + dev_err(ov5645->dev, "could not sync v4l2 controls\n"); + return ret; + } ++ ++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x45); ++ if (ret < 0) ++ return ret; ++ + ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0, + OV5645_SYSTEM_CTRL0_START); + if (ret < 0) + return ret; + } else { ++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x40); ++ if (ret < 0) ++ return ret; ++ + ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0, + OV5645_SYSTEM_CTRL0_STOP); + if (ret < 0) +-- +2.20.1 + diff --git a/queue-4.19/media-iguanair-add-sanity-checks.patch b/queue-4.19/media-iguanair-add-sanity-checks.patch new file mode 100644 index 00000000000..af672f25d99 --- /dev/null +++ b/queue-4.19/media-iguanair-add-sanity-checks.patch @@ -0,0 +1,61 @@ +From 59474b528d0c990d1a3c3ee263048c614c939ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2019 05:50:44 -0300 +Subject: media: iguanair: add sanity checks + +From: Oliver Neukum + +[ Upstream commit ab1cbdf159beba7395a13ab70bc71180929ca064 ] + +The driver needs to check the endpoint types, too, as opposed +to the number of endpoints. This also requires moving the check earlier. + +Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/iguanair.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c +index 7daac8bab83b0..6f3030b2054d0 100644 +--- a/drivers/media/rc/iguanair.c ++++ b/drivers/media/rc/iguanair.c +@@ -424,6 +424,10 @@ static int iguanair_probe(struct usb_interface *intf, + int ret, pipein, pipeout; + struct usb_host_interface *idesc; + ++ idesc = intf->altsetting; ++ if (idesc->desc.bNumEndpoints < 2) ++ return -ENODEV; ++ + ir = kzalloc(sizeof(*ir), GFP_KERNEL); + rc = rc_allocate_device(RC_DRIVER_IR_RAW); + if (!ir || !rc) { +@@ -438,18 +442,13 @@ static int iguanair_probe(struct usb_interface *intf, + ir->urb_in = usb_alloc_urb(0, GFP_KERNEL); + ir->urb_out = usb_alloc_urb(0, GFP_KERNEL); + +- if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) { ++ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out || ++ !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) || ++ !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) { + ret = -ENOMEM; + goto out; + } + +- idesc = intf->altsetting; +- +- if (idesc->desc.bNumEndpoints < 2) { +- ret = -ENODEV; +- goto out; +- } +- + ir->rc = rc; + ir->dev = &intf->dev; + ir->udev = udev; +-- +2.20.1 + diff --git a/queue-4.19/media-imx-mipi-csi-2-don-t-fail-if-initial-state-tim.patch b/queue-4.19/media-imx-mipi-csi-2-don-t-fail-if-initial-state-tim.patch new file mode 100644 index 00000000000..6da90d862a2 --- /dev/null +++ b/queue-4.19/media-imx-mipi-csi-2-don-t-fail-if-initial-state-tim.patch @@ -0,0 +1,75 @@ +From e7d93f8f34fe85ebbba639f8efbc0fd10ee94bf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2019 19:29:12 -0300 +Subject: media: imx: mipi csi-2: Don't fail if initial state times-out + +From: Ezequiel Garcia + +[ Upstream commit 0d5078c7172c46db6c58718d817b9fcf769554b4 ] + +Not all sensors will be able to guarantee a proper initial state. +This may be either because the driver is not properly written, +or (probably unlikely) because the hardware won't support it. + +While the right solution in the former case is to fix the sensor +driver, the real world not always allows right solutions, due to lack +of available documentation and support on these sensors. + +Let's relax this requirement, and allow the driver to support stream start, +even if the sensor initial sequence wasn't the expected. + +Also improve the warning message to better explain the problem and provide +a hint that the sensor driver needs to be fixed. + +Signed-off-by: Ezequiel Garcia +Signed-off-by: Fabio Estevam +Reviewed-by: Steve Longerbeam +Reviewed-by: Philipp Zabel +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx6-mipi-csi2.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/media/imx/imx6-mipi-csi2.c b/drivers/staging/media/imx/imx6-mipi-csi2.c +index ceeeb3069a024..212fa06f7c57c 100644 +--- a/drivers/staging/media/imx/imx6-mipi-csi2.c ++++ b/drivers/staging/media/imx/imx6-mipi-csi2.c +@@ -247,7 +247,7 @@ static int __maybe_unused csi2_dphy_wait_ulp(struct csi2_dev *csi2) + } + + /* Waits for low-power LP-11 state on data and clock lanes. */ +-static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2) ++static void csi2_dphy_wait_stopstate(struct csi2_dev *csi2) + { + u32 mask, reg; + int ret; +@@ -258,11 +258,9 @@ static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2) + ret = readl_poll_timeout(csi2->base + CSI2_PHY_STATE, reg, + (reg & mask) == mask, 0, 500000); + if (ret) { +- v4l2_err(&csi2->sd, "LP-11 timeout, phy_state = 0x%08x\n", reg); +- return ret; ++ v4l2_warn(&csi2->sd, "LP-11 wait timeout, likely a sensor driver bug, expect capture failures.\n"); ++ v4l2_warn(&csi2->sd, "phy_state = 0x%08x\n", reg); + } +- +- return 0; + } + + /* Wait for active clock on the clock lane. */ +@@ -320,9 +318,7 @@ static int csi2_start(struct csi2_dev *csi2) + csi2_enable(csi2, true); + + /* Step 5 */ +- ret = csi2_dphy_wait_stopstate(csi2); +- if (ret) +- goto err_assert_reset; ++ csi2_dphy_wait_stopstate(csi2); + + /* Step 6 */ + ret = v4l2_subdev_call(csi2->src_sd, video, s_stream, 1); +-- +2.20.1 + diff --git a/queue-4.19/media-mceusb-fix-eliminate-tx-ir-signal-length-limit.patch b/queue-4.19/media-mceusb-fix-eliminate-tx-ir-signal-length-limit.patch new file mode 100644 index 00000000000..dec1b07d6ed --- /dev/null +++ b/queue-4.19/media-mceusb-fix-eliminate-tx-ir-signal-length-limit.patch @@ -0,0 +1,682 @@ +From dec671063bd9e67c32c915b06055c3e42767b9f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 13:41:19 -0300 +Subject: media: mceusb: fix (eliminate) TX IR signal length limit + +From: A Sun + +[ Upstream commit 9fc3ce31f5bde660197f35135e90a1cced58aa2c ] + +Fix and eliminate mceusb's IR length limit for IR signals transmitted to +the MCE IR blaster ports. + +An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL +return error. There's no such limitation nor error with the MCE device +hardware. And valid IR signals exist with more than 400 pulse/space for the +control of certain appliances (eg Panasonic ACXA75C00600 air conditioner). + +The scope of this patch is limited to the mceusb driver. There are still +IR signal TX length and time constraints that related modules of rc core +(eg LIRC) impose, further up the driver stack. + +Changes for mceusb_tx_ir(): + +Converts and sends LIRC IR pulse/space sequence to MCE device IR +pulse/space format. + +Break long length LIRC sequence into multiple (unlimited number of) parts +for sending to the MCE device. +Reduce kernel stack IR buffer size: 128 (was 384) +Increase MCE IR data packet size: 31 (was 5) +Zero time LIRC pulse/space no longer copied to MCE IR data. +Eliminate overwriting the source/input LIRC IR data in txbuf[]. +Eliminate -EINVAL return; return number of IR samples sent (>0) or +MCE write error code (<0). + +New mce_write() and mce_write_callback(): + +Implements synchronous blocking I/O, with timeout, for writing/sending +data to the MCE device. + +An unlimited multipart IR signal sent to the MCE device faster than real +time requires flow control absent with the original mce_request_packet() +and mce_async_callback() asynchronous I/O implementation. Also absent is +TX error feedback. + +mce_write() combines and replaces mce_request_packet() and +mce_async_callback() with conversion to synchronous I/O. +mce_write() returns bytes sent (>0) or MCE device write error (<0). +Debug hex dump TX data before processing. + +Rename mce_async_out() -> mce_command_out(): + +The original name is misleading with underlying synchronous I/O +implementation. Function renamed to mce_command_out(). + +Changes in mceusb_handle_command(): + +Add support for MCE device error case MCE_RSP_TX_TIMEOUT +"IR TX timeout (TX buffer underrun)" + +Changes in mceusb_dev_printdata(): + +Changes support test and debug of multipart TX IR. + +Add buffer boundary information (offset and buffer size) to TX hex dump. +Correct TX trace bug "Raw IR data, 0 pulse/space samples" +Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)" + +Other changes: + +The driver's write to USB device architecture change (async to sync I/O) +is significant so we bump DRIVER_VERSION to "1.95" (from "1.94"). + +Tests: + +$ cat -n irdata1 | head -3 + 1 carrier 36000 + 2 pulse 6350 + 3 space 6350 +$ cat -n irdata1 | tail -3 + 76 pulse 6350 + 77 space 6350 + 78 pulse 6350 +$ ir-ctl -s irdata1 + +[1549021.073612] mceusb 1-1.3:1.0: requesting 36000 HZ carrier +[1549021.073635] mceusb 1-1.3:1.0: tx data[0]: 9f 06 01 45 (len=4 sz=4) +[1549021.073649] mceusb 1-1.3:1.0: Request carrier of 35714 Hz (period 28us) +[1549021.073848] mceusb 1-1.3:1.0: tx done status = 4 (wait = 100, expire = 100 (1000ms), urb->actual_length = 4, urb->status = 0) +[1549021.074689] mceusb 1-1.3:1.0: rx data[0]: 9f 06 01 45 (len=4 sz=4) +[1549021.074701] mceusb 1-1.3:1.0: Got carrier of 35714 Hz (period 28us) +[1549021.102023] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) +[1549021.102036] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 +[1549021.102219] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) +[1549021.131979] mceusb 1-1.3:1.0: tx data[0]: 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 91 ff (len=81 sz=81) +[1549021.131992] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples +[1549021.133592] mceusb 1-1.3:1.0: tx done status = 81 (wait = 100, expire = 100 (1000ms), urb->actual_length = 81, urb->status = 0) + +Hex dumps limited to 64 bytes. +0xff is MCE maximum time pulse, 0x7f is MCE maximum time space. + +$ cat -n irdata2 | head -3 + 1 carrier 36000 + 2 pulse 50 + 3 space 50 +$ cat -n irdata2 | tail -3 + 254 pulse 50 + 255 space 50 + 256 pulse 50 +$ ir-ctl -s irdata2 + +[1549306.586998] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) +[1549306.587015] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 +[1549306.587252] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) +[1549306.613275] mceusb 1-1.3:1.0: tx data[0]: 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 (len=128 sz=128) +[1549306.613291] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples +[1549306.614837] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) +[1549306.614861] mceusb 1-1.3:1.0: tx data[0]: 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 (len=128 sz=128) +[1549306.614869] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples +[1549306.620199] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) +[1549306.620212] mceusb 1-1.3:1.0: tx data[0]: 89 81 01 81 01 81 01 81 01 81 80 (len=11 sz=11) +[1549306.620221] mceusb 1-1.3:1.0: Raw IR data, 9 pulse/space samples +[1549306.633294] mceusb 1-1.3:1.0: tx done status = 11 (wait = 98, expire = 100 (1000ms), urb->actual_length = 11, urb->status = 0) + +Hex dumps limited to 64 bytes. +0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space. +TX IR part 3 sz=11 shows 20msec I/O blocking delay +(100expire - 98wait = 2jiffies) + +Signed-off-by: A Sun +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/mceusb.c | 334 ++++++++++++++++++++++---------------- + 1 file changed, 196 insertions(+), 138 deletions(-) + +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index 4c0c8008872ae..f1dfb84094328 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -42,21 +42,22 @@ + #include + #include + +-#define DRIVER_VERSION "1.94" ++#define DRIVER_VERSION "1.95" + #define DRIVER_AUTHOR "Jarod Wilson " + #define DRIVER_DESC "Windows Media Center Ed. eHome Infrared Transceiver " \ + "device driver" + #define DRIVER_NAME "mceusb" + ++#define USB_TX_TIMEOUT 1000 /* in milliseconds */ + #define USB_CTRL_MSG_SZ 2 /* Size of usb ctrl msg on gen1 hw */ + #define MCE_G1_INIT_MSGS 40 /* Init messages on gen1 hw to throw out */ + + /* MCE constants */ +-#define MCE_CMDBUF_SIZE 384 /* MCE Command buffer length */ ++#define MCE_IRBUF_SIZE 128 /* TX IR buffer length */ + #define MCE_TIME_UNIT 50 /* Approx 50us resolution */ +-#define MCE_CODE_LENGTH 5 /* Normal length of packet (with header) */ +-#define MCE_PACKET_SIZE 4 /* Normal length of packet (without header) */ +-#define MCE_IRDATA_HEADER 0x84 /* Actual header format is 0x80 + num_bytes */ ++#define MCE_PACKET_SIZE 31 /* Max length of packet (with header) */ ++#define MCE_IRDATA_HEADER (0x80 + MCE_PACKET_SIZE - 1) ++ /* Actual format is 0x80 + num_bytes */ + #define MCE_IRDATA_TRAILER 0x80 /* End of IR data */ + #define MCE_MAX_CHANNELS 2 /* Two transmitters, hardware dependent? */ + #define MCE_DEFAULT_TX_MASK 0x03 /* Vals: TX1=0x01, TX2=0x02, ALL=0x03 */ +@@ -609,9 +610,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len, + if (len <= skip) + return; + +- dev_dbg(dev, "%cx data: %*ph (length=%d)", +- (out ? 't' : 'r'), +- min(len, buf_len - offset), buf + offset, len); ++ dev_dbg(dev, "%cx data[%d]: %*ph (len=%d sz=%d)", ++ (out ? 't' : 'r'), offset, ++ min(len, buf_len - offset), buf + offset, len, buf_len); + + inout = out ? "Request" : "Got"; + +@@ -733,6 +734,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len, + case MCE_RSP_CMD_ILLEGAL: + dev_dbg(dev, "Illegal PORT_IR command"); + break; ++ case MCE_RSP_TX_TIMEOUT: ++ dev_dbg(dev, "IR TX timeout (TX buffer underrun)"); ++ break; + default: + dev_dbg(dev, "Unknown command 0x%02x 0x%02x", + cmd, subcmd); +@@ -747,13 +751,14 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len, + dev_dbg(dev, "End of raw IR data"); + else if ((cmd != MCE_CMD_PORT_IR) && + ((cmd & MCE_PORT_MASK) == MCE_COMMAND_IRDATA)) +- dev_dbg(dev, "Raw IR data, %d pulse/space samples", ir->rem); ++ dev_dbg(dev, "Raw IR data, %d pulse/space samples", ++ cmd & MCE_PACKET_LENGTH_MASK); + #endif + } + + /* + * Schedule work that can't be done in interrupt handlers +- * (mceusb_dev_recv() and mce_async_callback()) nor tasklets. ++ * (mceusb_dev_recv() and mce_write_callback()) nor tasklets. + * Invokes mceusb_deferred_kevent() for recovering from + * error events specified by the kevent bit field. + */ +@@ -766,23 +771,80 @@ static void mceusb_defer_kevent(struct mceusb_dev *ir, int kevent) + dev_dbg(ir->dev, "kevent %d scheduled", kevent); + } + +-static void mce_async_callback(struct urb *urb) ++static void mce_write_callback(struct urb *urb) + { +- struct mceusb_dev *ir; +- int len; +- + if (!urb) + return; + +- ir = urb->context; ++ complete(urb->context); ++} ++ ++/* ++ * Write (TX/send) data to MCE device USB endpoint out. ++ * Used for IR blaster TX and MCE device commands. ++ * ++ * Return: The number of bytes written (> 0) or errno (< 0). ++ */ ++static int mce_write(struct mceusb_dev *ir, u8 *data, int size) ++{ ++ int ret; ++ struct urb *urb; ++ struct device *dev = ir->dev; ++ unsigned char *buf_out; ++ struct completion tx_done; ++ unsigned long expire; ++ unsigned long ret_wait; ++ ++ mceusb_dev_printdata(ir, data, size, 0, size, true); ++ ++ urb = usb_alloc_urb(0, GFP_KERNEL); ++ if (unlikely(!urb)) { ++ dev_err(dev, "Error: mce write couldn't allocate urb"); ++ return -ENOMEM; ++ } ++ ++ buf_out = kmalloc(size, GFP_KERNEL); ++ if (!buf_out) { ++ usb_free_urb(urb); ++ return -ENOMEM; ++ } ++ ++ init_completion(&tx_done); ++ ++ /* outbound data */ ++ if (usb_endpoint_xfer_int(ir->usb_ep_out)) ++ usb_fill_int_urb(urb, ir->usbdev, ir->pipe_out, ++ buf_out, size, mce_write_callback, &tx_done, ++ ir->usb_ep_out->bInterval); ++ else ++ usb_fill_bulk_urb(urb, ir->usbdev, ir->pipe_out, ++ buf_out, size, mce_write_callback, &tx_done); ++ memcpy(buf_out, data, size); ++ ++ ret = usb_submit_urb(urb, GFP_KERNEL); ++ if (ret) { ++ dev_err(dev, "Error: mce write submit urb error = %d", ret); ++ kfree(buf_out); ++ usb_free_urb(urb); ++ return ret; ++ } ++ ++ expire = msecs_to_jiffies(USB_TX_TIMEOUT); ++ ret_wait = wait_for_completion_timeout(&tx_done, expire); ++ if (!ret_wait) { ++ dev_err(dev, "Error: mce write timed out (expire = %lu (%dms))", ++ expire, USB_TX_TIMEOUT); ++ usb_kill_urb(urb); ++ ret = (urb->status == -ENOENT ? -ETIMEDOUT : urb->status); ++ } else { ++ ret = urb->status; ++ } ++ if (ret >= 0) ++ ret = urb->actual_length; /* bytes written */ + + switch (urb->status) { + /* success */ + case 0: +- len = urb->actual_length; +- +- mceusb_dev_printdata(ir, urb->transfer_buffer, len, +- 0, len, true); + break; + + case -ECONNRESET: +@@ -792,140 +854,135 @@ static void mce_async_callback(struct urb *urb) + break; + + case -EPIPE: +- dev_err(ir->dev, "Error: request urb status = %d (TX HALT)", ++ dev_err(ir->dev, "Error: mce write urb status = %d (TX HALT)", + urb->status); + mceusb_defer_kevent(ir, EVENT_TX_HALT); + break; + + default: +- dev_err(ir->dev, "Error: request urb status = %d", urb->status); ++ dev_err(ir->dev, "Error: mce write urb status = %d", ++ urb->status); + break; + } + +- /* the transfer buffer and urb were allocated in mce_request_packet */ +- kfree(urb->transfer_buffer); +- usb_free_urb(urb); +-} +- +-/* request outgoing (send) usb packet - used to initialize remote */ +-static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data, +- int size) +-{ +- int res; +- struct urb *async_urb; +- struct device *dev = ir->dev; +- unsigned char *async_buf; ++ dev_dbg(dev, "tx done status = %d (wait = %lu, expire = %lu (%dms), urb->actual_length = %d, urb->status = %d)", ++ ret, ret_wait, expire, USB_TX_TIMEOUT, ++ urb->actual_length, urb->status); + +- async_urb = usb_alloc_urb(0, GFP_KERNEL); +- if (unlikely(!async_urb)) { +- dev_err(dev, "Error, couldn't allocate urb!"); +- return; +- } +- +- async_buf = kmalloc(size, GFP_KERNEL); +- if (!async_buf) { +- usb_free_urb(async_urb); +- return; +- } +- +- /* outbound data */ +- if (usb_endpoint_xfer_int(ir->usb_ep_out)) +- usb_fill_int_urb(async_urb, ir->usbdev, ir->pipe_out, +- async_buf, size, mce_async_callback, ir, +- ir->usb_ep_out->bInterval); +- else +- usb_fill_bulk_urb(async_urb, ir->usbdev, ir->pipe_out, +- async_buf, size, mce_async_callback, ir); +- +- memcpy(async_buf, data, size); +- +- dev_dbg(dev, "send request called (size=%#x)", size); ++ kfree(buf_out); ++ usb_free_urb(urb); + +- res = usb_submit_urb(async_urb, GFP_ATOMIC); +- if (res) { +- dev_err(dev, "send request FAILED! (res=%d)", res); +- kfree(async_buf); +- usb_free_urb(async_urb); +- return; +- } +- dev_dbg(dev, "send request complete (res=%d)", res); ++ return ret; + } + +-static void mce_async_out(struct mceusb_dev *ir, unsigned char *data, int size) ++static void mce_command_out(struct mceusb_dev *ir, u8 *data, int size) + { + int rsize = sizeof(DEVICE_RESUME); + + if (ir->need_reset) { + ir->need_reset = false; +- mce_request_packet(ir, DEVICE_RESUME, rsize); ++ mce_write(ir, DEVICE_RESUME, rsize); + msleep(10); + } + +- mce_request_packet(ir, data, size); ++ mce_write(ir, data, size); + msleep(10); + } + +-/* Send data out the IR blaster port(s) */ ++/* ++ * Transmit IR out the MCE device IR blaster port(s). ++ * ++ * Convert IR pulse/space sequence from LIRC to MCE format. ++ * Break up a long IR sequence into multiple parts (MCE IR data packets). ++ * ++ * u32 txbuf[] consists of IR pulse, space, ..., and pulse times in usec. ++ * Pulses and spaces are implicit by their position. ++ * The first IR sample, txbuf[0], is always a pulse. ++ * ++ * u8 irbuf[] consists of multiple IR data packets for the MCE device. ++ * A packet is 1 u8 MCE_IRDATA_HEADER and up to 30 u8 IR samples. ++ * An IR sample is 1-bit pulse/space flag with 7-bit time ++ * in MCE time units (50usec). ++ * ++ * Return: The number of IR samples sent (> 0) or errno (< 0). ++ */ + static int mceusb_tx_ir(struct rc_dev *dev, unsigned *txbuf, unsigned count) + { + struct mceusb_dev *ir = dev->priv; +- int i, length, ret = 0; +- int cmdcount = 0; +- unsigned char cmdbuf[MCE_CMDBUF_SIZE]; +- +- /* MCE tx init header */ +- cmdbuf[cmdcount++] = MCE_CMD_PORT_IR; +- cmdbuf[cmdcount++] = MCE_CMD_SETIRTXPORTS; +- cmdbuf[cmdcount++] = ir->tx_mask; ++ u8 cmdbuf[3] = { MCE_CMD_PORT_IR, MCE_CMD_SETIRTXPORTS, 0x00 }; ++ u8 irbuf[MCE_IRBUF_SIZE]; ++ int ircount = 0; ++ unsigned int irsample; ++ int i, length, ret; + + /* Send the set TX ports command */ +- mce_async_out(ir, cmdbuf, cmdcount); +- cmdcount = 0; +- +- /* Generate mce packet data */ +- for (i = 0; (i < count) && (cmdcount < MCE_CMDBUF_SIZE); i++) { +- txbuf[i] = txbuf[i] / MCE_TIME_UNIT; +- +- do { /* loop to support long pulses/spaces > 127*50us=6.35ms */ +- +- /* Insert mce packet header every 4th entry */ +- if ((cmdcount < MCE_CMDBUF_SIZE) && +- (cmdcount % MCE_CODE_LENGTH) == 0) +- cmdbuf[cmdcount++] = MCE_IRDATA_HEADER; +- +- /* Insert mce packet data */ +- if (cmdcount < MCE_CMDBUF_SIZE) +- cmdbuf[cmdcount++] = +- (txbuf[i] < MCE_PULSE_BIT ? +- txbuf[i] : MCE_MAX_PULSE_LENGTH) | +- (i & 1 ? 0x00 : MCE_PULSE_BIT); +- else { +- ret = -EINVAL; +- goto out; ++ cmdbuf[2] = ir->tx_mask; ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); ++ ++ /* Generate mce IR data packet */ ++ for (i = 0; i < count; i++) { ++ irsample = txbuf[i] / MCE_TIME_UNIT; ++ ++ /* loop to support long pulses/spaces > 6350us (127*50us) */ ++ while (irsample > 0) { ++ /* Insert IR header every 30th entry */ ++ if (ircount % MCE_PACKET_SIZE == 0) { ++ /* Room for IR header and one IR sample? */ ++ if (ircount >= MCE_IRBUF_SIZE - 1) { ++ /* Send near full buffer */ ++ ret = mce_write(ir, irbuf, ircount); ++ if (ret < 0) ++ return ret; ++ ircount = 0; ++ } ++ irbuf[ircount++] = MCE_IRDATA_HEADER; + } + +- } while ((txbuf[i] > MCE_MAX_PULSE_LENGTH) && +- (txbuf[i] -= MCE_MAX_PULSE_LENGTH)); +- } +- +- /* Check if we have room for the empty packet at the end */ +- if (cmdcount >= MCE_CMDBUF_SIZE) { +- ret = -EINVAL; +- goto out; +- } ++ /* Insert IR sample */ ++ if (irsample <= MCE_MAX_PULSE_LENGTH) { ++ irbuf[ircount] = irsample; ++ irsample = 0; ++ } else { ++ irbuf[ircount] = MCE_MAX_PULSE_LENGTH; ++ irsample -= MCE_MAX_PULSE_LENGTH; ++ } ++ /* ++ * Even i = IR pulse ++ * Odd i = IR space ++ */ ++ irbuf[ircount] |= (i & 1 ? 0 : MCE_PULSE_BIT); ++ ircount++; ++ ++ /* IR buffer full? */ ++ if (ircount >= MCE_IRBUF_SIZE) { ++ /* Fix packet length in last header */ ++ length = ircount % MCE_PACKET_SIZE; ++ if (length > 0) ++ irbuf[ircount - length] -= ++ MCE_PACKET_SIZE - length; ++ /* Send full buffer */ ++ ret = mce_write(ir, irbuf, ircount); ++ if (ret < 0) ++ return ret; ++ ircount = 0; ++ } ++ } ++ } /* after for loop, 0 <= ircount < MCE_IRBUF_SIZE */ + + /* Fix packet length in last header */ +- length = cmdcount % MCE_CODE_LENGTH; +- cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length; ++ length = ircount % MCE_PACKET_SIZE; ++ if (length > 0) ++ irbuf[ircount - length] -= MCE_PACKET_SIZE - length; + +- /* All mce commands end with an empty packet (0x80) */ +- cmdbuf[cmdcount++] = MCE_IRDATA_TRAILER; ++ /* Append IR trailer (0x80) to final partial (or empty) IR buffer */ ++ irbuf[ircount++] = MCE_IRDATA_TRAILER; + +- /* Transmit the command to the mce device */ +- mce_async_out(ir, cmdbuf, cmdcount); ++ /* Send final buffer */ ++ ret = mce_write(ir, irbuf, ircount); ++ if (ret < 0) ++ return ret; + +-out: +- return ret ? ret : count; ++ return count; + } + + /* Sets active IR outputs -- mce devices typically have two */ +@@ -965,7 +1022,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier) + cmdbuf[2] = MCE_CMD_SIG_END; + cmdbuf[3] = MCE_IRDATA_TRAILER; + dev_dbg(ir->dev, "disabling carrier modulation"); +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + return 0; + } + +@@ -979,7 +1036,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier) + carrier); + + /* Transmit new carrier to mce device */ +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + return 0; + } + } +@@ -1002,10 +1059,10 @@ static int mceusb_set_timeout(struct rc_dev *dev, unsigned int timeout) + cmdbuf[2] = units >> 8; + cmdbuf[3] = units; + +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + + /* get receiver timeout value */ +- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT)); ++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT)); + + return 0; + } +@@ -1030,7 +1087,7 @@ static int mceusb_set_rx_wideband(struct rc_dev *dev, int enable) + ir->wideband_rx_enabled = false; + cmdbuf[2] = 1; /* port 1 is long range receiver */ + } +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + /* response from device sets ir->learning_active */ + + return 0; +@@ -1053,7 +1110,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable) + ir->carrier_report_enabled = true; + if (!ir->learning_active) { + cmdbuf[2] = 2; /* port 2 is short range receiver */ +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + } + } else { + ir->carrier_report_enabled = false; +@@ -1064,7 +1121,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable) + */ + if (ir->learning_active && !ir->wideband_rx_enabled) { + cmdbuf[2] = 1; /* port 1 is long range receiver */ +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + } + } + +@@ -1143,6 +1200,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index) + } + break; + case MCE_RSP_CMD_ILLEGAL: ++ case MCE_RSP_TX_TIMEOUT: + ir->need_reset = true; + break; + default: +@@ -1280,7 +1338,7 @@ static void mceusb_get_emulator_version(struct mceusb_dev *ir) + { + /* If we get no reply or an illegal command reply, its ver 1, says MS */ + ir->emver = 1; +- mce_async_out(ir, GET_EMVER, sizeof(GET_EMVER)); ++ mce_command_out(ir, GET_EMVER, sizeof(GET_EMVER)); + } + + static void mceusb_gen1_init(struct mceusb_dev *ir) +@@ -1326,10 +1384,10 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + dev_dbg(dev, "set handshake - retC = %d", ret); + + /* device resume */ +- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME)); ++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME)); + + /* get hw/sw revision? */ +- mce_async_out(ir, GET_REVISION, sizeof(GET_REVISION)); ++ mce_command_out(ir, GET_REVISION, sizeof(GET_REVISION)); + + kfree(data); + } +@@ -1337,13 +1395,13 @@ static void mceusb_gen1_init(struct mceusb_dev *ir) + static void mceusb_gen2_init(struct mceusb_dev *ir) + { + /* device resume */ +- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME)); ++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME)); + + /* get wake version (protocol, key, address) */ +- mce_async_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION)); ++ mce_command_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION)); + + /* unknown what this one actually returns... */ +- mce_async_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2)); ++ mce_command_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2)); + } + + static void mceusb_get_parameters(struct mceusb_dev *ir) +@@ -1357,24 +1415,24 @@ static void mceusb_get_parameters(struct mceusb_dev *ir) + ir->num_rxports = 2; + + /* get number of tx and rx ports */ +- mce_async_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS)); ++ mce_command_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS)); + + /* get the carrier and frequency */ +- mce_async_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ)); ++ mce_command_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ)); + + if (ir->num_txports && !ir->flags.no_tx) + /* get the transmitter bitmask */ +- mce_async_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK)); ++ mce_command_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK)); + + /* get receiver timeout value */ +- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT)); ++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT)); + + /* get receiver sensor setting */ +- mce_async_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR)); ++ mce_command_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR)); + + for (i = 0; i < ir->num_txports; i++) { + cmdbuf[2] = i; +- mce_async_out(ir, cmdbuf, sizeof(cmdbuf)); ++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf)); + } + } + +@@ -1383,7 +1441,7 @@ static void mceusb_flash_led(struct mceusb_dev *ir) + if (ir->emver < 2) + return; + +- mce_async_out(ir, FLASH_LED, sizeof(FLASH_LED)); ++ mce_command_out(ir, FLASH_LED, sizeof(FLASH_LED)); + } + + /* +-- +2.20.1 + diff --git a/queue-4.19/media-media-platform-fsl-viu.c-fix-build-for-microbl.patch b/queue-4.19/media-media-platform-fsl-viu.c-fix-build-for-microbl.patch new file mode 100644 index 00000000000..2279e5ec15e --- /dev/null +++ b/queue-4.19/media-media-platform-fsl-viu.c-fix-build-for-microbl.patch @@ -0,0 +1,44 @@ +From 95ef26428ec83edc8a7f2c75a02a887fb247df48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2019 19:01:36 -0300 +Subject: media: media/platform: fsl-viu.c: fix build for MICROBLAZE + +From: Randy Dunlap + +[ Upstream commit 6898dd580a045341f844862ceb775144156ec1af ] + +arch/microblaze/ defines out_be32() and in_be32(), so don't do that +again in the driver source. + +Fixes these build warnings: + +../drivers/media/platform/fsl-viu.c:36: warning: "out_be32" redefined +../arch/microblaze/include/asm/io.h:50: note: this is the location of the previous definition +../drivers/media/platform/fsl-viu.c:37: warning: "in_be32" redefined +../arch/microblaze/include/asm/io.h:53: note: this is the location of the previous definition + +Fixes: 29d750686331 ("media: fsl-viu: allow building it with COMPILE_TEST") +Signed-off-by: Randy Dunlap +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/fsl-viu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c +index 0273302aa7412..83086eea14500 100644 +--- a/drivers/media/platform/fsl-viu.c ++++ b/drivers/media/platform/fsl-viu.c +@@ -37,7 +37,7 @@ + #define VIU_VERSION "0.5.1" + + /* Allow building this driver with COMPILE_TEST */ +-#ifndef CONFIG_PPC ++#if !defined(CONFIG_PPC) && !defined(CONFIG_MICROBLAZE) + #define out_be32(v, a) iowrite32be(a, (void __iomem *)v) + #define in_be32(a) ioread32be((void __iomem *)a) + #endif +-- +2.20.1 + diff --git a/queue-4.19/media-mtk-cir-lower-de-glitch-counter-for-rc-mm-prot.patch b/queue-4.19/media-mtk-cir-lower-de-glitch-counter-for-rc-mm-prot.patch new file mode 100644 index 00000000000..d39cbc013ab --- /dev/null +++ b/queue-4.19/media-mtk-cir-lower-de-glitch-counter-for-rc-mm-prot.patch @@ -0,0 +1,51 @@ +From a009dbe0d149917a0d81a270be7b521f18eda741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2019 18:47:00 -0400 +Subject: media: mtk-cir: lower de-glitch counter for rc-mm protocol + +From: Sean Young + +[ Upstream commit 5dd4b89dc098bf22cd13e82a308f42a02c102b2b ] + +The rc-mm protocol can't be decoded by the mtk-cir since the de-glitch +filter removes pulses/spaces shorter than 294 microseconds. + +Tested on a BananaPi R2. + +Signed-off-by: Sean Young +Acked-by: Sean Wang +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/mtk-cir.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/rc/mtk-cir.c b/drivers/media/rc/mtk-cir.c +index e42efd9d382ec..d37b85d2bc750 100644 +--- a/drivers/media/rc/mtk-cir.c ++++ b/drivers/media/rc/mtk-cir.c +@@ -44,6 +44,11 @@ + /* Fields containing pulse width data */ + #define MTK_WIDTH_MASK (GENMASK(7, 0)) + ++/* IR threshold */ ++#define MTK_IRTHD 0x14 ++#define MTK_DG_CNT_MASK (GENMASK(12, 8)) ++#define MTK_DG_CNT(x) ((x) << 8) ++ + /* Bit to enable interrupt */ + #define MTK_IRINT_EN BIT(0) + +@@ -409,6 +414,9 @@ static int mtk_ir_probe(struct platform_device *pdev) + mtk_w32_mask(ir, val, ir->data->fields[MTK_HW_PERIOD].mask, + ir->data->fields[MTK_HW_PERIOD].reg); + ++ /* Set de-glitch counter */ ++ mtk_w32_mask(ir, MTK_DG_CNT(1), MTK_DG_CNT_MASK, MTK_IRTHD); ++ + /* Enable IR and PWM */ + val = mtk_r32(ir, MTK_CONFIG_HIGH_REG); + val |= MTK_OK_COUNT(ir->data->ok_count) | MTK_PWM_EN | MTK_IR_EN; +-- +2.20.1 + diff --git a/queue-4.19/media-mtk-mdp-fix-reference-count-on-old-device-tree.patch b/queue-4.19/media-mtk-mdp-fix-reference-count-on-old-device-tree.patch new file mode 100644 index 00000000000..24f09e98b69 --- /dev/null +++ b/queue-4.19/media-mtk-mdp-fix-reference-count-on-old-device-tree.patch @@ -0,0 +1,42 @@ +From f60dca3792e48f7d7c281dcf89e85413d2c2930c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2019 08:32:50 -0300 +Subject: media: mtk-mdp: fix reference count on old device tree + +From: Matthias Brugger + +[ Upstream commit 864919ea0380e62adb2503b89825fe358acb8216 ] + +of_get_next_child() increments the reference count of the returning +device_node. Decrement it in the check if we are using the old or the +new DTB. + +Fixes: ba1f1f70c2c0 ("[media] media: mtk-mdp: Fix mdp device tree") +Signed-off-by: Matthias Brugger +Acked-by: Houlong Wei +[hverkuil-cisco@xs4all.nl: use node instead of parent as temp variable] +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-mdp/mtk_mdp_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c +index bbb24fb95b951..3deb0549b1a13 100644 +--- a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c ++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c +@@ -118,7 +118,9 @@ static int mtk_mdp_probe(struct platform_device *pdev) + mutex_init(&mdp->vpulock); + + /* Old dts had the components as child nodes */ +- if (of_get_next_child(dev->of_node, NULL)) { ++ node = of_get_next_child(dev->of_node, NULL); ++ if (node) { ++ of_node_put(node); + parent = dev->of_node; + dev_warn(dev, "device tree is out of date\n"); + } else { +-- +2.20.1 + diff --git a/queue-4.19/media-omap3isp-don-t-set-streaming-state-on-random-s.patch b/queue-4.19/media-omap3isp-don-t-set-streaming-state-on-random-s.patch new file mode 100644 index 00000000000..95fe9cde3dc --- /dev/null +++ b/queue-4.19/media-omap3isp-don-t-set-streaming-state-on-random-s.patch @@ -0,0 +1,50 @@ +From b31e173294d9fe15fb67a4998d4336d44f28ccfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 11:21:27 -0300 +Subject: media: omap3isp: Don't set streaming state on random subdevs + +From: Sakari Ailus + +[ Upstream commit 7ef57be07ac146e70535747797ef4aee0f06e9f9 ] + +The streaming state should be set to the first upstream sub-device only, +not everywhere, for a sub-device driver itself knows how to best control +the streaming state of its own upstream sub-devices. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 432bc7fbedc99..addd03b517481 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -722,6 +722,10 @@ static int isp_pipeline_enable(struct isp_pipeline *pipe, + s_stream, mode); + pipe->do_propagation = true; + } ++ ++ /* Stop at the first external sub-device. */ ++ if (subdev->dev != isp->dev) ++ break; + } + + return 0; +@@ -836,6 +840,10 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe) + &subdev->entity); + failure = -ETIMEDOUT; + } ++ ++ /* Stop at the first external sub-device. */ ++ if (subdev->dev != isp->dev) ++ break; + } + + return failure; +-- +2.20.1 + diff --git a/queue-4.19/media-omap3isp-set-device-on-omap3isp-subdevs.patch b/queue-4.19/media-omap3isp-set-device-on-omap3isp-subdevs.patch new file mode 100644 index 00000000000..a459bf910a3 --- /dev/null +++ b/queue-4.19/media-omap3isp-set-device-on-omap3isp-subdevs.patch @@ -0,0 +1,101 @@ +From 89164edec8a5aa8a7fe65392fd8790ab7b020926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 11:19:00 -0300 +Subject: media: omap3isp: Set device on omap3isp subdevs + +From: Sakari Ailus + +[ Upstream commit e9eb103f027725053a4b02f93d7f2858b56747ce ] + +The omap3isp driver registered subdevs without the dev field being set. Do +that now. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/ispccdc.c | 1 + + drivers/media/platform/omap3isp/ispccp2.c | 1 + + drivers/media/platform/omap3isp/ispcsi2.c | 1 + + drivers/media/platform/omap3isp/isppreview.c | 1 + + drivers/media/platform/omap3isp/ispresizer.c | 1 + + drivers/media/platform/omap3isp/ispstat.c | 2 ++ + 6 files changed, 7 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c +index 77b73e27a2746..412438dce2854 100644 +--- a/drivers/media/platform/omap3isp/ispccdc.c ++++ b/drivers/media/platform/omap3isp/ispccdc.c +@@ -2605,6 +2605,7 @@ int omap3isp_ccdc_register_entities(struct isp_ccdc_device *ccdc, + int ret; + + /* Register the subdev and video node. */ ++ ccdc->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &ccdc->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispccp2.c b/drivers/media/platform/omap3isp/ispccp2.c +index e062939d0d054..47b0d3fe87d80 100644 +--- a/drivers/media/platform/omap3isp/ispccp2.c ++++ b/drivers/media/platform/omap3isp/ispccp2.c +@@ -1034,6 +1034,7 @@ int omap3isp_ccp2_register_entities(struct isp_ccp2_device *ccp2, + int ret; + + /* Register the subdev and video nodes. */ ++ ccp2->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &ccp2->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispcsi2.c b/drivers/media/platform/omap3isp/ispcsi2.c +index a4d3d030e81e2..e45292a1bf6c5 100644 +--- a/drivers/media/platform/omap3isp/ispcsi2.c ++++ b/drivers/media/platform/omap3isp/ispcsi2.c +@@ -1201,6 +1201,7 @@ int omap3isp_csi2_register_entities(struct isp_csi2_device *csi2, + int ret; + + /* Register the subdev and video nodes. */ ++ csi2->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &csi2->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c +index 3195f7c8b8b7e..591c6de498f89 100644 +--- a/drivers/media/platform/omap3isp/isppreview.c ++++ b/drivers/media/platform/omap3isp/isppreview.c +@@ -2228,6 +2228,7 @@ int omap3isp_preview_register_entities(struct isp_prev_device *prev, + int ret; + + /* Register the subdev and video nodes. */ ++ prev->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &prev->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispresizer.c b/drivers/media/platform/omap3isp/ispresizer.c +index 0b6a87508584f..2035e3c6a9dee 100644 +--- a/drivers/media/platform/omap3isp/ispresizer.c ++++ b/drivers/media/platform/omap3isp/ispresizer.c +@@ -1684,6 +1684,7 @@ int omap3isp_resizer_register_entities(struct isp_res_device *res, + int ret; + + /* Register the subdev and video nodes. */ ++ res->subdev.dev = vdev->mdev->dev; + ret = v4l2_device_register_subdev(vdev, &res->subdev); + if (ret < 0) + goto error; +diff --git a/drivers/media/platform/omap3isp/ispstat.c b/drivers/media/platform/omap3isp/ispstat.c +index 47353fee26c32..bfa2d05046466 100644 +--- a/drivers/media/platform/omap3isp/ispstat.c ++++ b/drivers/media/platform/omap3isp/ispstat.c +@@ -1029,6 +1029,8 @@ void omap3isp_stat_unregister_entities(struct ispstat *stat) + int omap3isp_stat_register_entities(struct ispstat *stat, + struct v4l2_device *vdev) + { ++ stat->subdev.dev = vdev->mdev->dev; ++ + return v4l2_device_register_subdev(vdev, &stat->subdev); + } + +-- +2.20.1 + diff --git a/queue-4.19/media-ov9650-add-a-sanity-check.patch b/queue-4.19/media-ov9650-add-a-sanity-check.patch new file mode 100644 index 00000000000..7e09e5d365a --- /dev/null +++ b/queue-4.19/media-ov9650-add-a-sanity-check.patch @@ -0,0 +1,49 @@ +From d755ced7ec47ecc84069f90f6ea8b0bdb08b6a15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 11:55:07 -0300 +Subject: media: ov9650: add a sanity check + +From: Mauro Carvalho Chehab + +[ Upstream commit 093347abc7a4e0490e3c962ecbde2dc272a8f708 ] + +As pointed by cppcheck: + + [drivers/media/i2c/ov9650.c:706]: (error) Shifting by a negative value is undefined behaviour + [drivers/media/i2c/ov9650.c:707]: (error) Shifting by a negative value is undefined behaviour + [drivers/media/i2c/ov9650.c:721]: (error) Shifting by a negative value is undefined behaviour + +Prevent mangling with gains with invalid values. + +As pointed by Sylvester, this should never happen in practice, +as min value of V4L2_CID_GAIN control is 16 (gain is always >= 16 +and m is always >= 0), but it is too hard for a static analyzer +to get this, as the logic with validates control min/max is +elsewhere inside V4L2 core. + +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov9650.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c +index 5bea31cd41aa1..33a21d585dc9c 100644 +--- a/drivers/media/i2c/ov9650.c ++++ b/drivers/media/i2c/ov9650.c +@@ -716,6 +716,11 @@ static int ov965x_set_gain(struct ov965x *ov965x, int auto_gain) + for (m = 6; m >= 0; m--) + if (gain >= (1 << m) * 16) + break; ++ ++ /* Sanity check: don't adjust the gain with a negative value */ ++ if (m < 0) ++ return -EINVAL; ++ + rgain = (gain - ((1 << m) * 16)) / (1 << m); + rgain |= (((1 << m) - 1) << 4); + +-- +2.20.1 + diff --git a/queue-4.19/media-radio-si470x-kill-urb-on-error.patch b/queue-4.19/media-radio-si470x-kill-urb-on-error.patch new file mode 100644 index 00000000000..a07f7843cc1 --- /dev/null +++ b/queue-4.19/media-radio-si470x-kill-urb-on-error.patch @@ -0,0 +1,59 @@ +From 8fc9ca229a71c35e2767aa20fe5f97fe06e50662 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 09:40:52 -0300 +Subject: media: radio/si470x: kill urb on error + +From: Hans Verkuil + +[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ] + +In the probe() function radio->int_in_urb was not killed if an +error occurred in the probe sequence. It was also missing in +the disconnect. + +This caused this syzbot issue: + +https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 + +Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index 313a95f195a27..19e381dd58089 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -743,7 +743,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, + /* start radio */ + retval = si470x_start_usb(radio); + if (retval < 0) +- goto err_all; ++ goto err_buf; + + /* set initial frequency */ + si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ +@@ -758,6 +758,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, + + return 0; + err_all: ++ usb_kill_urb(radio->int_in_urb); ++err_buf: + kfree(radio->buffer); + err_ctrl: + v4l2_ctrl_handler_free(&radio->hdl); +@@ -831,6 +833,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) + mutex_lock(&radio->lock); + v4l2_device_disconnect(&radio->v4l2_dev); + video_unregister_device(&radio->videodev); ++ usb_kill_urb(radio->int_in_urb); + usb_set_intfdata(intf, NULL); + mutex_unlock(&radio->lock); + v4l2_device_put(&radio->v4l2_dev); +-- +2.20.1 + diff --git a/queue-4.19/media-rc-imon-allow-imon-rc-protocol-for-ffdc-7e-dev.patch b/queue-4.19/media-rc-imon-allow-imon-rc-protocol-for-ffdc-7e-dev.patch new file mode 100644 index 00000000000..228e909f9ee --- /dev/null +++ b/queue-4.19/media-rc-imon-allow-imon-rc-protocol-for-ffdc-7e-dev.patch @@ -0,0 +1,53 @@ +From e9882f2959fd726e0d18a8014bd175939e497926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2019 13:37:46 -0300 +Subject: media: rc: imon: Allow iMON RC protocol for ffdc 7e device + +From: Darius Rad + +[ Upstream commit b20a6e298bcb8cb8ae18de26baaf462a6418515b ] + +Allow selecting the IR protocol, MCE or iMON, for a device that +identifies as follows (with config id 0x7e): + +15c2:ffdc SoundGraph Inc. iMON PAD Remote Controller + +As the driver is structured to default to iMON when both RC +protocols are supported, existing users of this device (using MCE +protocol) will need to manually switch to MCE (RC-6) protocol from +userspace (with ir-keytable, sysfs). + +Signed-off-by: Darius Rad +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/imon.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index 1041c056854d5..f23a220352f7f 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -1835,12 +1835,17 @@ static void imon_get_ffdc_type(struct imon_context *ictx) + break; + /* iMON VFD, MCE IR */ + case 0x46: +- case 0x7e: + case 0x9e: + dev_info(ictx->dev, "0xffdc iMON VFD, MCE IR"); + detected_display_type = IMON_DISPLAY_TYPE_VFD; + allowed_protos = RC_PROTO_BIT_RC6_MCE; + break; ++ /* iMON VFD, iMON or MCE IR */ ++ case 0x7e: ++ dev_info(ictx->dev, "0xffdc iMON VFD, iMON or MCE IR"); ++ detected_display_type = IMON_DISPLAY_TYPE_VFD; ++ allowed_protos |= RC_PROTO_BIT_RC6_MCE; ++ break; + /* iMON LCD, MCE IR */ + case 0x9f: + dev_info(ictx->dev, "0xffdc iMON LCD, MCE IR"); +-- +2.20.1 + diff --git a/queue-4.19/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch b/queue-4.19/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch new file mode 100644 index 00000000000..5b3a295bde6 --- /dev/null +++ b/queue-4.19/media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch @@ -0,0 +1,61 @@ +From 4ceaad9559a3fd969658ecd771be9697c2028bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 19:05:55 -0300 +Subject: media: saa7134: fix terminology around + saa7134_i2c_eeprom_md7134_gate() + +From: Maciej S. Szmigiero + +[ Upstream commit 9d802222a3405599d6e1984d9324cddf592ea1f4 ] + +saa7134_i2c_eeprom_md7134_gate() function and the associated comment uses +an inverted i2c gate open / closed terminology. +Let's fix this. + +Signed-off-by: Maciej S. Szmigiero +Signed-off-by: Hans Verkuil +[hverkuil-cisco@xs4all.nl: fix alignment checkpatch warning] +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-i2c.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c +index cf1e526de56ac..8a1128c60680b 100644 +--- a/drivers/media/pci/saa7134/saa7134-i2c.c ++++ b/drivers/media/pci/saa7134/saa7134-i2c.c +@@ -351,7 +351,11 @@ static const struct i2c_client saa7134_client_template = { + + /* ----------------------------------------------------------- */ + +-/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */ ++/* ++ * On Medion 7134 reading the SAA7134 chip config EEPROM needs DVB-T ++ * demod i2c gate closed due to an address clash between this EEPROM ++ * and the demod one. ++ */ + static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) + { + u8 subaddr = 0x7, dmdregval; +@@ -368,14 +372,14 @@ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) + + ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2); + if ((ret == 2) && (dmdregval & 0x2)) { +- pr_debug("%s: DVB-T demod i2c gate was left closed\n", ++ pr_debug("%s: DVB-T demod i2c gate was left open\n", + dev->name); + + data[0] = subaddr; + data[1] = (dmdregval & ~0x2); + if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1) +- pr_err("%s: EEPROM i2c gate open failure\n", +- dev->name); ++ pr_err("%s: EEPROM i2c gate close failure\n", ++ dev->name); + } + } + +-- +2.20.1 + diff --git a/queue-4.19/media-saa7146-add-cleanup-in-hexium_attach.patch b/queue-4.19/media-saa7146-add-cleanup-in-hexium_attach.patch new file mode 100644 index 00000000000..cd351257608 --- /dev/null +++ b/queue-4.19/media-saa7146-add-cleanup-in-hexium_attach.patch @@ -0,0 +1,38 @@ +From 052c28835ba9d8cd32075eb3d9d7f1682fe136fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Aug 2019 02:40:14 -0300 +Subject: media: saa7146: add cleanup in hexium_attach() + +From: Wenwen Wang + +[ Upstream commit 42e64117d3b4a759013f77bbcf25ab6700e55de7 ] + +If saa7146_register_device() fails, no cleanup is executed, leading to +memory/resource leaks. To fix this issue, perform necessary cleanup work +before returning the error. + +Signed-off-by: Wenwen Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/hexium_gemini.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c +index 6d8e4afe9673a..8c56d4c37a525 100644 +--- a/drivers/media/pci/saa7146/hexium_gemini.c ++++ b/drivers/media/pci/saa7146/hexium_gemini.c +@@ -304,6 +304,9 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d + ret = saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER); + if (ret < 0) { + pr_err("cannot register capture v4l2 device. skipping.\n"); ++ saa7146_vv_release(dev); ++ i2c_del_adapter(&hexium->i2c_adapter); ++ kfree(hexium); + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch b/queue-4.19/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch new file mode 100644 index 00000000000..4e8f3539780 --- /dev/null +++ b/queue-4.19/media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch @@ -0,0 +1,40 @@ +From 4062bf625e336cab34b499bc1028576ac49b6acf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 12:19:05 -0300 +Subject: media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() + +From: Tomas Bortoli + +[ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ] + +The function at issue does not always initialize each byte allocated +for 'b' and can therefore leak uninitialized memory to a USB device in +the call to usb_bulk_msg() + +Use kzalloc() instead of kmalloc() + +Signed-off-by: Tomas Bortoli +Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c +index 44ca66cb9b8f1..f34efa7c61b40 100644 +--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c ++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c +@@ -329,7 +329,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, + + dprintk("%s\n", __func__); + +- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); ++ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); + if (!b) + return -ENOMEM; + +-- +2.20.1 + diff --git a/queue-4.19/media-vsp1-fix-memory-leak-of-dl-on-error-return-pat.patch b/queue-4.19/media-vsp1-fix-memory-leak-of-dl-on-error-return-pat.patch new file mode 100644 index 00000000000..c80d43adb36 --- /dev/null +++ b/queue-4.19/media-vsp1-fix-memory-leak-of-dl-on-error-return-pat.patch @@ -0,0 +1,44 @@ +From 1f0f67c948ba592d94e23da61401fa299e6b6bfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jul 2019 14:11:24 -0300 +Subject: media: vsp1: fix memory leak of dl on error return path + +From: Colin Ian King + +[ Upstream commit 70c55c1ad1a76e804ee5330e134674f5d2741cb7 ] + +Currently when the call vsp1_dl_body_get fails and returns null the +error return path leaks the allocation of dl. Fix this by kfree'ing +dl before returning. + +Addresses-Coverity: ("Resource leak") + +Fixes: 5d7936b8e27d ("media: vsp1: Convert display lists to use new body pool") +Signed-off-by: Colin Ian King +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vsp1/vsp1_dl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c +index 26289adaf658c..a5634ca85a316 100644 +--- a/drivers/media/platform/vsp1/vsp1_dl.c ++++ b/drivers/media/platform/vsp1/vsp1_dl.c +@@ -557,8 +557,10 @@ static struct vsp1_dl_list *vsp1_dl_list_alloc(struct vsp1_dl_manager *dlm) + + /* Get a default body for our list. */ + dl->body0 = vsp1_dl_body_get(dlm->pool); +- if (!dl->body0) ++ if (!dl->body0) { ++ kfree(dl); + return NULL; ++ } + + header_offset = dl->body0->max_entries * sizeof(*dl->body0->entries); + +-- +2.20.1 + diff --git a/queue-4.19/mmc-core-add-helper-function-to-indicate-if-sdio-irq.patch b/queue-4.19/mmc-core-add-helper-function-to-indicate-if-sdio-irq.patch new file mode 100644 index 00000000000..8789bd4a4e9 --- /dev/null +++ b/queue-4.19/mmc-core-add-helper-function-to-indicate-if-sdio-irq.patch @@ -0,0 +1,50 @@ +From 941c8e0c279a691c10b35d004decfe01a7071f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Sep 2019 12:12:26 +0200 +Subject: mmc: core: Add helper function to indicate if SDIO IRQs is enabled + +From: Ulf Hansson + +[ Upstream commit bd880b00697befb73eff7220ee20bdae4fdd487b ] + +To avoid each host driver supporting SDIO IRQs, from keeping track +internally about if SDIO IRQs has been claimed, let's introduce a common +helper function, sdio_irq_claimed(). + +The function returns true if SDIO IRQs are claimed, via using the +information about the number of claimed irqs. This is safe, even without +any locks, as long as the helper function is called only from +runtime/system suspend callbacks of the host driver. + +Tested-by: Matthias Kaehlcke +Signed-off-by: Ulf Hansson +Reviewed-by: Douglas Anderson +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + include/linux/mmc/host.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h +index 2ff52de1c2b89..840462ed1ec7e 100644 +--- a/include/linux/mmc/host.h ++++ b/include/linux/mmc/host.h +@@ -488,6 +488,15 @@ void mmc_command_done(struct mmc_host *host, struct mmc_request *mrq); + + void mmc_cqe_request_done(struct mmc_host *host, struct mmc_request *mrq); + ++/* ++ * May be called from host driver's system/runtime suspend/resume callbacks, ++ * to know if SDIO IRQs has been claimed. ++ */ ++static inline bool sdio_irq_claimed(struct mmc_host *host) ++{ ++ return host->sdio_irqs > 0; ++} ++ + static inline void mmc_signal_sdio_irq(struct mmc_host *host) + { + host->ops->enable_sdio_irq(host, 0); +-- +2.20.1 + diff --git a/queue-4.19/mmc-core-clarify-sdio_irq_pending-flag-for-mmc_cap2_.patch b/queue-4.19/mmc-core-clarify-sdio_irq_pending-flag-for-mmc_cap2_.patch new file mode 100644 index 00000000000..ed7b4e63789 --- /dev/null +++ b/queue-4.19/mmc-core-clarify-sdio_irq_pending-flag-for-mmc_cap2_.patch @@ -0,0 +1,103 @@ +From 41e8165ef742d0b08403528287df486ac64c4a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Sep 2019 12:12:30 +0200 +Subject: mmc: core: Clarify sdio_irq_pending flag for + MMC_CAP2_SDIO_IRQ_NOTHREAD + +From: Ulf Hansson + +[ Upstream commit 36d57efb4af534dd6b442ea0b9a04aa6dfa37abe ] + +The sdio_irq_pending flag is used to let host drivers indicate that it has +signaled an IRQ. If that is the case and we only have a single SDIO func +that have claimed an SDIO IRQ, our assumption is that we can avoid reading +the SDIO_CCCR_INTx register and just call the SDIO func irq handler +immediately. This makes sense, but the flag is set/cleared in a somewhat +messy order, let's fix that up according to below. + +First, the flag is currently set in sdio_run_irqs(), which is executed as a +work that was scheduled from sdio_signal_irq(). To make it more implicit +that the host have signaled an IRQ, let's instead immediately set the flag +in sdio_signal_irq(). This also makes the behavior consistent with host +drivers that uses the legacy, mmc_signal_sdio_irq() API. This have no +functional impact, because we don't expect host drivers to call +sdio_signal_irq() until after the work (sdio_run_irqs()) have been executed +anyways. + +Second, currently we never clears the flag when using the sdio_run_irqs() +work, but only when using the sdio_irq_thread(). Let make the behavior +consistent, by moving the flag to be cleared inside the common +process_sdio_pending_irqs() function. Additionally, tweak the behavior of +the flag slightly, by avoiding to clear it unless we processed the SDIO +IRQ. The purpose with this at this point, is to keep the information about +whether there have been an SDIO IRQ signaled by the host, so at system +resume we can decide to process it without reading the SDIO_CCCR_INTx +register. + +Tested-by: Matthias Kaehlcke +Reviewed-by: Matthias Kaehlcke +Signed-off-by: Ulf Hansson +Reviewed-by: Douglas Anderson +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sdio_irq.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c +index b299a24d33f96..d206f2de80d23 100644 +--- a/drivers/mmc/core/sdio_irq.c ++++ b/drivers/mmc/core/sdio_irq.c +@@ -35,6 +35,7 @@ static int process_sdio_pending_irqs(struct mmc_host *host) + { + struct mmc_card *card = host->card; + int i, ret, count; ++ bool sdio_irq_pending = host->sdio_irq_pending; + unsigned char pending; + struct sdio_func *func; + +@@ -42,13 +43,16 @@ static int process_sdio_pending_irqs(struct mmc_host *host) + if (mmc_card_suspended(card)) + return 0; + ++ /* Clear the flag to indicate that we have processed the IRQ. */ ++ host->sdio_irq_pending = false; ++ + /* + * Optimization, if there is only 1 function interrupt registered + * and we know an IRQ was signaled then call irq handler directly. + * Otherwise do the full probe. + */ + func = card->sdio_single_irq; +- if (func && host->sdio_irq_pending) { ++ if (func && sdio_irq_pending) { + func->irq_handler(func); + return 1; + } +@@ -100,7 +104,6 @@ void sdio_run_irqs(struct mmc_host *host) + { + mmc_claim_host(host); + if (host->sdio_irqs) { +- host->sdio_irq_pending = true; + process_sdio_pending_irqs(host); + if (host->ops->ack_sdio_irq) + host->ops->ack_sdio_irq(host); +@@ -119,6 +122,7 @@ void sdio_irq_work(struct work_struct *work) + + void sdio_signal_irq(struct mmc_host *host) + { ++ host->sdio_irq_pending = true; + queue_delayed_work(system_wq, &host->sdio_irq_work, 0); + } + EXPORT_SYMBOL_GPL(sdio_signal_irq); +@@ -164,7 +168,6 @@ static int sdio_irq_thread(void *_host) + if (ret) + break; + ret = process_sdio_pending_irqs(host); +- host->sdio_irq_pending = false; + mmc_release_host(host); + + /* +-- +2.20.1 + diff --git a/queue-4.19/mmc-dw_mmc-re-store-sdio-irqs-mask-at-system-resume.patch b/queue-4.19/mmc-dw_mmc-re-store-sdio-irqs-mask-at-system-resume.patch new file mode 100644 index 00000000000..b794e7c5d08 --- /dev/null +++ b/queue-4.19/mmc-dw_mmc-re-store-sdio-irqs-mask-at-system-resume.patch @@ -0,0 +1,48 @@ +From 79cea7d380b1ee713f6f7754e1b817283dd82af0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Sep 2019 12:12:27 +0200 +Subject: mmc: dw_mmc: Re-store SDIO IRQs mask at system resume + +From: Ulf Hansson + +[ Upstream commit 7c526608d5afb62cbc967225e2ccaacfdd142e9d ] + +In cases when SDIO IRQs have been enabled, runtime suspend is prevented by +the driver. However, this still means dw_mci_runtime_suspend|resume() gets +called during system suspend/resume, via pm_runtime_force_suspend|resume(). +This means during system suspend/resume, the register context of the dw_mmc +device most likely loses its register context, even in cases when SDIO IRQs +have been enabled. + +To re-enable the SDIO IRQs during system resume, the dw_mmc driver +currently relies on the mmc core to re-enable the SDIO IRQs when it resumes +the SDIO card, but this isn't the recommended solution. Instead, it's +better to deal with this locally in the dw_mmc driver, so let's do that. + +Tested-by: Matthias Kaehlcke +Signed-off-by: Ulf Hansson +Reviewed-by: Douglas Anderson +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/dw_mmc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 942da07c9eb87..22c454c7aaca6 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -3486,6 +3486,10 @@ int dw_mci_runtime_resume(struct device *dev) + /* Force setup bus to guarantee available clock output */ + dw_mci_setup_bus(host->slot, true); + ++ /* Re-enable SDIO interrupts. */ ++ if (sdio_irq_claimed(host->slot->mmc)) ++ __dw_mci_enable_sdio_irq(host->slot, 1); ++ + /* Now that slots are all setup, we can enable card detect */ + dw_mci_enable_cd(host); + +-- +2.20.1 + diff --git a/queue-4.19/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch b/queue-4.19/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch new file mode 100644 index 00000000000..b76fe0506c0 --- /dev/null +++ b/queue-4.19/mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch @@ -0,0 +1,56 @@ +From e5036877e53a7100dea930e7689457aeabe4f9ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2019 07:51:14 -0400 +Subject: mmc: sdhci: Fix incorrect switch to HS mode + +From: Al Cooper + +[ Upstream commit c894e33ddc1910e14d6f2a2016f60ab613fd8b37 ] + +When switching from any MMC speed mode that requires 1.8v +(HS200, HS400 and HS400ES) to High Speed (HS) mode, the system +ends up configured for SDR12 with a 50MHz clock which is an illegal +mode. + +This happens because the SDHCI_CTRL_VDD_180 bit in the +SDHCI_HOST_CONTROL2 register is left set and when this bit is +set, the speed mode is controlled by the SDHCI_CTRL_UHS field +in the SDHCI_HOST_CONTROL2 register. The SDHCI_CTRL_UHS field +will end up being set to 0 (SDR12) by sdhci_set_uhs_signaling() +because there is no UHS mode being set. + +The fix is to change sdhci_set_uhs_signaling() to set the +SDHCI_CTRL_UHS field to SDR25 (which is the same as HS) for +any switch to HS mode. + +This was found on a new eMMC controller that does strict checking +of the speed mode and the corresponding clock rate. It caused the +switch to HS400 mode to fail because part of the sequence to switch +to HS400 requires a switch from HS200 to HS before going to HS400. + +Suggested-by: Adrian Hunter +Signed-off-by: Al Cooper +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index c749d3dc1d36d..eb33b892b484c 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1713,7 +1713,9 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_SD_HS || ++ timing == MMC_TIMING_MMC_HS || ++ timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +-- +2.20.1 + diff --git a/queue-4.19/nbd-add-missing-config-put.patch b/queue-4.19/nbd-add-missing-config-put.patch new file mode 100644 index 00000000000..d00a7424328 --- /dev/null +++ b/queue-4.19/nbd-add-missing-config-put.patch @@ -0,0 +1,48 @@ +From 266821cf7d733d76b8cd0c9a0cb930c917d2ca33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2019 11:39:51 -0500 +Subject: nbd: add missing config put + +From: Mike Christie + +[ Upstream commit 887e975c4172d0d5670c39ead2f18ba1e4ec8133 ] + +Fix bug added with the patch: + +commit 8f3ea35929a0806ad1397db99a89ffee0140822a +Author: Josef Bacik +Date: Mon Jul 16 12:11:35 2018 -0400 + + nbd: handle unexpected replies better + +where if the timeout handler runs when the completion path is and we fail +to grab the mutex in the timeout handler we will leave a config reference +and cannot free the config later. + +Reviewed-by: Josef Bacik +Signed-off-by: Mike Christie +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index fa60f265ee506..b1c7009de1f4d 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -353,8 +353,10 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, + } + config = nbd->config; + +- if (!mutex_trylock(&cmd->lock)) ++ if (!mutex_trylock(&cmd->lock)) { ++ nbd_config_put(nbd); + return BLK_EH_RESET_TIMER; ++ } + + if (config->num_connections > 1) { + dev_err_ratelimited(nbd_to_dev(nbd), +-- +2.20.1 + diff --git a/queue-4.19/net-lpc-enet-fix-printk-format-strings.patch b/queue-4.19/net-lpc-enet-fix-printk-format-strings.patch new file mode 100644 index 00000000000..4b04d0d8ee8 --- /dev/null +++ b/queue-4.19/net-lpc-enet-fix-printk-format-strings.patch @@ -0,0 +1,64 @@ +From 3c6e2c7c1020e95ae9cdf7508da67394901d9fd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 16:40:35 +0200 +Subject: net: lpc-enet: fix printk format strings + +From: Arnd Bergmann + +[ Upstream commit de6f97b2bace0e2eb6c3a86e124d1e652a587b56 ] + +compile-testing this driver on other architectures showed +multiple warnings: + + drivers/net/ethernet/nxp/lpc_eth.c: In function 'lpc_eth_drv_probe': + drivers/net/ethernet/nxp/lpc_eth.c:1337:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'resource_size_t {aka long long unsigned int}' [-Wformat=] + + drivers/net/ethernet/nxp/lpc_eth.c:1342:19: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=] + +Use format strings that work on all architectures. + +Link: https://lore.kernel.org/r/20190809144043.476786-10-arnd@arndb.de +Reported-by: kbuild test robot +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/nxp/lpc_eth.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c +index 08381ef8bdb48..41d30f55c946b 100644 +--- a/drivers/net/ethernet/nxp/lpc_eth.c ++++ b/drivers/net/ethernet/nxp/lpc_eth.c +@@ -1371,13 +1371,14 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) + pldat->dma_buff_base_p = dma_handle; + + netdev_dbg(ndev, "IO address space :%pR\n", res); +- netdev_dbg(ndev, "IO address size :%d\n", resource_size(res)); ++ netdev_dbg(ndev, "IO address size :%zd\n", ++ (size_t)resource_size(res)); + netdev_dbg(ndev, "IO address (mapped) :0x%p\n", + pldat->net_base); + netdev_dbg(ndev, "IRQ number :%d\n", ndev->irq); +- netdev_dbg(ndev, "DMA buffer size :%d\n", pldat->dma_buff_size); +- netdev_dbg(ndev, "DMA buffer P address :0x%08x\n", +- pldat->dma_buff_base_p); ++ netdev_dbg(ndev, "DMA buffer size :%zd\n", pldat->dma_buff_size); ++ netdev_dbg(ndev, "DMA buffer P address :%pad\n", ++ &pldat->dma_buff_base_p); + netdev_dbg(ndev, "DMA buffer V address :0x%p\n", + pldat->dma_buff_base_v); + +@@ -1424,8 +1425,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) + if (ret) + goto err_out_unregister_netdev; + +- netdev_info(ndev, "LPC mac at 0x%08x irq %d\n", +- res->start, ndev->irq); ++ netdev_info(ndev, "LPC mac at 0x%08lx irq %d\n", ++ (unsigned long)res->start, ndev->irq); + + phydev = ndev->phydev; + +-- +2.20.1 + diff --git a/queue-4.19/nvme-multipath-fix-ana-log-nsid-lookup-when-nsid-is-.patch b/queue-4.19/nvme-multipath-fix-ana-log-nsid-lookup-when-nsid-is-.patch new file mode 100644 index 00000000000..33c80b225ac --- /dev/null +++ b/queue-4.19/nvme-multipath-fix-ana-log-nsid-lookup-when-nsid-is-.patch @@ -0,0 +1,82 @@ +From f9c7fac09cf8ec57bd4190597027a35b24b2f488 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 13:00:10 -0700 +Subject: nvme-multipath: fix ana log nsid lookup when nsid is not found + +From: Anton Eidelman + +[ Upstream commit e01f91dff91c7b16a6e3faf2565017d497a73f83 ] + +ANA log parsing invokes nvme_update_ana_state() per ANA group desc. +This updates the state of namespaces with nsids in desc->nsids[]. + +Both ctrl->namespaces list and desc->nsids[] array are sorted by nsid. +Hence nvme_update_ana_state() performs a single walk over ctrl->namespaces: +- if current namespace matches the current desc->nsids[n], + this namespace is updated, and n is incremented. +- the process stops when it encounters the end of either + ctrl->namespaces end or desc->nsids[] + +In case desc->nsids[n] does not match any of ctrl->namespaces, +the remaining nsids following desc->nsids[n] will not be updated. +Such situation was considered abnormal and generated WARN_ON_ONCE. + +However ANA log MAY contain nsids not (yet) found in ctrl->namespaces. +For example, lets consider the following scenario: +- nvme0 exposes namespaces with nsids = [2, 3] to the host +- a new namespace nsid = 1 is added dynamically +- also, a ANA topology change is triggered +- NS_CHANGED aen is generated and triggers scan_work +- before scan_work discovers nsid=1 and creates a namespace, a NOTICE_ANA + aen was issues and ana_work receives ANA log with nsids=[1, 2, 3] + +Result: ana_work fails to update ANA state on existing namespaces [2, 3] + +Solution: +Change the way nvme_update_ana_state() namespace list walk +checks the current namespace against desc->nsids[n] as follows: +a) ns->head->ns_id < desc->nsids[n]: keep walking ctrl->namespaces. +b) ns->head->ns_id == desc->nsids[n]: match, update the namespace +c) ns->head->ns_id >= desc->nsids[n]: skip to desc->nsids[n+1] + +This enables correct operation in the scenario described above. +This also allows ANA log to contain nsids currently invisible +to the host, i.e. inactive nsids. + +Signed-off-by: Anton Eidelman +Reviewed-by: James Smart +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index f57feb8fdea45..892ef52122329 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -404,14 +404,16 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl, + + down_write(&ctrl->namespaces_rwsem); + list_for_each_entry(ns, &ctrl->namespaces, list) { +- if (ns->head->ns_id != le32_to_cpu(desc->nsids[n])) ++ unsigned nsid = le32_to_cpu(desc->nsids[n]); ++ ++ if (ns->head->ns_id < nsid) + continue; +- nvme_update_ns_ana_state(desc, ns); ++ if (ns->head->ns_id == nsid) ++ nvme_update_ns_ana_state(desc, ns); + if (++n == nr_nsids) + break; + } + up_write(&ctrl->namespaces_rwsem); +- WARN_ON_ONCE(n < nr_nsids); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/nvmet-fix-data-units-read-and-written-counters-in-sm.patch b/queue-4.19/nvmet-fix-data-units-read-and-written-counters-in-sm.patch new file mode 100644 index 00000000000..ccdf821d2fc --- /dev/null +++ b/queue-4.19/nvmet-fix-data-units-read-and-written-counters-in-sm.patch @@ -0,0 +1,65 @@ +From 9e52e053530fa985d03ebedca42beca8c72f3647 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 02:22:36 +0000 +Subject: nvmet: fix data units read and written counters in SMART log + +From: Tom Wu + +[ Upstream commit 3bec2e3754becebd4c452999adb49bc62c575ea4 ] + +In nvme spec 1.3 there is a definition for data write/read counters +from SMART log, (See section 5.14.1.2): + This value is reported in thousands (i.e., a value of 1 + corresponds to 1000 units of 512 bytes read) and is rounded up. + +However, in nvme target where value is reported with actual units, +but not thousands of units as the spec requires. + +Signed-off-by: Tom Wu +Reviewed-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/admin-cmd.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c +index 2008fa62a373b..a8eb8784e151f 100644 +--- a/drivers/nvme/target/admin-cmd.c ++++ b/drivers/nvme/target/admin-cmd.c +@@ -68,9 +68,11 @@ static u16 nvmet_get_smart_log_nsid(struct nvmet_req *req, + goto out; + + host_reads = part_stat_read(ns->bdev->bd_part, ios[READ]); +- data_units_read = part_stat_read(ns->bdev->bd_part, sectors[READ]); ++ data_units_read = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part, ++ sectors[READ]), 1000); + host_writes = part_stat_read(ns->bdev->bd_part, ios[WRITE]); +- data_units_written = part_stat_read(ns->bdev->bd_part, sectors[WRITE]); ++ data_units_written = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part, ++ sectors[WRITE]), 1000); + + put_unaligned_le64(host_reads, &slog->host_reads[0]); + put_unaligned_le64(data_units_read, &slog->data_units_read[0]); +@@ -98,11 +100,11 @@ static u16 nvmet_get_smart_log_all(struct nvmet_req *req, + if (!ns->bdev) + continue; + host_reads += part_stat_read(ns->bdev->bd_part, ios[READ]); +- data_units_read += +- part_stat_read(ns->bdev->bd_part, sectors[READ]); ++ data_units_read += DIV_ROUND_UP( ++ part_stat_read(ns->bdev->bd_part, sectors[READ]), 1000); + host_writes += part_stat_read(ns->bdev->bd_part, ios[WRITE]); +- data_units_written += +- part_stat_read(ns->bdev->bd_part, sectors[WRITE]); ++ data_units_written += DIV_ROUND_UP( ++ part_stat_read(ns->bdev->bd_part, sectors[WRITE]), 1000); + + } + rcu_read_unlock(); +-- +2.20.1 + diff --git a/queue-4.19/perf-config-honour-perf_config-env-var-to-specify-al.patch b/queue-4.19/perf-config-honour-perf_config-env-var-to-specify-al.patch new file mode 100644 index 00000000000..17dd4afc63c --- /dev/null +++ b/queue-4.19/perf-config-honour-perf_config-env-var-to-specify-al.patch @@ -0,0 +1,50 @@ +From f483224ce3dc0d399dc725a768adcdce5d7ab8d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2019 11:20:55 -0300 +Subject: perf config: Honour $PERF_CONFIG env var to specify alternate + .perfconfig +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 61a461fcbd62d42c29a1ea6a9cc3838ad9f49401 ] + +We had this comment in Documentation/perf_counter/config.c, i.e. since +when we got this from the git sources, but never really did that +getenv("PERF_CONFIG"), do it now as I need to disable whatever +~/.perfconfig root has so that tests parsing tool output are done for +the expected default output or that we specify an alternate config file +that when read will make the tools produce expected output. + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Luis Cláudio Gonçalves +Cc: Namhyung Kim +Cc: Taeung Song +Fixes: 078006012401 ("perf_counter tools: add in basic glue from Git") +Link: https://lkml.kernel.org/n/tip-jo209zac9rut0dz1rqvbdlgm@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/perf.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/perf.c b/tools/perf/perf.c +index a11cb006f9682..80f8ae8b13666 100644 +--- a/tools/perf/perf.c ++++ b/tools/perf/perf.c +@@ -439,6 +439,9 @@ int main(int argc, const char **argv) + + srandom(time(NULL)); + ++ /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */ ++ config_exclusive_filename = getenv("PERF_CONFIG"); ++ + err = perf_config(perf_default_config, NULL); + if (err) + return err; +-- +2.20.1 + diff --git a/queue-4.19/perf-ftrace-use-cap_sys_admin-instead-of-euid-0.patch b/queue-4.19/perf-ftrace-use-cap_sys_admin-instead-of-euid-0.patch new file mode 100644 index 00000000000..4f371c49193 --- /dev/null +++ b/queue-4.19/perf-ftrace-use-cap_sys_admin-instead-of-euid-0.patch @@ -0,0 +1,61 @@ +From ef375daf32294fbfdf25702b3e090eb63967edc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 10:44:17 -0400 +Subject: perf ftrace: Use CAP_SYS_ADMIN instead of euid==0 + +From: Igor Lubashev + +[ Upstream commit c766f3df635de14295e410c6dd5410bc416c24a0 ] + +The kernel requires CAP_SYS_ADMIN instead of euid==0 to mount debugfs +for ftrace. Make perf do the same. + +Signed-off-by: Igor Lubashev +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Alexey Budankov +Cc: James Morris +Cc: Mathieu Poirier +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Suzuki Poulouse +Cc: linux-arm-kernel@lists.infradead.org +Link: http://lkml.kernel.org/r/bd8763b72ed4d58d0b42d44fbc7eb474d32e53a3.1565188228.git.ilubashe@akamai.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-ftrace.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c +index 137955197ba8d..e0c61c572db06 100644 +--- a/tools/perf/builtin-ftrace.c ++++ b/tools/perf/builtin-ftrace.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include "debug.h" + #include +@@ -22,6 +23,7 @@ + #include "target.h" + #include "cpumap.h" + #include "thread_map.h" ++#include "util/cap.h" + #include "util/config.h" + + +@@ -282,7 +284,7 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace, int argc, const char **argv) + .events = POLLIN, + }; + +- if (geteuid() != 0) { ++ if (!perf_cap__capable(CAP_SYS_ADMIN)) { + pr_err("ftrace only works for root!\n"); + return -1; + } +-- +2.20.1 + diff --git a/queue-4.19/perf-record-support-aarch64-random-socket_id-assignm.patch b/queue-4.19/perf-record-support-aarch64-random-socket_id-assignm.patch new file mode 100644 index 00000000000..21ed8747326 --- /dev/null +++ b/queue-4.19/perf-record-support-aarch64-random-socket_id-assignm.patch @@ -0,0 +1,80 @@ +From 8f4732710804e0cfaa42ef214b8ee066e3f340eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Aug 2019 11:48:57 +0800 +Subject: perf record: Support aarch64 random socket_id assignment + +From: Tan Xiaojun + +[ Upstream commit 0a4d8fb229dd78f9e0752817339e19e903b37a60 ] + +Same as in the commit 01766229533f ("perf record: Support s390 random +socket_id assignment"), aarch64 also have this problem. + +Without this fix: + + [root@localhost perf]# ./perf report --header -I -v + ... + socket_id number is too big.You may need to upgrade the perf tool. + + # ======== + # captured on : Thu Aug 1 22:58:38 2019 + # header version : 1 + ... + # Core ID and Socket ID information is not available + ... + +With this fix: + [root@localhost perf]# ./perf report --header -I -v + ... + cpumask list: 0-31 + cpumask list: 32-63 + cpumask list: 64-95 + cpumask list: 96-127 + + # ======== + # captured on : Thu Aug 1 22:58:38 2019 + # header version : 1 + ... + # CPU 0: Core ID 0, Socket ID 36 + # CPU 1: Core ID 1, Socket ID 36 + ... + # CPU 126: Core ID 126, Socket ID 8442 + # CPU 127: Core ID 127, Socket ID 8442 + ... + +Signed-off-by: Tan Xiaojun +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Alexey Budankov +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Steven Rostedt (VMware) +Cc: Tzvetomir Stoyanov (VMware) +Link: http://lkml.kernel.org/r/1564717737-21602-1-git-send-email-tanxiaojun@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 54c34c107cab5..0c70788593c8d 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2184,8 +2184,10 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused) + /* On s390 the socket_id number is not related to the numbers of cpus. + * The socket_id number might be higher than the numbers of cpus. + * This depends on the configuration. ++ * AArch64 is the same. + */ +- if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4)) ++ if (ph->env.arch && (!strncmp(ph->env.arch, "s390", 4) ++ || !strncmp(ph->env.arch, "aarch64", 7))) + do_core_id_test = false; + + for (i = 0; i < (u32)cpu_nr; i++) { +-- +2.20.1 + diff --git a/queue-4.19/perf-test-vfs_getname-disable-.perfconfig-to-get-def.patch b/queue-4.19/perf-test-vfs_getname-disable-.perfconfig-to-get-def.patch new file mode 100644 index 00000000000..510f4e2b5fb --- /dev/null +++ b/queue-4.19/perf-test-vfs_getname-disable-.perfconfig-to-get-def.patch @@ -0,0 +1,79 @@ +From 1de37a10bb7feee2e59b8eb8d972fd34b83916ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2019 11:37:44 -0300 +Subject: perf test vfs_getname: Disable ~/.perfconfig to get default output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 4fe94ce1c6ba678b5f12b94bb9996eea4fc99e85 ] + +To get the expected output we have to ignore whatever changes the user +has in its ~/.perfconfig file, so set PERF_CONFIG to /dev/null to +achieve that. + +Before: + + # egrep 'trace|show_' ~/.perfconfig + [trace] + show_zeros = yes + show_duration = no + show_timestamp = no + show_arg_names = no + show_prefix = yes + # echo $PERF_CONFIG + + # perf test "trace + vfs_getname" + 70: Check open filename arg using perf trace + vfs_getname: FAILED! + # export PERF_CONFIG=/dev/null + # perf test "trace + vfs_getname" + 70: Check open filename arg using perf trace + vfs_getname: Ok + # + +After: + + # egrep 'trace|show_' ~/.perfconfig + [trace] + show_zeros = yes + show_duration = no + show_timestamp = no + show_arg_names = no + show_prefix = yes + # echo $PERF_CONFIG + + # perf test "trace + vfs_getname" + 70: Check open filename arg using perf trace + vfs_getname: Ok + # + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Luis Cláudio Gonçalves +Cc: Namhyung Kim +Cc: Taeung Song +Link: https://lkml.kernel.org/n/tip-3up27pexg5i3exuzqrvt4m8u@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/trace+probe_vfs_getname.sh | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh +index 4ce276efe6b4c..fe223fc5c1f85 100755 +--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh ++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh +@@ -29,6 +29,10 @@ if [ $err -ne 0 ] ; then + exit $err + fi + ++# Do not use whatever ~/.perfconfig file, it may change the output ++# via trace.{show_timestamp,show_prefix,etc} ++export PERF_CONFIG=/dev/null ++ + trace_open_vfs_getname + err=$? + rm -f ${file} +-- +2.20.1 + diff --git a/queue-4.19/perf-trace-beauty-ioctl-fix-off-by-one-error-in-cmd-.patch b/queue-4.19/perf-trace-beauty-ioctl-fix-off-by-one-error-in-cmd-.patch new file mode 100644 index 00000000000..4f4b0f80568 --- /dev/null +++ b/queue-4.19/perf-trace-beauty-ioctl-fix-off-by-one-error-in-cmd-.patch @@ -0,0 +1,84 @@ +From 7c8c2bb5658f087f2dcb6fe45117f4528f8a6113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 20:36:25 -0700 +Subject: perf trace beauty ioctl: Fix off-by-one error in cmd->string table + +From: Benjamin Peterson + +[ Upstream commit b92675f4a9c02dd78052645597dac9e270679ddf ] + +While tracing a program that calls isatty(3), I noticed that strace +reported TCGETS for the request argument of the underlying ioctl(2) +syscall while perf trace reported TCSETS. strace is corrrect. The bug in +perf was due to the tty ioctl beauty table starting at 0x5400 rather +than 0x5401. + +Committer testing: + + Using augmented_raw_syscalls.o and settings to make 'perf trace' + use strace formatting, i.e. with this in ~/.perfconfig + + # cat ~/.perfconfig + [trace] + add_events = /home/acme/git/linux/tools/perf/examples/bpf/augmented_raw_syscalls.c + show_zeros = yes + show_duration = no + no_inherit = yes + show_timestamp = no + show_arg_names = no + args_alignment = 40 + show_prefix = yes + + # strace -e ioctl stty > /dev/null + ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 + ioctl(1, TIOCGWINSZ, 0x7fff8a9b0860) = -1 ENOTTY (Inappropriate ioctl for device) + ioctl(1, TCGETS, 0x7fff8a9b0540) = -1 ENOTTY (Inappropriate ioctl for device) + +++ exited with 0 +++ + # + +Before: + + # perf trace -e ioctl stty > /dev/null + ioctl(0, TCSETS, 0x7fff2cf79f20) = 0 + ioctl(1, TIOCSWINSZ, 0x7fff2cf79f40) = -1 ENOTTY (Inappropriate ioctl for device) + ioctl(1, TCSETS, 0x7fff2cf79c20) = -1 ENOTTY (Inappropriate ioctl for device) + # + +After: + + # perf trace -e ioctl stty > /dev/null + ioctl(0, TCGETS, 0x7ffed0763920) = 0 + ioctl(1, TIOCGWINSZ, 0x7ffed0763940) = -1 ENOTTY (Inappropriate ioctl for device) + ioctl(1, TCGETS, 0x7ffed0763620) = -1 ENOTTY (Inappropriate ioctl for device) + # + +Signed-off-by: Benjamin Peterson +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Fixes: 1cc47f2d46206d67285aea0ca7e8450af571da13 ("perf trace beauty ioctl: Improve 'cmd' beautifier") +Link: http://lkml.kernel.org/r/20190823033625.18814-1-benjamin@python.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/trace/beauty/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/trace/beauty/ioctl.c b/tools/perf/trace/beauty/ioctl.c +index 1be3b4cf08270..82346ca06f171 100644 +--- a/tools/perf/trace/beauty/ioctl.c ++++ b/tools/perf/trace/beauty/ioctl.c +@@ -22,7 +22,7 @@ + static size_t ioctl__scnprintf_tty_cmd(int nr, int dir, char *bf, size_t size) + { + static const char *ioctl_tty_cmd[] = { +- "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW", ++ [_IOC_NR(TCGETS)] = "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW", + "TCSETAF", "TCSBRK", "TCXONC", "TCFLSH", "TIOCEXCL", "TIOCNXCL", "TIOCSCTTY", + "TIOCGPGRP", "TIOCSPGRP", "TIOCOUTQ", "TIOCSTI", "TIOCGWINSZ", "TIOCSWINSZ", + "TIOCMGET", "TIOCMBIS", "TIOCMBIC", "TIOCMSET", "TIOCGSOFTCAR", "TIOCSSOFTCAR", +-- +2.20.1 + diff --git a/queue-4.19/platform-x86-intel_pmc_core-do-not-ioremap-ram.patch b/queue-4.19/platform-x86-intel_pmc_core-do-not-ioremap-ram.patch new file mode 100644 index 00000000000..65be88c86d2 --- /dev/null +++ b/queue-4.19/platform-x86-intel_pmc_core-do-not-ioremap-ram.patch @@ -0,0 +1,63 @@ +From f7dbce93af2c905c308128f2ce6f8e67d2062f77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 21:41:39 -0400 +Subject: platform/x86: intel_pmc_core: Do not ioremap RAM + +From: M. Vefa Bicakci + +[ Upstream commit 7d505758b1e556cdf65a5e451744fe0ae8063d17 ] + +On a Xen-based PVH virtual machine with more than 4 GiB of RAM, +intel_pmc_core fails initialization with the following warning message +from the kernel, indicating that the driver is attempting to ioremap +RAM: + + ioremap on RAM at 0x00000000fe000000 - 0x00000000fe001fff + WARNING: CPU: 1 PID: 434 at arch/x86/mm/ioremap.c:186 __ioremap_caller.constprop.0+0x2aa/0x2c0 +... + Call Trace: + ? pmc_core_probe+0x87/0x2d0 [intel_pmc_core] + pmc_core_probe+0x87/0x2d0 [intel_pmc_core] + +This issue appears to manifest itself because of the following fallback +mechanism in the driver: + + if (lpit_read_residency_count_address(&slp_s0_addr)) + pmcdev->base_addr = PMC_BASE_ADDR_DEFAULT; + +The validity of address PMC_BASE_ADDR_DEFAULT (i.e., 0xFE000000) is not +verified by the driver, which is what this patch introduces. With this +patch, if address PMC_BASE_ADDR_DEFAULT is in RAM, then the driver will +not attempt to ioremap the aforementioned address. + +Signed-off-by: M. Vefa Bicakci +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_pmc_core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c +index 088d1c2047e6b..36bd2545afb62 100644 +--- a/drivers/platform/x86/intel_pmc_core.c ++++ b/drivers/platform/x86/intel_pmc_core.c +@@ -685,10 +685,14 @@ static int __init pmc_core_probe(void) + if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids)) + pmcdev->map = &cnp_reg_map; + +- if (lpit_read_residency_count_address(&slp_s0_addr)) ++ if (lpit_read_residency_count_address(&slp_s0_addr)) { + pmcdev->base_addr = PMC_BASE_ADDR_DEFAULT; +- else ++ ++ if (page_is_ram(PHYS_PFN(pmcdev->base_addr))) ++ return -ENODEV; ++ } else { + pmcdev->base_addr = slp_s0_addr - pmcdev->map->slp_s0_offset; ++ } + + pmcdev->regbase = ioremap(pmcdev->base_addr, + pmcdev->map->regmap_length); +-- +2.20.1 + diff --git a/queue-4.19/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch b/queue-4.19/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch new file mode 100644 index 00000000000..284736d1856 --- /dev/null +++ b/queue-4.19/pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch @@ -0,0 +1,101 @@ +From caa3551b7a8a296fc6f2511773a2108256f86932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 15:38:35 +0200 +Subject: PM / devfreq: exynos-bus: Correct clock enable sequence + +From: Kamil Konieczny + +[ Upstream commit 2c2b20e0da89c76759ee28c6824413ab2fa3bfc6 ] + +Regulators should be enabled before clocks to avoid h/w hang. This +require change in exynos_bus_probe() to move exynos_bus_parse_of() +after exynos_bus_parent_parse_of() and change in error handling. +Similar change is needed in exynos_bus_exit() where clock should be +disabled before regulators. + +Signed-off-by: Kamil Konieczny +Acked-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/exynos-bus.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/drivers/devfreq/exynos-bus.c b/drivers/devfreq/exynos-bus.c +index c25658b265988..24a9658348d78 100644 +--- a/drivers/devfreq/exynos-bus.c ++++ b/drivers/devfreq/exynos-bus.c +@@ -194,11 +194,10 @@ static void exynos_bus_exit(struct device *dev) + if (ret < 0) + dev_warn(dev, "failed to disable the devfreq-event devices\n"); + +- if (bus->regulator) +- regulator_disable(bus->regulator); +- + dev_pm_opp_of_remove_table(dev); + clk_disable_unprepare(bus->clk); ++ if (bus->regulator) ++ regulator_disable(bus->regulator); + } + + /* +@@ -386,6 +385,7 @@ static int exynos_bus_probe(struct platform_device *pdev) + struct exynos_bus *bus; + int ret, max_state; + unsigned long min_freq, max_freq; ++ bool passive = false; + + if (!np) { + dev_err(dev, "failed to find devicetree node\n"); +@@ -399,27 +399,27 @@ static int exynos_bus_probe(struct platform_device *pdev) + bus->dev = &pdev->dev; + platform_set_drvdata(pdev, bus); + +- /* Parse the device-tree to get the resource information */ +- ret = exynos_bus_parse_of(np, bus); +- if (ret < 0) +- return ret; +- + profile = devm_kzalloc(dev, sizeof(*profile), GFP_KERNEL); +- if (!profile) { +- ret = -ENOMEM; +- goto err; +- } ++ if (!profile) ++ return -ENOMEM; + + node = of_parse_phandle(dev->of_node, "devfreq", 0); + if (node) { + of_node_put(node); +- goto passive; ++ passive = true; + } else { + ret = exynos_bus_parent_parse_of(np, bus); ++ if (ret < 0) ++ return ret; + } + ++ /* Parse the device-tree to get the resource information */ ++ ret = exynos_bus_parse_of(np, bus); + if (ret < 0) +- goto err; ++ goto err_reg; ++ ++ if (passive) ++ goto passive; + + /* Initialize the struct profile and governor data for parent device */ + profile->polling_ms = 50; +@@ -510,6 +510,9 @@ static int exynos_bus_probe(struct platform_device *pdev) + err: + dev_pm_opp_of_remove_table(dev); + clk_disable_unprepare(bus->clk); ++err_reg: ++ if (!passive) ++ regulator_disable(bus->regulator); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.19/pm-devfreq-passive-fix-compiler-warning.patch b/queue-4.19/pm-devfreq-passive-fix-compiler-warning.patch new file mode 100644 index 00000000000..579eb37a5d8 --- /dev/null +++ b/queue-4.19/pm-devfreq-passive-fix-compiler-warning.patch @@ -0,0 +1,35 @@ +From a5b19648c15721668b2839f42c28cea12b09b867 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 21:37:37 +0900 +Subject: PM / devfreq: passive: fix compiler warning + +From: MyungJoo Ham + +[ Upstream commit 0465814831a926ce2f83e8f606d067d86745234e ] + +The recent commit of +PM / devfreq: passive: Use non-devm notifiers +had incurred compiler warning, "unused variable 'dev'". + +Reported-by: Stephen Rothwell +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/governor_passive.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index 22fd41b4c1098..8cfb69749d498 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -152,7 +152,6 @@ static int devfreq_passive_notifier_call(struct notifier_block *nb, + static int devfreq_passive_event_handler(struct devfreq *devfreq, + unsigned int event, void *data) + { +- struct device *dev = devfreq->dev.parent; + struct devfreq_passive_data *p_data + = (struct devfreq_passive_data *)devfreq->data; + struct devfreq *parent = (struct devfreq *)p_data->parent; +-- +2.20.1 + diff --git a/queue-4.19/pm-devfreq-passive-use-non-devm-notifiers.patch b/queue-4.19/pm-devfreq-passive-use-non-devm-notifiers.patch new file mode 100644 index 00000000000..e5bb6bc2576 --- /dev/null +++ b/queue-4.19/pm-devfreq-passive-use-non-devm-notifiers.patch @@ -0,0 +1,69 @@ +From b0d6531ddc8349024bfc839a50fd567dce24f0cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 19:54:08 +0300 +Subject: PM / devfreq: passive: Use non-devm notifiers + +From: Leonard Crestez + +[ Upstream commit 0ef7c7cce43f6ecc2b96d447e69b2900a9655f7c ] + +The devfreq passive governor registers and unregisters devfreq +transition notifiers on DEVFREQ_GOV_START/GOV_STOP using devm wrappers. + +If devfreq itself is registered with devm then a warning is triggered on +rmmod from devm_devfreq_unregister_notifier. Call stack looks like this: + + devm_devfreq_unregister_notifier+0x30/0x40 + devfreq_passive_event_handler+0x4c/0x88 + devfreq_remove_device.part.8+0x6c/0x9c + devm_devfreq_dev_release+0x18/0x20 + release_nodes+0x1b0/0x220 + devres_release_all+0x78/0x84 + device_release_driver_internal+0x100/0x1c0 + driver_detach+0x4c/0x90 + bus_remove_driver+0x7c/0xd0 + driver_unregister+0x2c/0x58 + platform_driver_unregister+0x10/0x18 + imx_devfreq_platdrv_exit+0x14/0xd40 [imx_devfreq] + +This happens because devres_release_all will first remove all the nodes +into a separate todo list so the nested devres_release from +devm_devfreq_unregister_notifier won't find anything. + +Fix the warning by calling the non-devm APIS for frequency notification. +Using devm wrappers is not actually useful for a governor anyway: it +relies on the devfreq core to correctly match the GOV_START/GOV_STOP +notifications. + +Fixes: 996133119f57 ("PM / devfreq: Add new passive governor") +Signed-off-by: Leonard Crestez +Acked-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Sasha Levin +--- + drivers/devfreq/governor_passive.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index 3bc29acbd54e8..22fd41b4c1098 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -168,12 +168,12 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq, + p_data->this = devfreq; + + nb->notifier_call = devfreq_passive_notifier_call; +- ret = devm_devfreq_register_notifier(dev, parent, nb, ++ ret = devfreq_register_notifier(parent, nb, + DEVFREQ_TRANSITION_NOTIFIER); + break; + case DEVFREQ_GOV_STOP: +- devm_devfreq_unregister_notifier(dev, parent, nb, +- DEVFREQ_TRANSITION_NOTIFIER); ++ WARN_ON(devfreq_unregister_notifier(parent, nb, ++ DEVFREQ_TRANSITION_NOTIFIER)); + break; + default: + break; +-- +2.20.1 + diff --git a/queue-4.19/posix-cpu-timers-sanitize-bogus-warnons.patch b/queue-4.19/posix-cpu-timers-sanitize-bogus-warnons.patch new file mode 100644 index 00000000000..4c0ceee4062 --- /dev/null +++ b/queue-4.19/posix-cpu-timers-sanitize-bogus-warnons.patch @@ -0,0 +1,97 @@ +From 1626df04cd20277e9575595f10c01dc729607517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 16:31:46 +0200 +Subject: posix-cpu-timers: Sanitize bogus WARNONS + +From: Thomas Gleixner + +[ Upstream commit 692117c1f7a6770ed41dd8f277cd9fed1dfb16f1 ] + +Warning when p == NULL and then proceeding and dereferencing p does not +make any sense as the kernel will crash with a NULL pointer dereference +right away. + +Bailing out when p == NULL and returning an error code does not cure the +underlying problem which caused p to be NULL. Though it might allow to +do proper debugging. + +Same applies to the clock id check in set_process_cpu_timer(). + +Clean them up and make them return without trying to do further damage. + +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Link: https://lkml.kernel.org/r/20190819143801.846497772@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/posix-cpu-timers.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c +index 76801b9b481eb..d62d7ae5201c5 100644 +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -375,7 +375,8 @@ static int posix_cpu_timer_del(struct k_itimer *timer) + struct sighand_struct *sighand; + struct task_struct *p = timer->it.cpu.task; + +- WARN_ON_ONCE(p == NULL); ++ if (WARN_ON_ONCE(!p)) ++ return -EINVAL; + + /* + * Protect against sighand release/switch in exit/exec and process/ +@@ -580,7 +581,8 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, + u64 old_expires, new_expires, old_incr, val; + int ret; + +- WARN_ON_ONCE(p == NULL); ++ if (WARN_ON_ONCE(!p)) ++ return -EINVAL; + + /* + * Use the to_ktime conversion because that clamps the maximum +@@ -716,10 +718,11 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, + + static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec64 *itp) + { +- u64 now; + struct task_struct *p = timer->it.cpu.task; ++ u64 now; + +- WARN_ON_ONCE(p == NULL); ++ if (WARN_ON_ONCE(!p)) ++ return; + + /* + * Easy part: convert the reload time. +@@ -1004,12 +1007,13 @@ static void check_process_timers(struct task_struct *tsk, + */ + static void posix_cpu_timer_rearm(struct k_itimer *timer) + { ++ struct task_struct *p = timer->it.cpu.task; + struct sighand_struct *sighand; + unsigned long flags; +- struct task_struct *p = timer->it.cpu.task; + u64 now; + +- WARN_ON_ONCE(p == NULL); ++ if (WARN_ON_ONCE(!p)) ++ return; + + /* + * Fetch the current sample and update the timer's expiry time. +@@ -1206,7 +1210,9 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx, + u64 now; + int ret; + +- WARN_ON_ONCE(clock_idx == CPUCLOCK_SCHED); ++ if (WARN_ON_ONCE(clock_idx >= CPUCLOCK_SCHED)) ++ return; ++ + ret = cpu_timer_sample_group(clock_idx, tsk, &now); + + if (oldval && ret != -EINVAL) { +-- +2.20.1 + diff --git a/queue-4.19/raid5-don-t-increment-read_errors-on-eilseq-return.patch b/queue-4.19/raid5-don-t-increment-read_errors-on-eilseq-return.patch new file mode 100644 index 00000000000..d6649a6c280 --- /dev/null +++ b/queue-4.19/raid5-don-t-increment-read_errors-on-eilseq-return.patch @@ -0,0 +1,46 @@ +From 94824f898148b7c3f28c4bf6a86d3fbbe0da852c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2019 09:21:33 -0400 +Subject: raid5: don't increment read_errors on EILSEQ return + +From: Nigel Croxon + +[ Upstream commit b76b4715eba0d0ed574f58918b29c1b2f0fa37a8 ] + +While MD continues to count read errors returned by the lower layer. +If those errors are -EILSEQ, instead of -EIO, it should NOT increase +the read_errors count. + +When RAID6 is set up on dm-integrity target that detects massive +corruption, the leg will be ejected from the array. Even if the +issue is correctable with a sector re-write and the array has +necessary redundancy to correct it. + +The leg is ejected because it runs up the rdev->read_errors beyond +conf->max_nr_stripes. The return status in dm-drypt when there is +a data integrity error is -EILSEQ (BLK_STS_PROTECTION). + +Signed-off-by: Nigel Croxon +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d26e5e9bea427..dbc4655a95768 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2540,7 +2540,8 @@ static void raid5_end_read_request(struct bio * bi) + int set_bad = 0; + + clear_bit(R5_UPTODATE, &sh->dev[i].flags); +- atomic_inc(&rdev->read_errors); ++ if (!(bi->bi_status == BLK_STS_PROTECTION)) ++ atomic_inc(&rdev->read_errors); + if (test_bit(R5_ReadRepl, &sh->dev[i].flags)) + pr_warn_ratelimited( + "md/raid:%s: read error on replacement device (sector %llu on %s).\n", +-- +2.20.1 + diff --git a/queue-4.19/raid5-don-t-set-stripe_handle-to-stripe-which-is-in-.patch b/queue-4.19/raid5-don-t-set-stripe_handle-to-stripe-which-is-in-.patch new file mode 100644 index 00000000000..558da098967 --- /dev/null +++ b/queue-4.19/raid5-don-t-set-stripe_handle-to-stripe-which-is-in-.patch @@ -0,0 +1,75 @@ +From c3bc970cc9b82b68006e50874119bd64646d945a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2019 10:06:29 +0200 +Subject: raid5: don't set STRIPE_HANDLE to stripe which is in batch list + +From: Guoqing Jiang + +[ Upstream commit 6ce220dd2f8ea71d6afc29b9a7524c12e39f374a ] + +If stripe in batch list is set with STRIPE_HANDLE flag, then the stripe +could be set with STRIPE_ACTIVE by the handle_stripe function. And if +error happens to the batch_head at the same time, break_stripe_batch_list +is called, then below warning could happen (the same report in [1]), it +means a member of batch list was set with STRIPE_ACTIVE. + +[7028915.431770] stripe state: 2001 +[7028915.431815] ------------[ cut here ]------------ +[7028915.431828] WARNING: CPU: 18 PID: 29089 at drivers/md/raid5.c:4614 break_stripe_batch_list+0x203/0x240 [raid456] +[...] +[7028915.431879] CPU: 18 PID: 29089 Comm: kworker/u82:5 Tainted: G O 4.14.86-1-storage #4.14.86-1.2~deb9 +[7028915.431881] Hardware name: Supermicro SSG-2028R-ACR24L/X10DRH-iT, BIOS 3.1 06/18/2018 +[7028915.431888] Workqueue: raid5wq raid5_do_work [raid456] +[7028915.431890] task: ffff9ab0ef36d7c0 task.stack: ffffb72926f84000 +[7028915.431896] RIP: 0010:break_stripe_batch_list+0x203/0x240 [raid456] +[7028915.431898] RSP: 0018:ffffb72926f87ba8 EFLAGS: 00010286 +[7028915.431900] RAX: 0000000000000012 RBX: ffff9aaa84a98000 RCX: 0000000000000000 +[7028915.431901] RDX: 0000000000000000 RSI: ffff9ab2bfa15458 RDI: ffff9ab2bfa15458 +[7028915.431902] RBP: ffff9aaa8fb4e900 R08: 0000000000000001 R09: 0000000000002eb4 +[7028915.431903] R10: 00000000ffffffff R11: 0000000000000000 R12: ffff9ab1736f1b00 +[7028915.431904] R13: 0000000000000000 R14: ffff9aaa8fb4e900 R15: 0000000000000001 +[7028915.431906] FS: 0000000000000000(0000) GS:ffff9ab2bfa00000(0000) knlGS:0000000000000000 +[7028915.431907] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[7028915.431908] CR2: 00007ff953b9f5d8 CR3: 0000000bf4009002 CR4: 00000000003606e0 +[7028915.431909] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[7028915.431910] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[7028915.431910] Call Trace: +[7028915.431923] handle_stripe+0x8e7/0x2020 [raid456] +[7028915.431930] ? __wake_up_common_lock+0x89/0xc0 +[7028915.431935] handle_active_stripes.isra.58+0x35f/0x560 [raid456] +[7028915.431939] raid5_do_work+0xc6/0x1f0 [raid456] + +Also commit 59fc630b8b5f9f ("RAID5: batch adjacent full stripe write") +said "If a stripe is added to batch list, then only the first stripe +of the list should be put to handle_list and run handle_stripe." + +So don't set STRIPE_HANDLE to stripe which is already in batch list, +otherwise the stripe could be put to handle_list and run handle_stripe, +then the above warning could be triggered. + +[1]. https://www.spinics.net/lists/raid/msg62552.html + +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index a147619498dfb..d26e5e9bea427 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5721,7 +5721,8 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + do_flush = false; + } + +- set_bit(STRIPE_HANDLE, &sh->state); ++ if (!sh->batch_head) ++ set_bit(STRIPE_HANDLE, &sh->state); + clear_bit(STRIPE_DELAYED, &sh->state); + if ((!sh->batch_head || sh == sh->batch_head) && + (bi->bi_opf & REQ_SYNC) && +-- +2.20.1 + diff --git a/queue-4.19/ras-fix-prototype-warnings.patch b/queue-4.19/ras-fix-prototype-warnings.patch new file mode 100644 index 00000000000..622a049e940 --- /dev/null +++ b/queue-4.19/ras-fix-prototype-warnings.patch @@ -0,0 +1,73 @@ +From b4033824157e974c674ed3fcc5459940b9923480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 18:59:29 -0400 +Subject: RAS: Fix prototype warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Valdis Klētnieks + +[ Upstream commit 0a54b809a3a2c31e1055b45b03708eb730222be1 ] + +When building with C=2 and/or W=1, legitimate warnings are issued about +missing prototypes: + + CHECK drivers/ras/debugfs.c + drivers/ras/debugfs.c:4:15: warning: symbol 'ras_debugfs_dir' was not declared. Should it be static? + drivers/ras/debugfs.c:8:5: warning: symbol 'ras_userspace_consumers' was not declared. Should it be static? + drivers/ras/debugfs.c:38:12: warning: symbol 'ras_add_daemon_trace' was not declared. Should it be static? + drivers/ras/debugfs.c:54:13: warning: symbol 'ras_debugfs_init' was not declared. Should it be static? + CC drivers/ras/debugfs.o + drivers/ras/debugfs.c:8:5: warning: no previous prototype for 'ras_userspace_consumers' [-Wmissing-prototypes] + 8 | int ras_userspace_consumers(void) + | ^~~~~~~~~~~~~~~~~~~~~~~ + drivers/ras/debugfs.c:38:12: warning: no previous prototype for 'ras_add_daemon_trace' [-Wmissing-prototypes] + 38 | int __init ras_add_daemon_trace(void) + | ^~~~~~~~~~~~~~~~~~~~ + drivers/ras/debugfs.c:54:13: warning: no previous prototype for 'ras_debugfs_init' [-Wmissing-prototypes] + 54 | void __init ras_debugfs_init(void) + | ^~~~~~~~~~~~~~~~ + +Provide the proper includes. + + [ bp: Take care of the same warnings for cec.c too. ] + +Signed-off-by: Valdis Kletnieks +Signed-off-by: Borislav Petkov +Cc: Tony Luck +Cc: linux-edac@vger.kernel.org +Cc: x86@kernel.org +Link: http://lkml.kernel.org/r/7168.1565218769@turing-police +Signed-off-by: Sasha Levin +--- + drivers/ras/cec.c | 1 + + drivers/ras/debugfs.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c +index 5d2b2c02cbbec..0c719787876a5 100644 +--- a/drivers/ras/cec.c ++++ b/drivers/ras/cec.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include + #include ++#include + #include + #include + +diff --git a/drivers/ras/debugfs.c b/drivers/ras/debugfs.c +index 501603057dffe..12a161377f4f8 100644 +--- a/drivers/ras/debugfs.c ++++ b/drivers/ras/debugfs.c +@@ -1,4 +1,6 @@ + #include ++#include ++#include "debugfs.h" + + struct dentry *ras_debugfs_dir; + +-- +2.20.1 + diff --git a/queue-4.19/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch b/queue-4.19/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch new file mode 100644 index 00000000000..39fda62a535 --- /dev/null +++ b/queue-4.19/regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch @@ -0,0 +1,53 @@ +From 7a1fa9fd4e74a11a929d334709c1d7a94d0846c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2019 21:26:31 +0800 +Subject: regulator: lm363x: Fix off-by-one n_voltages for lm3632 + ldo_vpos/ldo_vneg + +From: Axel Lin + +[ Upstream commit 1e2cc8c5e0745b545d4974788dc606d678b6e564 ] + +According to the datasheet https://www.ti.com/lit/ds/symlink/lm3632a.pdf +Table 20. VPOS Bias Register Field Descriptions VPOS[5:0] +Sets the Positive Display Bias (LDO) Voltage (50 mV per step) +000000: 4 V +000001: 4.05 V +000010: 4.1 V +.................... +011101: 5.45 V +011110: 5.5 V (Default) +011111: 5.55 V +.................... +100111: 5.95 V +101000: 6 V +Note: Codes 101001 to 111111 map to 6 V + +The LM3632_LDO_VSEL_MAX should be 0b101000 (0x28), so the maximum voltage +can match the datasheet. + +Fixes: 3a8d1a73a037 ("regulator: add LM363X driver") +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20190626132632.32629-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/lm363x-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/lm363x-regulator.c b/drivers/regulator/lm363x-regulator.c +index b615a413ca9f6..27c0a67cfd0e2 100644 +--- a/drivers/regulator/lm363x-regulator.c ++++ b/drivers/regulator/lm363x-regulator.c +@@ -33,7 +33,7 @@ + + /* LM3632 */ + #define LM3632_BOOST_VSEL_MAX 0x26 +-#define LM3632_LDO_VSEL_MAX 0x29 ++#define LM3632_LDO_VSEL_MAX 0x28 + #define LM3632_VBOOST_MIN 4500000 + #define LM3632_VLDO_MIN 4000000 + +-- +2.20.1 + diff --git a/queue-4.19/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch b/queue-4.19/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch new file mode 100644 index 00000000000..87e46f1439b --- /dev/null +++ b/queue-4.19/s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch @@ -0,0 +1,56 @@ +From bae36726afc31ffcd174bdf3ade8730cd0935517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 09:38:17 +0200 +Subject: s390/crypto: xts-aes-s390 fix extra run-time crypto self tests + finding + +From: Harald Freudenberger + +[ Upstream commit 9e323d45ba94262620a073a3f9945ca927c07c71 ] + +With 'extra run-time crypto self tests' enabled, the selftest +for s390-xts fails with + + alg: skcipher: xts-aes-s390 encryption unexpectedly succeeded on + test vector "random: len=0 klen=64"; expected_error=-22, + cfg="random: inplace use_digest nosimd src_divs=[2.61%@+4006, + 84.44%@+21, 1.55%@+13, 4.50%@+344, 4.26%@+21, 2.64%@+27]" + +This special case with nbytes=0 is not handled correctly and this +fix now makes sure that -EINVAL is returned when there is en/decrypt +called with 0 bytes to en/decrypt. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/aes_s390.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 8ff7cb3da1cba..2bc189187ed40 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -585,6 +585,9 @@ static int xts_aes_encrypt(struct blkcipher_desc *desc, + struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + ++ if (!nbytes) ++ return -EINVAL; ++ + if (unlikely(!xts_ctx->fc)) + return xts_fallback_encrypt(desc, dst, src, nbytes); + +@@ -599,6 +602,9 @@ static int xts_aes_decrypt(struct blkcipher_desc *desc, + struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm); + struct blkcipher_walk walk; + ++ if (!nbytes) ++ return -EINVAL; ++ + if (unlikely(!xts_ctx->fc)) + return xts_fallback_decrypt(desc, dst, src, nbytes); + +-- +2.20.1 + diff --git a/queue-4.19/sched-core-fix-cpu-controller-for-rt_group_sched.patch b/queue-4.19/sched-core-fix-cpu-controller-for-rt_group_sched.patch new file mode 100644 index 00000000000..6ce638eb6e5 --- /dev/null +++ b/queue-4.19/sched-core-fix-cpu-controller-for-rt_group_sched.patch @@ -0,0 +1,84 @@ +From 628b0afb2a9940b21322010085ab7e949f6fdb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 08:34:55 +0200 +Subject: sched/core: Fix CPU controller for !RT_GROUP_SCHED +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juri Lelli + +[ Upstream commit a07db5c0865799ebed1f88be0df50c581fb65029 ] + +On !CONFIG_RT_GROUP_SCHED configurations it is currently not possible to +move RT tasks between cgroups to which CPU controller has been attached; +but it is oddly possible to first move tasks around and then make them +RT (setschedule to FIFO/RR). + +E.g.: + + # mkdir /sys/fs/cgroup/cpu,cpuacct/group1 + # chrt -fp 10 $$ + # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks + bash: echo: write error: Invalid argument + # chrt -op 0 $$ + # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks + # chrt -fp 10 $$ + # cat /sys/fs/cgroup/cpu,cpuacct/group1/tasks + 2345 + 2598 + # chrt -p 2345 + pid 2345's current scheduling policy: SCHED_FIFO + pid 2345's current scheduling priority: 10 + +Also, as Michal noted, it is currently not possible to enable CPU +controller on unified hierarchy with !CONFIG_RT_GROUP_SCHED (if there +are any kernel RT threads in root cgroup, they can't be migrated to the +newly created CPU controller's root in cgroup_update_dfl_csses()). + +Existing code comes with a comment saying the "we don't support RT-tasks +being in separate groups". Such comment is however stale and belongs to +pre-RT_GROUP_SCHED times. Also, it doesn't make much sense for +!RT_GROUP_ SCHED configurations, since checks related to RT bandwidth +are not performed at all in these cases. + +Make moving RT tasks between CPU controller groups viable by removing +special case check for RT (and DEADLINE) tasks. + +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Michal Koutný +Reviewed-by: Daniel Bristot de Oliveira +Acked-by: Tejun Heo +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: lizefan@huawei.com +Cc: longman@redhat.com +Cc: luca.abeni@santannapisa.it +Cc: rostedt@goodmis.org +Link: https://lkml.kernel.org/r/20190719063455.27328-1-juri.lelli@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index e06c12d293f70..f4e050681ba1c 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -6494,10 +6494,6 @@ static int cpu_cgroup_can_attach(struct cgroup_taskset *tset) + #ifdef CONFIG_RT_GROUP_SCHED + if (!sched_rt_can_attach(css_tg(css), task)) + return -EINVAL; +-#else +- /* We don't support RT-tasks being in separate groups */ +- if (task->sched_class != &fair_sched_class) +- return -EINVAL; + #endif + /* + * Serialize against wake_up_new_task() such that if its +-- +2.20.1 + diff --git a/queue-4.19/sched-cpufreq-align-trace-event-behavior-of-fast-swi.patch b/queue-4.19/sched-cpufreq-align-trace-event-behavior-of-fast-swi.patch new file mode 100644 index 00000000000..cf926c59079 --- /dev/null +++ b/queue-4.19/sched-cpufreq-align-trace-event-behavior-of-fast-swi.patch @@ -0,0 +1,52 @@ +From dc831156d1ca0c56f7c7dd4b37d267f63c2380d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 16:33:40 +0100 +Subject: sched/cpufreq: Align trace event behavior of fast switching + +From: Douglas RAILLARD + +[ Upstream commit 77c84dd1881d0f0176cb678d770bfbda26c54390 ] + +Fast switching path only emits an event for the CPU of interest, whereas the +regular path emits an event for all the CPUs that had their frequency changed, +i.e. all the CPUs sharing the same policy. + +With the current behavior, looking at cpu_frequency event for a given CPU that +is using the fast switching path will not give the correct frequency signal. + +Signed-off-by: Douglas RAILLARD +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/sched/cpufreq_schedutil.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index 64d54acc99282..54fcff656ecd7 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -118,6 +118,7 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time, + unsigned int next_freq) + { + struct cpufreq_policy *policy = sg_policy->policy; ++ int cpu; + + if (!sugov_update_next_freq(sg_policy, time, next_freq)) + return; +@@ -127,7 +128,11 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time, + return; + + policy->cur = next_freq; +- trace_cpu_frequency(next_freq, smp_processor_id()); ++ ++ if (trace_cpu_frequency_enabled()) { ++ for_each_cpu(cpu, policy->cpus) ++ trace_cpu_frequency(next_freq, cpu); ++ } + } + + static void sugov_deferred_update(struct sugov_policy *sg_policy, u64 time, +-- +2.20.1 + diff --git a/queue-4.19/sched-deadline-fix-bandwidth-accounting-at-all-level.patch b/queue-4.19/sched-deadline-fix-bandwidth-accounting-at-all-level.patch new file mode 100644 index 00000000000..60d6979d943 --- /dev/null +++ b/queue-4.19/sched-deadline-fix-bandwidth-accounting-at-all-level.patch @@ -0,0 +1,93 @@ +From eb9bb363e87cd2059b1e260ca4cbfea7935a924e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 15:59:56 +0200 +Subject: sched/deadline: Fix bandwidth accounting at all levels after offline + migration + +From: Juri Lelli + +[ Upstream commit 59d06cea1198d665ba11f7e8c5f45b00ff2e4812 ] + +If a task happens to be throttled while the CPU it was running on gets +hotplugged off, the bandwidth associated with the task is not correctly +migrated with it when the replenishment timer fires (offline_migration). + +Fix things up, for this_bw, running_bw and total_bw, when replenishment +timer fires and task is migrated (dl_task_offline_migration()). + +Tested-by: Dietmar Eggemann +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: bristot@redhat.com +Cc: claudio@evidence.eu.com +Cc: lizefan@huawei.com +Cc: longman@redhat.com +Cc: luca.abeni@santannapisa.it +Cc: mathieu.poirier@linaro.org +Cc: rostedt@goodmis.org +Cc: tj@kernel.org +Cc: tommaso.cucinotta@santannapisa.it +Link: https://lkml.kernel.org/r/20190719140000.31694-5-juri.lelli@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 72c07059ef371..ebec37cb3be9a 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -529,6 +529,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq); + static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p) + { + struct rq *later_rq = NULL; ++ struct dl_bw *dl_b; + + later_rq = find_lock_later_rq(p, rq); + if (!later_rq) { +@@ -557,6 +558,38 @@ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p + double_lock_balance(rq, later_rq); + } + ++ if (p->dl.dl_non_contending || p->dl.dl_throttled) { ++ /* ++ * Inactive timer is armed (or callback is running, but ++ * waiting for us to release rq locks). In any case, when it ++ * will fire (or continue), it will see running_bw of this ++ * task migrated to later_rq (and correctly handle it). ++ */ ++ sub_running_bw(&p->dl, &rq->dl); ++ sub_rq_bw(&p->dl, &rq->dl); ++ ++ add_rq_bw(&p->dl, &later_rq->dl); ++ add_running_bw(&p->dl, &later_rq->dl); ++ } else { ++ sub_rq_bw(&p->dl, &rq->dl); ++ add_rq_bw(&p->dl, &later_rq->dl); ++ } ++ ++ /* ++ * And we finally need to fixup root_domain(s) bandwidth accounting, ++ * since p is still hanging out in the old (now moved to default) root ++ * domain. ++ */ ++ dl_b = &rq->rd->dl_bw; ++ raw_spin_lock(&dl_b->lock); ++ __dl_sub(dl_b, p->dl.dl_bw, cpumask_weight(rq->rd->span)); ++ raw_spin_unlock(&dl_b->lock); ++ ++ dl_b = &later_rq->rd->dl_bw; ++ raw_spin_lock(&dl_b->lock); ++ __dl_add(dl_b, p->dl.dl_bw, cpumask_weight(later_rq->rd->span)); ++ raw_spin_unlock(&dl_b->lock); ++ + set_task_cpu(p, later_rq->cpu); + double_unlock_balance(later_rq, rq); + +-- +2.20.1 + diff --git a/queue-4.19/sched-fair-fix-imbalance-due-to-cpu-affinity.patch b/queue-4.19/sched-fair-fix-imbalance-due-to-cpu-affinity.patch new file mode 100644 index 00000000000..8dfcea56513 --- /dev/null +++ b/queue-4.19/sched-fair-fix-imbalance-due-to-cpu-affinity.patch @@ -0,0 +1,66 @@ +From a6e65f8ad9448aa1188532a471900375e15d1b8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2019 17:47:02 +0200 +Subject: sched/fair: Fix imbalance due to CPU affinity + +From: Vincent Guittot + +[ Upstream commit f6cad8df6b30a5d2bbbd2e698f74b4cafb9fb82b ] + +The load_balance() has a dedicated mecanism to detect when an imbalance +is due to CPU affinity and must be handled at parent level. In this case, +the imbalance field of the parent's sched_group is set. + +The description of sg_imbalanced() gives a typical example of two groups +of 4 CPUs each and 4 tasks each with a cpumask covering 1 CPU of the first +group and 3 CPUs of the second group. Something like: + + { 0 1 2 3 } { 4 5 6 7 } + * * * * + +But the load_balance fails to fix this UC on my octo cores system +made of 2 clusters of quad cores. + +Whereas the load_balance is able to detect that the imbalanced is due to +CPU affinity, it fails to fix it because the imbalance field is cleared +before letting parent level a chance to run. In fact, when the imbalance is +detected, the load_balance reruns without the CPU with pinned tasks. But +there is no other running tasks in the situation described above and +everything looks balanced this time so the imbalance field is immediately +cleared. + +The imbalance field should not be cleared if there is no other task to move +when the imbalance is detected. + +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/1561996022-28829-1-git-send-email-vincent.guittot@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 49ed38914669b..ad78a15bd5677 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -8863,9 +8863,10 @@ static int load_balance(int this_cpu, struct rq *this_rq, + out_balanced: + /* + * We reach balance although we may have faced some affinity +- * constraints. Clear the imbalance flag if it was set. ++ * constraints. Clear the imbalance flag only if other tasks got ++ * a chance to move and fix the imbalance. + */ +- if (sd_parent) { ++ if (sd_parent && !(env.flags & LBF_ALL_PINNED)) { + int *group_imbalance = &sd_parent->groups->sgc->imbalance; + + if (*group_imbalance) +-- +2.20.1 + diff --git a/queue-4.19/sched-fair-use-rq_lock-unlock-in-online_fair_sched_g.patch b/queue-4.19/sched-fair-use-rq_lock-unlock-in-online_fair_sched_g.patch new file mode 100644 index 00000000000..9c4fba511ed --- /dev/null +++ b/queue-4.19/sched-fair-use-rq_lock-unlock-in-online_fair_sched_g.patch @@ -0,0 +1,74 @@ +From fc948c15fd451272e8faec2f5b04653641b10d78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Aug 2019 09:37:49 -0400 +Subject: sched/fair: Use rq_lock/unlock in online_fair_sched_group + +From: Phil Auld + +[ Upstream commit a46d14eca7b75fffe35603aa8b81df654353d80f ] + +Enabling WARN_DOUBLE_CLOCK in /sys/kernel/debug/sched_features causes +warning to fire in update_rq_clock. This seems to be caused by onlining +a new fair sched group not using the rq lock wrappers. + + [] rq->clock_update_flags & RQCF_UPDATED + [] WARNING: CPU: 5 PID: 54385 at kernel/sched/core.c:210 update_rq_clock+0xec/0x150 + + [] Call Trace: + [] online_fair_sched_group+0x53/0x100 + [] cpu_cgroup_css_online+0x16/0x20 + [] online_css+0x1c/0x60 + [] cgroup_apply_control_enable+0x231/0x3b0 + [] cgroup_mkdir+0x41b/0x530 + [] kernfs_iop_mkdir+0x61/0xa0 + [] vfs_mkdir+0x108/0x1a0 + [] do_mkdirat+0x77/0xe0 + [] do_syscall_64+0x55/0x1d0 + [] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Using the wrappers in online_fair_sched_group instead of the raw locking +removes this warning. + +[ tglx: Use rq_*lock_irq() ] + +Signed-off-by: Phil Auld +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Thomas Gleixner +Cc: Ingo Molnar +Cc: Vincent Guittot +Cc: Ingo Molnar +Link: https://lkml.kernel.org/r/20190801133749.11033-1-pauld@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index ad78a15bd5677..32d2dac680a70 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -10079,18 +10079,18 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) + void online_fair_sched_group(struct task_group *tg) + { + struct sched_entity *se; ++ struct rq_flags rf; + struct rq *rq; + int i; + + for_each_possible_cpu(i) { + rq = cpu_rq(i); + se = tg->se[i]; +- +- raw_spin_lock_irq(&rq->lock); ++ rq_lock_irq(rq, &rf); + update_rq_clock(rq); + attach_entity_cfs_rq(se); + sync_throttle(tg, i); +- raw_spin_unlock_irq(&rq->lock); ++ rq_unlock_irq(rq, &rf); + } + } + +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 37612950e18..0c7a45fdce5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,129 @@ ax25-enforce-cap_net_raw-for-raw-sockets.patch ieee802154-enforce-cap_net_raw-for-raw-sockets.patch nfc-enforce-cap_net_raw-for-raw-sockets.patch nfp-flower-prevent-memory-leak-in-nfp_flower_spawn_phy_reprs.patch +alsa-hda-flush-interrupts-on-disabling.patch +regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch +asoc-tlv320aic31xx-suppress-error-message-for-eprobe.patch +asoc-sgtl5000-fix-of-unmute-outputs-on-probe.patch +asoc-sgtl5000-fix-charge-pump-source-assignment.patch +firmware-qcom_scm-use-proper-types-for-dma-mappings.patch +dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch +leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch +media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch +media-mtk-cir-lower-de-glitch-counter-for-rc-mm-prot.patch +media-exynos4-is-fix-leaked-of_node-references.patch +media-hdpvr-add-device-num-check-and-handling.patch +media-i2c-ov5640-check-for-devm_gpiod_get_optional-e.patch +time-tick-broadcast-fix-tick_broadcast_offline-lockd.patch +sched-fair-fix-imbalance-due-to-cpu-affinity.patch +sched-core-fix-cpu-controller-for-rt_group_sched.patch +x86-apic-make-apic_pending_intr_clear-more-robust.patch +sched-deadline-fix-bandwidth-accounting-at-all-level.patch +x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch +x86-apic-soft-disable-apic-before-initializing-it.patch +alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch +alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch +edac-mc-fix-grain_bits-calculation.patch +media-iguanair-add-sanity-checks.patch +base-soc-export-soc_device_register-unregister-apis.patch +alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch +ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch +edac-altera-use-the-proper-type-for-the-irq-status-b.patch +asoc-rsnd-don-t-call-clk_get_rate-under-atomic-conte.patch +arm64-prefetch-fix-a-wtype-limits-warning.patch +md-raid1-end-bio-when-the-device-faulty.patch +md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch +md-don-t-set-in_sync-if-array-is-frozen.patch +media-media-platform-fsl-viu.c-fix-build-for-microbl.patch +ras-fix-prototype-warnings.patch +acpi-processor-don-t-print-errors-for-processorids-0.patch +loop-add-loop_set_direct_io-to-compat-ioctl.patch +edac-pnd2-fix-ioremap-size-in-dnv_rd_reg.patch +efi-cper-print-aer-info-of-pcie-fatal-error.patch +firmware-arm_scmi-check-if-platform-has-released-shm.patch +sched-fair-use-rq_lock-unlock-in-online_fair_sched_g.patch +idle-prevent-late-arriving-interrupts-from-disruptin.patch +media-gspca-zero-usb_buf-on-error.patch +perf-config-honour-perf_config-env-var-to-specify-al.patch +perf-test-vfs_getname-disable-.perfconfig-to-get-def.patch +media-mtk-mdp-fix-reference-count-on-old-device-tree.patch +media-fdp1-reduce-fcp-not-found-message-level-to-deb.patch +media-em28xx-modules-workqueue-not-inited-for-2nd-de.patch +media-rc-imon-allow-imon-rc-protocol-for-ffdc-7e-dev.patch +dmaengine-iop-adma-use-correct-printk-format-strings.patch +perf-ftrace-use-cap_sys_admin-instead-of-euid-0.patch +perf-record-support-aarch64-random-socket_id-assignm.patch +media-vsp1-fix-memory-leak-of-dl-on-error-return-pat.patch +media-i2c-ov5645-fix-power-sequence.patch +media-omap3isp-don-t-set-streaming-state-on-random-s.patch +media-imx-mipi-csi-2-don-t-fail-if-initial-state-tim.patch +net-lpc-enet-fix-printk-format-strings.patch +m68k-prevent-some-compiler-warnings-in-coldfire-buil.patch +arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch +arm-dts-imx7-colibri-disable-hs400.patch +media-radio-si470x-kill-urb-on-error.patch +media-hdpvr-add-terminating-0-at-end-of-string.patch +asoc-uniphier-fix-double-reset-assersion-when-transi.patch +tools-headers-fixup-bitsperlong-per-arch-includes.patch +asoc-sun4i-i2s-don-t-use-the-oversample-to-calculate.patch +led-triggers-fix-a-memory-leak-bug.patch +nbd-add-missing-config-put.patch +media-mceusb-fix-eliminate-tx-ir-signal-length-limit.patch +media-dvb-frontends-use-ida-for-pll-number.patch +posix-cpu-timers-sanitize-bogus-warnons.patch +media-dvb-core-fix-a-memory-leak-bug.patch +libperf-fix-alignment-trap-with-xyarray-contents-in-.patch +edac-amd64-recognize-dram-device-type-ecc-capability.patch +edac-amd64-decode-syndrome-before-translating-addres.patch +pm-devfreq-passive-use-non-devm-notifiers.patch +pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch +media-cec-notifier-clear-cec_adap-in-cec_notifier_un.patch +media-saa7146-add-cleanup-in-hexium_attach.patch +media-cpia2_usb-fix-memory-leaks.patch +media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch +perf-trace-beauty-ioctl-fix-off-by-one-error-in-cmd-.patch +media-ov9650-add-a-sanity-check.patch +asoc-es8316-fix-headphone-mixer-volume-table.patch +acpi-cppc-do-not-require-the-_psd-method.patch +sched-cpufreq-align-trace-event-behavior-of-fast-swi.patch +x86-apic-vector-warn-when-vector-space-exhaustion-br.patch +arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch +x86-mm-pti-do-not-invoke-pti-functions-when-pti-is-d.patch +asoc-fsl_ssi-fix-clock-control-issue-in-master-mode.patch +x86-mm-pti-handle-unaligned-address-gracefully-in-pt.patch +nvmet-fix-data-units-read-and-written-counters-in-sm.patch +nvme-multipath-fix-ana-log-nsid-lookup-when-nsid-is-.patch +alsa-firewire-motu-add-support-for-motu-4pre.patch +arm64-lse-make-arm64_lse_atomics-depend-on-jump_labe.patch +iommu-amd-silence-warnings-under-memory-pressure.patch +libata-ahci-drop-pcs-quirk-for-denverton-and-beyond.patch +iommu-iova-avoid-false-sharing-on-fq_timer_on.patch +libtraceevent-change-users-plugin-directory.patch +arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch +acpi-custom_method-fix-memory-leaks.patch +acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch +closures-fix-a-race-on-wakeup-from-closure_sync.patch +hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch +md-raid1-fail-run-raid1-array-when-active-disk-less-.patch +dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch +kprobes-prohibit-probing-on-bug-and-warn-address.patch +s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch +x86-cpu-add-tiger-lake-to-intel-family.patch +platform-x86-intel_pmc_core-do-not-ioremap-ram.patch +asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch +raid5-don-t-set-stripe_handle-to-stripe-which-is-in-.patch +mmc-core-clarify-sdio_irq_pending-flag-for-mmc_cap2_.patch +mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch +mmc-core-add-helper-function-to-indicate-if-sdio-irq.patch +mmc-dw_mmc-re-store-sdio-irqs-mask-at-system-resume.patch +raid5-don-t-increment-read_errors-on-eilseq-return.patch +libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch +e1000e-add-workaround-for-possible-stalled-packet.patch +alsa-hda-drop-unsol-event-handler-for-intel-hdmi-cod.patch +drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch +media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch +alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch +iommu-amd-override-wrong-ivrs-ioapic-on-raven-ridge-.patch +btrfs-extent-tree-make-sure-we-only-allocate-extents.patch +media-omap3isp-set-device-on-omap3isp-subdevs.patch +pm-devfreq-passive-fix-compiler-warning.patch diff --git a/queue-4.19/time-tick-broadcast-fix-tick_broadcast_offline-lockd.patch b/queue-4.19/time-tick-broadcast-fix-tick_broadcast_offline-lockd.patch new file mode 100644 index 00000000000..c421a6c03fe --- /dev/null +++ b/queue-4.19/time-tick-broadcast-fix-tick_broadcast_offline-lockd.patch @@ -0,0 +1,219 @@ +From 5a9af945155b5ecd746754d11476b2d391f7ce5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2019 09:52:38 -0700 +Subject: time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint + +From: Paul E. McKenney + +[ Upstream commit 84ec3a0787086fcd25f284f59b3aa01fd6fc0a5d ] + +time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint + +The TASKS03 and TREE04 rcutorture scenarios produce the following +lockdep complaint: + + WARNING: inconsistent lock state + 5.2.0-rc1+ #513 Not tainted + -------------------------------- + inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. + migration/1/14 [HC0[0]:SC0[0]:HE1:SE1] takes: + (____ptrval____) (tick_broadcast_lock){?...}, at: tick_broadcast_offline+0xf/0x70 + {IN-HARDIRQ-W} state was registered at: + lock_acquire+0xb0/0x1c0 + _raw_spin_lock_irqsave+0x3c/0x50 + tick_broadcast_switch_to_oneshot+0xd/0x40 + tick_switch_to_oneshot+0x4f/0xd0 + hrtimer_run_queues+0xf3/0x130 + run_local_timers+0x1c/0x50 + update_process_times+0x1c/0x50 + tick_periodic+0x26/0xc0 + tick_handle_periodic+0x1a/0x60 + smp_apic_timer_interrupt+0x80/0x2a0 + apic_timer_interrupt+0xf/0x20 + _raw_spin_unlock_irqrestore+0x4e/0x60 + rcu_nocb_gp_kthread+0x15d/0x590 + kthread+0xf3/0x130 + ret_from_fork+0x3a/0x50 + irq event stamp: 171 + hardirqs last enabled at (171): [] trace_hardirqs_on_thunk+0x1a/0x1c + hardirqs last disabled at (170): [] trace_hardirqs_off_thunk+0x1a/0x1c + softirqs last enabled at (0): [] copy_process.part.56+0x650/0x1cb0 + softirqs last disabled at (0): [<0000000000000000>] 0x0 + + [...] + +To reproduce, run the following rcutorture test: + + $ tools/testing/selftests/rcutorture/bin/kvm.sh --duration 5 --kconfig "CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y" --configs "TASKS03 TREE04" + +It turns out that tick_broadcast_offline() was an innocent bystander. +After all, interrupts are supposed to be disabled throughout +take_cpu_down(), and therefore should have been disabled upon entry to +tick_offline_cpu() and thus to tick_broadcast_offline(). This suggests +that one of the CPU-hotplug notifiers was incorrectly enabling interrupts, +and leaving them enabled on return. + +Some debugging code showed that the culprit was sched_cpu_dying(). +It had irqs enabled after return from sched_tick_stop(). Which in turn +had irqs enabled after return from cancel_delayed_work_sync(). Which is a +wrapper around __cancel_work_timer(). Which can sleep in the case where +something else is concurrently trying to cancel the same delayed work, +and as Thomas Gleixner pointed out on IRC, sleeping is a decidedly bad +idea when you are invoked from take_cpu_down(), regardless of the state +you leave interrupts in upon return. + +Code inspection located no reason why the delayed work absolutely +needed to be canceled from sched_tick_stop(): The work is not +bound to the outgoing CPU by design, given that the whole point is +to collect statistics without disturbing the outgoing CPU. + +This commit therefore simply drops the cancel_delayed_work_sync() from +sched_tick_stop(). Instead, a new ->state field is added to the tick_work +structure so that the delayed-work handler function sched_tick_remote() +can avoid reposting itself. A cpu_is_offline() check is also added to +sched_tick_remote() to avoid mucking with the state of an offlined CPU +(though it does appear safe to do so). The sched_tick_start() and +sched_tick_stop() functions also update ->state, and sched_tick_start() +also schedules the delayed work if ->state indicates that it is not +already in flight. + +Signed-off-by: Paul E. McKenney +[ paulmck: Apply Peter Zijlstra and Frederic Weisbecker atomics feedback. ] +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Frederic Weisbecker +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/20190625165238.GJ26519@linux.ibm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 57 ++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 49 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 795c63ca44a99..e06c12d293f70 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3066,8 +3066,36 @@ void scheduler_tick(void) + + struct tick_work { + int cpu; ++ atomic_t state; + struct delayed_work work; + }; ++/* Values for ->state, see diagram below. */ ++#define TICK_SCHED_REMOTE_OFFLINE 0 ++#define TICK_SCHED_REMOTE_OFFLINING 1 ++#define TICK_SCHED_REMOTE_RUNNING 2 ++ ++/* ++ * State diagram for ->state: ++ * ++ * ++ * TICK_SCHED_REMOTE_OFFLINE ++ * | ^ ++ * | | ++ * | | sched_tick_remote() ++ * | | ++ * | | ++ * +--TICK_SCHED_REMOTE_OFFLINING ++ * | ^ ++ * | | ++ * sched_tick_start() | | sched_tick_stop() ++ * | | ++ * V | ++ * TICK_SCHED_REMOTE_RUNNING ++ * ++ * ++ * Other transitions get WARN_ON_ONCE(), except that sched_tick_remote() ++ * and sched_tick_start() are happy to leave the state in RUNNING. ++ */ + + static struct tick_work __percpu *tick_work_cpu; + +@@ -3080,6 +3108,7 @@ static void sched_tick_remote(struct work_struct *work) + struct task_struct *curr; + struct rq_flags rf; + u64 delta; ++ int os; + + /* + * Handle the tick only if it appears the remote CPU is running in full +@@ -3093,7 +3122,7 @@ static void sched_tick_remote(struct work_struct *work) + + rq_lock_irq(rq, &rf); + curr = rq->curr; +- if (is_idle_task(curr)) ++ if (is_idle_task(curr) || cpu_is_offline(cpu)) + goto out_unlock; + + update_rq_clock(rq); +@@ -3113,13 +3142,18 @@ static void sched_tick_remote(struct work_struct *work) + /* + * Run the remote tick once per second (1Hz). This arbitrary + * frequency is large enough to avoid overload but short enough +- * to keep scheduler internal stats reasonably up to date. ++ * to keep scheduler internal stats reasonably up to date. But ++ * first update state to reflect hotplug activity if required. + */ +- queue_delayed_work(system_unbound_wq, dwork, HZ); ++ os = atomic_fetch_add_unless(&twork->state, -1, TICK_SCHED_REMOTE_RUNNING); ++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_OFFLINE); ++ if (os == TICK_SCHED_REMOTE_RUNNING) ++ queue_delayed_work(system_unbound_wq, dwork, HZ); + } + + static void sched_tick_start(int cpu) + { ++ int os; + struct tick_work *twork; + + if (housekeeping_cpu(cpu, HK_FLAG_TICK)) +@@ -3128,15 +3162,20 @@ static void sched_tick_start(int cpu) + WARN_ON_ONCE(!tick_work_cpu); + + twork = per_cpu_ptr(tick_work_cpu, cpu); +- twork->cpu = cpu; +- INIT_DELAYED_WORK(&twork->work, sched_tick_remote); +- queue_delayed_work(system_unbound_wq, &twork->work, HZ); ++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_RUNNING); ++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_RUNNING); ++ if (os == TICK_SCHED_REMOTE_OFFLINE) { ++ twork->cpu = cpu; ++ INIT_DELAYED_WORK(&twork->work, sched_tick_remote); ++ queue_delayed_work(system_unbound_wq, &twork->work, HZ); ++ } + } + + #ifdef CONFIG_HOTPLUG_CPU + static void sched_tick_stop(int cpu) + { + struct tick_work *twork; ++ int os; + + if (housekeeping_cpu(cpu, HK_FLAG_TICK)) + return; +@@ -3144,7 +3183,10 @@ static void sched_tick_stop(int cpu) + WARN_ON_ONCE(!tick_work_cpu); + + twork = per_cpu_ptr(tick_work_cpu, cpu); +- cancel_delayed_work_sync(&twork->work); ++ /* There cannot be competing actions, but don't rely on stop-machine. */ ++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_OFFLINING); ++ WARN_ON_ONCE(os != TICK_SCHED_REMOTE_RUNNING); ++ /* Don't cancel, as this would mess up the state machine. */ + } + #endif /* CONFIG_HOTPLUG_CPU */ + +@@ -3152,7 +3194,6 @@ int __init sched_tick_offload_init(void) + { + tick_work_cpu = alloc_percpu(struct tick_work); + BUG_ON(!tick_work_cpu); +- + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/tools-headers-fixup-bitsperlong-per-arch-includes.patch b/queue-4.19/tools-headers-fixup-bitsperlong-per-arch-includes.patch new file mode 100644 index 00000000000..a283a3c29b5 --- /dev/null +++ b/queue-4.19/tools-headers-fixup-bitsperlong-per-arch-includes.patch @@ -0,0 +1,112 @@ +From 1cf159a97e5ca587029d29f67efae422793b36e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 11:45:17 -0300 +Subject: tools headers: Fixup bitsperlong per arch includes + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 42fc2e9ef9603a7948aaa4ffd8dfb94b30294ad8 ] + +We were getting the file by luck, from one of the paths in -I, fix it to +get it from the proper place: + + $ cd tools/include/uapi/asm/ + [acme@quaco asm]$ grep include bitsperlong.h + #include "../../arch/x86/include/uapi/asm/bitsperlong.h" + #include "../../arch/arm64/include/uapi/asm/bitsperlong.h" + #include "../../arch/powerpc/include/uapi/asm/bitsperlong.h" + #include "../../arch/s390/include/uapi/asm/bitsperlong.h" + #include "../../arch/sparc/include/uapi/asm/bitsperlong.h" + #include "../../arch/mips/include/uapi/asm/bitsperlong.h" + #include "../../arch/ia64/include/uapi/asm/bitsperlong.h" + #include "../../arch/riscv/include/uapi/asm/bitsperlong.h" + #include "../../arch/alpha/include/uapi/asm/bitsperlong.h" + #include + $ ls -la ../../arch/x86/include/uapi/asm/bitsperlong.h + ls: cannot access '../../arch/x86/include/uapi/asm/bitsperlong.h': No such file or directory + $ ls -la ../../../arch/*/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 237 ../../../arch/alpha/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 841 ../../../arch/arm64/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 966 ../../../arch/hexagon/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 234 ../../../arch/ia64/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 100 ../../../arch/microblaze/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 244 ../../../arch/mips/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 352 ../../../arch/parisc/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 312 ../../../arch/powerpc/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 353 ../../../arch/riscv/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 292 ../../../arch/s390/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 323 ../../../arch/sparc/include/uapi/asm/bitsperlong.h + -rw-rw-r--. 1 320 ../../../arch/x86/include/uapi/asm/bitsperlong.h + $ + +Found while fixing some other problem, before it was escaping the +tools/ chroot and using stuff in the kernel sources: + + CC /tmp/build/perf/util/find_bit.o +In file included from /git/linux/tools/include/../../arch/x86/include/uapi/asm/bitsperlong.h:11, + from /git/linux/tools/include/uapi/asm/bitsperlong.h:3, + from /git/linux/tools/include/linux/bits.h:6, + from /git/linux/tools/include/linux/bitops.h:13, + from ../lib/find_bit.c:17: + + # cd /git/linux/tools/include/../../arch/x86/include/uapi/asm/ + # pwd + /git/linux/arch/x86/include/uapi/asm + # + +Now it is getting the one we want it to, i.e. the one inside tools/: + + CC /tmp/build/perf/util/find_bit.o + In file included from /git/linux/tools/arch/x86/include/uapi/asm/bitsperlong.h:11, + from /git/linux/tools/include/linux/bits.h:6, + from /git/linux/tools/include/linux/bitops.h:13, + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lkml.kernel.org/n/tip-8f8cfqywmf6jk8a3ucr0ixhu@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/uapi/asm/bitsperlong.h | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h +index 57aaeaf8e1920..edba4d93e9e6a 100644 +--- a/tools/include/uapi/asm/bitsperlong.h ++++ b/tools/include/uapi/asm/bitsperlong.h +@@ -1,22 +1,22 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + #if defined(__i386__) || defined(__x86_64__) +-#include "../../arch/x86/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/x86/include/uapi/asm/bitsperlong.h" + #elif defined(__aarch64__) +-#include "../../arch/arm64/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/arm64/include/uapi/asm/bitsperlong.h" + #elif defined(__powerpc__) +-#include "../../arch/powerpc/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/powerpc/include/uapi/asm/bitsperlong.h" + #elif defined(__s390__) +-#include "../../arch/s390/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/s390/include/uapi/asm/bitsperlong.h" + #elif defined(__sparc__) +-#include "../../arch/sparc/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/sparc/include/uapi/asm/bitsperlong.h" + #elif defined(__mips__) +-#include "../../arch/mips/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/mips/include/uapi/asm/bitsperlong.h" + #elif defined(__ia64__) +-#include "../../arch/ia64/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/ia64/include/uapi/asm/bitsperlong.h" + #elif defined(__riscv) +-#include "../../arch/riscv/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/riscv/include/uapi/asm/bitsperlong.h" + #elif defined(__alpha__) +-#include "../../arch/alpha/include/uapi/asm/bitsperlong.h" ++#include "../../../arch/alpha/include/uapi/asm/bitsperlong.h" + #else + #include + #endif +-- +2.20.1 + diff --git a/queue-4.19/x86-apic-make-apic_pending_intr_clear-more-robust.patch b/queue-4.19/x86-apic-make-apic_pending_intr_clear-more-robust.patch new file mode 100644 index 00000000000..11d3390f4f9 --- /dev/null +++ b/queue-4.19/x86-apic-make-apic_pending_intr_clear-more-robust.patch @@ -0,0 +1,203 @@ +From 0a53c1d27256ffbd9620899863261ed565d8ad44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 20:47:09 +0200 +Subject: x86/apic: Make apic_pending_intr_clear() more robust + +From: Thomas Gleixner + +[ Upstream commit cc8bf191378c1da8ad2b99cf470ee70193ace84e ] + +In course of developing shorthand based IPI support issues with the +function which tries to clear eventually pending ISR bits in the local APIC +were observed. + + 1) O-day testing triggered the WARN_ON() in apic_pending_intr_clear(). + + This warning is emitted when the function fails to clear pending ISR + bits or observes pending IRR bits which are not delivered to the CPU + after the stale ISR bit(s) are ACK'ed. + + Unfortunately the function only emits a WARN_ON() and fails to dump + the IRR/ISR content. That's useless for debugging. + + Feng added spot on debug printk's which revealed that the stale IRR + bit belonged to the APIC timer interrupt vector, but adding ad hoc + debug code does not help with sporadic failures in the field. + + Rework the loop so the full IRR/ISR contents are saved and on failure + dumped. + + 2) The loop termination logic is interesting at best. + + If the machine has no TSC or cpu_khz is not known yet it tries 1 + million times to ack stale IRR/ISR bits. What? + + With TSC it uses the TSC to calculate the loop termination. It takes a + timestamp at entry and terminates the loop when: + + (rdtsc() - start_timestamp) >= (cpu_hkz << 10) + + That's roughly one second. + + Both methods are problematic. The APIC has 256 vectors, which means + that in theory max. 256 IRR/ISR bits can be set. In practice this is + impossible and the chance that more than a few bits are set is close + to zero. + + With the pure loop based approach the 1 million retries are complete + overkill. + + With TSC this can terminate too early in a guest which is running on a + heavily loaded host even with only a couple of IRR/ISR bits set. The + reason is that after acknowledging the highest priority ISR bit, + pending IRRs must get serviced first before the next round of + acknowledge can take place as the APIC (real and virtualized) does not + honour EOI without a preceeding interrupt on the CPU. And every APIC + read/write takes a VMEXIT if the APIC is virtualized. While trying to + reproduce the issue 0-day reported it was observed that the guest was + scheduled out long enough under heavy load that it terminated after 8 + iterations. + + Make the loop terminate after 512 iterations. That's plenty enough + in any case and does not take endless time to complete. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20190722105219.158847694@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 107 +++++++++++++++++++++--------------- + 1 file changed, 63 insertions(+), 44 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index b316bd61a6ace..9bfbe1fa0339c 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1450,54 +1450,72 @@ static void lapic_setup_esr(void) + oldvalue, value); + } + +-static void apic_pending_intr_clear(void) ++#define APIC_IR_REGS APIC_ISR_NR ++#define APIC_IR_BITS (APIC_IR_REGS * 32) ++#define APIC_IR_MAPSIZE (APIC_IR_BITS / BITS_PER_LONG) ++ ++union apic_ir { ++ unsigned long map[APIC_IR_MAPSIZE]; ++ u32 regs[APIC_IR_REGS]; ++}; ++ ++static bool apic_check_and_ack(union apic_ir *irr, union apic_ir *isr) + { +- long long max_loops = cpu_khz ? cpu_khz : 1000000; +- unsigned long long tsc = 0, ntsc; +- unsigned int queued; +- unsigned long value; +- int i, j, acked = 0; ++ int i, bit; ++ ++ /* Read the IRRs */ ++ for (i = 0; i < APIC_IR_REGS; i++) ++ irr->regs[i] = apic_read(APIC_IRR + i * 0x10); ++ ++ /* Read the ISRs */ ++ for (i = 0; i < APIC_IR_REGS; i++) ++ isr->regs[i] = apic_read(APIC_ISR + i * 0x10); + +- if (boot_cpu_has(X86_FEATURE_TSC)) +- tsc = rdtsc(); + /* +- * After a crash, we no longer service the interrupts and a pending +- * interrupt from previous kernel might still have ISR bit set. +- * +- * Most probably by now CPU has serviced that pending interrupt and +- * it might not have done the ack_APIC_irq() because it thought, +- * interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it +- * does not clear the ISR bit and cpu thinks it has already serivced +- * the interrupt. Hence a vector might get locked. It was noticed +- * for timer irq (vector 0x31). Issue an extra EOI to clear ISR. ++ * If the ISR map is not empty. ACK the APIC and run another round ++ * to verify whether a pending IRR has been unblocked and turned ++ * into a ISR. + */ +- do { +- queued = 0; +- for (i = APIC_ISR_NR - 1; i >= 0; i--) +- queued |= apic_read(APIC_IRR + i*0x10); +- +- for (i = APIC_ISR_NR - 1; i >= 0; i--) { +- value = apic_read(APIC_ISR + i*0x10); +- for_each_set_bit(j, &value, 32) { +- ack_APIC_irq(); +- acked++; +- } +- } +- if (acked > 256) { +- pr_err("LAPIC pending interrupts after %d EOI\n", acked); +- break; +- } +- if (queued) { +- if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) { +- ntsc = rdtsc(); +- max_loops = (long long)cpu_khz << 10; +- max_loops -= ntsc - tsc; +- } else { +- max_loops--; +- } +- } +- } while (queued && max_loops > 0); +- WARN_ON(max_loops <= 0); ++ if (!bitmap_empty(isr->map, APIC_IR_BITS)) { ++ /* ++ * There can be multiple ISR bits set when a high priority ++ * interrupt preempted a lower priority one. Issue an ACK ++ * per set bit. ++ */ ++ for_each_set_bit(bit, isr->map, APIC_IR_BITS) ++ ack_APIC_irq(); ++ return true; ++ } ++ ++ return !bitmap_empty(irr->map, APIC_IR_BITS); ++} ++ ++/* ++ * After a crash, we no longer service the interrupts and a pending ++ * interrupt from previous kernel might still have ISR bit set. ++ * ++ * Most probably by now the CPU has serviced that pending interrupt and it ++ * might not have done the ack_APIC_irq() because it thought, interrupt ++ * came from i8259 as ExtInt. LAPIC did not get EOI so it does not clear ++ * the ISR bit and cpu thinks it has already serivced the interrupt. Hence ++ * a vector might get locked. It was noticed for timer irq (vector ++ * 0x31). Issue an extra EOI to clear ISR. ++ * ++ * If there are pending IRR bits they turn into ISR bits after a higher ++ * priority ISR bit has been acked. ++ */ ++static void apic_pending_intr_clear(void) ++{ ++ union apic_ir irr, isr; ++ unsigned int i; ++ ++ /* 512 loops are way oversized and give the APIC a chance to obey. */ ++ for (i = 0; i < 512; i++) { ++ if (!apic_check_and_ack(&irr, &isr)) ++ return; ++ } ++ /* Dump the IRR/ISR content if that failed */ ++ pr_warn("APIC: Stale IRR: %256pb ISR: %256pb\n", irr.map, isr.map); + } + + /** +@@ -1565,6 +1583,7 @@ static void setup_local_APIC(void) + value &= ~APIC_TPRI_MASK; + apic_write(APIC_TASKPRI, value); + ++ /* Clear eventually stale ISR/IRR bits */ + apic_pending_intr_clear(); + + /* +-- +2.20.1 + diff --git a/queue-4.19/x86-apic-soft-disable-apic-before-initializing-it.patch b/queue-4.19/x86-apic-soft-disable-apic-before-initializing-it.patch new file mode 100644 index 00000000000..2b83c7ef253 --- /dev/null +++ b/queue-4.19/x86-apic-soft-disable-apic-before-initializing-it.patch @@ -0,0 +1,47 @@ +From ecaad0b4cdf59a35c7f34c5f39f44db3195a8c72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 20:47:08 +0200 +Subject: x86/apic: Soft disable APIC before initializing it + +From: Thomas Gleixner + +[ Upstream commit 2640da4cccf5cc613bf26f0998b9e340f4b5f69c ] + +If the APIC was already enabled on entry of setup_local_APIC() then +disabling it soft via the SPIV register makes a lot of sense. + +That masks all LVT entries and brings it into a well defined state. + +Otherwise previously enabled LVTs which are not touched in the setup +function stay unmasked and might surprise the just booting kernel. + +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20190722105219.068290579@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 9bfbe1fa0339c..dfdd1caf0d55d 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1538,6 +1538,14 @@ static void setup_local_APIC(void) + return; + } + ++ /* ++ * If this comes from kexec/kcrash the APIC might be enabled in ++ * SPIV. Soft disable it before doing further initialization. ++ */ ++ value = apic_read(APIC_SPIV); ++ value &= ~APIC_SPIV_APIC_ENABLED; ++ apic_write(APIC_SPIV, value); ++ + #ifdef CONFIG_X86_32 + /* Pound the ESR really hard over the head with a big hammer - mbligh */ + if (lapic_is_integrated() && apic->disable_esr) { +-- +2.20.1 + diff --git a/queue-4.19/x86-apic-vector-warn-when-vector-space-exhaustion-br.patch b/queue-4.19/x86-apic-vector-warn-when-vector-space-exhaustion-br.patch new file mode 100644 index 00000000000..ea6e3aa5b05 --- /dev/null +++ b/queue-4.19/x86-apic-vector-warn-when-vector-space-exhaustion-br.patch @@ -0,0 +1,64 @@ +From db1d95d570b0d9f648f8f65ee7c1d0f328f8c390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 10:34:21 -0400 +Subject: x86/apic/vector: Warn when vector space exhaustion breaks affinity + +From: Neil Horman + +[ Upstream commit 743dac494d61d991967ebcfab92e4f80dc7583b3 ] + +On x86, CPUs are limited in the number of interrupts they can have affined +to them as they only support 256 interrupt vectors per CPU. 32 vectors are +reserved for the CPU and the kernel reserves another 22 for internal +purposes. That leaves 202 vectors for assignement to devices. + +When an interrupt is set up or the affinity is changed by the kernel or the +administrator, the vector assignment code attempts to honor the requested +affinity mask. If the vector space on the CPUs in that affinity mask is +exhausted the code falls back to a wider set of CPUs and assigns a vector +on a CPU outside of the requested affinity mask silently. + +While the effective affinity is reflected in the corresponding +/proc/irq/$N/effective_affinity* files the silent breakage of the requested +affinity can lead to unexpected behaviour for administrators. + +Add a pr_warn() when this happens so that adminstrators get at least +informed about it in the syslog. + +[ tglx: Massaged changelog and made the pr_warn() more informative ] + +Reported-by: djuran@redhat.com +Signed-off-by: Neil Horman +Signed-off-by: Thomas Gleixner +Tested-by: djuran@redhat.com +Link: https://lkml.kernel.org/r/20190822143421.9535-1-nhorman@tuxdriver.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/vector.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 10e1d17aa0608..c352ca2e1456f 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -400,6 +400,17 @@ static int activate_reserved(struct irq_data *irqd) + if (!irqd_can_reserve(irqd)) + apicd->can_reserve = false; + } ++ ++ /* ++ * Check to ensure that the effective affinity mask is a subset ++ * the user supplied affinity mask, and warn the user if it is not ++ */ ++ if (!cpumask_subset(irq_data_get_effective_affinity_mask(irqd), ++ irq_data_get_affinity_mask(irqd))) { ++ pr_warn("irq %u: Affinity broken due to vector space exhaustion.\n", ++ irqd->irq); ++ } ++ + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.19/x86-cpu-add-tiger-lake-to-intel-family.patch b/queue-4.19/x86-cpu-add-tiger-lake-to-intel-family.patch new file mode 100644 index 00000000000..d7e67445219 --- /dev/null +++ b/queue-4.19/x86-cpu-add-tiger-lake-to-intel-family.patch @@ -0,0 +1,44 @@ +From 2c7e0c6cb9ba63eedbdc82c1485105d5309416c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 12:30:17 -0700 +Subject: x86/cpu: Add Tiger Lake to Intel family + +From: Gayatri Kammela + +[ Upstream commit 6e1c32c5dbb4b90eea8f964c2869d0bde050dbe0 ] + +Add the model numbers/CPUIDs of Tiger Lake mobile and desktop to the +Intel family. + +Suggested-by: Tony Luck +Signed-off-by: Gayatri Kammela +Signed-off-by: Tony Luck +Reviewed-by: Tony Luck +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Rahul Tanwar +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/20190905193020.14707-2-tony.luck@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/intel-family.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index aebedbaf52607..5d0b72f281402 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -58,6 +58,9 @@ + #define INTEL_FAM6_ICELAKE_MOBILE 0x7E + #define INTEL_FAM6_ICELAKE_NNPI 0x9D + ++#define INTEL_FAM6_TIGERLAKE_L 0x8C ++#define INTEL_FAM6_TIGERLAKE 0x8D ++ + /* "Small Core" Processors (Atom) */ + + #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ +-- +2.20.1 + diff --git a/queue-4.19/x86-mm-pti-do-not-invoke-pti-functions-when-pti-is-d.patch b/queue-4.19/x86-mm-pti-do-not-invoke-pti-functions-when-pti-is-d.patch new file mode 100644 index 00000000000..a1b5b5d27d1 --- /dev/null +++ b/queue-4.19/x86-mm-pti-do-not-invoke-pti-functions-when-pti-is-d.patch @@ -0,0 +1,54 @@ +From c27c179108ec4415c3e0efc4fe86bb53a79322d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 16:24:47 +0200 +Subject: x86/mm/pti: Do not invoke PTI functions when PTI is disabled + +From: Thomas Gleixner + +[ Upstream commit 990784b57731192b7d90c8d4049e6318d81e887d ] + +When PTI is disabled at boot time either because the CPU is not affected or +PTI has been disabled on the command line, the boot code still calls into +pti_finalize() which then unconditionally invokes: + + pti_clone_entry_text() + pti_clone_kernel_text() + +pti_clone_kernel_text() was called unconditionally before the 32bit support +was added and 32bit added the call to pti_clone_entry_text(). + +The call has no side effects as cloning the page tables into the available +second one, which was allocated for PTI does not create damage. But it does +not make sense either and in case that this functionality would be extended +later this might actually lead to hard to diagnose issues. + +Neither function should be called when PTI is runtime disabled. Make the +invocation conditional. + +Signed-off-by: Thomas Gleixner +Reviewed-by: Dave Hansen +Acked-by: Ingo Molnar +Acked-by: Song Liu +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20190828143124.063353972@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/mm/pti.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c +index 4df3e5c89d57c..c1ba376484a5b 100644 +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -643,6 +643,8 @@ void __init pti_init(void) + */ + void pti_finalize(void) + { ++ if (!boot_cpu_has(X86_FEATURE_PTI)) ++ return; + /* + * We need to clone everything (again) that maps parts of the + * kernel image. +-- +2.20.1 + diff --git a/queue-4.19/x86-mm-pti-handle-unaligned-address-gracefully-in-pt.patch b/queue-4.19/x86-mm-pti-handle-unaligned-address-gracefully-in-pt.patch new file mode 100644 index 00000000000..d7353b1c6b7 --- /dev/null +++ b/queue-4.19/x86-mm-pti-handle-unaligned-address-gracefully-in-pt.patch @@ -0,0 +1,60 @@ +From c70682359ae4d7199fad8e0c1300852422f78505 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 23:54:55 +0200 +Subject: x86/mm/pti: Handle unaligned address gracefully in + pti_clone_pagetable() + +From: Song Liu + +[ Upstream commit 825d0b73cd7526b0bb186798583fae810091cbac ] + +pti_clone_pmds() assumes that the supplied address is either: + + - properly PUD/PMD aligned +or + - the address is actually mapped which means that independently + of the mapping level (PUD/PMD/PTE) the next higher mapping + exists. + +If that's not the case the unaligned address can be incremented by PUD or +PMD size incorrectly. All callers supply mapped and/or aligned addresses, +but for the sake of robustness it's better to handle that case properly and +to emit a warning. + +[ tglx: Rewrote changelog and added WARN_ON_ONCE() ] + +Signed-off-by: Song Liu +Signed-off-by: Thomas Gleixner +Reviewed-by: Ingo Molnar +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282352470.1938@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/mm/pti.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c +index c1ba376484a5b..622d5968c9795 100644 +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -338,13 +338,15 @@ pti_clone_pgtable(unsigned long start, unsigned long end, + + pud = pud_offset(p4d, addr); + if (pud_none(*pud)) { +- addr += PUD_SIZE; ++ WARN_ON_ONCE(addr & ~PUD_MASK); ++ addr = round_up(addr + 1, PUD_SIZE); + continue; + } + + pmd = pmd_offset(pud, addr); + if (pmd_none(*pmd)) { +- addr += PMD_SIZE; ++ WARN_ON_ONCE(addr & ~PMD_MASK); ++ addr = round_up(addr + 1, PMD_SIZE); + continue; + } + +-- +2.20.1 + diff --git a/queue-4.19/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch b/queue-4.19/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch new file mode 100644 index 00000000000..17c07669d26 --- /dev/null +++ b/queue-4.19/x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch @@ -0,0 +1,129 @@ +From 569eab2ed7b5cf9fbc1da2ec0ecf2076d3fc7cea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 14:28:13 +0200 +Subject: x86/reboot: Always use NMI fallback when shutdown via reboot vector + IPI fails + +From: Grzegorz Halat + +[ Upstream commit 747d5a1bf293dcb33af755a6d285d41b8c1ea010 ] + +A reboot request sends an IPI via the reboot vector and waits for all other +CPUs to stop. If one or more CPUs are in critical regions with interrupts +disabled then the IPI is not handled on those CPUs and the shutdown hangs +if native_stop_other_cpus() is called with the wait argument set. + +Such a situation can happen when one CPU was stopped within a lock held +section and another CPU is trying to acquire that lock with interrupts +disabled. There are other scenarios which can cause such a lockup as well. + +In theory the shutdown should be attempted by an NMI IPI after the timeout +period elapsed. Though the wait loop after sending the reboot vector IPI +prevents this. It checks the wait request argument and the timeout. If wait +is set, which is true for sys_reboot() then it won't fall through to the +NMI shutdown method after the timeout period has finished. + +This was an oversight when the NMI shutdown mechanism was added to handle +the 'reboot IPI is not working' situation. The mechanism was added to deal +with stuck panic shutdowns, which do not have the wait request set, so the +'wait request' case was probably not considered. + +Remove the wait check from the post reboot vector IPI wait loop and enforce +that the wait loop in the NMI fallback path is invoked even if NMI IPIs are +disabled or the registration of the NMI handler fails. That second wait +loop will then hang if not all CPUs shutdown and the wait argument is set. + +[ tglx: Avoid the hard to parse line break in the NMI fallback path, + add comments and massage the changelog ] + +Fixes: 7d007d21e539 ("x86/reboot: Use NMI to assist in shutting down if IRQ fails") +Signed-off-by: Grzegorz Halat +Signed-off-by: Thomas Gleixner +Cc: Don Zickus +Link: https://lkml.kernel.org/r/20190628122813.15500-1-ghalat@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/smp.c | 46 +++++++++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c +index 04adc8d60aed8..b2b87b91f3361 100644 +--- a/arch/x86/kernel/smp.c ++++ b/arch/x86/kernel/smp.c +@@ -181,6 +181,12 @@ asmlinkage __visible void smp_reboot_interrupt(void) + irq_exit(); + } + ++static int register_stop_handler(void) ++{ ++ return register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, ++ NMI_FLAG_FIRST, "smp_stop"); ++} ++ + static void native_stop_other_cpus(int wait) + { + unsigned long flags; +@@ -214,39 +220,41 @@ static void native_stop_other_cpus(int wait) + apic->send_IPI_allbutself(REBOOT_VECTOR); + + /* +- * Don't wait longer than a second if the caller +- * didn't ask us to wait. ++ * Don't wait longer than a second for IPI completion. The ++ * wait request is not checked here because that would ++ * prevent an NMI shutdown attempt in case that not all ++ * CPUs reach shutdown state. + */ + timeout = USEC_PER_SEC; +- while (num_online_cpus() > 1 && (wait || timeout--)) ++ while (num_online_cpus() > 1 && timeout--) + udelay(1); + } +- +- /* if the REBOOT_VECTOR didn't work, try with the NMI */ +- if ((num_online_cpus() > 1) && (!smp_no_nmi_ipi)) { +- if (register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, +- NMI_FLAG_FIRST, "smp_stop")) +- /* Note: we ignore failures here */ +- /* Hope the REBOOT_IRQ is good enough */ +- goto finish; +- +- /* sync above data before sending IRQ */ +- wmb(); + +- pr_emerg("Shutting down cpus with NMI\n"); ++ /* if the REBOOT_VECTOR didn't work, try with the NMI */ ++ if (num_online_cpus() > 1) { ++ /* ++ * If NMI IPI is enabled, try to register the stop handler ++ * and send the IPI. In any case try to wait for the other ++ * CPUs to stop. ++ */ ++ if (!smp_no_nmi_ipi && !register_stop_handler()) { ++ /* Sync above data before sending IRQ */ ++ wmb(); + +- apic->send_IPI_allbutself(NMI_VECTOR); ++ pr_emerg("Shutting down cpus with NMI\n"); + ++ apic->send_IPI_allbutself(NMI_VECTOR); ++ } + /* +- * Don't wait longer than a 10 ms if the caller +- * didn't ask us to wait. ++ * Don't wait longer than 10 ms if the caller didn't ++ * reqeust it. If wait is true, the machine hangs here if ++ * one or more CPUs do not reach shutdown state. + */ + timeout = USEC_PER_MSEC * 10; + while (num_online_cpus() > 1 && (wait || timeout--)) + udelay(1); + } + +-finish: + local_irq_save(flags); + disable_local_APIC(); + mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); +-- +2.20.1 +