From: Sasha Levin Date: Wed, 8 May 2019 20:23:45 +0000 (-0400) Subject: fixes for 4.19 X-Git-Tag: v4.9.175~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e7e2c20d66fa3b66843e51b23538f62b31a228ac;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/asoc-cs35l35-disable-regulators-on-driver-removal.patch b/queue-4.19/asoc-cs35l35-disable-regulators-on-driver-removal.patch new file mode 100644 index 00000000000..2640458eddc --- /dev/null +++ b/queue-4.19/asoc-cs35l35-disable-regulators-on-driver-removal.patch @@ -0,0 +1,52 @@ +From 3de372324ab5583d40e5eb111ab7134d2824d131 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Thu, 4 Apr 2019 17:27:20 +0100 +Subject: ASoC: cs35l35: Disable regulators on driver removal + +[ Upstream commit 47c4cc08cb5b34e93ab337b924c5ede77ca3c936 ] + +The chips main power supplies VA and VP are enabled during probe but +then never disabled, this will cause warnings from the regulator +framework on driver removal. Fix this by adding a remove callback and +disabling the supplies, whilst doing so follow best practice and put the +chip back into reset as well. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l35.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c +index bd6226bde45f6..17e0101081ef6 100644 +--- a/sound/soc/codecs/cs35l35.c ++++ b/sound/soc/codecs/cs35l35.c +@@ -1634,6 +1634,16 @@ static int cs35l35_i2c_probe(struct i2c_client *i2c_client, + return ret; + } + ++static int cs35l35_i2c_remove(struct i2c_client *i2c_client) ++{ ++ struct cs35l35_private *cs35l35 = i2c_get_clientdata(i2c_client); ++ ++ regulator_bulk_disable(cs35l35->num_supplies, cs35l35->supplies); ++ gpiod_set_value_cansleep(cs35l35->reset_gpio, 0); ++ ++ return 0; ++} ++ + static const struct of_device_id cs35l35_of_match[] = { + {.compatible = "cirrus,cs35l35"}, + {}, +@@ -1654,6 +1664,7 @@ static struct i2c_driver cs35l35_i2c_driver = { + }, + .id_table = cs35l35_id, + .probe = cs35l35_i2c_probe, ++ .remove = cs35l35_i2c_remove, + }; + + module_i2c_driver(cs35l35_i2c_driver); +-- +2.20.1 + diff --git a/queue-4.19/asoc-cs4270-set-auto-increment-bit-for-register-writ.patch b/queue-4.19/asoc-cs4270-set-auto-increment-bit-for-register-writ.patch new file mode 100644 index 00000000000..d8079a0684d --- /dev/null +++ b/queue-4.19/asoc-cs4270-set-auto-increment-bit-for-register-writ.patch @@ -0,0 +1,37 @@ +From 8a17f372a218576c6e3613cbfbc5d5f65c120554 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 20 Mar 2019 22:41:56 +0100 +Subject: ASoC: cs4270: Set auto-increment bit for register writes + +[ Upstream commit f0f2338a9cfaf71db895fa989ea7234e8a9b471d ] + +The CS4270 does not by default increment the register address on +consecutive writes. During normal operation it doesn't matter as all +register accesses are done individually. At resume time after suspend, +however, the regcache code gathers the biggest possible block of +registers to sync and sends them one on one go. + +To fix this, set the INCR bit in all cases. + +Signed-off-by: Daniel Mack +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4270.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c +index 3c266eeb89bfb..007ce9f48e443 100644 +--- a/sound/soc/codecs/cs4270.c ++++ b/sound/soc/codecs/cs4270.c +@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = { + .reg_defaults = cs4270_reg_defaults, + .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults), + .cache_type = REGCACHE_RBTREE, ++ .write_flag_mask = CS4270_I2C_INCR, + + .readable_reg = cs4270_reg_is_readable, + .volatile_reg = cs4270_reg_is_volatile, +-- +2.20.1 + diff --git a/queue-4.19/asoc-dapm-fix-null-pointer-dereference-in-snd_soc_da.patch b/queue-4.19/asoc-dapm-fix-null-pointer-dereference-in-snd_soc_da.patch new file mode 100644 index 00000000000..e887e94cb38 --- /dev/null +++ b/queue-4.19/asoc-dapm-fix-null-pointer-dereference-in-snd_soc_da.patch @@ -0,0 +1,37 @@ +From 45f78c7c8da977c979a56cc907a191ff2479b699 Mon Sep 17 00:00:00 2001 +From: Pankaj Bharadiya +Date: Fri, 22 Mar 2019 18:00:09 +0530 +Subject: ASoC: dapm: Fix NULL pointer dereference in + snd_soc_dapm_free_kcontrol + +[ Upstream commit cacea3a90e211f0c111975535508d446a4a928d2 ] + +w_text_param can be NULL and it is being dereferenced without checking. +Add the missing sanity check to prevent NULL pointer dereference. + +Signed-off-by: Pankaj Bharadiya +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 9b78fb3daa7bb..2257b1b0151c4 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3847,6 +3847,10 @@ snd_soc_dapm_free_kcontrol(struct snd_soc_card *card, + int count; + + devm_kfree(card->dev, (void *)*private_value); ++ ++ if (!w_param_text) ++ return; ++ + for (count = 0 ; count < num_params; count++) + devm_kfree(card->dev, (void *)w_param_text[count]); + devm_kfree(card->dev, w_param_text); +-- +2.20.1 + diff --git a/queue-4.19/asoc-hdmi-codec-fix-s-pdif-dai.patch b/queue-4.19/asoc-hdmi-codec-fix-s-pdif-dai.patch new file mode 100644 index 00000000000..6f7bb4a59ee --- /dev/null +++ b/queue-4.19/asoc-hdmi-codec-fix-s-pdif-dai.patch @@ -0,0 +1,176 @@ +From 3518e90295abb601180fa834b1a74c3f89d4e0c8 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 28 Feb 2019 15:30:34 +0000 +Subject: ASoC: hdmi-codec: fix S/PDIF DAI + +[ Upstream commit 2e95f984aae4cf0608d0ba2189c756f2bd50b44a ] + +When using the S/PDIF DAI, there is no requirement to call +snd_soc_dai_set_fmt() as there is no DAI format definition that defines +S/PDIF. In any case, S/PDIF does not have separate clocks, this is +embedded into the data stream. + +Consequently, when attempting to use TDA998x in S/PDIF mode, the attempt +to configure TDA998x via the hw_params callback fails as the +hdmi_codec_daifmt is left initialised to zero. + +Since the S/PDIF DAI will only be used by S/PDIF, prepare the +hdmi_codec_daifmt structure for this format. + +Signed-off-by: Russell King +Reviewed-by: Jyri Sarha +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdmi-codec.c | 118 +++++++++++++++++----------------- + 1 file changed, 59 insertions(+), 59 deletions(-) + +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index e5b6769b97977..d5f73c8372817 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -529,73 +529,71 @@ static int hdmi_codec_set_fmt(struct snd_soc_dai *dai, + { + struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); + struct hdmi_codec_daifmt cf = { 0 }; +- int ret = 0; + + dev_dbg(dai->dev, "%s()\n", __func__); + +- if (dai->id == DAI_ID_SPDIF) { +- cf.fmt = HDMI_SPDIF; +- } else { +- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { +- case SND_SOC_DAIFMT_CBM_CFM: +- cf.bit_clk_master = 1; +- cf.frame_clk_master = 1; +- break; +- case SND_SOC_DAIFMT_CBS_CFM: +- cf.frame_clk_master = 1; +- break; +- case SND_SOC_DAIFMT_CBM_CFS: +- cf.bit_clk_master = 1; +- break; +- case SND_SOC_DAIFMT_CBS_CFS: +- break; +- default: +- return -EINVAL; +- } ++ if (dai->id == DAI_ID_SPDIF) ++ return 0; ++ ++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { ++ case SND_SOC_DAIFMT_CBM_CFM: ++ cf.bit_clk_master = 1; ++ cf.frame_clk_master = 1; ++ break; ++ case SND_SOC_DAIFMT_CBS_CFM: ++ cf.frame_clk_master = 1; ++ break; ++ case SND_SOC_DAIFMT_CBM_CFS: ++ cf.bit_clk_master = 1; ++ break; ++ case SND_SOC_DAIFMT_CBS_CFS: ++ break; ++ default: ++ return -EINVAL; ++ } + +- switch (fmt & SND_SOC_DAIFMT_INV_MASK) { +- case SND_SOC_DAIFMT_NB_NF: +- break; +- case SND_SOC_DAIFMT_NB_IF: +- cf.frame_clk_inv = 1; +- break; +- case SND_SOC_DAIFMT_IB_NF: +- cf.bit_clk_inv = 1; +- break; +- case SND_SOC_DAIFMT_IB_IF: +- cf.frame_clk_inv = 1; +- cf.bit_clk_inv = 1; +- break; +- } ++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) { ++ case SND_SOC_DAIFMT_NB_NF: ++ break; ++ case SND_SOC_DAIFMT_NB_IF: ++ cf.frame_clk_inv = 1; ++ break; ++ case SND_SOC_DAIFMT_IB_NF: ++ cf.bit_clk_inv = 1; ++ break; ++ case SND_SOC_DAIFMT_IB_IF: ++ cf.frame_clk_inv = 1; ++ cf.bit_clk_inv = 1; ++ break; ++ } + +- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { +- case SND_SOC_DAIFMT_I2S: +- cf.fmt = HDMI_I2S; +- break; +- case SND_SOC_DAIFMT_DSP_A: +- cf.fmt = HDMI_DSP_A; +- break; +- case SND_SOC_DAIFMT_DSP_B: +- cf.fmt = HDMI_DSP_B; +- break; +- case SND_SOC_DAIFMT_RIGHT_J: +- cf.fmt = HDMI_RIGHT_J; +- break; +- case SND_SOC_DAIFMT_LEFT_J: +- cf.fmt = HDMI_LEFT_J; +- break; +- case SND_SOC_DAIFMT_AC97: +- cf.fmt = HDMI_AC97; +- break; +- default: +- dev_err(dai->dev, "Invalid DAI interface format\n"); +- return -EINVAL; +- } ++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { ++ case SND_SOC_DAIFMT_I2S: ++ cf.fmt = HDMI_I2S; ++ break; ++ case SND_SOC_DAIFMT_DSP_A: ++ cf.fmt = HDMI_DSP_A; ++ break; ++ case SND_SOC_DAIFMT_DSP_B: ++ cf.fmt = HDMI_DSP_B; ++ break; ++ case SND_SOC_DAIFMT_RIGHT_J: ++ cf.fmt = HDMI_RIGHT_J; ++ break; ++ case SND_SOC_DAIFMT_LEFT_J: ++ cf.fmt = HDMI_LEFT_J; ++ break; ++ case SND_SOC_DAIFMT_AC97: ++ cf.fmt = HDMI_AC97; ++ break; ++ default: ++ dev_err(dai->dev, "Invalid DAI interface format\n"); ++ return -EINVAL; + } + + hcp->daifmt[dai->id] = cf; + +- return ret; ++ return 0; + } + + static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute) +@@ -792,8 +790,10 @@ static int hdmi_codec_probe(struct platform_device *pdev) + i++; + } + +- if (hcd->spdif) ++ if (hcd->spdif) { + hcp->daidrv[i] = hdmi_spdif_dai; ++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF; ++ } + + dev_set_drvdata(dev, hcp); + +-- +2.20.1 + diff --git a/queue-4.19/asoc-intel-kbl-fix-wrong-number-of-channels.patch b/queue-4.19/asoc-intel-kbl-fix-wrong-number-of-channels.patch new file mode 100644 index 00000000000..672216c3e3a --- /dev/null +++ b/queue-4.19/asoc-intel-kbl-fix-wrong-number-of-channels.patch @@ -0,0 +1,34 @@ +From 70384f392c10a7f81790b8e979a2d0b25807fd68 Mon Sep 17 00:00:00 2001 +From: Tzung-Bi Shih +Date: Mon, 8 Apr 2019 17:08:58 +0800 +Subject: ASoC: Intel: kbl: fix wrong number of channels + +[ Upstream commit d6ba3f815bc5f3c4249d15c8bc5fbb012651b4a4 ] + +Fix wrong setting on number of channels. The context wants to set +constraint to 2 channels instead of 4. + +Signed-off-by: Tzung-Bi Shih +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index a892b37eab7c9..b8a03f58ac8cc 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -406,7 +406,7 @@ static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = { + }; + + static const unsigned int dmic_2ch[] = { +- 4, ++ 2, + }; + + static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = { +-- +2.20.1 + diff --git a/queue-4.19/asoc-intel-skl-fix-a-simultaneous-playback-capture-i.patch b/queue-4.19/asoc-intel-skl-fix-a-simultaneous-playback-capture-i.patch new file mode 100644 index 00000000000..d53ef644a76 --- /dev/null +++ b/queue-4.19/asoc-intel-skl-fix-a-simultaneous-playback-capture-i.patch @@ -0,0 +1,79 @@ +From 9f3b5dc0e4aca4c89c833008e5eca5f72e21a965 Mon Sep 17 00:00:00 2001 +From: Rander Wang +Date: Fri, 8 Mar 2019 16:38:59 +0800 +Subject: ASoC:intel:skl:fix a simultaneous playback & capture issue on hda + platform + +[ Upstream commit c899df3e9b0bf7b76e642aed1a214582ea7012d5 ] + +If playback and capture are enabled concurrently, when the capture stops +the output becomes inaudile. The playback application will become stuck +and underrun after a timeout. + +This is caused by mistaken use of the stream_id, which should only be +set for playback and not for capture + +Tested on Apollolake and Kabylake with SST driver. + +Signed-off-by: Rander Wang +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 823e39103edd3..6b2c8c6e7a00f 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -180,6 +180,7 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params) + struct hdac_stream *hstream; + struct hdac_ext_stream *stream; + struct hdac_ext_link *link; ++ unsigned char stream_tag; + + hstream = snd_hdac_get_stream(bus, params->stream, + params->link_dma_id + 1); +@@ -198,10 +199,13 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params) + + snd_hdac_ext_link_stream_setup(stream, format_val); + +- list_for_each_entry(link, &bus->hlink_list, list) { +- if (link->index == params->link_index) +- snd_hdac_ext_link_set_stream_id(link, +- hstream->stream_tag); ++ stream_tag = hstream->stream_tag; ++ if (stream->hstream.direction == SNDRV_PCM_STREAM_PLAYBACK) { ++ list_for_each_entry(link, &bus->hlink_list, list) { ++ if (link->index == params->link_index) ++ snd_hdac_ext_link_set_stream_id(link, ++ stream_tag); ++ } + } + + stream->link_prepared = 1; +@@ -640,6 +644,7 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream, + struct hdac_ext_stream *link_dev = + snd_soc_dai_get_dma_data(dai, substream); + struct hdac_ext_link *link; ++ unsigned char stream_tag; + + dev_dbg(dai->dev, "%s: %s\n", __func__, dai->name); + +@@ -649,7 +654,11 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream, + if (!link) + return -EINVAL; + +- snd_hdac_ext_link_clear_stream_id(link, hdac_stream(link_dev)->stream_tag); ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { ++ stream_tag = hdac_stream(link_dev)->stream_tag; ++ snd_hdac_ext_link_clear_stream_id(link, stream_tag); ++ } ++ + snd_hdac_ext_stream_release(link_dev, HDAC_EXT_STREAM_TYPE_LINK); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch b/queue-4.19/asoc-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch new file mode 100644 index 00000000000..a7ca636687f --- /dev/null +++ b/queue-4.19/asoc-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch @@ -0,0 +1,37 @@ +From 86672667fbdae834faafc94cd8907109ed7bb316 Mon Sep 17 00:00:00 2001 +From: John Hsu +Date: Wed, 13 Mar 2019 16:23:44 +0800 +Subject: ASoC: nau8810: fix the issue of widget with prefixed name + +[ Upstream commit 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a ] + +The driver changes the stream name of DAC and ADC to avoid the issue of +widget with prefixed name. When the machine adds prefixed name for codec, +the stream name of DAI may not find the widgets. + +Signed-off-by: John Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8810.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c +index bfd74b86c9d2f..645aa07941237 100644 +--- a/sound/soc/codecs/nau8810.c ++++ b/sound/soc/codecs/nau8810.c +@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = { + SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3, + NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0], + ARRAY_SIZE(nau8810_mono_mixer_controls)), +- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3, ++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3, + NAU8810_DAC_EN_SFT, 0), +- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2, ++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2, + NAU8810_ADC_EN_SFT, 0), + SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3, + NAU8810_NSPK_EN_SFT, 0, NULL, 0), +-- +2.20.1 + diff --git a/queue-4.19/asoc-nau8824-fix-the-issue-of-the-widget-with-prefix.patch b/queue-4.19/asoc-nau8824-fix-the-issue-of-the-widget-with-prefix.patch new file mode 100644 index 00000000000..5b4742bc30a --- /dev/null +++ b/queue-4.19/asoc-nau8824-fix-the-issue-of-the-widget-with-prefix.patch @@ -0,0 +1,108 @@ +From 1dd6a1914216dd76535b49ee0196bd20d0d862be Mon Sep 17 00:00:00 2001 +From: John Hsu +Date: Mon, 11 Mar 2019 09:36:45 +0800 +Subject: ASoC: nau8824: fix the issue of the widget with prefix name + +[ Upstream commit 844a4a362dbec166b44d6b9b3dd45b08cb273703 ] + +The driver has two issues when machine add prefix name for codec. +(1)The stream name of DAI can't find the AIF widgets. +(2)The drivr can enable/disalbe the MICBIAS and SAR widgets. + +The patch will fix these issues caused by prefixed name added. + +Signed-off-by: John Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8824.c | 46 +++++++++++++++++++++++++++++++------- + 1 file changed, 38 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c +index 468d5143e2c4f..663a208c2f784 100644 +--- a/sound/soc/codecs/nau8824.c ++++ b/sound/soc/codecs/nau8824.c +@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = { + SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2, + NAU8824_ADCR_EN_SFT, 0), + +- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0), +- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0), ++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0), + + SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC, + NAU8824_DACL_EN_SFT, 0), +@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap) + } + } + ++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin) ++{ ++ struct snd_soc_dapm_context *dapm = nau8824->dapm; ++ const char *prefix = dapm->component->name_prefix; ++ char prefixed_pin[80]; ++ ++ if (prefix) { ++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s", ++ prefix, pin); ++ snd_soc_dapm_disable_pin(dapm, prefixed_pin); ++ } else { ++ snd_soc_dapm_disable_pin(dapm, pin); ++ } ++} ++ ++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin) ++{ ++ struct snd_soc_dapm_context *dapm = nau8824->dapm; ++ const char *prefix = dapm->component->name_prefix; ++ char prefixed_pin[80]; ++ ++ if (prefix) { ++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s", ++ prefix, pin); ++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin); ++ } else { ++ snd_soc_dapm_force_enable_pin(dapm, pin); ++ } ++} ++ + static void nau8824_eject_jack(struct nau8824 *nau8824) + { + struct snd_soc_dapm_context *dapm = nau8824->dapm; +@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824) + /* Clear all interruption status */ + nau8824_int_status_clear_all(regmap); + +- snd_soc_dapm_disable_pin(dapm, "SAR"); +- snd_soc_dapm_disable_pin(dapm, "MICBIAS"); ++ nau8824_dapm_disable_pin(nau8824, "SAR"); ++ nau8824_dapm_disable_pin(nau8824, "MICBIAS"); + snd_soc_dapm_sync(dapm); + + /* Enable the insertion interruption, disable the ejection +@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work) + struct regmap *regmap = nau8824->regmap; + int adc_value, event = 0, event_mask = 0; + +- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS"); +- snd_soc_dapm_force_enable_pin(dapm, "SAR"); ++ nau8824_dapm_enable_pin(nau8824, "MICBIAS"); ++ nau8824_dapm_enable_pin(nau8824, "SAR"); + snd_soc_dapm_sync(dapm); + + msleep(100); +@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work) + if (adc_value < HEADSET_SARADC_THD) { + event |= SND_JACK_HEADPHONE; + +- snd_soc_dapm_disable_pin(dapm, "SAR"); +- snd_soc_dapm_disable_pin(dapm, "MICBIAS"); ++ nau8824_dapm_disable_pin(nau8824, "SAR"); ++ nau8824_dapm_disable_pin(nau8824, "MICBIAS"); + snd_soc_dapm_sync(dapm); + } else { + event |= SND_JACK_HEADSET; +-- +2.20.1 + diff --git a/queue-4.19/asoc-rockchip-pdm-fix-regmap_ops-hang-issue.patch b/queue-4.19/asoc-rockchip-pdm-fix-regmap_ops-hang-issue.patch new file mode 100644 index 00000000000..7da8e94f1ae --- /dev/null +++ b/queue-4.19/asoc-rockchip-pdm-fix-regmap_ops-hang-issue.patch @@ -0,0 +1,35 @@ +From f15246223f4b1cfa8f84e645703e2e47c2461b30 Mon Sep 17 00:00:00 2001 +From: Sugar Zhang +Date: Wed, 3 Apr 2019 21:40:45 +0800 +Subject: ASoC: rockchip: pdm: fix regmap_ops hang issue + +[ Upstream commit c85064435fe7a216ec0f0238ef2b8f7cd850a450 ] + +This is because set_fmt ops maybe called when PD is off, +and in such case, regmap_ops will lead system hang. +enale PD before doing regmap_ops. + +Signed-off-by: Sugar Zhang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_pdm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c +index 400e29edb1c9c..8a2e3bbce3a16 100644 +--- a/sound/soc/rockchip/rockchip_pdm.c ++++ b/sound/soc/rockchip/rockchip_pdm.c +@@ -208,7 +208,9 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai, + return -EINVAL; + } + ++ pm_runtime_get_sync(cpu_dai->dev); + regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val); ++ pm_runtime_put(cpu_dai->dev); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-rt5682-recording-has-no-sound-after-booting.patch b/queue-4.19/asoc-rt5682-recording-has-no-sound-after-booting.patch new file mode 100644 index 00000000000..46a1b786239 --- /dev/null +++ b/queue-4.19/asoc-rt5682-recording-has-no-sound-after-booting.patch @@ -0,0 +1,62 @@ +From f2a465219dc6dd2224441b3bf02e0ebe15517343 Mon Sep 17 00:00:00 2001 +From: Shuming Fan +Date: Mon, 18 Mar 2019 15:17:42 +0800 +Subject: ASoC: rt5682: recording has no sound after booting + +[ Upstream commit 1c5b6a27e432e4fe170a924c8b41012271496a4c ] + +If ASRC turns on, HW will use clk_dac as the reference clock +whether recording or playback. +Both of clk_dac and clk_adc should set proper clock while using ASRC. + +Signed-off-by: Shuming Fan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index 79ebcc2397865..6f5dac09ceded 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -1196,7 +1196,7 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w, + struct snd_soc_component *component = + snd_soc_dapm_to_component(w->dapm); + struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component); +- int ref, val, reg, sft, mask, idx = -EINVAL; ++ int ref, val, reg, idx = -EINVAL; + static const int div_f[] = {1, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48}; + static const int div_o[] = {1, 2, 4, 6, 8, 12, 16, 24, 32, 48}; + +@@ -1210,15 +1210,10 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w, + + idx = rt5682_div_sel(rt5682, ref, div_f, ARRAY_SIZE(div_f)); + +- if (w->shift == RT5682_PWR_ADC_S1F_BIT) { ++ if (w->shift == RT5682_PWR_ADC_S1F_BIT) + reg = RT5682_PLL_TRACK_3; +- sft = RT5682_ADC_OSR_SFT; +- mask = RT5682_ADC_OSR_MASK; +- } else { ++ else + reg = RT5682_PLL_TRACK_2; +- sft = RT5682_DAC_OSR_SFT; +- mask = RT5682_DAC_OSR_MASK; +- } + + snd_soc_component_update_bits(component, reg, + RT5682_FILTER_CLK_DIV_MASK, idx << RT5682_FILTER_CLK_DIV_SFT); +@@ -1230,7 +1225,8 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w, + } + + snd_soc_component_update_bits(component, RT5682_ADDA_CLK_1, +- mask, idx << sft); ++ RT5682_ADC_OSR_MASK | RT5682_DAC_OSR_MASK, ++ (idx << RT5682_ADC_OSR_SFT) | (idx << RT5682_DAC_OSR_SFT)); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/asoc-samsung-odroid-fix-clock-configuration-for-4410.patch b/queue-4.19/asoc-samsung-odroid-fix-clock-configuration-for-4410.patch new file mode 100644 index 00000000000..d04243bd6a5 --- /dev/null +++ b/queue-4.19/asoc-samsung-odroid-fix-clock-configuration-for-4410.patch @@ -0,0 +1,47 @@ +From 460d4582cc5cd7f19009b8900eb2b41106d4410e Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Tue, 12 Mar 2019 18:40:06 +0100 +Subject: ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate + +[ Upstream commit 2b13bee3884926cba22061efa75bd315e871de24 ] + +After commit fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate +handling") the audio root clock frequency is configured improperly for +44100 sample rate. Due to clock rate rounding it's 20070401 Hz instead +of 22579000 Hz. This results in a too low value of the PSR clock divider +in the CPU DAI driver and too fast actual sample rate for fs=44100. E.g. +1 kHz tone has actual 1780 Hz frequency (1 kHz * 20070401/22579000 * 2). + +Fix this by increasing the correction passed to clk_set_rate() to take +into account inaccuracy of the EPLL frequency properly. + +Fixes: fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate handling") +Reported-by: JaeChul Lee +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/odroid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c +index e7b371b072304..45c6d73967852 100644 +--- a/sound/soc/samsung/odroid.c ++++ b/sound/soc/samsung/odroid.c +@@ -64,11 +64,11 @@ static int odroid_card_hw_params(struct snd_pcm_substream *substream, + return ret; + + /* +- * We add 1 to the rclk_freq value in order to avoid too low clock ++ * We add 2 to the rclk_freq value in order to avoid too low clock + * frequency values due to the EPLL output frequency not being exact + * multiple of the audio sampling rate. + */ +- rclk_freq = params_rate(params) * rfs + 1; ++ rclk_freq = params_rate(params) * rfs + 2; + + ret = clk_set_rate(priv->sclk_i2s, rclk_freq); + if (ret < 0) +-- +2.20.1 + diff --git a/queue-4.19/asoc-soc-pcm-fix-a-codec-fixup-issue-in-tdm-case.patch b/queue-4.19/asoc-soc-pcm-fix-a-codec-fixup-issue-in-tdm-case.patch new file mode 100644 index 00000000000..37b6b8bcb76 --- /dev/null +++ b/queue-4.19/asoc-soc-pcm-fix-a-codec-fixup-issue-in-tdm-case.patch @@ -0,0 +1,62 @@ +From e3e7826394efc7fd10b99f7854a3b663d49e57ec Mon Sep 17 00:00:00 2001 +From: Rander Wang +Date: Fri, 8 Mar 2019 16:38:57 +0800 +Subject: ASoC:soc-pcm:fix a codec fixup issue in TDM case + +[ Upstream commit 570f18b6a8d1f0e60e8caf30e66161b6438dcc91 ] + +On HDaudio platforms, if playback is started when capture is working, +there is no audible output. + +This can be root-caused to the use of the rx|tx_mask to store an HDaudio +stream tag. + +If capture is stared before playback, rx_mask would be non-zero on HDaudio +platform, then the channel number of playback, which is in the same codec +dai with the capture, would be changed by soc_pcm_codec_params_fixup based +on the tx_mask at first, then overwritten by this function based on rx_mask +at last. + +According to the author of tx|rx_mask, tx_mask is for playback and rx_mask +is for capture. And stream direction is checked at all other references of +tx|rx_mask in ASoC, so here should be an error. This patch checks stream +direction for tx|rx_mask for fixup function. + +This issue would affect not only HDaudio+ASoC, but also I2S codecs if the +channel number based on rx_mask is not equal to the one for tx_mask. It could +be rarely reproduecd because most drivers in kernel set the same channel number +to tx|rx_mask or rx_mask is zero. + +Tested on all platforms using stream_tag & HDaudio and intel I2S platforms. + +Signed-off-by: Rander Wang +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index e8b98bfd4cf13..33060af18b5a4 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -957,10 +957,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, + codec_params = *params; + + /* fixup params based on TDM slot masks */ +- if (codec_dai->tx_mask) ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && ++ codec_dai->tx_mask) + soc_pcm_codec_params_fixup(&codec_params, + codec_dai->tx_mask); +- if (codec_dai->rx_mask) ++ ++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE && ++ codec_dai->rx_mask) + soc_pcm_codec_params_fixup(&codec_params, + codec_dai->rx_mask); + +-- +2.20.1 + diff --git a/queue-4.19/asoc-stm32-dfsdm-fix-debugfs-warnings-on-entry-creat.patch b/queue-4.19/asoc-stm32-dfsdm-fix-debugfs-warnings-on-entry-creat.patch new file mode 100644 index 00000000000..e80f7c5262a --- /dev/null +++ b/queue-4.19/asoc-stm32-dfsdm-fix-debugfs-warnings-on-entry-creat.patch @@ -0,0 +1,73 @@ +From 2c51c9ac1cda44e3c54e8633b1e4050e079ef6f8 Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Mon, 4 Mar 2019 15:52:44 +0100 +Subject: ASoC: stm32: dfsdm: fix debugfs warnings on entry creation + +[ Upstream commit c47255b61129857b74b0d86eaf59335348be05e0 ] + +Register platform component with a prefix, to avoid warnings +on debugfs entries creation, due to component name +redundancy. + +Signed-off-by: Olivier Moysan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_adfsdm.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c +index 71d341b732a4d..24948b95eb19f 100644 +--- a/sound/soc/stm/stm32_adfsdm.c ++++ b/sound/soc/stm/stm32_adfsdm.c +@@ -304,6 +304,7 @@ MODULE_DEVICE_TABLE(of, stm32_adfsdm_of_match); + static int stm32_adfsdm_probe(struct platform_device *pdev) + { + struct stm32_adfsdm_priv *priv; ++ struct snd_soc_component *component; + int ret; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); +@@ -331,9 +332,15 @@ static int stm32_adfsdm_probe(struct platform_device *pdev) + if (IS_ERR(priv->iio_cb)) + return PTR_ERR(priv->iio_cb); + +- ret = devm_snd_soc_register_component(&pdev->dev, +- &stm32_adfsdm_soc_platform, +- NULL, 0); ++ component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL); ++ if (!component) ++ return -ENOMEM; ++#ifdef CONFIG_DEBUG_FS ++ component->debugfs_prefix = "pcm"; ++#endif ++ ++ ret = snd_soc_add_component(&pdev->dev, component, ++ &stm32_adfsdm_soc_platform, NULL, 0); + if (ret < 0) + dev_err(&pdev->dev, "%s: Failed to register PCM platform\n", + __func__); +@@ -341,12 +348,20 @@ static int stm32_adfsdm_probe(struct platform_device *pdev) + return ret; + } + ++static int stm32_adfsdm_remove(struct platform_device *pdev) ++{ ++ snd_soc_unregister_component(&pdev->dev); ++ ++ return 0; ++} ++ + static struct platform_driver stm32_adfsdm_driver = { + .driver = { + .name = STM32_ADFSDM_DRV_NAME, + .of_match_table = stm32_adfsdm_of_match, + }, + .probe = stm32_adfsdm_probe, ++ .remove = stm32_adfsdm_remove, + }; + + module_platform_driver(stm32_adfsdm_driver); +-- +2.20.1 + diff --git a/queue-4.19/asoc-stm32-dfsdm-manage-multiple-prepare.patch b/queue-4.19/asoc-stm32-dfsdm-manage-multiple-prepare.patch new file mode 100644 index 00000000000..3713a114237 --- /dev/null +++ b/queue-4.19/asoc-stm32-dfsdm-manage-multiple-prepare.patch @@ -0,0 +1,94 @@ +From d6c3ab267c315ce9bd36e434c610b93de2684211 Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Mon, 4 Mar 2019 15:52:43 +0100 +Subject: ASoC: stm32: dfsdm: manage multiple prepare + +[ Upstream commit 19441e35a43b616ea6afad91ed0d9e77268d8f6a ] + +The DFSDM must be stopped when a new setting is applied. +restart systematically DFSDM on multiple prepare calls, +to apply changes. + +Signed-off-by: Olivier Moysan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_adfsdm.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c +index 706ff005234f3..71d341b732a4d 100644 +--- a/sound/soc/stm/stm32_adfsdm.c ++++ b/sound/soc/stm/stm32_adfsdm.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + +@@ -37,6 +38,8 @@ struct stm32_adfsdm_priv { + /* PCM buffer */ + unsigned char *pcm_buff; + unsigned int pos; ++ ++ struct mutex lock; /* protect against race condition on iio state */ + }; + + static const struct snd_pcm_hardware stm32_adfsdm_pcm_hw = { +@@ -62,10 +65,12 @@ static void stm32_adfsdm_shutdown(struct snd_pcm_substream *substream, + { + struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai); + ++ mutex_lock(&priv->lock); + if (priv->iio_active) { + iio_channel_stop_all_cb(priv->iio_cb); + priv->iio_active = false; + } ++ mutex_unlock(&priv->lock); + } + + static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream, +@@ -74,13 +79,19 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream, + struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai); + int ret; + ++ mutex_lock(&priv->lock); ++ if (priv->iio_active) { ++ iio_channel_stop_all_cb(priv->iio_cb); ++ priv->iio_active = false; ++ } ++ + ret = iio_write_channel_attribute(priv->iio_ch, + substream->runtime->rate, 0, + IIO_CHAN_INFO_SAMP_FREQ); + if (ret < 0) { + dev_err(dai->dev, "%s: Failed to set %d sampling rate\n", + __func__, substream->runtime->rate); +- return ret; ++ goto out; + } + + if (!priv->iio_active) { +@@ -92,6 +103,9 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream, + __func__, ret); + } + ++out: ++ mutex_unlock(&priv->lock); ++ + return ret; + } + +@@ -298,6 +312,7 @@ static int stm32_adfsdm_probe(struct platform_device *pdev) + + priv->dev = &pdev->dev; + priv->dai_drv = stm32_adfsdm_dai; ++ mutex_init(&priv->lock); + + dev_set_drvdata(&pdev->dev, priv); + +-- +2.20.1 + diff --git a/queue-4.19/asoc-stm32-sai-fix-exposed-capabilities-in-spdif-mod.patch b/queue-4.19/asoc-stm32-sai-fix-exposed-capabilities-in-spdif-mod.patch new file mode 100644 index 00000000000..018d6557e77 --- /dev/null +++ b/queue-4.19/asoc-stm32-sai-fix-exposed-capabilities-in-spdif-mod.patch @@ -0,0 +1,40 @@ +From d3ce649fca238eed706471f2c8d7f9d388ff00b9 Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Thu, 28 Feb 2019 14:19:22 +0100 +Subject: ASoC: stm32: sai: fix exposed capabilities in spdif mode + +[ Upstream commit b8468192971807c43a80d6e2c41f83141cb7b211 ] + +Change capabilities exposed in SAI S/PDIF mode, to match +actually supported formats. +In S/PDIF mode only 32 bits stereo is supported. + +Signed-off-by: Olivier Moysan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_sai_sub.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c +index e8df3cc341b5e..2fb2b914e78b4 100644 +--- a/sound/soc/stm/stm32_sai_sub.c ++++ b/sound/soc/stm/stm32_sai_sub.c +@@ -498,6 +498,14 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream, + + sai->substream = substream; + ++ if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) { ++ snd_pcm_hw_constraint_mask64(substream->runtime, ++ SNDRV_PCM_HW_PARAM_FORMAT, ++ SNDRV_PCM_FMTBIT_S32_LE); ++ snd_pcm_hw_constraint_single(substream->runtime, ++ SNDRV_PCM_HW_PARAM_CHANNELS, 2); ++ } ++ + ret = clk_prepare_enable(sai->sai_ck); + if (ret < 0) { + dev_err(cpu_dai->dev, "Failed to enable clock: %d\n", ret); +-- +2.20.1 + diff --git a/queue-4.19/asoc-stm32-sai-fix-iec958-controls-indexation.patch b/queue-4.19/asoc-stm32-sai-fix-iec958-controls-indexation.patch new file mode 100644 index 00000000000..f0af38b4f6f --- /dev/null +++ b/queue-4.19/asoc-stm32-sai-fix-iec958-controls-indexation.patch @@ -0,0 +1,48 @@ +From 6b00122a6c2e236efc67f6ce2639816750c4b47f Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Thu, 28 Feb 2019 14:19:21 +0100 +Subject: ASoC: stm32: sai: fix iec958 controls indexation + +[ Upstream commit 5f8a1000c3e630c3ac06f1d664eeaa755bce8823 ] + +Allow indexation of sai iec958 controls according +to device id. + +Signed-off-by: Olivier Moysan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_sai_sub.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c +index 85c4b6d8e89db..e8df3cc341b5e 100644 +--- a/sound/soc/stm/stm32_sai_sub.c ++++ b/sound/soc/stm/stm32_sai_sub.c +@@ -96,7 +96,7 @@ + * @slot_mask: rx or tx active slots mask. set at init or at runtime + * @data_size: PCM data width. corresponds to PCM substream width. + * @spdif_frm_cnt: S/PDIF playback frame counter +- * @snd_aes_iec958: iec958 data ++ * @iec958: iec958 data + * @ctrl_lock: control lock + */ + struct stm32_sai_sub_data { +@@ -888,11 +888,12 @@ static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd, + struct snd_soc_dai *cpu_dai) + { + struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev); ++ struct snd_kcontrol_new knew = iec958_ctls; + + if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) { + dev_dbg(&sai->pdev->dev, "%s: register iec controls", __func__); +- return snd_ctl_add(rtd->pcm->card, +- snd_ctl_new1(&iec958_ctls, sai)); ++ knew.device = rtd->pcm->device; ++ return snd_ctl_add(rtd->pcm->card, snd_ctl_new1(&knew, sai)); + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.19/asoc-tlv320aic32x4-fix-common-pins.patch b/queue-4.19/asoc-tlv320aic32x4-fix-common-pins.patch new file mode 100644 index 00000000000..c3fb0bd5536 --- /dev/null +++ b/queue-4.19/asoc-tlv320aic32x4-fix-common-pins.patch @@ -0,0 +1,33 @@ +From 0e53bf4ee2f08d1ef3c3fcae9c3b41d11ee67871 Mon Sep 17 00:00:00 2001 +From: Annaliese McDermond +Date: Sat, 30 Mar 2019 09:02:02 -0700 +Subject: ASoC: tlv320aic32x4: Fix Common Pins + +[ Upstream commit c63adb28f6d913310430f14c69f0a2ea55eed0cc ] + +The common pins were mistakenly not added to the DAPM graph. +Adding these pins will allow valid graphs to be created. + +Signed-off-by: Annaliese McDermond +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic32x4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c +index f03195d2ab2ea..45d9f4a090441 100644 +--- a/sound/soc/codecs/tlv320aic32x4.c ++++ b/sound/soc/codecs/tlv320aic32x4.c +@@ -462,6 +462,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = { + SND_SOC_DAPM_INPUT("IN2_R"), + SND_SOC_DAPM_INPUT("IN3_L"), + SND_SOC_DAPM_INPUT("IN3_R"), ++ SND_SOC_DAPM_INPUT("CM_L"), ++ SND_SOC_DAPM_INPUT("CM_R"), + }; + + static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = { +-- +2.20.1 + diff --git a/queue-4.19/asoc-tlv320aic3x-fix-reset-gpio-reference-counting.patch b/queue-4.19/asoc-tlv320aic3x-fix-reset-gpio-reference-counting.patch new file mode 100644 index 00000000000..83038d3d51b --- /dev/null +++ b/queue-4.19/asoc-tlv320aic3x-fix-reset-gpio-reference-counting.patch @@ -0,0 +1,68 @@ +From 23d45d7fda72844e2c5971f12fe399bab9377c73 Mon Sep 17 00:00:00 2001 +From: Philipp Puschmann +Date: Wed, 27 Feb 2019 16:17:33 +0100 +Subject: ASoC: tlv320aic3x: fix reset gpio reference counting + +[ Upstream commit 82ad759143ed77673db0d93d53c1cde7b99917ee ] + +This patch fixes a bug that prevents freeing the reset gpio on unloading +the module. + +aic3x_i2c_probe is called when loading the module and it calls list_add +with a probably uninitialized list entry aic3x->list (next = prev = NULL)). +So even if list_del is called it does nothing and in the end the gpio_reset +is not freed. Then a repeated module probing fails silently because +gpio_request fails. + +When moving INIT_LIST_HEAD to aic3x_i2c_probe we also have to move +list_del to aic3x_i2c_remove because aic3x_remove may be called +multiple times without aic3x_i2c_remove being called which leads to +a NULL pointer dereference. + +Signed-off-by: Philipp Puschmann +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic3x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c +index 6a271e6e6b8fc..6c0a3dad44b89 100644 +--- a/sound/soc/codecs/tlv320aic3x.c ++++ b/sound/soc/codecs/tlv320aic3x.c +@@ -1599,7 +1599,6 @@ static int aic3x_probe(struct snd_soc_component *component) + struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component); + int ret, i; + +- INIT_LIST_HEAD(&aic3x->list); + aic3x->component = component; + + for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) { +@@ -1682,7 +1681,6 @@ static void aic3x_remove(struct snd_soc_component *component) + struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component); + int i; + +- list_del(&aic3x->list); + for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) + regulator_unregister_notifier(aic3x->supplies[i].consumer, + &aic3x->disable_nb[i].nb); +@@ -1880,6 +1878,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c, + if (ret != 0) + goto err_gpio; + ++ INIT_LIST_HEAD(&aic3x->list); + list_add(&aic3x->list, &reset_list); + + return 0; +@@ -1896,6 +1895,8 @@ static int aic3x_i2c_remove(struct i2c_client *client) + { + struct aic3x_priv *aic3x = i2c_get_clientdata(client); + ++ list_del(&aic3x->list); ++ + if (gpio_is_valid(aic3x->gpio_reset) && + !aic3x_is_shared_reset(aic3x)) { + gpio_set_value(aic3x->gpio_reset, 0); +-- +2.20.1 + diff --git a/queue-4.19/asoc-wm_adsp-add-locking-to-wm_adsp2_bus_error.patch b/queue-4.19/asoc-wm_adsp-add-locking-to-wm_adsp2_bus_error.patch new file mode 100644 index 00000000000..f7bff512916 --- /dev/null +++ b/queue-4.19/asoc-wm_adsp-add-locking-to-wm_adsp2_bus_error.patch @@ -0,0 +1,67 @@ +From c36add181da5b4ea2f4d96b7976df9abebd3501a Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Tue, 19 Mar 2019 11:52:06 +0000 +Subject: ASoC: wm_adsp: Add locking to wm_adsp2_bus_error + +[ Upstream commit a2225a6d155fcb247fe4c6d87f7c91807462966d ] + +Best to lock across handling the bus error to ensure the DSP doesn't +change power state as we are reading the status registers. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index a651fed62a27d..ee85056a85774 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -3819,11 +3819,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp) + struct regmap *regmap = dsp->regmap; + int ret = 0; + ++ mutex_lock(&dsp->pwr_lock); ++ + ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val); + if (ret) { + adsp_err(dsp, + "Failed to read Region Lock Ctrl register: %d\n", ret); +- return IRQ_HANDLED; ++ goto error; + } + + if (val & ADSP2_WDT_TIMEOUT_STS_MASK) { +@@ -3842,7 +3844,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp) + adsp_err(dsp, + "Failed to read Bus Err Addr register: %d\n", + ret); +- return IRQ_HANDLED; ++ goto error; + } + + adsp_err(dsp, "bus error address = 0x%x\n", +@@ -3855,7 +3857,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp) + adsp_err(dsp, + "Failed to read Pmem Xmem Err Addr register: %d\n", + ret); +- return IRQ_HANDLED; ++ goto error; + } + + adsp_err(dsp, "xmem error address = 0x%x\n", +@@ -3868,6 +3870,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp) + regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, + ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT); + ++error: ++ mutex_unlock(&dsp->pwr_lock); ++ + return IRQ_HANDLED; + } + EXPORT_SYMBOL_GPL(wm_adsp2_bus_error); +-- +2.20.1 + diff --git a/queue-4.19/clk-meson-gxbb-round-the-vdec-dividers-to-closest.patch b/queue-4.19/clk-meson-gxbb-round-the-vdec-dividers-to-closest.patch new file mode 100644 index 00000000000..016bcef0c40 --- /dev/null +++ b/queue-4.19/clk-meson-gxbb-round-the-vdec-dividers-to-closest.patch @@ -0,0 +1,46 @@ +From e7fdade12497265520560ce7dfa8e7db594f9b9d Mon Sep 17 00:00:00 2001 +From: Maxime Jourdan +Date: Tue, 19 Mar 2019 11:25:37 +0100 +Subject: clk: meson-gxbb: round the vdec dividers to closest + +[ Upstream commit 9b70c697e87286ade406e6a02091757307dd4b7c ] + +We want the video decoder clocks to always round to closest. While the +muxes are already using CLK_MUX_ROUND_CLOSEST, the corresponding +CLK_DIVIDER_ROUND_CLOSEST was forgotten for the dividers. + +Fix this by adding the flag to the two vdec dividers. + +Fixes: a565242eb9fc ("clk: meson: gxbb: add the video decoder clocks") +Signed-off-by: Maxime Jourdan +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lkml.kernel.org/r/20190319102537.2043-1-mjourdan@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/gxbb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 6628ffa31383a..4d4f6d842c31c 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -1571,6 +1571,7 @@ static struct clk_regmap gxbb_vdec_1_div = { + .offset = HHI_VDEC_CLK_CNTL, + .shift = 0, + .width = 7, ++ .flags = CLK_DIVIDER_ROUND_CLOSEST, + }, + .hw.init = &(struct clk_init_data){ + .name = "vdec_1_div", +@@ -1616,6 +1617,7 @@ static struct clk_regmap gxbb_vdec_hevc_div = { + .offset = HHI_VDEC2_CLK_CNTL, + .shift = 16, + .width = 7, ++ .flags = CLK_DIVIDER_ROUND_CLOSEST, + }, + .hw.init = &(struct clk_init_data){ + .name = "vdec_hevc_div", +-- +2.20.1 + diff --git a/queue-4.19/drm-amd-display-fix-cursor-black-issue.patch b/queue-4.19/drm-amd-display-fix-cursor-black-issue.patch new file mode 100644 index 00000000000..eb279e8018c --- /dev/null +++ b/queue-4.19/drm-amd-display-fix-cursor-black-issue.patch @@ -0,0 +1,40 @@ +From 55e1ac0f8dc4bae584f7bbcbca9de37abed2de38 Mon Sep 17 00:00:00 2001 +From: tiancyin +Date: Mon, 1 Apr 2019 10:15:31 +0800 +Subject: drm/amd/display: fix cursor black issue + +[ Upstream commit c1cefe115d1cdc460014483319d440b2f0d07c68 ] + +[Why] +the member sdr_white_level of struct dc_cursor_attributes was not +initialized, then the random value result that +dcn10_set_cursor_sdr_white_level() set error hw_scale value 0x20D9(normal +value is 0x3c00), this cause the black cursor issue. + +[how] +just initilize the obj of struct dc_cursor_attributes to zero to avoid +the random value. + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Tianci Yin +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 2b8b892eb846f..76ee2de43ea66 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4028,6 +4028,7 @@ static void handle_cursor_update(struct drm_plane *plane, + amdgpu_crtc->cursor_width = plane->state->crtc_w; + amdgpu_crtc->cursor_height = plane->state->crtc_h; + ++ memset(&attributes, 0, sizeof(attributes)); + attributes.address.high_part = upper_32_bits(address); + attributes.address.low_part = lower_32_bits(address); + attributes.width = plane->state->crtc_w; +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-fix-an-error-code-in-mtk_hdmi_dt_parse_.patch b/queue-4.19/drm-mediatek-fix-an-error-code-in-mtk_hdmi_dt_parse_.patch new file mode 100644 index 00000000000..148c3c7144e --- /dev/null +++ b/queue-4.19/drm-mediatek-fix-an-error-code-in-mtk_hdmi_dt_parse_.patch @@ -0,0 +1,33 @@ +From a642ceaa6e1fc82a59026730dda33625a078da28 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 28 Mar 2019 17:31:30 +0300 +Subject: drm/mediatek: Fix an error code in mtk_hdmi_dt_parse_pdata() + +[ Upstream commit 2d85978341e6a32e7443d9f28639da254d53f400 ] + +We don't want to overwrite "ret", it already holds the correct error +code. The "regmap" variable might be a valid pointer as this point. + +Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") +Signed-off-by: Dan Carpenter +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c +index 643f5edd68fe3..c7a77d6f612b2 100644 +--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c ++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c +@@ -1473,7 +1473,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, + if (IS_ERR(regmap)) + ret = PTR_ERR(regmap); + if (ret) { +- ret = PTR_ERR(regmap); + dev_err(dev, + "Failed to get system configuration registers: %d\n", + ret); +-- +2.20.1 + diff --git a/queue-4.19/drm-mediatek-fix-possible-object-reference-leak.patch b/queue-4.19/drm-mediatek-fix-possible-object-reference-leak.patch new file mode 100644 index 00000000000..325acad4909 --- /dev/null +++ b/queue-4.19/drm-mediatek-fix-possible-object-reference-leak.patch @@ -0,0 +1,46 @@ +From c12a30e4ddb07538caf2ead9d3062d0096337932 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Thu, 4 Apr 2019 00:04:09 +0800 +Subject: drm/mediatek: fix possible object reference leak + +[ Upstream commit 2ae2c3316fb77dcf64275d011596b60104c45426 ] + +The call to of_parse_phandle returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +drivers/gpu/drm/mediatek/mtk_hdmi.c:1521:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function. +drivers/gpu/drm/mediatek/mtk_hdmi.c:1524:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Cc: CK Hu +Cc: Philipp Zabel +Cc: David Airlie +Cc: Daniel Vetter +Cc: Matthias Brugger +Cc: dri-devel@lists.freedesktop.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-mediatek@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c +index c7a77d6f612b2..62444a3a5742a 100644 +--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c ++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c +@@ -1508,6 +1508,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, + of_node_put(remote); + + hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np); ++ of_node_put(i2c_np); + if (!hdmi->ddc_adpt) { + dev_err(dev, "Failed to get ddc i2c adapter by node\n"); + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.19/drm-omap-hdmi4_cec-fix-cec-clock-handling-for-pm.patch b/queue-4.19/drm-omap-hdmi4_cec-fix-cec-clock-handling-for-pm.patch new file mode 100644 index 00000000000..baef4abc2b8 --- /dev/null +++ b/queue-4.19/drm-omap-hdmi4_cec-fix-cec-clock-handling-for-pm.patch @@ -0,0 +1,101 @@ +From ab478ee0c3f290c40dac5d1e42be49223a54a6c2 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 26 Mar 2019 08:14:37 -0700 +Subject: drm/omap: hdmi4_cec: Fix CEC clock handling for PM + +[ Upstream commit 36a1da15b5df493241b0011d2185fdd724ac1ed1 ] + +If CONFIG_OMAP4_DSS_HDMI_CEC is enabled in .config, deeper SoC idle +states are blocked because the CEC clock gets always enabled on init. + +Let's fix the issue by moving the CEC clock handling to happen later in +hdmi_cec_adap_enable() as suggested by Hans Verkuil . +This way the CEC clock gets only enabled when needed. This can be tested +by doing cec-ctl --playback to enable the CEC, and doing cec-ctl --clear +to disable it. + +Let's also fix the typo for "divider" in the comments while at it. + +Fixes: 8d7f934df8d8 ("omapdrm: hdmi4_cec: add OMAP4 HDMI CEC support") +Suggested-by: Hans Verkuil +Cc: Hans Verkuil +Cc: Jyri Sarha +Cc: Laurent Pinchart +Signed-off-by: Tony Lindgren +Reviewed-by: Hans Verkuil +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20190326151438.32414-1-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c | 26 ++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c +index 340383150fb98..ebf9c96d43eee 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c +@@ -175,6 +175,7 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable) + REG_FLD_MOD(core->base, HDMI_CORE_SYS_INTR_UNMASK4, 0, 3, 3); + hdmi_wp_clear_irqenable(core->wp, HDMI_IRQ_CORE); + hdmi_wp_set_irqstatus(core->wp, HDMI_IRQ_CORE); ++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0); + hdmi4_core_disable(core); + return 0; + } +@@ -182,16 +183,24 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable) + if (err) + return err; + ++ /* ++ * Initialize CEC clock divider: CEC needs 2MHz clock hence ++ * set the divider to 24 to get 48/24=2MHz clock ++ */ ++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0); ++ + /* Clear TX FIFO */ + if (!hdmi_cec_clear_tx_fifo(adap)) { + pr_err("cec-%s: could not clear TX FIFO\n", adap->name); +- return -EIO; ++ err = -EIO; ++ goto err_disable_clk; + } + + /* Clear RX FIFO */ + if (!hdmi_cec_clear_rx_fifo(adap)) { + pr_err("cec-%s: could not clear RX FIFO\n", adap->name); +- return -EIO; ++ err = -EIO; ++ goto err_disable_clk; + } + + /* Clear CEC interrupts */ +@@ -236,6 +245,12 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable) + hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, temp); + } + return 0; ++ ++err_disable_clk: ++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0); ++ hdmi4_core_disable(core); ++ ++ return err; + } + + static int hdmi_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr) +@@ -333,11 +348,8 @@ int hdmi4_cec_init(struct platform_device *pdev, struct hdmi_core_data *core, + return ret; + core->wp = wp; + +- /* +- * Initialize CEC clock divider: CEC needs 2MHz clock hence +- * set the devider to 24 to get 48/24=2MHz clock +- */ +- REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0); ++ /* Disable clock initially, hdmi_cec_adap_enable() manages it */ ++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0); + + ret = cec_register_adapter(core->adap, &pdev->dev); + if (ret < 0) { +-- +2.20.1 + diff --git a/queue-4.19/drm-sun4i-tcon-top-fix-null-invalid-pointer-derefere.patch b/queue-4.19/drm-sun4i-tcon-top-fix-null-invalid-pointer-derefere.patch new file mode 100644 index 00000000000..6c8ad594cb2 --- /dev/null +++ b/queue-4.19/drm-sun4i-tcon-top-fix-null-invalid-pointer-derefere.patch @@ -0,0 +1,72 @@ +From 2350a6603b5c564196dfc6844efbbd76b6b25209 Mon Sep 17 00:00:00 2001 +From: Ondrej Jirman +Date: Sat, 6 Apr 2019 01:30:48 +0200 +Subject: drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in + sun8i_tcon_top_un/bind + +[ Upstream commit 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea ] + +There are two problems here: + +1. Not all clk_data->hws[] need to be initialized, depending on various + configured quirks. This leads to NULL ptr deref in + clk_hw_unregister_gate() in sun8i_tcon_top_unbind() +2. If there is error when registering the clk_data->hws[], + err_unregister_gates error path will try to unregister + IS_ERR()=true (invalid) pointer. + +For problem (1) I have this stack trace: + +Unable to handle kernel NULL pointer dereference at virtual + address 0000000000000008 +Call trace: + clk_hw_unregister+0x8/0x18 + clk_hw_unregister_gate+0x14/0x28 + sun8i_tcon_top_unbind+0x2c/0x60 + component_unbind.isra.4+0x2c/0x50 + component_bind_all+0x1d4/0x230 + sun4i_drv_bind+0xc4/0x1a0 + try_to_bring_up_master+0x164/0x1c0 + __component_add+0xa0/0x168 + component_add+0x10/0x18 + sun8i_dw_hdmi_probe+0x18/0x20 + platform_drv_probe+0x3c/0x70 + really_probe+0xcc/0x278 + driver_probe_device+0x34/0xa8 + +Problem (2) was identified by head scratching. + +Signed-off-by: Ondrej Jirman +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20190405233048.3823-1-megous@megous.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c +index adcdf946c365d..dfbcd1ad81a54 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c ++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c +@@ -217,7 +217,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master, + + err_unregister_gates: + for (i = 0; i < CLK_NUM; i++) +- if (clk_data->hws[i]) ++ if (!IS_ERR_OR_NULL(clk_data->hws[i])) + clk_hw_unregister_gate(clk_data->hws[i]); + clk_disable_unprepare(tcon_top->bus); + err_assert_reset: +@@ -235,7 +235,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master, + + of_clk_del_provider(dev->of_node); + for (i = 0; i < CLK_NUM; i++) +- clk_hw_unregister_gate(clk_data->hws[i]); ++ if (clk_data->hws[i]) ++ clk_hw_unregister_gate(clk_data->hws[i]); + + clk_disable_unprepare(tcon_top->bus); + reset_control_assert(tcon_top->rst); +-- +2.20.1 + diff --git a/queue-4.19/ib-hfi1-eliminate-opcode-tests-on-mr-deref.patch b/queue-4.19/ib-hfi1-eliminate-opcode-tests-on-mr-deref.patch new file mode 100644 index 00000000000..07e27638bd0 --- /dev/null +++ b/queue-4.19/ib-hfi1-eliminate-opcode-tests-on-mr-deref.patch @@ -0,0 +1,52 @@ +From 45b2f726129885a1e1ab78b4fc89958532026f72 Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Mon, 18 Mar 2019 09:55:39 -0700 +Subject: IB/hfi1: Eliminate opcode tests on mr deref + +[ Upstream commit a8639a79e85c18c16c10089edd589c7948f19bbd ] + +When an old ack_queue entry is used to store an incoming request, it may +need to clean up the old entry if it is still referencing the +MR. Originally only RDMA READ request needed to reference MR on the +responder side and therefore the opcode was tested when cleaning up the +old entry. The introduction of tid rdma specific operations in the +ack_queue makes the specific opcode tests wrong. Multiple opcodes (RDMA +READ, TID RDMA READ, and TID RDMA WRITE) may need MR ref cleanup. + +Remove the opcode specific tests associated with the ack_queue. + +Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging") +Signed-off-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/rc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c +index 6f013a565353f..770c78c657306 100644 +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -2303,7 +2303,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet) + update_ack_queue(qp, next); + } + e = &qp->s_ack_queue[qp->r_head_ack_queue]; +- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) { ++ if (e->rdma_sge.mr) { + rvt_put_mr(e->rdma_sge.mr); + e->rdma_sge.mr = NULL; + } +@@ -2377,7 +2377,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet) + update_ack_queue(qp, next); + } + e = &qp->s_ack_queue[qp->r_head_ack_queue]; +- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) { ++ if (e->rdma_sge.mr) { + rvt_put_mr(e->rdma_sge.mr); + e->rdma_sge.mr = NULL; + } +-- +2.20.1 + diff --git a/queue-4.19/ib-hfi1-fix-the-allocation-of-rsm-table.patch b/queue-4.19/ib-hfi1-fix-the-allocation-of-rsm-table.patch new file mode 100644 index 00000000000..a789df2df19 --- /dev/null +++ b/queue-4.19/ib-hfi1-fix-the-allocation-of-rsm-table.patch @@ -0,0 +1,101 @@ +From cbca3091c6a0589acf261d3278364254d92af6fc Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Mon, 18 Mar 2019 09:55:49 -0700 +Subject: IB/hfi1: Fix the allocation of RSM table + +[ Upstream commit d0294344470e6b52d097aa7369173f32d11f2f52 ] + +The receive side mapping (RSM) on hfi1 hardware is a special +matching mechanism to direct an incoming packet to a given +hardware receive context. It has 4 instances of matching capabilities +(RSM0 - RSM3) that share the same RSM table (RMT). The RMT has a total of +256 entries, each of which points to a receive context. + +Currently, three instances of RSM have been used: +1. RSM0 by QOS; +2. RSM1 by PSM FECN; +3. RSM2 by VNIC. + +Each RSM instance should reserve enough entries in RMT to function +properly. Since both PSM and VNIC could allocate any receive context +between dd->first_dyn_alloc_ctxt and dd->num_rcv_contexts, PSM FECN must +reserve enough RMT entries to cover the entire receive context index +range (dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt) instead of only +the user receive contexts allocated for PSM +(dd->num_user_contexts). Consequently, the sizing of +dd->num_user_contexts in set_up_context_variables is incorrect. + +Fixes: 2280740f01ae ("IB/hfi1: Virtual Network Interface Controller (VNIC) HW support") +Reviewed-by: Mike Marciniszyn +Reviewed-by: Michael J. Ruhl +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/chip.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 902d12d6d88b0..b12c8ff8ed666 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -13388,7 +13388,7 @@ static int set_up_context_variables(struct hfi1_devdata *dd) + int total_contexts; + int ret; + unsigned ngroups; +- int qos_rmt_count; ++ int rmt_count; + int user_rmt_reduced; + u32 n_usr_ctxts; + u32 send_contexts = chip_send_contexts(dd); +@@ -13450,10 +13450,20 @@ static int set_up_context_variables(struct hfi1_devdata *dd) + n_usr_ctxts = rcv_contexts - total_contexts; + } + +- /* each user context requires an entry in the RMT */ +- qos_rmt_count = qos_rmt_entries(dd, NULL, NULL); +- if (qos_rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) { +- user_rmt_reduced = NUM_MAP_ENTRIES - qos_rmt_count; ++ /* ++ * The RMT entries are currently allocated as shown below: ++ * 1. QOS (0 to 128 entries); ++ * 2. FECN for PSM (num_user_contexts + num_vnic_contexts); ++ * 3. VNIC (num_vnic_contexts). ++ * It should be noted that PSM FECN oversubscribe num_vnic_contexts ++ * entries of RMT because both VNIC and PSM could allocate any receive ++ * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts, ++ * and PSM FECN must reserve an RMT entry for each possible PSM receive ++ * context. ++ */ ++ rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_vnic_contexts * 2); ++ if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) { ++ user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count; + dd_dev_err(dd, + "RMT size is reducing the number of user receive contexts from %u to %d\n", + n_usr_ctxts, +@@ -14441,9 +14451,11 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd, + u64 reg; + int i, idx, regoff, regidx; + u8 offset; ++ u32 total_cnt; + + /* there needs to be enough room in the map table */ +- if (rmt->used + dd->num_user_contexts >= NUM_MAP_ENTRIES) { ++ total_cnt = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; ++ if (rmt->used + total_cnt >= NUM_MAP_ENTRIES) { + dd_dev_err(dd, "User FECN handling disabled - too many user contexts allocated\n"); + return; + } +@@ -14497,7 +14509,7 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd, + /* add rule 1 */ + add_rsm_rule(dd, RSM_INS_FECN, &rrd); + +- rmt->used += dd->num_user_contexts; ++ rmt->used += total_cnt; + } + + /* Initialize RSM for VNIC */ +-- +2.20.1 + diff --git a/queue-4.19/iommu-amd-set-exclusion-range-correctly.patch b/queue-4.19/iommu-amd-set-exclusion-range-correctly.patch new file mode 100644 index 00000000000..f31bfbb834b --- /dev/null +++ b/queue-4.19/iommu-amd-set-exclusion-range-correctly.patch @@ -0,0 +1,38 @@ +From 2ed49ebbe02beb07462ba0910287539f2ebd30b7 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Fri, 12 Apr 2019 12:50:31 +0200 +Subject: iommu/amd: Set exclusion range correctly + +[ Upstream commit 3c677d206210f53a4be972211066c0f1cd47fe12 ] + +The exlcusion range limit register needs to contain the +base-address of the last page that is part of the range, as +bits 0-11 of this register are treated as 0xfff by the +hardware for comparisons. + +So correctly set the exclusion range in the hardware to the +last page which is _in_ the range. + +Fixes: b2026aa2dce44 ('x86, AMD IOMMU: add functions for programming IOMMU MMIO space') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index be3801d43d48b..3a1d30304f7e9 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -356,7 +356,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val) + static void iommu_set_exclusion_range(struct amd_iommu *iommu) + { + u64 start = iommu->exclusion_start & PAGE_MASK; +- u64 limit = (start + iommu->exclusion_length) & PAGE_MASK; ++ u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK; + u64 entry; + + if (!iommu->exclusion_start) +-- +2.20.1 + diff --git a/queue-4.19/linux-kernel.h-use-parentheses-around-argument-in-u6.patch b/queue-4.19/linux-kernel.h-use-parentheses-around-argument-in-u6.patch new file mode 100644 index 00000000000..ae508afe2a5 --- /dev/null +++ b/queue-4.19/linux-kernel.h-use-parentheses-around-argument-in-u6.patch @@ -0,0 +1,70 @@ +From 064453197ac12024f16cfeef27687790e32c50e9 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Fri, 29 Mar 2019 22:46:49 +0100 +Subject: linux/kernel.h: Use parentheses around argument in u64_to_user_ptr() + +[ Upstream commit a0fe2c6479aab5723239b315ef1b552673f434a3 ] + +Use parentheses around uses of the argument in u64_to_user_ptr() to +ensure that the cast doesn't apply to part of the argument. + +There are existing uses of the macro of the form + + u64_to_user_ptr(A + B) + +which expands to + + (void __user *)(uintptr_t)A + B + +(the cast applies to the first operand of the addition, the addition +is a pointer addition). This happens to still work as intended, the +semantic difference doesn't cause a difference in behavior. + +But I want to use u64_to_user_ptr() with a ternary operator in the +argument, like so: + + u64_to_user_ptr(A ? B : C) + +This currently doesn't work as intended. + +Signed-off-by: Jann Horn +Signed-off-by: Borislav Petkov +Reviewed-by: Mukesh Ojha +Cc: Andrei Vagin +Cc: Andrew Morton +Cc: Dan Carpenter +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jani Nikula +Cc: Kees Cook +Cc: Masahiro Yamada +Cc: NeilBrown +Cc: Peter Zijlstra +Cc: Qiaowei Ren +Cc: Thomas Gleixner +Cc: x86-ml +Link: https://lkml.kernel.org/r/20190329214652.258477-1-jannh@google.com +Signed-off-by: Sasha Levin +--- + include/linux/kernel.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index d6aac75b51baa..3d83ebb302cfd 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -73,8 +73,8 @@ + + #define u64_to_user_ptr(x) ( \ + { \ +- typecheck(u64, x); \ +- (void __user *)(uintptr_t)x; \ ++ typecheck(u64, (x)); \ ++ (void __user *)(uintptr_t)(x); \ + } \ + ) + +-- +2.20.1 + diff --git a/queue-4.19/mips-kgdb-fix-kgdb-support-for-smp-platforms.patch b/queue-4.19/mips-kgdb-fix-kgdb-support-for-smp-platforms.patch new file mode 100644 index 00000000000..81c9fbec0bf --- /dev/null +++ b/queue-4.19/mips-kgdb-fix-kgdb-support-for-smp-platforms.patch @@ -0,0 +1,53 @@ +From 379ddf102e732cc58f90a149a9153754624d415d Mon Sep 17 00:00:00 2001 +From: Chong Qiao +Date: Thu, 28 Mar 2019 07:08:01 +0800 +Subject: MIPS: KGDB: fix kgdb support for SMP platforms. + +[ Upstream commit ab8a6d821179ab9bea1a9179f535ccba6330c1ed ] + +KGDB_call_nmi_hook is called by other cpu through smp call. +MIPS smp call is processed in ipi irq handler and regs is saved in + handle_int. +So kgdb_call_nmi_hook get regs by get_irq_regs and regs will be passed + to kgdb_cpu_enter. + +Signed-off-by: Chong Qiao +Reviewed-by: Douglas Anderson +Acked-by: Daniel Thompson +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: Will Deacon +Cc: Christophe Leroy +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: QiaoChong +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/kgdb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c +index eb6c0d582626b..2c1e30ca7ee4e 100644 +--- a/arch/mips/kernel/kgdb.c ++++ b/arch/mips/kernel/kgdb.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + static struct hard_trap_info { + unsigned char tt; /* Trap type code for MIPS R3xxx and R4xxx */ +@@ -214,7 +215,7 @@ static void kgdb_call_nmi_hook(void *ignored) + old_fs = get_fs(); + set_fs(get_ds()); + +- kgdb_nmicallback(raw_smp_processor_id(), NULL); ++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs()); + + set_fs(old_fs); + } +-- +2.20.1 + diff --git a/queue-4.19/nvme-fc-correct-csn-initialization-and-increments-on.patch b/queue-4.19/nvme-fc-correct-csn-initialization-and-increments-on.patch new file mode 100644 index 00000000000..81a72d5baa4 --- /dev/null +++ b/queue-4.19/nvme-fc-correct-csn-initialization-and-increments-on.patch @@ -0,0 +1,96 @@ +From 6e762ddd44112bf469460e40a18a9ee6a9c677d0 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Mon, 8 Apr 2019 11:15:19 -0700 +Subject: nvme-fc: correct csn initialization and increments on error + +[ Upstream commit 67f471b6ed3b09033c4ac77ea03f92afdb1989fe ] + +This patch fixes a long-standing bug that initialized the FC-NVME +cmnd iu CSN value to 1. Early FC-NVME specs had the connection starting +with CSN=1. By the time the spec reached approval, the language had +changed to state a connection should start with CSN=0. This patch +corrects the initialization value for FC-NVME connections. + +Additionally, in reviewing the transport, the CSN value is assigned to +the new IU early in the start routine. It's possible that a later dma +map request may fail, causing the command to never be sent to the +controller. Change the location of the assignment so that it is +immediately prior to calling the lldd. Add a comment block to explain +the impacts if the lldd were to additionally fail sending the command. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Reviewed-by: Ewan D. Milne +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 9375fa705d829..67dec8860bf3c 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1844,7 +1844,7 @@ nvme_fc_init_queue(struct nvme_fc_ctrl *ctrl, int idx) + memset(queue, 0, sizeof(*queue)); + queue->ctrl = ctrl; + queue->qnum = idx; +- atomic_set(&queue->csn, 1); ++ atomic_set(&queue->csn, 0); + queue->dev = ctrl->dev; + + if (idx > 0) +@@ -1886,7 +1886,7 @@ nvme_fc_free_queue(struct nvme_fc_queue *queue) + */ + + queue->connection_id = 0; +- atomic_set(&queue->csn, 1); ++ atomic_set(&queue->csn, 0); + } + + static void +@@ -2182,7 +2182,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue, + { + struct nvme_fc_cmd_iu *cmdiu = &op->cmd_iu; + struct nvme_command *sqe = &cmdiu->sqe; +- u32 csn; + int ret, opstate; + + /* +@@ -2197,8 +2196,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue, + + /* format the FC-NVME CMD IU and fcp_req */ + cmdiu->connection_id = cpu_to_be64(queue->connection_id); +- csn = atomic_inc_return(&queue->csn); +- cmdiu->csn = cpu_to_be32(csn); + cmdiu->data_len = cpu_to_be32(data_len); + switch (io_dir) { + case NVMEFC_FCP_WRITE: +@@ -2256,11 +2253,24 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue, + if (!(op->flags & FCOP_FLAGS_AEN)) + blk_mq_start_request(op->rq); + ++ cmdiu->csn = cpu_to_be32(atomic_inc_return(&queue->csn)); + ret = ctrl->lport->ops->fcp_io(&ctrl->lport->localport, + &ctrl->rport->remoteport, + queue->lldd_handle, &op->fcp_req); + + if (ret) { ++ /* ++ * If the lld fails to send the command is there an issue with ++ * the csn value? If the command that fails is the Connect, ++ * no - as the connection won't be live. If it is a command ++ * post-connect, it's possible a gap in csn may be created. ++ * Does this matter? As Linux initiators don't send fused ++ * commands, no. The gap would exist, but as there's nothing ++ * that depends on csn order to be delivered on the target ++ * side, it shouldn't hurt. It would be difficult for a ++ * target to even detect the csn gap as it has no idea when the ++ * cmd with the csn was supposed to arrive. ++ */ + opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE); + __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate); + +-- +2.20.1 + diff --git a/queue-4.19/objtool-add-rewind_stack_do_exit-to-the-noreturn-lis.patch b/queue-4.19/objtool-add-rewind_stack_do_exit-to-the-noreturn-lis.patch new file mode 100644 index 00000000000..21eb02fedf6 --- /dev/null +++ b/queue-4.19/objtool-add-rewind_stack_do_exit-to-the-noreturn-lis.patch @@ -0,0 +1,36 @@ +From fdfb7e5a85784134ebc515cde517d8fbe2831887 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Thu, 4 Apr 2019 12:17:35 -0500 +Subject: objtool: Add rewind_stack_do_exit() to the noreturn list + +[ Upstream commit 4fa5ecda2bf96be7464eb406df8aba9d89260227 ] + +This fixes the following warning seen on GCC 7.3: + + arch/x86/kernel/dumpstack.o: warning: objtool: oops_end() falls through to next function show_regs() + +Reported-by: kbuild test robot +Signed-off-by: Josh Poimboeuf +Signed-off-by: Thomas Gleixner +Cc: Peter Zijlstra +Link: https://lkml.kernel.org/r/3418ebf5a5a9f6ed7e80954c741c0b904b67b5dc.1554398240.git.jpoimboe@redhat.com +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 550f17611bd75..ef152daccc333 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -165,6 +165,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func, + "fortify_panic", + "usercopy_abort", + "machine_real_restart", ++ "rewind_stack_do_exit", + }; + + if (func->bind == STB_WEAK) +-- +2.20.1 + diff --git a/queue-4.19/perf-core-fix-perf_event_disable_inatomic-race.patch b/queue-4.19/perf-core-fix-perf_event_disable_inatomic-race.patch new file mode 100644 index 00000000000..9ef3e173165 --- /dev/null +++ b/queue-4.19/perf-core-fix-perf_event_disable_inatomic-race.patch @@ -0,0 +1,187 @@ +From 402f48b5b20808a80bfd5b69876889a61b5de87c Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 4 Apr 2019 15:03:00 +0200 +Subject: perf/core: Fix perf_event_disable_inatomic() race + +[ Upstream commit 1d54ad944074010609562da5c89e4f5df2f4e5db ] + +Thomas-Mich Richter reported he triggered a WARN()ing from event_function_local() +on his s390. The problem boils down to: + + CPU-A CPU-B + + perf_event_overflow() + perf_event_disable_inatomic() + @pending_disable = 1 + irq_work_queue(); + + sched-out + event_sched_out() + @pending_disable = 0 + + sched-in + perf_event_overflow() + perf_event_disable_inatomic() + @pending_disable = 1; + irq_work_queue(); // FAILS + + irq_work_run() + perf_pending_event() + if (@pending_disable) + perf_event_disable_local(); // WHOOPS + +The problem exists in generic, but s390 is particularly sensitive +because it doesn't implement arch_irq_work_raise(), nor does it call +irq_work_run() from it's PMU interrupt handler (nor would that be +sufficient in this case, because s390 also generates +perf_event_overflow() from pmu::stop). Add to that the fact that s390 +is a virtual architecture and (virtual) CPU-A can stall long enough +for the above race to happen, even if it would self-IPI. + +Adding a irq_work_sync() to event_sched_in() would work for all hardare +PMUs that properly use irq_work_run() but fails for software PMUs. + +Instead encode the CPU number in @pending_disable, such that we can +tell which CPU requested the disable. This then allows us to detect +the above scenario and even redirect the IPI to make up for the failed +queue. + +Reported-by: Thomas-Mich Richter +Tested-by: Thomas Richter +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Mark Rutland +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Heiko Carstens +Cc: Hendrik Brueckner +Cc: Jiri Olsa +Cc: Kees Cook +Cc: Linus Torvalds +Cc: Martin Schwidefsky +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 52 ++++++++++++++++++++++++++++++------- + kernel/events/ring_buffer.c | 4 +-- + 2 files changed, 45 insertions(+), 11 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 87bd96399d1ce..171b83ebed4a3 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2007,8 +2007,8 @@ event_sched_out(struct perf_event *event, + event->pmu->del(event, 0); + event->oncpu = -1; + +- if (event->pending_disable) { +- event->pending_disable = 0; ++ if (READ_ONCE(event->pending_disable) >= 0) { ++ WRITE_ONCE(event->pending_disable, -1); + state = PERF_EVENT_STATE_OFF; + } + perf_event_set_state(event, state); +@@ -2196,7 +2196,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable); + + void perf_event_disable_inatomic(struct perf_event *event) + { +- event->pending_disable = 1; ++ WRITE_ONCE(event->pending_disable, smp_processor_id()); ++ /* can fail, see perf_pending_event_disable() */ + irq_work_queue(&event->pending); + } + +@@ -5803,10 +5804,45 @@ void perf_event_wakeup(struct perf_event *event) + } + } + ++static void perf_pending_event_disable(struct perf_event *event) ++{ ++ int cpu = READ_ONCE(event->pending_disable); ++ ++ if (cpu < 0) ++ return; ++ ++ if (cpu == smp_processor_id()) { ++ WRITE_ONCE(event->pending_disable, -1); ++ perf_event_disable_local(event); ++ return; ++ } ++ ++ /* ++ * CPU-A CPU-B ++ * ++ * perf_event_disable_inatomic() ++ * @pending_disable = CPU-A; ++ * irq_work_queue(); ++ * ++ * sched-out ++ * @pending_disable = -1; ++ * ++ * sched-in ++ * perf_event_disable_inatomic() ++ * @pending_disable = CPU-B; ++ * irq_work_queue(); // FAILS ++ * ++ * irq_work_run() ++ * perf_pending_event() ++ * ++ * But the event runs on CPU-B and wants disabling there. ++ */ ++ irq_work_queue_on(&event->pending, cpu); ++} ++ + static void perf_pending_event(struct irq_work *entry) + { +- struct perf_event *event = container_of(entry, +- struct perf_event, pending); ++ struct perf_event *event = container_of(entry, struct perf_event, pending); + int rctx; + + rctx = perf_swevent_get_recursion_context(); +@@ -5815,10 +5851,7 @@ static void perf_pending_event(struct irq_work *entry) + * and we won't recurse 'further'. + */ + +- if (event->pending_disable) { +- event->pending_disable = 0; +- perf_event_disable_local(event); +- } ++ perf_pending_event_disable(event); + + if (event->pending_wakeup) { + event->pending_wakeup = 0; +@@ -9969,6 +10002,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + + + init_waitqueue_head(&event->waitq); ++ event->pending_disable = -1; + init_irq_work(&event->pending, perf_pending_event); + + mutex_init(&event->mmap_mutex); +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 474b2ccdbe69e..99c7f199f2d4e 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -393,7 +393,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle, + * store that will be enabled on successful return + */ + if (!handle->size) { /* A, matches D */ +- event->pending_disable = 1; ++ event->pending_disable = smp_processor_id(); + perf_output_wakeup(handle); + local_set(&rb->aux_nest, 0); + goto err_put; +@@ -471,7 +471,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size) + + if (wakeup) { + if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED) +- handle->event->pending_disable = 1; ++ handle->event->pending_disable = smp_processor_id(); + perf_output_wakeup(handle); + } + +-- +2.20.1 + diff --git a/queue-4.19/perf-x86-intel-fix-handling-of-wakeup_events-for-mul.patch b/queue-4.19/perf-x86-intel-fix-handling-of-wakeup_events-for-mul.patch new file mode 100644 index 00000000000..ee237410c4d --- /dev/null +++ b/queue-4.19/perf-x86-intel-fix-handling-of-wakeup_events-for-mul.patch @@ -0,0 +1,59 @@ +From 38ee2243aff928af588b2c25995b006f533d3963 Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Wed, 6 Mar 2019 11:50:48 -0800 +Subject: perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS + +[ Upstream commit 583feb08e7f7ac9d533b446882eb3a54737a6dbb ] + +When an event is programmed with attr.wakeup_events=N (N>0), it means +the caller is interested in getting a user level notification after +N samples have been recorded in the kernel sampling buffer. + +With precise events on Intel processors, the kernel uses PEBS. +The kernel tries minimize sampling overhead by verifying +if the event configuration is compatible with multi-entry PEBS mode. +If so, the kernel is notified only when the buffer has reached its threshold. +Other PEBS operates in single-entry mode, the kenrel is notified for each +PEBS sample. + +The problem is that the current implementation look at frequency +mode and event sample_type but ignores the wakeup_events field. Thus, +it may not be possible to receive a notification after each precise event. + +This patch fixes this problem by disabling multi-entry PEBS if wakeup_events +is non-zero. + +Signed-off-by: Stephane Eranian +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andi Kleen +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: kan.liang@intel.com +Link: https://lkml.kernel.org/r/20190306195048.189514-1-eranian@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 3dd204d1dd194..26432ee4590e3 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3068,7 +3068,7 @@ static int intel_pmu_hw_config(struct perf_event *event) + return ret; + + if (event->attr.precise_ip) { +- if (!event->attr.freq) { ++ if (!(event->attr.freq || event->attr.wakeup_events)) { + event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD; + if (!(event->attr.sample_type & + ~intel_pmu_large_pebs_flags(event))) +-- +2.20.1 + diff --git a/queue-4.19/perf-x86-intel-initialize-tfa-msr.patch b/queue-4.19/perf-x86-intel-initialize-tfa-msr.patch new file mode 100644 index 00000000000..15d18b2f663 --- /dev/null +++ b/queue-4.19/perf-x86-intel-initialize-tfa-msr.patch @@ -0,0 +1,49 @@ +From a305a02b5b0a9f45b7670fa77b1197812a7e6468 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 21 Mar 2019 13:38:49 +0100 +Subject: perf/x86/intel: Initialize TFA MSR + +[ Upstream commit d7262457e35dbe239659e62654e56f8ddb814bed ] + +Stephane reported that the TFA MSR is not initialized by the kernel, +but the TFA bit could set by firmware or as a leftover from a kexec, +which makes the state inconsistent. + +Reported-by: Stephane Eranian +Tested-by: Nelson DSouza +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: tonyj@suse.com +Link: https://lkml.kernel.org/r/20190321123849.GN6521@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 26432ee4590e3..f9958ad4d3353 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3447,6 +3447,12 @@ static void intel_pmu_cpu_starting(int cpu) + + cpuc->lbr_sel = NULL; + ++ if (x86_pmu.flags & PMU_FL_TFA) { ++ WARN_ON_ONCE(cpuc->tfa_shadow); ++ cpuc->tfa_shadow = ~0ULL; ++ intel_set_tfa(cpuc, false); ++ } ++ + if (x86_pmu.version > 1) + flip_smm_bit(&x86_pmu.attr_freeze_on_smi); + +-- +2.20.1 + diff --git a/queue-4.19/platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch b/queue-4.19/platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch new file mode 100644 index 00000000000..649814fe1b9 --- /dev/null +++ b/queue-4.19/platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch @@ -0,0 +1,40 @@ +From 929e7636ddc662bab8f73dd77912ef7e33de5a6b Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Thu, 11 Apr 2019 10:22:43 -0700 +Subject: platform/x86: pmc_atom: Drop __initconst on dmi table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit b995dcca7cf12f208cfd95fd9d5768dca7cccec7 ] + +It's used by probe and that isn't an init function. Drop this so that we +don't get a section mismatch. + +Reported-by: kbuild test robot +Cc: David Müller +Cc: Hans de Goede +Cc: Andy Shevchenko +Fixes: 7c2e07130090 ("clk: x86: Add system specific quirk to mark clocks as critical") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/pmc_atom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index eaec2d306481c..c7039f52ad518 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -396,7 +396,7 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc) + * Some systems need one or more of their pmc_plt_clks to be + * marked as critical. + */ +-static const struct dmi_system_id critclk_systems[] __initconst = { ++static const struct dmi_system_id critclk_systems[] = { + { + .ident = "MPL CEC1x", + .matches = { +-- +2.20.1 + diff --git a/queue-4.19/rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch b/queue-4.19/rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch new file mode 100644 index 00000000000..c65f0ca570f --- /dev/null +++ b/queue-4.19/rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch @@ -0,0 +1,79 @@ +From 7e7d0318ecdd65f91bfbbe02391bd731832e0c26 Mon Sep 17 00:00:00 2001 +From: Lijun Ou +Date: Sun, 7 Apr 2019 13:23:38 +0800 +Subject: RDMA/hns: Fix bug that caused srq creation to fail + +[ Upstream commit 4772e03d239484f3461e33c79d721c8ea03f7416 ] + +Due to the incorrect use of the seg and obj information, the position of +the mtt is calculated incorrectly, and the free space of the page is not +enough to store the entire mtt, resulting in access to the next page. This +patch fixes this problem. + + Unable to handle kernel paging request at virtual address ffff00006e3cd000 + ... + Call trace: + hns_roce_write_mtt+0x154/0x2f0 [hns_roce] + hns_roce_buf_write_mtt+0xa8/0xd8 [hns_roce] + hns_roce_create_srq+0x74c/0x808 [hns_roce] + ib_create_srq+0x28/0xc8 + +Fixes: 0203b14c4f32 ("RDMA/hns: Unify the calculation for hem index in hip08") +Signed-off-by: chenglang +Signed-off-by: Lijun Ou +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 6 ++++-- + drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index f6faefed96e8b..a73d388b70930 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -745,6 +745,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev, + idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk; + dma_offset = offset = idx_offset * table->obj_size; + } else { ++ u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */ ++ + hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop); + /* mtt mhop */ + i = mhop.l0_idx; +@@ -756,8 +758,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev, + hem_idx = i; + + hem = table->hem[hem_idx]; +- dma_offset = offset = (obj & (table->num_obj - 1)) * +- table->obj_size % mhop.bt_chunk_size; ++ dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size % ++ mhop.bt_chunk_size; + if (mhop.hop_num == 2) + dma_offset = offset = 0; + } +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index eb26a5f6fc58c..41a538d23b802 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -707,7 +707,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_table *table; + dma_addr_t dma_handle; + __le64 *mtts; +- u32 s = start_index * sizeof(u64); + u32 bt_page_size; + u32 i; + +@@ -730,7 +729,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev, + table = &hr_dev->mr_table.mtt_cqe_table; + + mtts = hns_roce_table_find(hr_dev, table, +- mtt->first_seg + s / hr_dev->caps.mtt_entry_sz, ++ mtt->first_seg + ++ start_index / HNS_ROCE_MTT_ENTRY_PER_SEG, + &dma_handle); + if (!mtts) + return -ENOMEM; +-- +2.20.1 + diff --git a/queue-4.19/rdma-vmw_pvrdma-fix-memory-leak-on-pvrdma_pci_remove.patch b/queue-4.19/rdma-vmw_pvrdma-fix-memory-leak-on-pvrdma_pci_remove.patch new file mode 100644 index 00000000000..dce08ef4b5f --- /dev/null +++ b/queue-4.19/rdma-vmw_pvrdma-fix-memory-leak-on-pvrdma_pci_remove.patch @@ -0,0 +1,34 @@ +From 4704bfc0643b890b0e75eb38a5a682d65d166931 Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Wed, 3 Apr 2019 16:52:54 +0300 +Subject: RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove + +[ Upstream commit ea7a5c706fa49273cf6d1d9def053ecb50db2076 ] + +Make sure to free the DSR on pvrdma_pci_remove() to avoid the memory leak. + +Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") +Signed-off-by: Kamal Heib +Acked-by: Adit Ranadive +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +index a5719899f49ad..ed99f0a08dc4e 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +@@ -1123,6 +1123,8 @@ static void pvrdma_pci_remove(struct pci_dev *pdev) + pvrdma_page_dir_cleanup(dev, &dev->cq_pdir); + pvrdma_page_dir_cleanup(dev, &dev->async_pdir); + pvrdma_free_slots(dev); ++ dma_free_coherent(&pdev->dev, sizeof(*dev->dsr), dev->dsr, ++ dev->dsrbase); + + iounmap(dev->regs); + kfree(dev->sgid_tbl); +-- +2.20.1 + diff --git a/queue-4.19/scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err.patch b/queue-4.19/scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err.patch new file mode 100644 index 00000000000..dfd29bea342 --- /dev/null +++ b/queue-4.19/scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err.patch @@ -0,0 +1,38 @@ +From 1679a11063c1d4f39820ace0e182c16ac0862cd6 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Fri, 5 Apr 2019 20:39:13 +0530 +Subject: scsi: csiostor: fix missing data copy in csio_scsi_err_handler() + +[ Upstream commit 5c2442fd78998af60e13aba506d103f7f43f8701 ] + +If scsi cmd sglist is not suitable for DDP then csiostor driver uses +preallocated buffers for DDP, because of this data copy is required from +DDP buffer to scsi cmd sglist before calling ->scsi_done(). + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/csiostor/csio_scsi.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c +index dab0d3f9bee13..e09c7f360dbde 100644 +--- a/drivers/scsi/csiostor/csio_scsi.c ++++ b/drivers/scsi/csiostor/csio_scsi.c +@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req) + } + + out: +- if (req->nsge > 0) ++ if (req->nsge > 0) { + scsi_dma_unmap(cmnd); ++ if (req->dcopy && (host_status == DID_OK)) ++ host_status = csio_scsi_copy_to_sgl(hw, req); ++ } + + cmnd->result = (((host_status) << 16) | scsi_status); + cmnd->scsi_done(cmnd); +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 08b28c2ac90..375f3c52a0d 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -4,3 +4,46 @@ drivers-hv-vmbus-remove-the-undesired-put_cpu_ptr-in-hv_synic_cleanup.patch ubsan-fix-nasty-wbuiltin-declaration-mismatch-gcc-9-warnings.patch staging-greybus-power_supply-fix-prop-descriptor-request-size.patch staging-most-cdev-fix-chrdev_region-leak-in-mod_exit.patch +asoc-tlv320aic3x-fix-reset-gpio-reference-counting.patch +asoc-hdmi-codec-fix-s-pdif-dai.patch +asoc-stm32-sai-fix-iec958-controls-indexation.patch +asoc-stm32-sai-fix-exposed-capabilities-in-spdif-mod.patch +asoc-soc-pcm-fix-a-codec-fixup-issue-in-tdm-case.patch +asoc-intel-skl-fix-a-simultaneous-playback-capture-i.patch +asoc-nau8824-fix-the-issue-of-the-widget-with-prefix.patch +asoc-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch +asoc-samsung-odroid-fix-clock-configuration-for-4410.patch +asoc-rt5682-recording-has-no-sound-after-booting.patch +asoc-wm_adsp-add-locking-to-wm_adsp2_bus_error.patch +clk-meson-gxbb-round-the-vdec-dividers-to-closest.patch +asoc-stm32-dfsdm-manage-multiple-prepare.patch +asoc-stm32-dfsdm-fix-debugfs-warnings-on-entry-creat.patch +asoc-cs4270-set-auto-increment-bit-for-register-writ.patch +asoc-dapm-fix-null-pointer-dereference-in-snd_soc_da.patch +drm-omap-hdmi4_cec-fix-cec-clock-handling-for-pm.patch +ib-hfi1-eliminate-opcode-tests-on-mr-deref.patch +ib-hfi1-fix-the-allocation-of-rsm-table.patch +mips-kgdb-fix-kgdb-support-for-smp-platforms.patch +asoc-tlv320aic32x4-fix-common-pins.patch +drm-mediatek-fix-an-error-code-in-mtk_hdmi_dt_parse_.patch +perf-x86-intel-fix-handling-of-wakeup_events-for-mul.patch +perf-x86-intel-initialize-tfa-msr.patch +linux-kernel.h-use-parentheses-around-argument-in-u6.patch +xtensa-fix-initialization-of-pt_regs-syscall-in-star.patch +asoc-rockchip-pdm-fix-regmap_ops-hang-issue.patch +drm-amd-display-fix-cursor-black-issue.patch +asoc-cs35l35-disable-regulators-on-driver-removal.patch +objtool-add-rewind_stack_do_exit-to-the-noreturn-lis.patch +slab-fix-a-crash-by-reading-proc-slab_allocators.patch +drm-sun4i-tcon-top-fix-null-invalid-pointer-derefere.patch +virtio_pci-fix-a-null-pointer-reference-in-vp_del_vq.patch +rdma-vmw_pvrdma-fix-memory-leak-on-pvrdma_pci_remove.patch +rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch +scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err.patch +drm-mediatek-fix-possible-object-reference-leak.patch +asoc-intel-kbl-fix-wrong-number-of-channels.patch +virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch +nvme-fc-correct-csn-initialization-and-increments-on.patch +platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch +perf-core-fix-perf_event_disable_inatomic-race.patch +iommu-amd-set-exclusion-range-correctly.patch diff --git a/queue-4.19/slab-fix-a-crash-by-reading-proc-slab_allocators.patch b/queue-4.19/slab-fix-a-crash-by-reading-proc-slab_allocators.patch new file mode 100644 index 00000000000..f1d6887b37f --- /dev/null +++ b/queue-4.19/slab-fix-a-crash-by-reading-proc-slab_allocators.patch @@ -0,0 +1,44 @@ +From 34ec98605c366701b19aed8fbc5de84b880bd4bf Mon Sep 17 00:00:00 2001 +From: Qian Cai +Date: Sat, 6 Apr 2019 18:59:01 -0400 +Subject: slab: fix a crash by reading /proc/slab_allocators + +[ Upstream commit fcf88917dd435c6a4cb2830cb086ee58605a1d85 ] + +The commit 510ded33e075 ("slab: implement slab_root_caches list") +changes the name of the list node within "struct kmem_cache" from "list" +to "root_caches_node", but leaks_show() still use the "list" which +causes a crash when reading /proc/slab_allocators. + +You need to have CONFIG_SLAB=y and CONFIG_MEMCG=y to see the problem, +because without MEMCG all slab caches are root caches, and the "list" +node happens to be the right one. + +Fixes: 510ded33e075 ("slab: implement slab_root_caches list") +Signed-off-by: Qian Cai +Reviewed-by: Tobin C. Harding +Cc: Tejun Heo +Cc: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/slab.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/mm/slab.c b/mm/slab.c +index b8e0ec74330f3..018d32496e8d1 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -4305,7 +4305,8 @@ static void show_symbol(struct seq_file *m, unsigned long address) + + static int leaks_show(struct seq_file *m, void *p) + { +- struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list); ++ struct kmem_cache *cachep = list_entry(p, struct kmem_cache, ++ root_caches_node); + struct page *page; + struct kmem_cache_node *n; + const char *name; +-- +2.20.1 + diff --git a/queue-4.19/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch b/queue-4.19/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch new file mode 100644 index 00000000000..d0172b7bbf5 --- /dev/null +++ b/queue-4.19/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch @@ -0,0 +1,44 @@ +From 24ca25647f542d987e27df551901e4ada72c6400 Mon Sep 17 00:00:00 2001 +From: Dongli Zhang +Date: Wed, 27 Mar 2019 18:36:34 +0800 +Subject: virtio-blk: limit number of hw queues by nr_cpu_ids + +[ Upstream commit bf348f9b78d413e75bb079462751a1d86b6de36c ] + +When tag_set->nr_maps is 1, the block layer limits the number of hw queues +by nr_cpu_ids. No matter how many hw queues are used by virtio-blk, as it +has (tag_set->nr_maps == 1), it can use at most nr_cpu_ids hw queues. + +In addition, specifically for pci scenario, when the 'num-queues' specified +by qemu is more than maxcpus, virtio-blk would not be able to allocate more +than maxcpus vectors in order to have a vector for each queue. As a result, +it falls back into MSI-X with one vector for config and one shared for +queues. + +Considering above reasons, this patch limits the number of hw queues used +by virtio-blk by nr_cpu_ids. + +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Dongli Zhang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 23752dc99b008..dd64f586679e1 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -446,6 +446,8 @@ static int init_vq(struct virtio_blk *vblk) + if (err) + num_vqs = 1; + ++ num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs); ++ + vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL); + if (!vblk->vqs) + return -ENOMEM; +-- +2.20.1 + diff --git a/queue-4.19/virtio_pci-fix-a-null-pointer-reference-in-vp_del_vq.patch b/queue-4.19/virtio_pci-fix-a-null-pointer-reference-in-vp_del_vq.patch new file mode 100644 index 00000000000..dd06b872a72 --- /dev/null +++ b/queue-4.19/virtio_pci-fix-a-null-pointer-reference-in-vp_del_vq.patch @@ -0,0 +1,68 @@ +From 9c97b03462499e871671ac5b06cd96086928a0d3 Mon Sep 17 00:00:00 2001 +From: Longpeng +Date: Sat, 9 Mar 2019 15:17:40 +0800 +Subject: virtio_pci: fix a NULL pointer reference in vp_del_vqs + +[ Upstream commit 6a8aae68c87349dbbcd46eac380bc43cdb98a13b ] + +If the msix_affinity_masks is alloced failed, then we'll +try to free some resources in vp_free_vectors() that may +access it directly. + +We met the following stack in our production: +[ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null) +[ 29.311151] IP: [] vp_free_vectors+0x6a/0x150 [virtio_pci] +[ 29.324787] PGD 0 +[ 29.333224] Oops: 0000 [#1] SMP +[...] +[ 29.425175] RIP: 0010:[] [] vp_free_vectors+0x6a/0x150 [virtio_pci] +[ 29.441405] RSP: 0018:ffff9a55c2dcfa10 EFLAGS: 00010206 +[ 29.453491] RAX: 0000000000000000 RBX: ffff9a55c322c400 RCX: 0000000000000000 +[ 29.467488] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a55c322c400 +[ 29.481461] RBP: ffff9a55c2dcfa20 R08: 0000000000000000 R09: ffffc1b6806ff020 +[ 29.495427] R10: 0000000000000e95 R11: 0000000000aaaaaa R12: 0000000000000000 +[ 29.509414] R13: 0000000000010000 R14: ffff9a55bd2d9e98 R15: ffff9a55c322c400 +[ 29.523407] FS: 00007fdcba69f8c0(0000) GS:ffff9a55c2840000(0000) knlGS:0000000000000000 +[ 29.538472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 29.551621] CR2: 0000000000000000 CR3: 000000003ce52000 CR4: 00000000003607a0 +[ 29.565886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 29.580055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 29.594122] Call Trace: +[ 29.603446] [] vp_request_msix_vectors+0xe2/0x260 [virtio_pci] +[ 29.618017] [] vp_try_to_find_vqs+0x95/0x3b0 [virtio_pci] +[ 29.632152] [] vp_find_vqs+0x37/0xb0 [virtio_pci] +[ 29.645582] [] init_vq+0x153/0x260 [virtio_blk] +[ 29.658831] [] virtblk_probe+0xe8/0x87f [virtio_blk] +[...] + +Cc: Gonglei +Signed-off-by: Longpeng +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Gonglei +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_pci_common.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c +index 465a6f5142cc5..45b04bc91f248 100644 +--- a/drivers/virtio/virtio_pci_common.c ++++ b/drivers/virtio/virtio_pci_common.c +@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev) + for (i = 0; i < vp_dev->msix_used_vectors; ++i) + free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev); + +- for (i = 0; i < vp_dev->msix_vectors; i++) +- if (vp_dev->msix_affinity_masks[i]) +- free_cpumask_var(vp_dev->msix_affinity_masks[i]); ++ if (vp_dev->msix_affinity_masks) { ++ for (i = 0; i < vp_dev->msix_vectors; i++) ++ if (vp_dev->msix_affinity_masks[i]) ++ free_cpumask_var(vp_dev->msix_affinity_masks[i]); ++ } + + if (vp_dev->msix_enabled) { + /* Disable the vector used for configuration */ +-- +2.20.1 + diff --git a/queue-4.19/xtensa-fix-initialization-of-pt_regs-syscall-in-star.patch b/queue-4.19/xtensa-fix-initialization-of-pt_regs-syscall-in-star.patch new file mode 100644 index 00000000000..c1f5163f0ab --- /dev/null +++ b/queue-4.19/xtensa-fix-initialization-of-pt_regs-syscall-in-star.patch @@ -0,0 +1,52 @@ +From 0008f3f34df5efc48bcedfae9f77017c12498673 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Wed, 3 Apr 2019 20:22:42 -0700 +Subject: xtensa: fix initialization of pt_regs::syscall in start_thread + +[ Upstream commit 2663147dc7465cb29040a05cc4286fdd839978b5 ] + +New pt_regs should indicate that there's no syscall, not that there's +syscall #0. While at it wrap macro body in do/while and parenthesize +macro arguments. + +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/include/asm/processor.h | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index 677bc76c1d707..6e709fb562831 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -194,15 +194,18 @@ struct thread_struct { + + /* Clearing a0 terminates the backtrace. */ + #define start_thread(regs, new_pc, new_sp) \ +- memset(regs, 0, sizeof(*regs)); \ +- regs->pc = new_pc; \ +- regs->ps = USER_PS_VALUE; \ +- regs->areg[1] = new_sp; \ +- regs->areg[0] = 0; \ +- regs->wmask = 1; \ +- regs->depc = 0; \ +- regs->windowbase = 0; \ +- regs->windowstart = 1; ++ do { \ ++ memset((regs), 0, sizeof(*(regs))); \ ++ (regs)->pc = (new_pc); \ ++ (regs)->ps = USER_PS_VALUE; \ ++ (regs)->areg[1] = (new_sp); \ ++ (regs)->areg[0] = 0; \ ++ (regs)->wmask = 1; \ ++ (regs)->depc = 0; \ ++ (regs)->windowbase = 0; \ ++ (regs)->windowstart = 1; \ ++ (regs)->syscall = NO_SYSCALL; \ ++ } while (0) + + /* Forward declaration */ + struct task_struct; +-- +2.20.1 +