From: Greg Kroah-Hartman Date: Mon, 13 Jan 2020 20:19:22 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.210~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a1cf1b414dc5483d05abead198ec41ce877d6ba9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: drm-amdgpu-add-driver_syncobj_timeline-to-amdgpu.patch drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch drm-fb-helper-round-up-bits_per_pixel-if-possible.patch drm-i915-add-wa_1407352427-icl-ehl.patch drm-i915-add-wa_1408615072-and-wa_1407596294-to-icl-ehl.patch drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch drm-sun4i-tcon-set-rgb-dclk-min.-divider-based-on-hardware-model.patch hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch hid-hid-input-clear-unmapped-usages.patch hid-hidraw-fix-returning-epollout-from-hidraw_poll.patch hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch input-add-safety-guards-to-input_set_keycode.patch input-input_event-fix-struct-padding-on-sparc64.patch kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch revert-drm-amdgpu-set-no-retry-as-default.patch tracing-change-offset-type-to-s32-in-preempt-irq-tracepoints.patch tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch --- diff --git a/queue-5.4/drm-amdgpu-add-driver_syncobj_timeline-to-amdgpu.patch b/queue-5.4/drm-amdgpu-add-driver_syncobj_timeline-to-amdgpu.patch new file mode 100644 index 00000000000..436d0b4ba96 --- /dev/null +++ b/queue-5.4/drm-amdgpu-add-driver_syncobj_timeline-to-amdgpu.patch @@ -0,0 +1,38 @@ +From db4ff423cd1659580e541a2d4363342f15c14230 Mon Sep 17 00:00:00 2001 +From: Chunming Zhou +Date: Tue, 28 May 2019 10:46:04 +0800 +Subject: drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chunming Zhou + +commit db4ff423cd1659580e541a2d4363342f15c14230 upstream. + +Can expose it now that the khronos has exposed the +vlk extension. + +Signed-off-by: Chunming Zhou +Reviewed-by: Flora Cui +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1422,7 +1422,8 @@ static struct drm_driver kms_driver = { + .driver_features = + DRIVER_USE_AGP | DRIVER_ATOMIC | + DRIVER_GEM | +- DRIVER_RENDER | DRIVER_MODESET | DRIVER_SYNCOBJ, ++ DRIVER_RENDER | DRIVER_MODESET | DRIVER_SYNCOBJ | ++ DRIVER_SYNCOBJ_TIMELINE, + .load = amdgpu_driver_load_kms, + .open = amdgpu_driver_open_kms, + .postclose = amdgpu_driver_postclose_kms, diff --git a/queue-5.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch b/queue-5.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch new file mode 100644 index 00000000000..61285772750 --- /dev/null +++ b/queue-5.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch @@ -0,0 +1,52 @@ +From c4e4fccc5d52d881afaac11d3353265ef4eccb8b Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Fri, 3 Jan 2020 13:50:01 +0800 +Subject: drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ + +From: Wayne Lin + +commit c4e4fccc5d52d881afaac11d3353265ef4eccb8b upstream. + +[Why] +According to DP spec, it should shift left 4 digits for NO_STOP_BIT +in REMOTE_I2C_READ message. Not 5 digits. + +In current code, NO_STOP_BIT is always set to zero which means I2C +master is always generating a I2C stop at the end of each I2C write +transaction while handling REMOTE_I2C_READ sideband message. This issue +might have the generated I2C signal not meeting the requirement. Take +random read in I2C for instance, I2C master should generate a repeat +start to start to read data after writing the read address. This issue +will cause the I2C master to generate a stop-start rather than a +re-start which is not expected in I2C random read. + +[How] +Correct the shifting value of NO_STOP_BIT for DP_REMOTE_I2C_READ case in +drm_dp_encode_sideband_req(). + +Changes since v1:(https://patchwork.kernel.org/patch/11312667/) +* Add more descriptions in commit and cc to stable + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Cc: stable@vger.kernel.org +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20200103055001.10287-1-Wayne.Lin@amd.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -339,7 +339,7 @@ static void drm_dp_encode_sideband_req(s + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } diff --git a/queue-5.4/drm-fb-helper-round-up-bits_per_pixel-if-possible.patch b/queue-5.4/drm-fb-helper-round-up-bits_per_pixel-if-possible.patch new file mode 100644 index 00000000000..a81e2727de4 --- /dev/null +++ b/queue-5.4/drm-fb-helper-round-up-bits_per_pixel-if-possible.patch @@ -0,0 +1,58 @@ +From f30e27779d3031a092c2a177b7fb76adccc45241 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 30 Dec 2019 14:27:34 +0100 +Subject: drm/fb-helper: Round up bits_per_pixel if possible + +From: Geert Uytterhoeven + +commit f30e27779d3031a092c2a177b7fb76adccc45241 upstream. + +When userspace requests a video mode parameter value that is not +supported, frame buffer device drivers should round it up to a supported +value, if possible, instead of just rejecting it. This allows +applications to quickly scan for supported video modes. + +Currently this rule is not followed for the number of bits per pixel, +causing e.g. "fbset -depth N" to fail, if N is smaller than the current +number of bits per pixel. + +Fix this by returning an error only if bits per pixel is too large, and +setting it to the current value otherwise. + +See also Documentation/fb/framebuffer.rst, Section 2 (Programmer's View +of /dev/fb*"). + +Fixes: 865afb11949e5bf4 ("drm/fb-helper: reject any changes to the fbdev") +Cc: stable@vger.kernel.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20191230132734.4538-1-geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fb_helper.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1320,7 +1320,7 @@ int drm_fb_helper_check_var(struct fb_va + * Changes struct fb_var_screeninfo are currently not pushed back + * to KMS, hence fail if different settings are requested. + */ +- if (var->bits_per_pixel != fb->format->cpp[0] * 8 || ++ if (var->bits_per_pixel > fb->format->cpp[0] * 8 || + var->xres > fb->width || var->yres > fb->height || + var->xres_virtual > fb->width || var->yres_virtual > fb->height) { + DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " +@@ -1346,6 +1346,11 @@ int drm_fb_helper_check_var(struct fb_va + } + + /* ++ * Likewise, bits_per_pixel should be rounded up to a supported value. ++ */ ++ var->bits_per_pixel = fb->format->cpp[0] * 8; ++ ++ /* + * drm fbdev emulation doesn't support changing the pixel format at all, + * so reject all pixel format changing requests. + */ diff --git a/queue-5.4/drm-i915-add-wa_1407352427-icl-ehl.patch b/queue-5.4/drm-i915-add-wa_1407352427-icl-ehl.patch new file mode 100644 index 00000000000..273cb8fbe2c --- /dev/null +++ b/queue-5.4/drm-i915-add-wa_1407352427-icl-ehl.patch @@ -0,0 +1,62 @@ +From 25b79ad51bf04a8aa67b5bccd631fc05f963b8e0 Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Tue, 31 Dec 2019 11:07:13 -0800 +Subject: drm/i915: Add Wa_1407352427:icl,ehl + +From: Matt Roper + +commit 25b79ad51bf04a8aa67b5bccd631fc05f963b8e0 upstream. + +The workaround database now indicates we need to disable psdunit clock +gating as well. + +v3: + - Rebase on top of other workarounds that have landed. + - Restrict cc:stable tag to 5.2+ since that's when ICL was first + officially supported. + +Bspec: 32354 +Bspec: 33450 +Bspec: 33451 +Suggested-by: Lionel Landwerlin +Cc: stable@vger.kernel.org # v5.2+ +Cc: Lionel Landwerlin +Cc: Lucas De Marchi +Cc: Matt Atwood +Signed-off-by: Matt Roper +Acked-by: Lionel Landwerlin +Link: https://patchwork.freedesktop.org/patch/msgid/20191231190713.1549533-1-matthew.d.roper@intel.com +(cherry picked from commit 1cd21a7c5679015352e8a6f46813aced51d71bb8) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 4 ++++ + drivers/gpu/drm/i915/intel_pm.c | 3 +++ + 2 files changed, 7 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -4053,6 +4053,10 @@ enum { + #define HSUNIT_CLKGATE_DIS REG_BIT(8) + #define VSUNIT_CLKGATE_DIS REG_BIT(3) + ++#define UNSLICE_UNIT_LEVEL_CLKGATE2 _MMIO(0x94e4) ++#define VSUNIT_CLKGATE_DIS_TGL REG_BIT(19) ++#define PSDUNIT_CLKGATE_DIS REG_BIT(5) ++ + #define INF_UNIT_LEVEL_CLKGATE _MMIO(0x9560) + #define CGPSF_CLKGATE_DIS (1 << 3) + +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -9202,6 +9202,9 @@ static void icl_init_clock_gating(struct + intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE, + 0, VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); + ++ /* Wa_1407352427:icl,ehl */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE2, ++ 0, PSDUNIT_CLKGATE_DIS); + } + + static void cnp_init_clock_gating(struct drm_i915_private *dev_priv) diff --git a/queue-5.4/drm-i915-add-wa_1408615072-and-wa_1407596294-to-icl-ehl.patch b/queue-5.4/drm-i915-add-wa_1408615072-and-wa_1407596294-to-icl-ehl.patch new file mode 100644 index 00000000000..9265396f277 --- /dev/null +++ b/queue-5.4/drm-i915-add-wa_1408615072-and-wa_1407596294-to-icl-ehl.patch @@ -0,0 +1,60 @@ +From a7f3ad37f80d0d5eec9dad156964c0dac800a80e Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Mon, 23 Dec 2019 17:20:25 -0800 +Subject: drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl + +From: Matt Roper + +commit a7f3ad37f80d0d5eec9dad156964c0dac800a80e upstream. + +Workaround database indicates we should disable clock gating of both the +vsunit and hsunit. + +Bspec: 33450 +Bspec: 33451 +Cc: stable@kernel.vger.org +Cc: Lucas De Marchi +Cc: Matt Atwood +Cc: Radhakrishna Sripada +Signed-off-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20191224012026.3157766-3-matthew.d.roper@intel.com +Reviewed-by: Lucas De Marchi +(cherry picked from commit b9cf9dac3dac4c1d2a47d34f30ec53c0423cecf8) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 4 +++- + drivers/gpu/drm/i915/intel_pm.c | 8 ++++++++ + 2 files changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -4049,7 +4049,9 @@ enum { + #define GWUNIT_CLKGATE_DIS (1 << 16) + + #define UNSLICE_UNIT_LEVEL_CLKGATE _MMIO(0x9434) +-#define VFUNIT_CLKGATE_DIS (1 << 20) ++#define VFUNIT_CLKGATE_DIS REG_BIT(20) ++#define HSUNIT_CLKGATE_DIS REG_BIT(8) ++#define VSUNIT_CLKGATE_DIS REG_BIT(3) + + #define INF_UNIT_LEVEL_CLKGATE _MMIO(0x9560) + #define CGPSF_CLKGATE_DIS (1 << 3) +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -9194,6 +9194,14 @@ static void icl_init_clock_gating(struct + /* WaEnable32PlaneMode:icl */ + I915_WRITE(GEN9_CSFE_CHICKEN1_RCS, + _MASKED_BIT_ENABLE(GEN11_ENABLE_32_PLANE_MODE)); ++ ++ /* ++ * Wa_1408615072:icl,ehl (vsunit) ++ * Wa_1407596294:icl,ehl (hsunit) ++ */ ++ intel_uncore_rmw(&dev_priv->uncore, UNSLICE_UNIT_LEVEL_CLKGATE, ++ 0, VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS); ++ + } + + static void cnp_init_clock_gating(struct drm_i915_private *dev_priv) diff --git a/queue-5.4/drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch b/queue-5.4/drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch new file mode 100644 index 00000000000..da28919e51d --- /dev/null +++ b/queue-5.4/drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch @@ -0,0 +1,41 @@ +From 1325008f5c8dbc84aa835d98af8447fa0569bc4d Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 6 Jan 2020 12:39:21 +0000 +Subject: drm/i915/gt: Mark up virtual engine uabi_instance + +From: Chris Wilson + +commit 1325008f5c8dbc84aa835d98af8447fa0569bc4d upstream. + +Be sure to initialise the uabi_instance on the virtual engine to the +special invalid value, just in case we ever peek at it from the uAPI. + +Reported-by: Tvrtko Ursulin +Fixes: 750e76b4f9f6 ("drm/i915/gt: Move the [class][inst] lookup for engines onto the GT") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: # v5.4+ +Reviewed-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20200106123921.2543886-1-chris@chris-wilson.co.uk +(cherry picked from commit f75fc37b5e70b75f21550410f88e2379648120e2) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gt/intel_lrc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -3716,9 +3716,11 @@ intel_execlists_create_virtual(struct i9 + ve->base.i915 = ctx->i915; + ve->base.gt = siblings[0]->gt; + ve->base.id = -1; ++ + ve->base.class = OTHER_CLASS; + ve->base.uabi_class = I915_ENGINE_CLASS_INVALID; + ve->base.instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; ++ ve->base.uabi_instance = I915_ENGINE_CLASS_INVALID_VIRTUAL; + + /* + * The decision on whether to submit a request using semaphores diff --git a/queue-5.4/drm-sun4i-tcon-set-rgb-dclk-min.-divider-based-on-hardware-model.patch b/queue-5.4/drm-sun4i-tcon-set-rgb-dclk-min.-divider-based-on-hardware-model.patch new file mode 100644 index 00000000000..94e662f6514 --- /dev/null +++ b/queue-5.4/drm-sun4i-tcon-set-rgb-dclk-min.-divider-based-on-hardware-model.patch @@ -0,0 +1,125 @@ +From 4396393fb96449c56423fb4b351f76e45a6bcaf6 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Tue, 7 Jan 2020 15:01:13 +0800 +Subject: drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model + +From: Chen-Yu Tsai + +commit 4396393fb96449c56423fb4b351f76e45a6bcaf6 upstream. + +In commit 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK +to 1.") it was assumed that all TCON variants support a minimum divider +of 1 if only DCLK was used. + +However, the oldest generation of hardware only supports minimum divider +of 4 if only DCLK is used. If a divider of 1 was used on this old +hardware, some scrolling artifact would appear. A divider of 2 seemed +OK, but a divider of 3 had artifacts as well. + +Set the minimum divider when outputing to parallel RGB based on the +hardware model, with a minimum of 4 for the oldest (A10/A10s/A13/A20) +hardware, and a minimum of 1 for the rest. A value is not set for the +TCON variants lacking channel 0. + +This fixes the scrolling artifacts seen on my A13 tablet. + +Fixes: 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.") +Cc: # 5.4.x +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20200107070113.28951-1-wens@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 15 ++++++++++++--- + drivers/gpu/drm/sun4i/sun4i_tcon.h | 1 + + 2 files changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -488,7 +488,7 @@ static void sun4i_tcon0_mode_set_rgb(str + + WARN_ON(!tcon->quirks->has_channel_0); + +- tcon->dclk_min_div = 1; ++ tcon->dclk_min_div = tcon->quirks->dclk_min_div; + tcon->dclk_max_div = 127; + sun4i_tcon0_mode_set_common(tcon, mode); + +@@ -1425,12 +1425,14 @@ static int sun8i_r40_tcon_tv_set_mux(str + static const struct sun4i_tcon_quirks sun4i_a10_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun4i_a10_tcon_set_mux, + }; + + static const struct sun4i_tcon_quirks sun5i_a13_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + .set_mux = sun5i_a13_tcon_set_mux, + }; + +@@ -1439,6 +1441,7 @@ static const struct sun4i_tcon_quirks su + .has_channel_1 = true, + .has_lvds_alt = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + .set_mux = sun6i_tcon_set_mux, + }; + +@@ -1446,11 +1449,13 @@ static const struct sun4i_tcon_quirks su + .has_channel_0 = true, + .has_channel_1 = true, + .needs_de_be_mux = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun7i_a20_quirks = { + .has_channel_0 = true, + .has_channel_1 = true, ++ .dclk_min_div = 4, + /* Same display pipeline structure as A10 */ + .set_mux = sun4i_a10_tcon_set_mux, + }; +@@ -1458,11 +1463,13 @@ static const struct sun4i_tcon_quirks su + static const struct sun4i_tcon_quirks sun8i_a33_quirks = { + .has_channel_0 = true, + .has_lvds_alt = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = { + .supports_lvds = true, + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { +@@ -1476,11 +1483,13 @@ static const struct sun4i_tcon_quirks su + + static const struct sun4i_tcon_quirks sun8i_v3s_quirks = { + .has_channel_0 = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = { +- .has_channel_0 = true, +- .needs_edp_reset = true, ++ .has_channel_0 = true, ++ .needs_edp_reset = true, ++ .dclk_min_div = 1, + }; + + static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = { +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h +@@ -224,6 +224,7 @@ struct sun4i_tcon_quirks { + bool needs_de_be_mux; /* sun6i needs mux to select backend */ + bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ + bool supports_lvds; /* Does the TCON support an LVDS output? */ ++ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ + + /* callback to handle tcon muxing options */ + int (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *); diff --git a/queue-5.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch b/queue-5.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch new file mode 100644 index 00000000000..1ae69df6b71 --- /dev/null +++ b/queue-5.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch @@ -0,0 +1,52 @@ +From 8ec321e96e056de84022c032ffea253431a83c3c Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 10 Dec 2019 16:26:11 -0500 +Subject: HID: Fix slab-out-of-bounds read in hid_field_extract + +From: Alan Stern + +commit 8ec321e96e056de84022c032ffea253431a83c3c upstream. + +The syzbot fuzzer found a slab-out-of-bounds bug in the HID report +handler. The bug was caused by a report descriptor which included a +field with size 12 bits and count 4899, for a total size of 7349 +bytes. + +The usbhid driver uses at most a single-page 4-KB buffer for reports. +In the test there wasn't any problem about overflowing the buffer, +since only one byte was received from the device. Rather, the bug +occurred when the HID core tried to extract the data from the report +fields, which caused it to try reading data beyond the end of the +allocated buffer. + +This patch fixes the problem by rejecting any report whose total +length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow +for a possible report index). In theory a device could have a report +longer than that, but if there was such a thing we wouldn't handle it +correctly anyway. + +Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -288,6 +288,12 @@ static int hid_add_field(struct hid_pars + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + diff --git a/queue-5.4/hid-hid-input-clear-unmapped-usages.patch b/queue-5.4/hid-hid-input-clear-unmapped-usages.patch new file mode 100644 index 00000000000..6e3d3acae75 --- /dev/null +++ b/queue-5.4/hid-hid-input-clear-unmapped-usages.patch @@ -0,0 +1,73 @@ +From 4f3882177240a1f55e45a3d241d3121341bead78 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sat, 7 Dec 2019 13:05:18 -0800 +Subject: HID: hid-input: clear unmapped usages + +From: Dmitry Torokhov + +commit 4f3882177240a1f55e45a3d241d3121341bead78 upstream. + +We should not be leaving half-mapped usages with potentially invalid +keycodes, as that may confuse hidinput_find_key() when the key is located +by index, which may end up feeding way too large keycode into the VT +keyboard handler and cause OOB write there: + +BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] +BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] +BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 +Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 +... + kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] + kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 + input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 + input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 + input_pass_values drivers/input/input.c:949 [inline] + input_set_keycode+0x290/0x320 drivers/input/input.c:954 + evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 + evdev_do_ioctl drivers/input/evdev.c:1150 [inline] + +Cc: stable@vger.kernel.org +Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com +Signed-off-by: Dmitry Torokhov +Tested-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-input.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1132,9 +1132,15 @@ static void hidinput_configure_usage(str + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1215,9 +1221,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + static void hidinput_handle_scroll(struct hid_usage *usage, diff --git a/queue-5.4/hid-hidraw-fix-returning-epollout-from-hidraw_poll.patch b/queue-5.4/hid-hidraw-fix-returning-epollout-from-hidraw_poll.patch new file mode 100644 index 00000000000..d7483c4d3f8 --- /dev/null +++ b/queue-5.4/hid-hidraw-fix-returning-epollout-from-hidraw_poll.patch @@ -0,0 +1,44 @@ +From 9f3b61dc1dd7b81e99e7ed23776bb64a35f39e1a Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Wed, 4 Dec 2019 03:37:13 +0100 +Subject: HID: hidraw: Fix returning EPOLLOUT from hidraw_poll + +From: Marcel Holtmann + +commit 9f3b61dc1dd7b81e99e7ed23776bb64a35f39e1a upstream. + +When polling a connected /dev/hidrawX device, it is useful to get the +EPOLLOUT when writing is possible. Since writing is possible as soon as +the device is connected, always return it. + +Right now EPOLLOUT is only returned when there are also input reports +are available. This works if devices start sending reports when +connected, but some HID devices might need an output report first before +sending any input reports. This change will allow using EPOLLOUT here as +well. + +Fixes: 378b80370aa1 ("hidraw: Return EPOLLOUT from hidraw_poll") +Signed-off-by: Marcel Holtmann +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hidraw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -252,10 +252,10 @@ static __poll_t hidraw_poll(struct file + + poll_wait(file, &list->hidraw->wait, wait); + if (list->head != list->tail) +- return EPOLLIN | EPOLLRDNORM | EPOLLOUT; ++ return EPOLLIN | EPOLLRDNORM; + if (!list->hidraw->exist) + return EPOLLERR | EPOLLHUP; +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static int hidraw_open(struct inode *inode, struct file *file) diff --git a/queue-5.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch b/queue-5.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch new file mode 100644 index 00000000000..d3912f9b7da --- /dev/null +++ b/queue-5.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch @@ -0,0 +1,33 @@ +From be54e7461ffdc5809b67d2aeefc1ddc9a91470c7 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Wed, 4 Dec 2019 03:43:55 +0100 +Subject: HID: uhid: Fix returning EPOLLOUT from uhid_char_poll + +From: Marcel Holtmann + +commit be54e7461ffdc5809b67d2aeefc1ddc9a91470c7 upstream. + +Always return EPOLLOUT from uhid_char_poll to allow polling /dev/uhid +for writable state. + +Fixes: 1f9dec1e0164 ("HID: uhid: allow poll()'ing on uhid devices") +Signed-off-by: Marcel Holtmann +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/uhid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -772,7 +772,7 @@ static __poll_t uhid_char_poll(struct fi + if (uhid->head != uhid->tail) + return EPOLLIN | EPOLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { diff --git a/queue-5.4/ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch b/queue-5.4/ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch new file mode 100644 index 00000000000..90c73884e4d --- /dev/null +++ b/queue-5.4/ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch @@ -0,0 +1,92 @@ +From b2ff0d510182eb5cc05a65d1b2371af62c4b170c Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Thu, 19 Dec 2019 18:19:20 -0500 +Subject: IB/hfi1: Adjust flow PSN with the correct resync_psn + +From: Kaike Wan + +commit b2ff0d510182eb5cc05a65d1b2371af62c4b170c upstream. + +When a TID RDMA ACK to RESYNC request is received, the flow PSNs for +pending TID RDMA WRITE segments will be adjusted with the next flow +generation number, based on the resync_psn value extracted from the flow +PSN of the TID RDMA ACK packet. The resync_psn value indicates the last +flow PSN for which a TID RDMA WRITE DATA packet has been received by the +responder and the requester should resend TID RDMA WRITE DATA packets, +starting from the next flow PSN. + +However, if resync_psn points to the last flow PSN for a segment and the +next segment flow PSN starts with a new generation number, use of the old +resync_psn to adjust the flow PSN for the next segment will lead to +miscalculation, resulting in WARN_ON and sge rewinding errors: + + WARNING: CPU: 4 PID: 146961 at /nfs/site/home/phcvs2/gitrepo/ifs-all/components/Drivers/tmp/rpmbuild/BUILD/ifs-kernel-updates-3.10.0_957.el7.x86_64/hfi1/tid_rdma.c:4764 hfi1_rc_rcv_tid_rdma_ack+0x8f6/0xa90 [hfi1] + Modules linked in: ib_ipoib(OE) hfi1(OE) rdmavt(OE) rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfsv3 nfs_acl nfs lockd grace fscache iTCO_wdt iTCO_vendor_support skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm irqbypass crc32_pclmul ghash_clmulni_intel ib_isert iscsi_target_mod target_core_mod aesni_intel lrw gf128mul glue_helper ablk_helper cryptd rpcrdma sunrpc opa_vnic ast ttm ib_iser libiscsi drm_kms_helper scsi_transport_iscsi ipmi_ssif syscopyarea sysfillrect sysimgblt fb_sys_fops drm joydev ipmi_si pcspkr sg drm_panel_orientation_quirks ipmi_devintf lpc_ich i2c_i801 ipmi_msghandler wmi rdma_ucm ib_ucm ib_uverbs acpi_cpufreq acpi_power_meter ib_umad rdma_cm ib_cm iw_cm ip_tables ext4 mbcache jbd2 sd_mod crc_t10dif crct10dif_generic crct10dif_pclmul i2c_algo_bit crct10dif_common + crc32c_intel e1000e ib_core ahci libahci ptp libata pps_core nfit libnvdimm [last unloaded: rdmavt] + CPU: 4 PID: 146961 Comm: kworker/4:0H Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.el7.x86_64 #1 + Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.0X.02.0117.040420182310 04/04/2018 + Workqueue: hfi0_0 _hfi1_do_tid_send [hfi1] + Call Trace: + [] dump_stack+0x19/0x1b + [] __warn+0xd8/0x100 + [] warn_slowpath_null+0x1d/0x20 + [] hfi1_rc_rcv_tid_rdma_ack+0x8f6/0xa90 [hfi1] + [] hfi1_kdeth_eager_rcv+0x1dc/0x210 [hfi1] + [] ? hfi1_kdeth_expected_rcv+0x1ef/0x210 [hfi1] + [] kdeth_process_eager+0x35/0x90 [hfi1] + [] handle_receive_interrupt_nodma_rtail+0x17a/0x2b0 [hfi1] + [] receive_context_interrupt+0x23/0x40 [hfi1] + [] __handle_irq_event_percpu+0x44/0x1c0 + [] handle_irq_event_percpu+0x32/0x80 + [] handle_irq_event+0x3c/0x60 + [] handle_edge_irq+0x7f/0x150 + [] handle_irq+0xe4/0x1a0 + [] do_IRQ+0x4d/0xf0 + [] common_interrupt+0x162/0x162 + [] ? swiotlb_map_page+0x49/0x150 + [] hfi1_verbs_send_dma+0x291/0xb70 [hfi1] + [] ? hfi1_wait_kmem+0xf0/0xf0 [hfi1] + [] hfi1_verbs_send+0x126/0x2b0 [hfi1] + [] _hfi1_do_tid_send+0x1d3/0x320 [hfi1] + [] process_one_work+0x17f/0x440 + [] worker_thread+0x126/0x3c0 + [] ? manage_workers.isra.25+0x2a0/0x2a0 + [] kthread+0xd1/0xe0 + [] ? insert_kthread_work+0x40/0x40 + [] ret_from_fork_nospec_begin+0x7/0x21 + [] ? insert_kthread_work+0x40/0x40 + +This patch fixes the issue by adjusting the resync_psn first if the flow +generation has been advanced for a pending segment. + +Fixes: 9e93e967f7b4 ("IB/hfi1: Add a function to receive TID RDMA ACK packet") +Link: https://lore.kernel.org/r/20191219231920.51069.37147.stgit@awfm-01.aw.intel.com +Cc: +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/tid_rdma.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/infiniband/hw/hfi1/tid_rdma.c ++++ b/drivers/infiniband/hw/hfi1/tid_rdma.c +@@ -4633,6 +4633,15 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi + */ + fpsn = full_flow_psn(flow, flow->flow_state.spsn); + req->r_ack_psn = psn; ++ /* ++ * If resync_psn points to the last flow PSN for a ++ * segment and the new segment (likely from a new ++ * request) starts with a new generation number, we ++ * need to adjust resync_psn accordingly. ++ */ ++ if (flow->flow_state.generation != ++ (resync_psn >> HFI1_KDETH_BTH_SEQ_SHIFT)) ++ resync_psn = mask_psn(fpsn - 1); + flow->resync_npkts += + delta_psn(mask_psn(resync_psn + 1), fpsn); + /* diff --git a/queue-5.4/input-add-safety-guards-to-input_set_keycode.patch b/queue-5.4/input-add-safety-guards-to-input_set_keycode.patch new file mode 100644 index 00000000000..69bef47ec09 --- /dev/null +++ b/queue-5.4/input-add-safety-guards-to-input_set_keycode.patch @@ -0,0 +1,69 @@ +From cb222aed03d798fc074be55e59d9a112338ee784 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 13 Dec 2019 14:56:16 -0800 +Subject: Input: add safety guards to input_set_keycode() + +From: Dmitry Torokhov + +commit cb222aed03d798fc074be55e59d9a112338ee784 upstream. + +If we happen to have a garbage in input device's keycode table with values +too big we'll end up doing clear_bit() with offset way outside of our +bitmaps, damaging other objects within an input device or even outside of +it. Let's add sanity checks to the returned old keycodes. + +Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com +Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/input.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -878,16 +878,18 @@ static int input_default_setkeycode(stru + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -943,9 +945,13 @@ int input_set_keycode(struct input_dev * + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync diff --git a/queue-5.4/input-input_event-fix-struct-padding-on-sparc64.patch b/queue-5.4/input-input_event-fix-struct-padding-on-sparc64.patch new file mode 100644 index 00000000000..f0684a3baed --- /dev/null +++ b/queue-5.4/input-input_event-fix-struct-padding-on-sparc64.patch @@ -0,0 +1,90 @@ +From f729a1b0f8df7091cea3729fc0e414f5326e1163 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 13 Dec 2019 14:06:58 -0800 +Subject: Input: input_event - fix struct padding on sparc64 + +From: Arnd Bergmann + +commit f729a1b0f8df7091cea3729fc0e414f5326e1163 upstream. + +Going through all uses of timeval, I noticed that we screwed up +input_event in the previous attempts to fix it: + +The time fields now match between kernel and user space, but all following +fields are in the wrong place. + +Add the required padding that is implied by the glibc timeval definition +to fix the layout, and use a struct initializer to avoid leaking kernel +stack data. + +Fixes: 141e5dcaa735 ("Input: input_event - fix the CONFIG_SPARC64 mixup") +Fixes: 2e746942ebac ("Input: input_event - provide override for sparc64") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20191213204936.3643476-2-arnd@arndb.de +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/evdev.c | 14 +++++++------- + drivers/input/misc/uinput.c | 14 +++++++++----- + include/uapi/linux/input.h | 1 + + 3 files changed, 17 insertions(+), 12 deletions(-) + +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -224,13 +224,13 @@ static void __pass_event(struct evdev_cl + */ + client->tail = (client->head - 2) & (client->bufsize - 1); + +- client->buffer[client->tail].input_event_sec = +- event->input_event_sec; +- client->buffer[client->tail].input_event_usec = +- event->input_event_usec; +- client->buffer[client->tail].type = EV_SYN; +- client->buffer[client->tail].code = SYN_DROPPED; +- client->buffer[client->tail].value = 0; ++ client->buffer[client->tail] = (struct input_event) { ++ .input_event_sec = event->input_event_sec, ++ .input_event_usec = event->input_event_usec, ++ .type = EV_SYN, ++ .code = SYN_DROPPED, ++ .value = 0, ++ }; + + client->packet_head = client->tail; + } +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -74,12 +74,16 @@ static int uinput_dev_event(struct input + struct uinput_device *udev = input_get_drvdata(dev); + struct timespec64 ts; + +- udev->buff[udev->head].type = type; +- udev->buff[udev->head].code = code; +- udev->buff[udev->head].value = value; + ktime_get_ts64(&ts); +- udev->buff[udev->head].input_event_sec = ts.tv_sec; +- udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC; ++ ++ udev->buff[udev->head] = (struct input_event) { ++ .input_event_sec = ts.tv_sec, ++ .input_event_usec = ts.tv_nsec / NSEC_PER_USEC, ++ .type = type, ++ .code = code, ++ .value = value, ++ }; ++ + udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; + + wake_up_interruptible(&udev->waitq); +--- a/include/uapi/linux/input.h ++++ b/include/uapi/linux/input.h +@@ -34,6 +34,7 @@ struct input_event { + __kernel_ulong_t __sec; + #if defined(__sparc__) && defined(__arch64__) + unsigned int __usec; ++ unsigned int __pad; + #else + __kernel_ulong_t __usec; + #endif diff --git a/queue-5.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch b/queue-5.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch new file mode 100644 index 00000000000..ca171b014c5 --- /dev/null +++ b/queue-5.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch @@ -0,0 +1,45 @@ +From 50f9ad607ea891a9308e67b81f774c71736d1098 Mon Sep 17 00:00:00 2001 +From: Kaitao Cheng +Date: Tue, 31 Dec 2019 05:35:30 -0800 +Subject: kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail + +From: Kaitao Cheng + +commit 50f9ad607ea891a9308e67b81f774c71736d1098 upstream. + +In the function, if register_trace_sched_migrate_task() returns error, +sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is +why fail_deprobe_sched_switch was added. + +Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com + +Cc: stable@vger.kernel.org +Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") +Signed-off-by: Kaitao Cheng +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_sched_wakeup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -630,7 +630,7 @@ static void start_wakeup_tracer(struct t + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -648,6 +648,8 @@ static void start_wakeup_tracer(struct t + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: diff --git a/queue-5.4/revert-drm-amdgpu-set-no-retry-as-default.patch b/queue-5.4/revert-drm-amdgpu-set-no-retry-as-default.patch new file mode 100644 index 00000000000..40e51fe5fe9 --- /dev/null +++ b/queue-5.4/revert-drm-amdgpu-set-no-retry-as-default.patch @@ -0,0 +1,49 @@ +From 7aec9ec1cf324d5c5a8d17b9c78a34c388e5f17b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 6 Jan 2020 15:24:47 -0500 +Subject: Revert "drm/amdgpu: Set no-retry as default." +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 7aec9ec1cf324d5c5a8d17b9c78a34c388e5f17b upstream. + +This reverts commit 51bfac71cade386966791a8db87a5912781d249f. + +This causes stability issues on some raven boards. Revert +for now until a proper fix is completed. + +Bug: https://gitlab.freedesktop.org/drm/amd/issues/934 +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206017 +Reviewed-by: Felix Kuehling +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -145,7 +145,7 @@ int amdgpu_async_gfx_ring = 1; + int amdgpu_mcbp = 0; + int amdgpu_discovery = -1; + int amdgpu_mes = 0; +-int amdgpu_noretry = 1; ++int amdgpu_noretry; + + struct amdgpu_mgpu_info mgpu_info = { + .mutex = __MUTEX_INITIALIZER(mgpu_info.mutex), +@@ -613,7 +613,7 @@ MODULE_PARM_DESC(mes, + module_param_named(mes, amdgpu_mes, int, 0444); + + MODULE_PARM_DESC(noretry, +- "Disable retry faults (0 = retry enabled, 1 = retry disabled (default))"); ++ "Disable retry faults (0 = retry enabled (default), 1 = retry disabled)"); + module_param_named(noretry, amdgpu_noretry, int, 0644); + + #ifdef CONFIG_HSA_AMD diff --git a/queue-5.4/series b/queue-5.4/series index afd525e7848..87f03992ad8 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -11,3 +11,21 @@ tpm-revert-tpm_tis_core-set-tpm_chip_flag_irq-before-probing-for-interrupts.patc tpm-revert-tpm_tis_core-turn-on-the-tpm-before-probing-irq-s.patch tpm-handle-negative-priv-response_len-in-tpm_common_read.patch rtc-sun6i-add-support-for-rtc-clocks-on-r40.patch +kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch +tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch +tracing-change-offset-type-to-s32-in-preempt-irq-tracepoints.patch +hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch +hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch +hid-hidraw-fix-returning-epollout-from-hidraw_poll.patch +hid-hid-input-clear-unmapped-usages.patch +input-add-safety-guards-to-input_set_keycode.patch +input-input_event-fix-struct-padding-on-sparc64.patch +drm-i915-add-wa_1408615072-and-wa_1407596294-to-icl-ehl.patch +drm-amdgpu-add-driver_syncobj_timeline-to-amdgpu.patch +revert-drm-amdgpu-set-no-retry-as-default.patch +drm-sun4i-tcon-set-rgb-dclk-min.-divider-based-on-hardware-model.patch +drm-fb-helper-round-up-bits_per_pixel-if-possible.patch +drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch +drm-i915-add-wa_1407352427-icl-ehl.patch +drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch +ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch diff --git a/queue-5.4/tracing-change-offset-type-to-s32-in-preempt-irq-tracepoints.patch b/queue-5.4/tracing-change-offset-type-to-s32-in-preempt-irq-tracepoints.patch new file mode 100644 index 00000000000..beef6f98c9f --- /dev/null +++ b/queue-5.4/tracing-change-offset-type-to-s32-in-preempt-irq-tracepoints.patch @@ -0,0 +1,53 @@ +From bf44f488e168368cae4139b4b33c3d0aaa11679c Mon Sep 17 00:00:00 2001 +From: "Joel Fernandes (Google)" +Date: Thu, 2 Jan 2020 14:46:25 -0500 +Subject: tracing: Change offset type to s32 in preempt/irq tracepoints + +From: Joel Fernandes (Google) + +commit bf44f488e168368cae4139b4b33c3d0aaa11679c upstream. + +Discussion in the below link reported that symbols in modules can appear +to be before _stext on ARM architecture, causing wrapping with the +offsets of this tracepoint. Change the offset type to s32 to fix this. + +Link: http://lore.kernel.org/r/20191127154428.191095-1-antonio.borneo@st.com +Link: http://lkml.kernel.org/r/20200102194625.226436-1-joel@joelfernandes.org + +Cc: Bjorn Helgaas +Cc: David Sterba +Cc: Ingo Molnar +Cc: Mike Rapoport +Cc: "Rafael J. Wysocki" +Cc: Sakari Ailus +Cc: Antonio Borneo +Cc: stable@vger.kernel.org +Fixes: d59158162e032 ("tracing: Add support for preempt and irq enable/disable events") +Signed-off-by: Joel Fernandes (Google) +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/events/preemptirq.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/include/trace/events/preemptirq.h ++++ b/include/trace/events/preemptirq.h +@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template, + TP_ARGS(ip, parent_ip), + + TP_STRUCT__entry( +- __field(u32, caller_offs) +- __field(u32, parent_offs) ++ __field(s32, caller_offs) ++ __field(s32, parent_offs) + ), + + TP_fast_assign( +- __entry->caller_offs = (u32)(ip - (unsigned long)_stext); +- __entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext); ++ __entry->caller_offs = (s32)(ip - (unsigned long)_stext); ++ __entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext); + ), + + TP_printk("caller=%pS parent=%pS", diff --git a/queue-5.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch b/queue-5.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch new file mode 100644 index 00000000000..eb206ccc432 --- /dev/null +++ b/queue-5.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch @@ -0,0 +1,39 @@ +From b8299d362d0837ae39e87e9019ebe6b736e0f035 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (VMware)" +Date: Thu, 2 Jan 2020 22:02:41 -0500 +Subject: tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined + +From: Steven Rostedt (VMware) + +commit b8299d362d0837ae39e87e9019ebe6b736e0f035 upstream. + +On some archs with some configurations, MCOUNT_INSN_SIZE is not defined, and +this makes the stack tracer fail to compile. Just define it to zero in this +case. + +Link: https://lore.kernel.org/r/202001020219.zvE3vsty%lkp@intel.com + +Cc: stable@vger.kernel.org +Fixes: 4df297129f622 ("tracing: Remove most or all of stack tracer stack size from stack_max_size") +Reported-by: kbuild test robot +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_stack.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -283,6 +283,11 @@ static void check_stack(unsigned long ip + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs)