From e7deba4c6eb86d44c4a0df352aad28b0e8889695 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 22 Mar 2020 13:53:23 -0400 Subject: [PATCH] Fixes for 5.5 Signed-off-by: Sasha Levin --- ...era_get_note-prevent-write-beyond-en.patch | 102 ++++++++++ ...onfig-explicitly-restore-config_debu.patch | 37 ++++ ...add-missing-properties-to-the-pwr-le.patch | 65 ++++++ ...-dma-ranges-property-to-pcie-rc-dt-n.patch | 46 +++++ ...a7-l4-mark-timer13-16-as-pwm-capable.patch | 59 ++++++ .../asoc-meson-g12a-add-tohdmitx-reset.patch | 46 +++++ .../asoc-stm32-sai-manage-rebind-issue.patch | 99 +++++++++ ...count-for-binder-control-devices-too.patch | 55 +++++ ...erwrite-of-bfq_group-pointer-in-bfq_.patch | 63 ++++++ ...-missing-mount-option-to-proc-mounts.patch | 35 ++++ ...-fix-potential-mismatch-of-unc-paths.patch | 40 ++++ ...ve-restore-bi_end_io-and-bi_integrit.patch | 64 ++++++ ...use-dm_bio_record-and-dm_bio_restore.patch | 116 +++++++++++ ..._pmu_acpi-fix-incorrect-checking-of-.patch | 49 +++++ ..._imx8_ddr-correct-the-clear-bit-defi.patch | 53 +++++ ...clear-link-settings-on-mst-disable-c.patch | 92 +++++++++ ...fix-dcc-swath-size-calculations-on-d.patch | 47 +++++ ...u-clean-wptr-on-wb-when-gpu-recovery.patch | 56 +++++ ...ix-workaround-for-the-legacy-clock-n.patch | 74 +++++++ ...ropagate-error-value-and-silence-mea.patch | 41 ++++ ...don-t-leak-enable-hdmi_en-regulator-.patch | 106 ++++++++++ ...ure-the-cursor-plane-is-on-top-of-ot.patch | 53 +++++ ...d-the-cursor-plane-instead-of-hard-c.patch | 60 ++++++ ...ix-io_wq_work_no_cancel-cancellation.patch | 77 +++++++ .../io_uring-fix-lockup-with-timeouts.patch | 41 ++++ ...parse-maintainers-mark-as-executable.patch | 28 +++ ...gmii-sel-do-not-fail-in-case-of-gmii.patch | 34 ++++ ...mii-sel-fix-set-of-copy-paste-errors.patch | 58 ++++++ queue-5.5/powerpc-include-.btf-section.patch | 42 ++++ ...-fallback-to-non-tiled-mode-if-all-t.patch | 171 ++++++++++++++++ ...pic-offset-of-static-percpu-data-in-.patch | 66 ++++++ ...ge-looking-for-kernel-image-memblock.patch | 37 ++++ ...fix-seccomp-reject-syscall-code-path.patch | 149 ++++++++++++++ ...-force-flat-memory-model-with-no-mmu.patch | 38 ++++ queue-5.5/series | 42 ++++ ...pi-pxa2xx-add-cs-control-clock-quirk.patch | 87 ++++++++ ..._qup_pm_resume_runtime-before-suspen.patch | 55 +++++ ...spi-handle-dma-size-restriction-on-a.patch | 103 ++++++++++ ...spi-support-probe-deferral-for-dma-c.patch | 192 ++++++++++++++++++ ..._controller-free-bus-id-on-error-pat.patch | 97 +++++++++ ...remove-entry-that-causes-a-cs-glitch.patch | 58 ++++++ ...y-should-be-updated-before-req-state.patch | 113 +++++++++++ ...r-should-be-updated-before-req-state.patch | 40 ++++ 43 files changed, 2986 insertions(+) create mode 100644 queue-5.5/altera-stapl-altera_get_note-prevent-write-beyond-en.patch create mode 100644 queue-5.5/arm-bcm2835_defconfig-explicitly-restore-config_debu.patch create mode 100644 queue-5.5/arm-dts-bcm283x-add-missing-properties-to-the-pwr-le.patch create mode 100644 queue-5.5/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch create mode 100644 queue-5.5/arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch create mode 100644 queue-5.5/asoc-meson-g12a-add-tohdmitx-reset.patch create mode 100644 queue-5.5/asoc-stm32-sai-manage-rebind-issue.patch create mode 100644 queue-5.5/binderfs-use-refcount-for-binder-control-devices-too.patch create mode 100644 queue-5.5/block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch create mode 100644 queue-5.5/cifs-add-missing-mount-option-to-proc-mounts.patch create mode 100644 queue-5.5/cifs-fix-potential-mismatch-of-unc-paths.patch create mode 100644 queue-5.5/dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch create mode 100644 queue-5.5/dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch create mode 100644 queue-5.5/drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch create mode 100644 queue-5.5/drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch create mode 100644 queue-5.5/drm-amd-display-clear-link-settings-on-mst-disable-c.patch create mode 100644 queue-5.5/drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch create mode 100644 queue-5.5/drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch create mode 100644 queue-5.5/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch create mode 100644 queue-5.5/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch create mode 100644 queue-5.5/drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch create mode 100644 queue-5.5/drm-mediatek-ensure-the-cursor-plane-is-on-top-of-ot.patch create mode 100644 queue-5.5/drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch create mode 100644 queue-5.5/io-wq-fix-io_wq_work_no_cancel-cancellation.patch create mode 100644 queue-5.5/io_uring-fix-lockup-with-timeouts.patch create mode 100644 queue-5.5/parse-maintainers-mark-as-executable.patch create mode 100644 queue-5.5/phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch create mode 100644 queue-5.5/phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch create mode 100644 queue-5.5/powerpc-include-.btf-section.patch create mode 100644 queue-5.5/revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch create mode 100644 queue-5.5/riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch create mode 100644 queue-5.5/riscv-fix-range-looking-for-kernel-image-memblock.patch create mode 100644 queue-5.5/riscv-fix-seccomp-reject-syscall-code-path.patch create mode 100644 queue-5.5/riscv-force-flat-memory-model-with-no-mmu.patch create mode 100644 queue-5.5/spi-pxa2xx-add-cs-control-clock-quirk.patch create mode 100644 queue-5.5/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch create mode 100644 queue-5.5/spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch create mode 100644 queue-5.5/spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch create mode 100644 queue-5.5/spi-spi_register_controller-free-bus-id-on-error-pat.patch create mode 100644 queue-5.5/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch create mode 100644 queue-5.5/xenbus-req-body-should-be-updated-before-req-state.patch create mode 100644 queue-5.5/xenbus-req-err-should-be-updated-before-req-state.patch diff --git a/queue-5.5/altera-stapl-altera_get_note-prevent-write-beyond-en.patch b/queue-5.5/altera-stapl-altera_get_note-prevent-write-beyond-en.patch new file mode 100644 index 00000000000..ce9cc8c8aeb --- /dev/null +++ b/queue-5.5/altera-stapl-altera_get_note-prevent-write-beyond-en.patch @@ -0,0 +1,102 @@ +From 3f8e684d7b02b39811d67a668d4b7417fa257685 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 10:44:27 -0800 +Subject: altera-stapl: altera_get_note: prevent write beyond end of 'key' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Axtens + +[ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ] + +altera_get_note is called from altera_init, where key is kzalloc(33). + +When the allocation functions are annotated to allow the compiler to see +the sizes of objects, and with FORTIFY_SOURCE, we see: + +In file included from drivers/misc/altera-stapl/altera.c:14:0: +In function ‘strlcpy’, + inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: +include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter + __write_overflow(); + ^~~~~~~~~~~~~~~~~~ + +That refers to this code in altera_get_note: + + if (key != NULL) + strlcpy(key, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])], + length); + +The error triggers because the length of 'key' is 33, but the copy +uses length supplied as the 'length' parameter, which is always +256. Split the size parameter into key_len and val_len, and use the +appropriate length depending on what is being copied. + +Detected by compiler error, only compile-tested. + +Cc: "Igor M. Liplianin" +Signed-off-by: Daniel Axtens +Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/altera-stapl/altera.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index 25e5f24b3fecd..5bdf574723144 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2112,8 +2112,8 @@ static int altera_execute(struct altera_state *astate, + return status; + } + +-static int altera_get_note(u8 *p, s32 program_size, +- s32 *offset, char *key, char *value, int length) ++static int altera_get_note(u8 *p, s32 program_size, s32 *offset, ++ char *key, char *value, int keylen, int vallen) + /* + * Gets key and value of NOTE fields in the JBC file. + * Can be called in two modes: if offset pointer is NULL, +@@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size, + &p[note_table + (8 * i) + 4])]; + + if (value != NULL) +- strlcpy(value, value_ptr, length); ++ strlcpy(value, value_ptr, vallen); + + } + } +@@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size, + strlcpy(key, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])], +- length); ++ keylen); + + if (value != NULL) + strlcpy(value, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i) + 4])], +- length); ++ vallen); + + *offset = i + 1; + } +@@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) + __func__, (format_version == 2) ? "Jam STAPL" : + "pre-standardized Jam 1.1"); + while (altera_get_note((u8 *)fw->data, fw->size, +- &offset, key, value, 256) == 0) ++ &offset, key, value, 32, 256) == 0) + printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", + __func__, key, value); + } +-- +2.20.1 + diff --git a/queue-5.5/arm-bcm2835_defconfig-explicitly-restore-config_debu.patch b/queue-5.5/arm-bcm2835_defconfig-explicitly-restore-config_debu.patch new file mode 100644 index 00000000000..78f50fa6350 --- /dev/null +++ b/queue-5.5/arm-bcm2835_defconfig-explicitly-restore-config_debu.patch @@ -0,0 +1,37 @@ +From 1f402b22fd80dcefdcf07ae60bd5deafda1779e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2020 14:02:56 +0100 +Subject: ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS + +From: Stefan Wahren + +[ Upstream commit 1bba60808404b873defa0f3560497eb2e8fe86b8 ] + +The commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") +accidentally dropped the DEBUG FS support in bcm2835_defconfig. So +restore the config as before the commit. + +Reported-by: Marek Szyprowski +Fixes: 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency") +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/configs/bcm2835_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig +index 519ff58e67b30..0afcae9f7cf8a 100644 +--- a/arch/arm/configs/bcm2835_defconfig ++++ b/arch/arm/configs/bcm2835_defconfig +@@ -178,6 +178,7 @@ CONFIG_SCHED_TRACER=y + CONFIG_STACK_TRACER=y + CONFIG_FUNCTION_PROFILER=y + CONFIG_TEST_KSTRTOX=y ++CONFIG_DEBUG_FS=y + CONFIG_KGDB=y + CONFIG_KGDB_KDB=y + CONFIG_STRICT_DEVMEM=y +-- +2.20.1 + diff --git a/queue-5.5/arm-dts-bcm283x-add-missing-properties-to-the-pwr-le.patch b/queue-5.5/arm-dts-bcm283x-add-missing-properties-to-the-pwr-le.patch new file mode 100644 index 00000000000..da8caf214c7 --- /dev/null +++ b/queue-5.5/arm-dts-bcm283x-add-missing-properties-to-the-pwr-le.patch @@ -0,0 +1,65 @@ +From d12179fd2f58af643ca206768fce734b38912585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2020 19:03:05 +0100 +Subject: ARM: dts: bcm283x: Add missing properties to the PWR LED + +From: Stefan Wahren + +[ Upstream commit bff211bab301db890e38de872d43cbb459940daa ] + +This adds the missing properties to the PWR LED for the RPi 3 & 4 boards, +which are already set for the other boards. Without them we will lose +the LED state after suspend. + +Signed-off-by: Stefan Wahren +Tested-by: Peter Robinson +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 ++ + arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts | 2 ++ + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 ++ + 3 files changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts +index 1b5a835f66bd3..b8c4b5bb265a9 100644 +--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts ++++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts +@@ -31,6 +31,8 @@ + pwr { + label = "PWR"; + gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; ++ default-state = "keep"; ++ linux,default-trigger = "default-on"; + }; + }; + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts +index 66ab35eccba7b..28be0332c1c81 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-a-plus.dts +@@ -26,6 +26,8 @@ + pwr { + label = "PWR"; + gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; ++ default-state = "keep"; ++ linux,default-trigger = "default-on"; + }; + }; + }; +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +index 74ed6d0478070..37343148643db 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +@@ -27,6 +27,8 @@ + pwr { + label = "PWR"; + gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; ++ default-state = "keep"; ++ linux,default-trigger = "default-on"; + }; + }; + +-- +2.20.1 + diff --git a/queue-5.5/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch b/queue-5.5/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch new file mode 100644 index 00000000000..cf18a293189 --- /dev/null +++ b/queue-5.5/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch @@ -0,0 +1,46 @@ +From 7b325e60256fd68c4eaed8e06adaa923906de0a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2020 12:11:47 +0530 +Subject: ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes + +From: Kishon Vijay Abraham I + +[ Upstream commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 ] + +'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI +devices not described in the DT. Certain DRA7 platforms (e.g., DRA76) +has RAM above 32-bit boundary (accessible with LPAE config) though the +PCIe bridge will be able to access only 32-bits. Add 'dma-ranges' +property in PCIe RC DT nodes to indicate the host bridge can access +only 32 bits. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 73e5011f531ab..c5af7530be7c8 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -184,6 +184,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x20013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +@@ -238,6 +239,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x30013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +-- +2.20.1 + diff --git a/queue-5.5/arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch b/queue-5.5/arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch new file mode 100644 index 00000000000..a792f646496 --- /dev/null +++ b/queue-5.5/arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch @@ -0,0 +1,59 @@ +From 5961f47ad30ac7de7fd6014b93f8cbe51ae5bfd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2020 18:21:26 +0200 +Subject: ARM: dts: dra7-l4: mark timer13-16 as pwm capable + +From: Grygorii Strashko + +[ Upstream commit 00a39c92c8ab94727f021297d1748531af113fcd ] + +DMTimers 13 - 16 are PWM capable and also can be used for CPTS input +signals generation. Hence, mark them as "ti,timer-pwm". + +Signed-off-by: Grygorii Strashko +Reviewed-by: Lokesh Vutla +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7-l4.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 7e7aa101d8a49..912ee8778830a 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -3461,6 +3461,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER13_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3489,6 +3490,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER14_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3517,6 +3519,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +@@ -3545,6 +3548,7 @@ + clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>; + clock-names = "fck"; + interrupts = ; ++ ti,timer-pwm; + }; + }; + +-- +2.20.1 + diff --git a/queue-5.5/asoc-meson-g12a-add-tohdmitx-reset.patch b/queue-5.5/asoc-meson-g12a-add-tohdmitx-reset.patch new file mode 100644 index 00000000000..71586e8ba53 --- /dev/null +++ b/queue-5.5/asoc-meson-g12a-add-tohdmitx-reset.patch @@ -0,0 +1,46 @@ +From 583656f5f6fda704b97b2e8b2e2fae2571ec015c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2020 13:11:46 +0100 +Subject: ASoC: meson: g12a: add tohdmitx reset + +From: Jerome Brunet + +[ Upstream commit 22946f37557e27697aabc8e4f62642bfe4a17fd8 ] + +Reset the g12a hdmi codec glue on probe. This ensure a sane startup state. + +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20200221121146.1498427-1-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/g12a-tohdmitx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c +index 9cfbd343a00c8..8a0db28a6a406 100644 +--- a/sound/soc/meson/g12a-tohdmitx.c ++++ b/sound/soc/meson/g12a-tohdmitx.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -378,6 +379,11 @@ static int g12a_tohdmitx_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + void __iomem *regs; + struct regmap *map; ++ int ret; ++ ++ ret = device_reset(dev); ++ if (ret) ++ return ret; + + regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(regs)) +-- +2.20.1 + diff --git a/queue-5.5/asoc-stm32-sai-manage-rebind-issue.patch b/queue-5.5/asoc-stm32-sai-manage-rebind-issue.patch new file mode 100644 index 00000000000..17b7fa474f5 --- /dev/null +++ b/queue-5.5/asoc-stm32-sai-manage-rebind-issue.patch @@ -0,0 +1,99 @@ +From 6d609a6df0ff5f6109914d8b63372854b15783f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 11:24:06 +0100 +Subject: ASoC: stm32: sai: manage rebind issue + +From: Olivier Moysan + +[ Upstream commit 0d6defc7e0e437a9fd53622f7fd85740f38d5693 ] + +The commit e894efef9ac7 ("ASoC: core: add support to card rebind") +allows to rebind the sound card after a rebind of one of its component. +With this commit, the sound card is actually rebound, +but may be no more functional. The following problems have been seen +with STM32 SAI driver. + +1) DMA channel is not requested: + +With the sound card rebind the simplified call sequence is: +stm32_sai_sub_probe + snd_soc_register_component + snd_soc_try_rebind_card + snd_soc_instantiate_card + devm_snd_dmaengine_pcm_register + +The problem occurs because the pcm must be registered, +before snd_soc_instantiate_card() is called. + +Modify SAI driver, to change the call sequence as follows: +stm32_sai_sub_probe + devm_snd_dmaengine_pcm_register + snd_soc_register_component + snd_soc_try_rebind_card + +2) DMA channel is not released: + +dma_release_channel() is not called when +devm_dmaengine_pcm_release() is executed. +This occurs because SND_DMAENGINE_PCM_DRV_NAME component, +has already been released through devm_component_release(). + +devm_dmaengine_pcm_release() should be called before +devm_component_release() to avoid this problem. + +Call snd_dmaengine_pcm_unregister() and snd_soc_unregister_component() +explicitly from SAI driver, to have the right sequence. + +Signed-off-by: Olivier Moysan +Message-Id: <20200304102406.8093-1-olivier.moysan@st.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_sai_sub.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c +index 30bcd5d3a32a8..10eb4b8e8e7ee 100644 +--- a/sound/soc/stm/stm32_sai_sub.c ++++ b/sound/soc/stm/stm32_sai_sub.c +@@ -1543,20 +1543,20 @@ static int stm32_sai_sub_probe(struct platform_device *pdev) + return ret; + } + +- ret = devm_snd_soc_register_component(&pdev->dev, &stm32_component, +- &sai->cpu_dai_drv, 1); ++ ret = snd_dmaengine_pcm_register(&pdev->dev, conf, 0); ++ if (ret) { ++ dev_err(&pdev->dev, "Could not register pcm dma\n"); ++ return ret; ++ } ++ ++ ret = snd_soc_register_component(&pdev->dev, &stm32_component, ++ &sai->cpu_dai_drv, 1); + if (ret) + return ret; + + if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) + conf = &stm32_sai_pcm_config_spdif; + +- ret = devm_snd_dmaengine_pcm_register(&pdev->dev, conf, 0); +- if (ret) { +- dev_err(&pdev->dev, "Could not register pcm dma\n"); +- return ret; +- } +- + return 0; + } + +@@ -1565,6 +1565,8 @@ static int stm32_sai_sub_remove(struct platform_device *pdev) + struct stm32_sai_sub_data *sai = dev_get_drvdata(&pdev->dev); + + clk_unprepare(sai->pdata->pclk); ++ snd_dmaengine_pcm_unregister(&pdev->dev); ++ snd_soc_unregister_component(&pdev->dev); + + return 0; + } +-- +2.20.1 + diff --git a/queue-5.5/binderfs-use-refcount-for-binder-control-devices-too.patch b/queue-5.5/binderfs-use-refcount-for-binder-control-devices-too.patch new file mode 100644 index 00000000000..3989f682bca --- /dev/null +++ b/queue-5.5/binderfs-use-refcount-for-binder-control-devices-too.patch @@ -0,0 +1,55 @@ +From 4895dbcac424b66141b57ecbfed7b8923b19c099 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 11:53:09 +0100 +Subject: binderfs: use refcount for binder control devices too + +From: Christian Brauner + +[ Upstream commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9 ] + +Binderfs binder-control devices are cleaned up via binderfs_evict_inode +too() which will use refcount_dec_and_test(). However, we missed to set +the refcount for binderfs binder-control devices and so we underflowed +when the binderfs instance got unmounted. Pretty obvious oversight and +should have been part of the more general UAF fix. The good news is that +having test cases (suprisingly) helps. + +Technically, we could detect that we're about to cleanup the +binder-control dentry in binderfs_evict_inode() and then simply clean it +up. But that makes the assumption that the binder driver itself will +never make use of a binderfs binder-control device after the binderfs +instance it belongs to has been unmounted and the superblock for it been +destroyed. While it is unlikely to ever come to this let's be on the +safe side. Performance-wise this also really doesn't matter since the +binder-control device is only every really when creating the binderfs +filesystem or creating additional binder devices. Both operations are +pretty rare. + +Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II") +Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com +Reported-by: Naresh Kamboju +Cc: stable@vger.kernel.org +Signed-off-by: Christian Brauner +Acked-by: Todd Kjos +Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binderfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c +index 110e41f920c27..f303106b3362b 100644 +--- a/drivers/android/binderfs.c ++++ b/drivers/android/binderfs.c +@@ -448,6 +448,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) + inode->i_uid = info->root_uid; + inode->i_gid = info->root_gid; + ++ refcount_set(&device->ref, 1); + device->binderfs_inode = inode; + device->miscdev.minor = minor; + +-- +2.20.1 + diff --git a/queue-5.5/block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch b/queue-5.5/block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch new file mode 100644 index 00000000000..e642ecea044 --- /dev/null +++ b/queue-5.5/block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch @@ -0,0 +1,63 @@ +From ec6271dbdad2a5b0947c398bb427d9b08ccf79ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 13:27:31 +0100 +Subject: block, bfq: fix overwrite of bfq_group pointer in + bfq_find_set_group() + +From: Carlo Nonato + +[ Upstream commit 14afc59361976c0ba39e3a9589c3eaa43ebc7e1d ] + +The bfq_find_set_group() function takes as input a blkcg (which represents +a cgroup) and retrieves the corresponding bfq_group, then it updates the +bfq internal group hierarchy (see comments inside the function for why +this is needed) and finally it returns the bfq_group. +In the hierarchy update cycle, the pointer holding the correct bfq_group +that has to be returned is mistakenly used to traverse the hierarchy +bottom to top, meaning that in each iteration it gets overwritten with the +parent of the current group. Since the update cycle stops at root's +children (depth = 2), the overwrite becomes a problem only if the blkcg +describes a cgroup at a hierarchy level deeper than that (depth > 2). In +this case the root's child that happens to be also an ancestor of the +correct bfq_group is returned. The main consequence is that processes +contained in a cgroup at depth greater than 2 are wrongly placed in the +group described above by BFQ. + +This commits fixes this problem by using a different bfq_group pointer in +the update cycle in order to avoid the overwrite of the variable holding +the original group reference. + +Reported-by: Kwon Je Oh +Signed-off-by: Carlo Nonato +Signed-off-by: Paolo Valente +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 5a64607ce7744..facbf4db19428 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -610,12 +610,13 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, + */ + entity = &bfqg->entity; + for_each_entity(entity) { +- bfqg = container_of(entity, struct bfq_group, entity); +- if (bfqg != bfqd->root_group) { +- parent = bfqg_parent(bfqg); ++ struct bfq_group *curr_bfqg = container_of(entity, ++ struct bfq_group, entity); ++ if (curr_bfqg != bfqd->root_group) { ++ parent = bfqg_parent(curr_bfqg); + if (!parent) + parent = bfqd->root_group; +- bfq_group_set_parent(bfqg, parent); ++ bfq_group_set_parent(curr_bfqg, parent); + } + } + +-- +2.20.1 + diff --git a/queue-5.5/cifs-add-missing-mount-option-to-proc-mounts.patch b/queue-5.5/cifs-add-missing-mount-option-to-proc-mounts.patch new file mode 100644 index 00000000000..8c86c5415b1 --- /dev/null +++ b/queue-5.5/cifs-add-missing-mount-option-to-proc-mounts.patch @@ -0,0 +1,35 @@ +From 27cff5c0796f628d808f7c7ea2ea1ec48b493dfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2020 23:59:32 -0600 +Subject: cifs: add missing mount option to /proc/mounts + +From: Steve French + +[ Upstream commit ec57010acd03428a749d2600bf09bd537eaae993 ] + +We were not displaying the mount option "signloosely" in /proc/mounts +for cifs mounts which some users found confusing recently + +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 92b9c8221f078..7659286954d3a 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -530,6 +530,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root) + + if (tcon->seal) + seq_puts(s, ",seal"); ++ else if (tcon->ses->server->ignore_signature) ++ seq_puts(s, ",signloosely"); + if (tcon->nocase) + seq_puts(s, ",nocase"); + if (tcon->local_lease) +-- +2.20.1 + diff --git a/queue-5.5/cifs-fix-potential-mismatch-of-unc-paths.patch b/queue-5.5/cifs-fix-potential-mismatch-of-unc-paths.patch new file mode 100644 index 00000000000..3531e855021 --- /dev/null +++ b/queue-5.5/cifs-fix-potential-mismatch-of-unc-paths.patch @@ -0,0 +1,40 @@ +From 57b8d914caf7b022c04a6933bbf6381f2671fa47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 19:49:35 -0300 +Subject: cifs: fix potential mismatch of UNC paths + +From: Paulo Alcantara (SUSE) + +[ Upstream commit 154255233830e1e4dd0d99ac929a5dce588c0b81 ] + +Ensure that full_path is an UNC path that contains '\\' as delimiter, +which is required by cifs_build_devname(). + +The build_path_from_dentry_optional_prefix() function may return a +path with '/' as delimiter when using SMB1 UNIX extensions, for +example. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Acked-by: Ronnie Sahlberg +Signed-off-by: Sasha Levin +--- + fs/cifs/cifs_dfs_ref.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c +index 606f26d862dc1..cc3ada12848d9 100644 +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -324,6 +324,8 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt) + if (full_path == NULL) + goto cdda_exit; + ++ convert_delimiter(full_path, '\\'); ++ + cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path); + + if (!cifs_sb_master_tlink(cifs_sb)) { +-- +2.20.1 + diff --git a/queue-5.5/dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch b/queue-5.5/dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch new file mode 100644 index 00000000000..36f34f2a8f0 --- /dev/null +++ b/queue-5.5/dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch @@ -0,0 +1,64 @@ +From 80f300c2f68272c54a3b345eff7fc1d13944fdd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2020 18:00:53 -0500 +Subject: dm bio record: save/restore bi_end_io and bi_integrity + +From: Mike Snitzer + +[ Upstream commit 1b17159e52bb31f982f82a6278acd7fab1d3f67b ] + +Also, save/restore __bi_remaining in case the bio was used in a +BIO_CHAIN (e.g. due to blk_queue_split). + +Suggested-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-bio-record.h | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h +index c82578af56a5b..2ea0360108e1d 100644 +--- a/drivers/md/dm-bio-record.h ++++ b/drivers/md/dm-bio-record.h +@@ -20,8 +20,13 @@ + struct dm_bio_details { + struct gendisk *bi_disk; + u8 bi_partno; ++ int __bi_remaining; + unsigned long bi_flags; + struct bvec_iter bi_iter; ++ bio_end_io_t *bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ struct bio_integrity_payload *bi_integrity; ++#endif + }; + + static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) +@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio) + bd->bi_partno = bio->bi_partno; + bd->bi_flags = bio->bi_flags; + bd->bi_iter = bio->bi_iter; ++ bd->__bi_remaining = atomic_read(&bio->__bi_remaining); ++ bd->bi_end_io = bio->bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ bd->bi_integrity = bio_integrity(bio); ++#endif + } + + static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) +@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio) + bio->bi_partno = bd->bi_partno; + bio->bi_flags = bd->bi_flags; + bio->bi_iter = bd->bi_iter; ++ atomic_set(&bio->__bi_remaining, bd->__bi_remaining); ++ bio->bi_end_io = bd->bi_end_io; ++#if defined(CONFIG_BLK_DEV_INTEGRITY) ++ bio->bi_integrity = bd->bi_integrity; ++#endif + } + + #endif +-- +2.20.1 + diff --git a/queue-5.5/dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch b/queue-5.5/dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch new file mode 100644 index 00000000000..44586f0505c --- /dev/null +++ b/queue-5.5/dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch @@ -0,0 +1,116 @@ +From 51c8d3717ccb3ddbd61bc4e500598f377166d979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2020 18:11:53 -0500 +Subject: dm integrity: use dm_bio_record and dm_bio_restore +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mike Snitzer + +[ Upstream commit 248aa2645aa7fc9175d1107c2593cc90d4af5a4e ] + +In cases where dec_in_flight() has to requeue the integrity_bio_wait +work to transfer the rest of the data, the bio's __bi_remaining might +already have been decremented to 0, e.g.: if bio passed to underlying +data device was split via blk_queue_split(). + +Use dm_bio_{record,restore} rather than effectively open-coding them in +dm-integrity -- these methods now manage __bi_remaining too. + +Depends-on: f7f0b057a9c1 ("dm bio record: save/restore bi_end_io and bi_integrity") +Reported-by: Daniel Glöckner +Suggested-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 32 +++++++++----------------------- + 1 file changed, 9 insertions(+), 23 deletions(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index e1ad0b53f681a..a82a9c2577443 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -6,6 +6,8 @@ + * This file is released under the GPL. + */ + ++#include "dm-bio-record.h" ++ + #include + #include + #include +@@ -295,11 +297,7 @@ struct dm_integrity_io { + + struct completion *completion; + +- struct gendisk *orig_bi_disk; +- u8 orig_bi_partno; +- bio_end_io_t *orig_bi_end_io; +- struct bio_integrity_payload *orig_bi_integrity; +- struct bvec_iter orig_bi_iter; ++ struct dm_bio_details bio_details; + }; + + struct journal_completion { +@@ -1452,14 +1450,9 @@ static void integrity_end_io(struct bio *bio) + { + struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io)); + +- bio->bi_iter = dio->orig_bi_iter; +- bio->bi_disk = dio->orig_bi_disk; +- bio->bi_partno = dio->orig_bi_partno; +- if (dio->orig_bi_integrity) { +- bio->bi_integrity = dio->orig_bi_integrity; ++ dm_bio_restore(&dio->bio_details, bio); ++ if (bio->bi_integrity) + bio->bi_opf |= REQ_INTEGRITY; +- } +- bio->bi_end_io = dio->orig_bi_end_io; + + if (dio->completion) + complete(dio->completion); +@@ -1544,7 +1537,7 @@ static void integrity_metadata(struct work_struct *w) + } + } + +- __bio_for_each_segment(bv, bio, iter, dio->orig_bi_iter) { ++ __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) { + unsigned pos; + char *mem, *checksums_ptr; + +@@ -1588,7 +1581,7 @@ static void integrity_metadata(struct work_struct *w) + if (likely(checksums != checksums_onstack)) + kfree(checksums); + } else { +- struct bio_integrity_payload *bip = dio->orig_bi_integrity; ++ struct bio_integrity_payload *bip = dio->bio_details.bi_integrity; + + if (bip) { + struct bio_vec biv; +@@ -2007,20 +2000,13 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map + } else + dio->completion = NULL; + +- dio->orig_bi_iter = bio->bi_iter; +- +- dio->orig_bi_disk = bio->bi_disk; +- dio->orig_bi_partno = bio->bi_partno; ++ dm_bio_record(&dio->bio_details, bio); + bio_set_dev(bio, ic->dev->bdev); +- +- dio->orig_bi_integrity = bio_integrity(bio); + bio->bi_integrity = NULL; + bio->bi_opf &= ~REQ_INTEGRITY; +- +- dio->orig_bi_end_io = bio->bi_end_io; + bio->bi_end_io = integrity_end_io; +- + bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT; ++ + generic_make_request(bio); + + if (need_sync_io) { +-- +2.20.1 + diff --git a/queue-5.5/drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch b/queue-5.5/drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch new file mode 100644 index 00000000000..b0b4e3c93b5 --- /dev/null +++ b/queue-5.5/drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch @@ -0,0 +1,49 @@ +From a3fe3b6d979d08544d1417aa640c5ec0cc62bff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2020 13:45:10 +0800 +Subject: drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer + +From: luanshi + +[ Upstream commit 3ba52ad55b533760a1f65836aa0ec9d35e36bb4f ] + +Fix bogus NULL checks on the return value of acpi_cpu_get_madt_gicc() +by checking for a 0 'gicc->performance_interrupt' value instead. + +Signed-off-by: Liguang Zhang +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_pmu_acpi.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c +index acce8781c456c..f5c7a845cd7bf 100644 +--- a/drivers/perf/arm_pmu_acpi.c ++++ b/drivers/perf/arm_pmu_acpi.c +@@ -24,8 +24,6 @@ static int arm_pmu_acpi_register_irq(int cpu) + int gsi, trigger; + + gicc = acpi_cpu_get_madt_gicc(cpu); +- if (WARN_ON(!gicc)) +- return -EINVAL; + + gsi = gicc->performance_interrupt; + +@@ -64,11 +62,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu) + int gsi; + + gicc = acpi_cpu_get_madt_gicc(cpu); +- if (!gicc) +- return; + + gsi = gicc->performance_interrupt; +- acpi_unregister_gsi(gsi); ++ if (gsi) ++ acpi_unregister_gsi(gsi); + } + + #if IS_ENABLED(CONFIG_ARM_SPE_PMU) +-- +2.20.1 + diff --git a/queue-5.5/drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch b/queue-5.5/drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch new file mode 100644 index 00000000000..1e130bea068 --- /dev/null +++ b/queue-5.5/drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch @@ -0,0 +1,53 @@ +From 9e136e6e39a6132e18cfedbbad9e035e509d0fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 20:56:43 +0800 +Subject: drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition + +From: Joakim Zhang + +[ Upstream commit 049d919168458ac54e7fad27cd156a958b042d2f ] + +When disabling a counter from ddr_perf_event_stop(), the counter value +is reset to 0 at the same time. + +Preserve the counter value by performing a read-modify-write of the +PMU register and clearing only the enable bit. + +Signed-off-by: Joakim Zhang +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/fsl_imx8_ddr_perf.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 95dca2cb52650..90884d14f95fa 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -388,9 +388,10 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config, + + if (enable) { + /* +- * must disable first, then enable again +- * otherwise, cycle counter will not work +- * if previous state is enabled. ++ * cycle counter is special which should firstly write 0 then ++ * write 1 into CLEAR bit to clear it. Other counters only ++ * need write 0 into CLEAR bit and it turns out to be 1 by ++ * hardware. Below enable flow is harmless for all counters. + */ + writel(0, pmu->base + reg); + val = CNTL_EN | CNTL_CLEAR; +@@ -398,7 +399,8 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config, + writel(val, pmu->base + reg); + } else { + /* Disable counter */ +- writel(0, pmu->base + reg); ++ val = readl_relaxed(pmu->base + reg) & CNTL_EN_MASK; ++ writel(val, pmu->base + reg); + } + } + +-- +2.20.1 + diff --git a/queue-5.5/drm-amd-display-clear-link-settings-on-mst-disable-c.patch b/queue-5.5/drm-amd-display-clear-link-settings-on-mst-disable-c.patch new file mode 100644 index 00000000000..64bb71f6aff --- /dev/null +++ b/queue-5.5/drm-amd-display-clear-link-settings-on-mst-disable-c.patch @@ -0,0 +1,92 @@ +From 0113976992ea09b0b99c126b4c2a0a62713b98ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 11:16:14 -0500 +Subject: drm/amd/display: Clear link settings on MST disable connector + +From: Bhawanpreet Lakha + +[ Upstream commit 5ac7fd2f597b88ee81f4748ee50cab06192a8dc3 ] + +[Why] +If we have a single MST display and we disconnect it, we dont disable that +link. This causes the old link settings to still exist + +Now on a replug for MST we think its a link loss and will try to reallocate +mst payload which will fail, throwing warning below. + +[ 129.374192] [drm] Failed to updateMST allocation table forpipe idx:0 +[ 129.374206] ------------[ cut here ]------------ +[ 129.374284] WARNING: CPU: 14 PID: 1710 at +drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/core/dc_link.c:3153 +dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu] + +[ 129.374285] Modules linked in: amdgpu(OE) amd_iommu_v2 gpu_sched ttm +drm_kms_helper drm fb_sys_fops syscopyarea sysfillrect sysimgblt +binfmt_misc nls_iso8859_1 edac_mce_amd snd_hda_codec_realtek +snd_hda_codec_generic ledtrig_audio kvm snd_hda_codec_hdmi snd_hda_intel +snd_intel_nhlt snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm +snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul snd_seq +crc32_pclmul ghash_clmulni_intel snd_seq_device snd_timer snd aesni_intel +eeepc_wmi crypto_simd asus_wmi joydev cryptd sparse_keymap input_leds +soundcore video glue_helper wmi_bmof mxm_wmi k10temp ccp mac_hid +sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 +hid_generic usbhid hid igb i2c_algo_bit ahci dca i2c_piix4 libahci +gpio_amdpt wmi gpio_generic + +[ 129.374318] CPU: 14 PID: 1710 Comm: kworker/14:2 Tainted: G W OE 5.4.0-rc7bhawan+ #480 +[ 129.374318] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 0515 03/30/2017 +[ 129.374397] Workqueue: events dm_irq_work_func [amdgpu] +[ 129.374468] RIP: 0010:dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu] +[ 129.374470] Code: 52 20 e8 1c 63 ad f4 48 8b 5d d0 65 48 33 1c 25 28 00 +00 00 b8 01 00 00 00 75 16 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 +<0f> 0b e9 fa fe ff ff e8 ed 5b d6 f3 41 0f b6 b6 c4 02 00 00 48 c7 +[ 129.374471] RSP: 0018:ffff9f9141e7fcc0 EFLAGS: 00010246 +[ 129.374472] RAX: 0000000000000000 RBX: ffff91ef0762f800 RCX: 0000000000000000 +[ 129.374473] RDX: 0000000000000005 RSI: ffffffffc0c4a988 RDI: 0000000000000004 +[ 129.374474] RBP: ffff9f9141e7fd10 R08: 0000000000000005 R09: 0000000000000000 +[ 129.374475] R10: 0000000000000002 R11: 0000000000000001 R12: ffff91eebd510c00 +[ 129.374475] R13: ffff91eebd510e58 R14: ffff91ef052c01b8 R15: 0000000000000006 +[ 129.374476] FS: 0000000000000000(0000) GS:ffff91ef0ef80000(0000) knlGS:0000000000000000 +[ 129.374477] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 129.374478] CR2: 000055623ea01d50 CR3: 0000000408a8c000 CR4: 00000000003406e0 +[ 129.374479] Call Trace: +[ 129.374550] dc_link_reallocate_mst_payload+0x12e/0x150 [amdgpu] +[ 129.374617] dc_link_handle_hpd_rx_irq+0x6d4/0x6e0 [amdgpu] +[ 129.374693] handle_hpd_rx_irq+0x77/0x310 [amdgpu] +[ 129.374768] dm_irq_work_func+0x53/0x70 [amdgpu] +[ 129.374774] process_one_work+0x1fd/0x3f0 +[ 129.374776] worker_thread+0x255/0x410 +[ 129.374778] kthread+0x121/0x140 +[ 129.374780] ? process_one_work+0x3f0/0x3f0 +[ 129.374781] ? kthread_park+0x90/0x90 +[ 129.374785] ret_from_fork+0x22/0x40 + +[How] +when we disable MST we should clear the cur link settings (lane_count=0 is +good enough). This will cause us to not reallocate payloads earlier than +expected and not throw the warning + +Signed-off-by: Bhawanpreet Lakha +Reviewed-by: Hersen Wu +Acked-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 2bf8534c18fbe..1e3bc708b2e8d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -382,6 +382,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + aconnector->dc_sink); + dc_sink_release(aconnector->dc_sink); + aconnector->dc_sink = NULL; ++ aconnector->dc_link->cur_link_settings.lane_count = 0; + } + + drm_connector_unregister(connector); +-- +2.20.1 + diff --git a/queue-5.5/drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch b/queue-5.5/drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch new file mode 100644 index 00000000000..80eb138157d --- /dev/null +++ b/queue-5.5/drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch @@ -0,0 +1,47 @@ +From c0ef4feca108e6d21f966b5b09aaa479914a2fcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2020 12:26:19 -0500 +Subject: drm/amd/display: fix dcc swath size calculations on dcn1 + +From: Josip Pavic + +[ Upstream commit a0275dfc82c9034eefbeffd556cca6dd239d7925 ] + +[Why] +Swath sizes are being calculated incorrectly. The horizontal swath size +should be the product of block height, viewport width, and bytes per +element, but the calculation uses viewport height instead of width. The +vertical swath size is similarly incorrectly calculated. The effect of +this is that we report the wrong DCC caps. + +[How] +Use viewport width in the horizontal swath size calculation and viewport +height in the vertical swath size calculation. + +Signed-off-by: Josip Pavic +Reviewed-by: Aric Cyr +Acked-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c +index a02c10e23e0d6..d163388c99a06 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c +@@ -840,8 +840,8 @@ static void hubbub1_det_request_size( + + hubbub1_get_blk256_size(&blk256_width, &blk256_height, bpe); + +- swath_bytes_horz_wc = height * blk256_height * bpe; +- swath_bytes_vert_wc = width * blk256_width * bpe; ++ swath_bytes_horz_wc = width * blk256_height * bpe; ++ swath_bytes_vert_wc = height * blk256_width * bpe; + + *req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ? + false : /* full 256B request */ +-- +2.20.1 + diff --git a/queue-5.5/drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch b/queue-5.5/drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch new file mode 100644 index 00000000000..e4c00a70890 --- /dev/null +++ b/queue-5.5/drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch @@ -0,0 +1,56 @@ +From c7556e80e5af72634f41a377a283d12c86c7f8e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2020 14:24:42 +0800 +Subject: drm/amdgpu: clean wptr on wb when gpu recovery +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yintian Tao + +[ Upstream commit 2ab7e274b86739f4ceed5d94b6879f2d07b2802f ] + +The TDR will be randomly failed due to compute ring +test failure. If the compute ring wptr & 0x7ff(ring_buf_mask) +is 0x100 then after map mqd the compute ring rptr will be +synced with 0x100. And the ring test packet size is also 0x100. +Then after invocation of amdgpu_ring_commit, the cp will not +really handle the packet on the ring buffer because rptr is equal to wptr. + +Signed-off-by: Yintian Tao +Acked-by: Christian König +Reviewed-by: Monk Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 + + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 6b5b243af15dc..1a80423b1d4f0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -3496,6 +3496,7 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring) + + /* reset ring buffer */ + ring->wptr = 0; ++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0); + amdgpu_ring_clear_ring(ring); + } else { + amdgpu_ring_clear_ring(ring); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 085b84322e928..67f30fec94df2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3538,6 +3538,7 @@ static int gfx_v9_0_kcq_init_queue(struct amdgpu_ring *ring) + + /* reset ring buffer */ + ring->wptr = 0; ++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0); + amdgpu_ring_clear_ring(ring); + } else { + amdgpu_ring_clear_ring(ring); +-- +2.20.1 + diff --git a/queue-5.5/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch b/queue-5.5/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch new file mode 100644 index 00000000000..68107ab6d99 --- /dev/null +++ b/queue-5.5/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch @@ -0,0 +1,74 @@ +From 782232f3c5e9659d01c6d6fa13eae6ad1bf6da75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 13:30:12 +0100 +Subject: drm/exynos: dsi: fix workaround for the legacy clock name + +From: Marek Szyprowski + +[ Upstream commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 ] + +Writing to the built-in strings arrays doesn't work if driver is loaded +as kernel module. This is also considered as a bad pattern. Fix this by +adding a call to clk_get() with legacy clock name. This fixes following +kernel oops if driver is loaded as module: + +Unable to handle kernel paging request at virtual address bf047978 + pgd = (ptrval) + [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f + Internal error: Oops: 80f [#1] SMP ARM + Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio + CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326 + videodev: Linux video capture interface: v2.00 + Hardware name: Samsung Exynos (Flattened Device Tree) + PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm] + LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm] + ... + Process systemd-udevd (pid: 212, stack limit = 0x(ptrval)) + ... + [] (exynos_dsi_probe [exynosdrm]) from [] (platform_drv_probe+0x6c/0xa4) + [] (platform_drv_probe) from [] (really_probe+0x210/0x350) + [] (really_probe) from [] (driver_probe_device+0x60/0x1a0) + [] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) + [] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) + [] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) + [] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) + [] (bus_add_driver) from [] (driver_register+0x78/0x110) + [] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) + [] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) + [] (do_one_initcall) from [] (do_init_module+0x60/0x210) + [] (do_init_module) from [] (load_module+0x1c0c/0x2310) + [] (load_module) from [] (sys_finit_module+0xac/0xbc) + [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) + Exception stack(0xd979bfa8 to 0xd979bff0) + ... + ---[ end trace db16efe05faab470 ]--- + +Signed-off-by: Marek Szyprowski +Reviewed-by: Andrzej Hajda +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index 8d880012b5876..0f6497670e29d 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -1766,9 +1766,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) + dsi->clks[i] = devm_clk_get(dev, clk_names[i]); + if (IS_ERR(dsi->clks[i])) { + if (strcmp(clk_names[i], "sclk_mipi") == 0) { +- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME); +- i--; +- continue; ++ dsi->clks[i] = devm_clk_get(dev, ++ OLD_SCLK_MIPI_CLK_NAME); ++ if (!IS_ERR(dsi->clks[i])) ++ continue; + } + + dev_info(dev, "failed to get the clock: %s\n", +-- +2.20.1 + diff --git a/queue-5.5/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch b/queue-5.5/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch new file mode 100644 index 00000000000..286bbf0cb75 --- /dev/null +++ b/queue-5.5/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch @@ -0,0 +1,41 @@ +From ec91ee4ef132d2fd5a9944906e852e50b5743de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 08:06:37 +0100 +Subject: drm/exynos: dsi: propagate error value and silence meaningless + warning + +From: Marek Szyprowski + +[ Upstream commit 0a9d1e3f3f038785ebc72d53f1c409d07f6b4ff5 ] + +Properly propagate error value from devm_regulator_bulk_get() and don't +confuse user with meaningless warning about failure in getting regulators +in case of deferred probe. + +Signed-off-by: Marek Szyprowski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index 72726f2c7a9fb..8d880012b5876 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -1751,8 +1751,9 @@ static int exynos_dsi_probe(struct platform_device *pdev) + ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies), + dsi->supplies); + if (ret) { +- dev_info(dev, "failed to get regulators: %d\n", ret); +- return -EPROBE_DEFER; ++ if (ret != -EPROBE_DEFER) ++ dev_info(dev, "failed to get regulators: %d\n", ret); ++ return ret; + } + + dsi->clks = devm_kcalloc(dev, +-- +2.20.1 + diff --git a/queue-5.5/drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch b/queue-5.5/drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch new file mode 100644 index 00000000000..8215975d23c --- /dev/null +++ b/queue-5.5/drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch @@ -0,0 +1,106 @@ +From 802da3bc3729b154d6715c5bfe47220754480863 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 13:57:26 +0100 +Subject: drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails + +From: Marek Szyprowski + +[ Upstream commit 3b6a9b19ab652efac7ad4c392add6f1235019568 ] + +Move enabling and disabling HDMI_EN optional regulator to probe() function +to keep track on the regulator status. This fixes following warning if +probe() fails (for example when I2C DDC adapter cannot be yet gathered +due to the missing driver). This fixes following warning observed on +Arndale5250 board with multi_v7_defconfig: + +[drm] Failed to get ddc i2c adapter by node +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 214 at drivers/regulator/core.c:2051 _regulator_put+0x16c/0x184 +Modules linked in: ... +CPU: 0 PID: 214 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219-00040-g38af1dfafdbb #7570 +Hardware name: Samsung Exynos (Flattened Device Tree) +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0xcc/0xe0) +[] (dump_stack) from [] (__warn+0xe0/0xf8) +[] (__warn) from [] (warn_slowpath_fmt+0xb0/0xb8) +[] (warn_slowpath_fmt) from [] (_regulator_put+0x16c/0x184) +[] (_regulator_put) from [] (regulator_put+0x1c/0x2c) +[] (regulator_put) from [] (release_nodes+0x17c/0x200) +[] (release_nodes) from [] (really_probe+0x10c/0x350) +[] (really_probe) from [] (driver_probe_device+0x60/0x1a0) +[] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) +[] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) +[] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) +[] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) +[] (bus_add_driver) from [] (driver_register+0x78/0x110) +[] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) +[] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) +[] (do_one_initcall) from [] (do_init_module+0x60/0x210) +[] (do_init_module) from [] (load_module+0x1c0c/0x2310) +[] (load_module) from [] (sys_finit_module+0xac/0xbc) +[] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) +Exception stack(0xecca3fa8 to 0xecca3ff0) +... +---[ end trace 276c91214635905c ]--- + +Signed-off-by: Marek Szyprowski +Reviewed-by: Andrzej Hajda +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index 48159d5d22144..d85e15e816e99 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1803,18 +1803,10 @@ static int hdmi_resources_init(struct hdmi_context *hdata) + + hdata->reg_hdmi_en = devm_regulator_get_optional(dev, "hdmi-en"); + +- if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) { ++ if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) + if (IS_ERR(hdata->reg_hdmi_en)) + return PTR_ERR(hdata->reg_hdmi_en); + +- ret = regulator_enable(hdata->reg_hdmi_en); +- if (ret) { +- DRM_DEV_ERROR(dev, +- "failed to enable hdmi-en regulator\n"); +- return ret; +- } +- } +- + return hdmi_bridge_init(hdata); + } + +@@ -2021,6 +2013,15 @@ static int hdmi_probe(struct platform_device *pdev) + } + } + ++ if (!IS_ERR(hdata->reg_hdmi_en)) { ++ ret = regulator_enable(hdata->reg_hdmi_en); ++ if (ret) { ++ DRM_DEV_ERROR(dev, ++ "failed to enable hdmi-en regulator\n"); ++ goto err_hdmiphy; ++ } ++ } ++ + pm_runtime_enable(dev); + + audio_infoframe = &hdata->audio.infoframe; +@@ -2045,7 +2046,8 @@ static int hdmi_probe(struct platform_device *pdev) + + err_rpm_disable: + pm_runtime_disable(dev); +- ++ if (!IS_ERR(hdata->reg_hdmi_en)) ++ regulator_disable(hdata->reg_hdmi_en); + err_hdmiphy: + if (hdata->hdmiphy_port) + put_device(&hdata->hdmiphy_port->dev); +-- +2.20.1 + diff --git a/queue-5.5/drm-mediatek-ensure-the-cursor-plane-is-on-top-of-ot.patch b/queue-5.5/drm-mediatek-ensure-the-cursor-plane-is-on-top-of-ot.patch new file mode 100644 index 00000000000..c8c1b434b17 --- /dev/null +++ b/queue-5.5/drm-mediatek-ensure-the-cursor-plane-is-on-top-of-ot.patch @@ -0,0 +1,53 @@ +From 71a5de008edddeefe4df60a79f56b857931463ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jan 2020 14:24:55 -0500 +Subject: drm/mediatek: Ensure the cursor plane is on top of other overlays + +From: Sean Paul + +[ Upstream commit 26d696192aa5f4fe9119d6d23f90ed535053abca ] + +Currently the cursor is placed on the first overlay plane, which means +it will be at the bottom of the stack when the hw does the compositing +with anything other than primary plane. Since mtk doesn't support plane +zpos, change the cursor location to the top-most plane. + +Signed-off-by: Sean Paul +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 7104504babde0..1d46fbe9e07c6 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -606,11 +606,12 @@ static int mtk_drm_crtc_num_comp_planes(struct mtk_drm_crtc *mtk_crtc, + } + + static inline +-enum drm_plane_type mtk_drm_crtc_plane_type(unsigned int plane_idx) ++enum drm_plane_type mtk_drm_crtc_plane_type(unsigned int plane_idx, ++ unsigned int num_planes) + { + if (plane_idx == 0) + return DRM_PLANE_TYPE_PRIMARY; +- else if (plane_idx == 1) ++ else if (plane_idx == (num_planes - 1)) + return DRM_PLANE_TYPE_CURSOR; + else + return DRM_PLANE_TYPE_OVERLAY; +@@ -629,7 +630,8 @@ static int mtk_drm_crtc_init_comp_planes(struct drm_device *drm_dev, + ret = mtk_plane_init(drm_dev, + &mtk_crtc->planes[mtk_crtc->layer_nr], + BIT(pipe), +- mtk_drm_crtc_plane_type(mtk_crtc->layer_nr), ++ mtk_drm_crtc_plane_type(mtk_crtc->layer_nr, ++ num_planes), + mtk_ddp_comp_supported_rotations(comp)); + if (ret) + return ret; +-- +2.20.1 + diff --git a/queue-5.5/drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch b/queue-5.5/drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch new file mode 100644 index 00000000000..2ed11b5514c --- /dev/null +++ b/queue-5.5/drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch @@ -0,0 +1,60 @@ +From 7a8f8f485b6873deefc6b8e8a53568b0a8dcc5cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2020 15:23:51 +1100 +Subject: drm/mediatek: Find the cursor plane instead of hard coding it + +From: Evan Benn + +[ Upstream commit 318caac7c81cdf5806df30c3d72385659a5f0f53 ] + +The cursor and primary planes were hard coded. +Now search for them for passing to drm_crtc_init_with_planes + +Signed-off-by: Evan Benn +Reviewed-by: Sean Paul +Signed-off-by: CK Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index c3f5111fd563f..7104504babde0 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -549,10 +549,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = { + + static int mtk_drm_crtc_init(struct drm_device *drm, + struct mtk_drm_crtc *mtk_crtc, +- struct drm_plane *primary, +- struct drm_plane *cursor, unsigned int pipe) ++ unsigned int pipe) + { +- int ret; ++ struct drm_plane *primary = NULL; ++ struct drm_plane *cursor = NULL; ++ int i, ret; ++ ++ for (i = 0; i < mtk_crtc->layer_nr; i++) { ++ if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_PRIMARY) ++ primary = &mtk_crtc->planes[i]; ++ else if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_CURSOR) ++ cursor = &mtk_crtc->planes[i]; ++ } + + ret = drm_crtc_init_with_planes(drm, &mtk_crtc->base, primary, cursor, + &mtk_crtc_funcs, NULL); +@@ -710,9 +718,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + return ret; + } + +- ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0], +- mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] : +- NULL, pipe); ++ ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, pipe); + if (ret < 0) + return ret; + +-- +2.20.1 + diff --git a/queue-5.5/io-wq-fix-io_wq_work_no_cancel-cancellation.patch b/queue-5.5/io-wq-fix-io_wq_work_no_cancel-cancellation.patch new file mode 100644 index 00000000000..571f8c794d5 --- /dev/null +++ b/queue-5.5/io-wq-fix-io_wq_work_no_cancel-cancellation.patch @@ -0,0 +1,77 @@ +From 09774bb0f347a594b91f025791c709e8a985cef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Mar 2020 19:18:19 +0300 +Subject: io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation + +From: Pavel Begunkov + +[ Upstream commit fc04c39bae01a607454f7619665309870c60937a ] + +To cancel a work, io-wq sets IO_WQ_WORK_CANCEL and executes the +callback. However, IO_WQ_WORK_NO_CANCEL works will just execute and may +return next work, which will be ignored and lost. + +Cancel the whole link. + +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io-wq.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/fs/io-wq.c b/fs/io-wq.c +index 25ffb6685baea..1f46fe663b287 100644 +--- a/fs/io-wq.c ++++ b/fs/io-wq.c +@@ -733,6 +733,17 @@ static bool io_wq_can_queue(struct io_wqe *wqe, struct io_wqe_acct *acct, + return true; + } + ++static void io_run_cancel(struct io_wq_work *work) ++{ ++ do { ++ struct io_wq_work *old_work = work; ++ ++ work->flags |= IO_WQ_WORK_CANCEL; ++ work->func(&work); ++ work = (work == old_work) ? NULL : work; ++ } while (work); ++} ++ + static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work) + { + struct io_wqe_acct *acct = io_work_get_acct(wqe, work); +@@ -745,8 +756,7 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work) + * It's close enough to not be an issue, fork() has the same delay. + */ + if (unlikely(!io_wq_can_queue(wqe, acct, work))) { +- work->flags |= IO_WQ_WORK_CANCEL; +- work->func(&work); ++ io_run_cancel(work); + return; + } + +@@ -882,8 +892,7 @@ static enum io_wq_cancel io_wqe_cancel_cb_work(struct io_wqe *wqe, + spin_unlock_irqrestore(&wqe->lock, flags); + + if (found) { +- work->flags |= IO_WQ_WORK_CANCEL; +- work->func(&work); ++ io_run_cancel(work); + return IO_WQ_CANCEL_OK; + } + +@@ -957,8 +966,7 @@ static enum io_wq_cancel io_wqe_cancel_work(struct io_wqe *wqe, + spin_unlock_irqrestore(&wqe->lock, flags); + + if (found) { +- work->flags |= IO_WQ_WORK_CANCEL; +- work->func(&work); ++ io_run_cancel(work); + return IO_WQ_CANCEL_OK; + } + +-- +2.20.1 + diff --git a/queue-5.5/io_uring-fix-lockup-with-timeouts.patch b/queue-5.5/io_uring-fix-lockup-with-timeouts.patch new file mode 100644 index 00000000000..6ca8b22730e --- /dev/null +++ b/queue-5.5/io_uring-fix-lockup-with-timeouts.patch @@ -0,0 +1,41 @@ +From 8ebdac30bad9037a90fe18524ca6c5866c1206b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Mar 2020 01:15:22 +0300 +Subject: io_uring: fix lockup with timeouts + +From: Pavel Begunkov + +[ Upstream commit f0e20b8943509d81200cef5e30af2adfddba0f5c ] + +There is a recipe to deadlock the kernel: submit a timeout sqe with a +linked_timeout (e.g. test_single_link_timeout_ception() from liburing), +and SIGKILL the process. + +Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout +isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it +during io_put_free() to cancel the linked timeout. Probably, the same +can happen with another io_kill_timeout() call site, that is +io_commit_cqring(). + +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 2547c6395d5e4..44ae2641b4b06 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -688,6 +688,7 @@ static void io_kill_timeout(struct io_kiocb *req) + if (ret != -1) { + atomic_inc(&req->ctx->cq_timeouts); + list_del_init(&req->list); ++ req->flags |= REQ_F_COMP_LOCKED; + io_cqring_fill_event(req, 0); + io_put_req(req); + } +-- +2.20.1 + diff --git a/queue-5.5/parse-maintainers-mark-as-executable.patch b/queue-5.5/parse-maintainers-mark-as-executable.patch new file mode 100644 index 00000000000..fa42e15e641 --- /dev/null +++ b/queue-5.5/parse-maintainers-mark-as-executable.patch @@ -0,0 +1,28 @@ +From d490bc165ab4e214531a5d762d393991ed01ea74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 23:13:11 +0100 +Subject: parse-maintainers: Mark as executable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit 611d61f9ac99dc9e1494473fb90117a960a89dfa ] + +This makes the script more convenient to run. + +Signed-off-by: Jonathan Neuschäfer +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/parse-maintainers.pl | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100644 => 100755 scripts/parse-maintainers.pl + +diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl +old mode 100644 +new mode 100755 +-- +2.20.1 + diff --git a/queue-5.5/phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch b/queue-5.5/phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch new file mode 100644 index 00000000000..6dfcd189e89 --- /dev/null +++ b/queue-5.5/phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch @@ -0,0 +1,34 @@ +From 169265cf47f80ae93d7fce864a4994e096a7a8b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 21:08:01 +0200 +Subject: phy: ti: gmii-sel: do not fail in case of gmii + +From: Grygorii Strashko + +[ Upstream commit 58aa7729310db04ffcc022c98002dd8fcb486c58 ] + +The "gmii" PHY interface mode is supported on TI AM335x/437x/5xx SoCs, so +don't fail if it's selected. + +Signed-off-by: Grygorii Strashko +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-gmii-sel.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c +index e998e9cd8d1f8..1c536fc03c83c 100644 +--- a/drivers/phy/ti/phy-gmii-sel.c ++++ b/drivers/phy/ti/phy-gmii-sel.c +@@ -80,6 +80,7 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode) + break; + + case PHY_INTERFACE_MODE_MII: ++ case PHY_INTERFACE_MODE_GMII: + gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII; + break; + +-- +2.20.1 + diff --git a/queue-5.5/phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch b/queue-5.5/phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch new file mode 100644 index 00000000000..c9941b8b5c3 --- /dev/null +++ b/queue-5.5/phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch @@ -0,0 +1,58 @@ +From 2b32f624e14ddb477fa799f56c650bff24d6cd12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 21:08:00 +0200 +Subject: phy: ti: gmii-sel: fix set of copy-paste errors + +From: Grygorii Strashko + +[ Upstream commit eefed634eb61e4094b9fb8183cb8d43b26838517 ] + +- under PHY_INTERFACE_MODE_MII the 'mode' func parameter is assigned +instead of 'gmii_sel_mode' and it's working only because the default value +'gmii_sel_mode' is set to 0. + +- console outputs use 'rgmii_id' and 'mode' values to print PHY mode +instead of using 'submode' value which is representing PHY interface mode +now. + +This patch fixes above two cases. + +Signed-off-by: Grygorii Strashko +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-gmii-sel.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c +index a28bd15297f53..e998e9cd8d1f8 100644 +--- a/drivers/phy/ti/phy-gmii-sel.c ++++ b/drivers/phy/ti/phy-gmii-sel.c +@@ -80,20 +80,19 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode) + break; + + case PHY_INTERFACE_MODE_MII: +- mode = AM33XX_GMII_SEL_MODE_MII; ++ gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII; + break; + + default: +- dev_warn(dev, +- "port%u: unsupported mode: \"%s\". Defaulting to MII.\n", +- if_phy->id, phy_modes(rgmii_id)); ++ dev_warn(dev, "port%u: unsupported mode: \"%s\"\n", ++ if_phy->id, phy_modes(submode)); + return -EINVAL; + } + + if_phy->phy_if_mode = submode; + + dev_dbg(dev, "%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n", +- __func__, if_phy->id, mode, rgmii_id, ++ __func__, if_phy->id, submode, rgmii_id, + if_phy->rmii_clock_external); + + regfield = if_phy->fields[PHY_GMII_SEL_PORT_MODE]; +-- +2.20.1 + diff --git a/queue-5.5/powerpc-include-.btf-section.patch b/queue-5.5/powerpc-include-.btf-section.patch new file mode 100644 index 00000000000..dc9a4ce4c01 --- /dev/null +++ b/queue-5.5/powerpc-include-.btf-section.patch @@ -0,0 +1,42 @@ +From 8266cf213e8940936dfb5249e7441564c1c101ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 17:01:32 +0530 +Subject: powerpc: Include .BTF section + +From: Naveen N. Rao + +[ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ] + +Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld: + ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF' + +Include .BTF section in vmlinux explicitly to fix the same. + +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vmlinux.lds.S | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 8834220036a51..857ab49750f18 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -303,6 +303,12 @@ SECTIONS + *(.branch_lt) + } + ++#ifdef CONFIG_DEBUG_INFO_BTF ++ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { ++ *(.BTF) ++ } ++#endif ++ + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { + __start_opd = .; + KEEP(*(.opd)) +-- +2.20.1 + diff --git a/queue-5.5/revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch b/queue-5.5/revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch new file mode 100644 index 00000000000..5385b15adcf --- /dev/null +++ b/queue-5.5/revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch @@ -0,0 +1,171 @@ +From 1caf8e469dff26c6b740723f8cc3dcb81fa4c0b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Mar 2020 10:37:16 -0400 +Subject: Revert "drm/fbdev: Fallback to non tiled mode if all tiles not + present" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit f053c83ad5c88427644e06746bfddcefa409c27d ] + +This reverts commit f25c7a006cd1 ("drm/fbdev: Fallback to non tiled mode +if all tiles not present"). The commit causes flip done timeouts in CI. + +Below are the sample errors thrown in logs: + +[IGT] core_getversion: executing +[IGT] core_getversion: exiting, ret=0 +Setting dangerous option reset - tainting kernel +drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out +drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out +drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out +[drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out +[drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out +Console: switching to colour frame buffer device 480x135 +[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out +[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out + +Reverting the change for now to unblock CI execution. + +Cc: Ville Syrjälä +Cc: Dave Airlie +Cc: Jani Nikula +Cc: Manasi Navare +Signed-off-by: Uma Shankar +Fixes: f25c7a006cd1 ("drm/fbdev: Fallback to non tiled mode if all tiles not present") +Closes: https://gitlab.freedesktop.org/drm/intel/issues/6 +Acked-by: Daniel Vetter +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20191123091840.32382-1-uma.shankar@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_client_modeset.c | 72 ---------------------------- + 1 file changed, 72 deletions(-) + +diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c +index 3035584f6dc72..29367b6506a8f 100644 +--- a/drivers/gpu/drm/drm_client_modeset.c ++++ b/drivers/gpu/drm/drm_client_modeset.c +@@ -114,33 +114,6 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc) + return NULL; + } + +-static struct drm_display_mode * +-drm_connector_get_tiled_mode(struct drm_connector *connector) +-{ +- struct drm_display_mode *mode; +- +- list_for_each_entry(mode, &connector->modes, head) { +- if (mode->hdisplay == connector->tile_h_size && +- mode->vdisplay == connector->tile_v_size) +- return mode; +- } +- return NULL; +-} +- +-static struct drm_display_mode * +-drm_connector_fallback_non_tiled_mode(struct drm_connector *connector) +-{ +- struct drm_display_mode *mode; +- +- list_for_each_entry(mode, &connector->modes, head) { +- if (mode->hdisplay == connector->tile_h_size && +- mode->vdisplay == connector->tile_v_size) +- continue; +- return mode; +- } +- return NULL; +-} +- + static struct drm_display_mode * + drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height) + { +@@ -375,15 +348,8 @@ static bool drm_client_target_preferred(struct drm_connector **connectors, + struct drm_connector *connector; + u64 conn_configured = 0; + int tile_pass = 0; +- int num_tiled_conns = 0; + int i; + +- for (i = 0; i < connector_count; i++) { +- if (connectors[i]->has_tile && +- connectors[i]->status == connector_status_connected) +- num_tiled_conns++; +- } +- + retry: + for (i = 0; i < connector_count; i++) { + connector = connectors[i]; +@@ -433,28 +399,6 @@ static bool drm_client_target_preferred(struct drm_connector **connectors, + list_for_each_entry(modes[i], &connector->modes, head) + break; + } +- /* +- * In case of tiled mode if all tiles not present fallback to +- * first available non tiled mode. +- * After all tiles are present, try to find the tiled mode +- * for all and if tiled mode not present due to fbcon size +- * limitations, use first non tiled mode only for +- * tile 0,0 and set to no mode for all other tiles. +- */ +- if (connector->has_tile) { +- if (num_tiled_conns < +- connector->num_h_tile * connector->num_v_tile || +- (connector->tile_h_loc == 0 && +- connector->tile_v_loc == 0 && +- !drm_connector_get_tiled_mode(connector))) { +- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n", +- connector->base.id); +- modes[i] = drm_connector_fallback_non_tiled_mode(connector); +- } else { +- modes[i] = drm_connector_get_tiled_mode(connector); +- } +- } +- + DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name : + "none"); + conn_configured |= BIT_ULL(i); +@@ -571,7 +515,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, + bool fallback = true, ret = true; + int num_connectors_enabled = 0; + int num_connectors_detected = 0; +- int num_tiled_conns = 0; + struct drm_modeset_acquire_ctx ctx; + + if (!drm_drv_uses_atomic_modeset(dev)) +@@ -589,11 +532,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, + memcpy(save_enabled, enabled, count); + mask = GENMASK(count - 1, 0); + conn_configured = 0; +- for (i = 0; i < count; i++) { +- if (connectors[i]->has_tile && +- connectors[i]->status == connector_status_connected) +- num_tiled_conns++; +- } + retry: + conn_seq = conn_configured; + for (i = 0; i < count; i++) { +@@ -693,16 +631,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client, + connector->name); + modes[i] = &connector->state->crtc->mode; + } +- /* +- * In case of tiled modes, if all tiles are not present +- * then fallback to a non tiled mode. +- */ +- if (connector->has_tile && +- num_tiled_conns < connector->num_h_tile * connector->num_v_tile) { +- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n", +- connector->base.id); +- modes[i] = drm_connector_fallback_non_tiled_mode(connector); +- } + crtcs[i] = new_crtc; + + DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n", +-- +2.20.1 + diff --git a/queue-5.5/riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch b/queue-5.5/riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch new file mode 100644 index 00000000000..3a371e4d893 --- /dev/null +++ b/queue-5.5/riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch @@ -0,0 +1,66 @@ +From fd0d56557d01e91f3aa3168666d4ca59b51c13ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2020 10:47:54 +0800 +Subject: riscv: avoid the PIC offset of static percpu data in module beyond 2G + limits + +From: Vincent Chen + +[ Upstream commit 0cff8bff7af886af0923d5c91776cd51603e531f ] + +The compiler uses the PIC-relative method to access static variables +instead of GOT when the code model is PIC. Therefore, the limitation of +the access range from the instruction to the symbol address is +-2GB. +Under this circumstance, the kernel cannot load a kernel module if this +module has static per-CPU symbols declared by DEFINE_PER_CPU(). The reason +is that kernel relocates the .data..percpu section of the kernel module to +the end of kernel's .data..percpu. Hence, the distance between the per-CPU +symbols and the instruction will exceed the 2GB limits. To solve this +problem, the kernel should place the loaded module in the memory area +[&_end-2G, VMALLOC_END]. + +Signed-off-by: Vincent Chen +Suggested-by: Alexandre Ghiti +Suggested-by: Anup Patel +Tested-by: Alexandre Ghiti +Tested-by: Carlos de Paula +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/module.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index b7401858d872f..8bbe5dbe1341b 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -8,6 +8,10 @@ + #include + #include + #include ++#include ++#include ++#include ++#include + + static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v) + { +@@ -386,3 +390,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, + + return 0; + } ++ ++#if defined(CONFIG_MMU) && defined(CONFIG_64BIT) ++#define VMALLOC_MODULE_START \ ++ max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START) ++void *module_alloc(unsigned long size) ++{ ++ return __vmalloc_node_range(size, 1, VMALLOC_MODULE_START, ++ VMALLOC_END, GFP_KERNEL, ++ PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, ++ __builtin_return_address(0)); ++} ++#endif +-- +2.20.1 + diff --git a/queue-5.5/riscv-fix-range-looking-for-kernel-image-memblock.patch b/queue-5.5/riscv-fix-range-looking-for-kernel-image-memblock.patch new file mode 100644 index 00000000000..3bed0370a79 --- /dev/null +++ b/queue-5.5/riscv-fix-range-looking-for-kernel-image-memblock.patch @@ -0,0 +1,37 @@ +From 82ba91a34db928e763f39ceccc372bb2ca1c40f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2020 00:28:47 -0500 +Subject: riscv: Fix range looking for kernel image memblock + +From: Alexandre Ghiti + +[ Upstream commit a160eed4b783d7b250a32f7e5787c9867abc5686 ] + +When looking for the memblock where the kernel lives, we should check +that the memory range associated to the memblock entirely comprises the +kernel image and not only intersects with it. + +Signed-off-by: Alexandre Ghiti +Reviewed-by: Anup Patel +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 965a8cf4829ca..fab855963c730 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -131,7 +131,7 @@ void __init setup_bootmem(void) + for_each_memblock(memory, reg) { + phys_addr_t end = reg->base + reg->size; + +- if (reg->base <= vmlinux_end && vmlinux_end <= end) { ++ if (reg->base <= vmlinux_start && vmlinux_end <= end) { + mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET); + + /* +-- +2.20.1 + diff --git a/queue-5.5/riscv-fix-seccomp-reject-syscall-code-path.patch b/queue-5.5/riscv-fix-seccomp-reject-syscall-code-path.patch new file mode 100644 index 00000000000..9c3aa067cec --- /dev/null +++ b/queue-5.5/riscv-fix-seccomp-reject-syscall-code-path.patch @@ -0,0 +1,149 @@ +From 2d8c6e3613dcb9c2824901a0441581ca0c754977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Feb 2020 08:18:17 -0700 +Subject: riscv: fix seccomp reject syscall code path + +From: Tycho Andersen + +[ Upstream commit af33d2433b03d63ed31fcfda842f46676a5e1afc ] + +If secure_computing() rejected a system call, we were previously setting +the system call number to -1, to indicate to later code that the syscall +failed. However, if something (e.g. a user notification) was sleeping, and +received a signal, we may set a0 to -ERESTARTSYS and re-try the system call +again. + +In this case, seccomp "denies" the syscall (because of the signal), and we +would set a7 to -1, thus losing the value of the system call we want to +restart. + +Instead, let's return -1 from do_syscall_trace_enter() to indicate that the +syscall was rejected, so we don't clobber the value in case of -ERESTARTSYS +or whatever. + +This commit fixes the user_notification_signal seccomp selftest on riscv to +no longer hang. That test expects the system call to be re-issued after the +signal, and it wasn't due to the above bug. Now that it is, everything +works normally. + +Note that in the ptrace (tracer) case, the tracer can set the register +values to whatever they want, so we still need to keep the code that +handles out-of-bounds syscalls. However, we can drop the comment. + +We can also drop syscall_set_nr(), since it is no longer used anywhere, and +the code that re-loads the value in a7 because of it. + +Reported in: https://lore.kernel.org/bpf/CAEn-LTp=ss0Dfv6J00=rCAy+N78U2AmhqJNjfqjr2FDpPYjxEQ@mail.gmail.com/ + +Reported-by: David Abdurachmanov +Signed-off-by: Tycho Andersen +Reviewed-by: Kees Cook +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/syscall.h | 7 ------- + arch/riscv/kernel/entry.S | 11 +++-------- + arch/riscv/kernel/ptrace.c | 11 +++++------ + 3 files changed, 8 insertions(+), 21 deletions(-) + +diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h +index 42347d0981e7e..49350c8bd7b09 100644 +--- a/arch/riscv/include/asm/syscall.h ++++ b/arch/riscv/include/asm/syscall.h +@@ -28,13 +28,6 @@ static inline int syscall_get_nr(struct task_struct *task, + return regs->a7; + } + +-static inline void syscall_set_nr(struct task_struct *task, +- struct pt_regs *regs, +- int sysno) +-{ +- regs->a7 = sysno; +-} +- + static inline void syscall_rollback(struct task_struct *task, + struct pt_regs *regs) + { +diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S +index e163b7b64c86c..f6486d4956013 100644 +--- a/arch/riscv/kernel/entry.S ++++ b/arch/riscv/kernel/entry.S +@@ -228,20 +228,13 @@ check_syscall_nr: + /* Check to make sure we don't jump to a bogus syscall number. */ + li t0, __NR_syscalls + la s0, sys_ni_syscall +- /* +- * The tracer can change syscall number to valid/invalid value. +- * We use syscall_set_nr helper in syscall_trace_enter thus we +- * cannot trust the current value in a7 and have to reload from +- * the current task pt_regs. +- */ +- REG_L a7, PT_A7(sp) + /* + * Syscall number held in a7. + * If syscall number is above allowed value, redirect to ni_syscall. + */ + bge a7, t0, 1f + /* +- * Check if syscall is rejected by tracer or seccomp, i.e., a7 == -1. ++ * Check if syscall is rejected by tracer, i.e., a7 == -1. + * If yes, we pretend it was executed. + */ + li t1, -1 +@@ -334,6 +327,7 @@ work_resched: + handle_syscall_trace_enter: + move a0, sp + call do_syscall_trace_enter ++ move t0, a0 + REG_L a0, PT_A0(sp) + REG_L a1, PT_A1(sp) + REG_L a2, PT_A2(sp) +@@ -342,6 +336,7 @@ handle_syscall_trace_enter: + REG_L a5, PT_A5(sp) + REG_L a6, PT_A6(sp) + REG_L a7, PT_A7(sp) ++ bnez t0, ret_from_syscall_rejected + j check_syscall_nr + handle_syscall_trace_exit: + move a0, sp +diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c +index 407464201b91e..444dc7b0fd78c 100644 +--- a/arch/riscv/kernel/ptrace.c ++++ b/arch/riscv/kernel/ptrace.c +@@ -148,21 +148,19 @@ long arch_ptrace(struct task_struct *child, long request, + * Allows PTRACE_SYSCALL to work. These are called from entry.S in + * {handle,ret_from}_syscall. + */ +-__visible void do_syscall_trace_enter(struct pt_regs *regs) ++__visible int do_syscall_trace_enter(struct pt_regs *regs) + { + if (test_thread_flag(TIF_SYSCALL_TRACE)) + if (tracehook_report_syscall_entry(regs)) +- syscall_set_nr(current, regs, -1); ++ return -1; + + /* + * Do the secure computing after ptrace; failures should be fast. + * If this fails we might have return value in a0 from seccomp + * (via SECCOMP_RET_ERRNO/TRACE). + */ +- if (secure_computing() == -1) { +- syscall_set_nr(current, regs, -1); +- return; +- } ++ if (secure_computing() == -1) ++ return -1; + + #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) +@@ -170,6 +168,7 @@ __visible void do_syscall_trace_enter(struct pt_regs *regs) + #endif + + audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3); ++ return 0; + } + + __visible void do_syscall_trace_exit(struct pt_regs *regs) +-- +2.20.1 + diff --git a/queue-5.5/riscv-force-flat-memory-model-with-no-mmu.patch b/queue-5.5/riscv-force-flat-memory-model-with-no-mmu.patch new file mode 100644 index 00000000000..ddfff3e2de8 --- /dev/null +++ b/queue-5.5/riscv-force-flat-memory-model-with-no-mmu.patch @@ -0,0 +1,38 @@ +From b1cc20514e5de35d6931892d307ac2d7ab272b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2020 19:34:24 +0900 +Subject: riscv: Force flat memory model with no-mmu + +From: Damien Le Moal + +[ Upstream commit aa2734202acc506d09c8e641db4da161f902df27 ] + +Compilation errors trigger if ARCH_SPARSEMEM_ENABLE is enabled for +a nommu kernel. Since the sparsemem model does not make sense anyway +for the nommu case, do not allow selecting this option to always use +the flatmem model. + +Signed-off-by: Damien Le Moal +Reviewed-by: Anup Patel +Reviewed-by: Palmer Dabbelt +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index fa7dc03459e7f..1be11c23fa335 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -121,6 +121,7 @@ config ARCH_FLATMEM_ENABLE + + config ARCH_SPARSEMEM_ENABLE + def_bool y ++ depends on MMU + select SPARSEMEM_VMEMMAP_ENABLE + + config ARCH_SELECT_MEMORY_MODEL +-- +2.20.1 + diff --git a/queue-5.5/series b/queue-5.5/series index fb3b63ac99a..320b7092077 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -1,2 +1,44 @@ locks-fix-a-potential-use-after-free-problem-when-wa.patch locks-reinstate-locks_delete_block-optimization.patch +spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch +spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch +drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch +drm-mediatek-ensure-the-cursor-plane-is-on-top-of-ot.patch +phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch +phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch +arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch +asoc-meson-g12a-add-tohdmitx-reset.patch +spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch +powerpc-include-.btf-section.patch +cifs-fix-potential-mismatch-of-unc-paths.patch +cifs-add-missing-mount-option-to-proc-mounts.patch +arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch +spi-pxa2xx-add-cs-control-clock-quirk.patch +spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch +arm-dts-bcm283x-add-missing-properties-to-the-pwr-le.patch +drm-exynos-dsi-propagate-error-value-and-silence-mea.patch +drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch +drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch +drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch +drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch +io-wq-fix-io_wq_work_no_cancel-cancellation.patch +arm-bcm2835_defconfig-explicitly-restore-config_debu.patch +altera-stapl-altera_get_note-prevent-write-beyond-en.patch +dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch +dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch +riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch +asoc-stm32-sai-manage-rebind-issue.patch +spi-spi_register_controller-free-bus-id-on-error-pat.patch +riscv-force-flat-memory-model-with-no-mmu.patch +riscv-fix-range-looking-for-kernel-image-memblock.patch +drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch +drm-amd-display-clear-link-settings-on-mst-disable-c.patch +drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch +xenbus-req-body-should-be-updated-before-req-state.patch +xenbus-req-err-should-be-updated-before-req-state.patch +riscv-fix-seccomp-reject-syscall-code-path.patch +block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch +parse-maintainers-mark-as-executable.patch +io_uring-fix-lockup-with-timeouts.patch +binderfs-use-refcount-for-binder-control-devices-too.patch +revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch diff --git a/queue-5.5/spi-pxa2xx-add-cs-control-clock-quirk.patch b/queue-5.5/spi-pxa2xx-add-cs-control-clock-quirk.patch new file mode 100644 index 00000000000..d3e7e2840a5 --- /dev/null +++ b/queue-5.5/spi-pxa2xx-add-cs-control-clock-quirk.patch @@ -0,0 +1,87 @@ +From 3a6004a0e4442e456e5f4d3f272c092434275ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2020 14:37:00 -0800 +Subject: spi: pxa2xx: Add CS control clock quirk + +From: Evan Green + +[ Upstream commit 683f65ded66a9a7ff01ed7280804d2132ebfdf7e ] + +In some circumstances on Intel LPSS controllers, toggling the LPSS +CS control register doesn't actually cause the CS line to toggle. +This seems to be failure of dynamic clock gating that occurs after +going through a suspend/resume transition, where the controller +is sent through a reset transition. This ruins SPI transactions +that either rely on delay_usecs, or toggle the CS line without +sending data. + +Whenever CS is toggled, momentarily set the clock gating register +to "Force On" to poke the controller into acting on CS. + +Signed-off-by: Rajat Jain +Signed-off-by: Evan Green +Link: https://lore.kernel.org/r/20200211223700.110252-1-rajatja@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 9071333ebdd86..cabd1a85d71e3 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -70,6 +70,10 @@ MODULE_ALIAS("platform:pxa2xx-spi"); + #define LPSS_CAPS_CS_EN_SHIFT 9 + #define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT) + ++#define LPSS_PRIV_CLOCK_GATE 0x38 ++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3 ++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3 ++ + struct lpss_config { + /* LPSS offset from drv_data->ioaddr */ + unsigned offset; +@@ -86,6 +90,8 @@ struct lpss_config { + unsigned cs_sel_shift; + unsigned cs_sel_mask; + unsigned cs_num; ++ /* Quirks */ ++ unsigned cs_clk_stays_gated : 1; + }; + + /* Keep these sorted with enum pxa_ssp_type */ +@@ -156,6 +162,7 @@ static const struct lpss_config lpss_platforms[] = { + .tx_threshold_hi = 56, + .cs_sel_shift = 8, + .cs_sel_mask = 3 << 8, ++ .cs_clk_stays_gated = true, + }, + }; + +@@ -383,6 +390,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable) + else + value |= LPSS_CS_CONTROL_CS_HIGH; + __lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value); ++ if (config->cs_clk_stays_gated) { ++ u32 clkgate; ++ ++ /* ++ * Changing CS alone when dynamic clock gating is on won't ++ * actually flip CS at that time. This ruins SPI transfers ++ * that specify delays, or have no data. Toggle the clock mode ++ * to force on briefly to poke the CS pin to move. ++ */ ++ clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE); ++ value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) | ++ LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON; ++ ++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value); ++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate); ++ } + } + + static void cs_assert(struct spi_device *spi) +-- +2.20.1 + diff --git a/queue-5.5/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch b/queue-5.5/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch new file mode 100644 index 00000000000..e06c9255142 --- /dev/null +++ b/queue-5.5/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch @@ -0,0 +1,55 @@ +From 091e2a35431fefda618c0a8fa0cff36aabd5e8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 13:13:40 +0530 +Subject: spi: qup: call spi_qup_pm_resume_runtime before suspending + +From: Yuji Sasaki + +[ Upstream commit 136b5cd2e2f97581ae560cff0db2a3b5369112da ] + +spi_qup_suspend() will cause synchronous external abort when +runtime suspend is enabled and applied, as it tries to +access SPI controller register while clock is already disabled +in spi_qup_pm_suspend_runtime(). + +Signed-off-by: Yuji sasaki +Signed-off-by: Vinod Koul +Link: https://lore.kernel.org/r/20200214074340.2286170-1-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index dd3434a407ea6..a364b99497e26 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1217,6 +1217,11 @@ static int spi_qup_suspend(struct device *device) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + ++ if (pm_runtime_suspended(device)) { ++ ret = spi_qup_pm_resume_runtime(device); ++ if (ret) ++ return ret; ++ } + ret = spi_master_suspend(master); + if (ret) + return ret; +@@ -1225,10 +1230,8 @@ static int spi_qup_suspend(struct device *device) + if (ret) + return ret; + +- if (!pm_runtime_suspended(device)) { +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); +- } ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.5/spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch b/queue-5.5/spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch new file mode 100644 index 00000000000..7f2e538131e --- /dev/null +++ b/queue-5.5/spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch @@ -0,0 +1,103 @@ +From 313b21b44208424e5e8ce0e683ffbb7bd387a92b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2020 18:18:15 +0530 +Subject: spi: spi-omap2-mcspi: Handle DMA size restriction on AM65x + +From: Vignesh Raghavendra + +[ Upstream commit e4e8276a4f652be2c7bb783a0155d4adb85f5d7d ] + +On AM654, McSPI can only support 4K - 1 bytes per transfer when DMA is +enabled. Therefore populate master->max_transfer_size callback to +inform client drivers of this restriction when DMA channels are +available. + +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20200204124816.16735-2-vigneshr@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 26 +++++++++++++++++++ + include/linux/platform_data/spi-omap2-mcspi.h | 1 + + 2 files changed, 27 insertions(+) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 7e2292c11d120..e9bc9cf984d60 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -130,6 +130,7 @@ struct omap2_mcspi { + int fifo_depth; + bool slave_aborted; + unsigned int pin_dir:1; ++ size_t max_xfer_len; + }; + + struct omap2_mcspi_cs { +@@ -1305,6 +1306,18 @@ static bool omap2_mcspi_can_dma(struct spi_master *master, + return (xfer->len >= DMA_MIN_BYTES); + } + ++static size_t omap2_mcspi_max_xfer_size(struct spi_device *spi) ++{ ++ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); ++ struct omap2_mcspi_dma *mcspi_dma = ++ &mcspi->dma_channels[spi->chip_select]; ++ ++ if (mcspi->max_xfer_len && mcspi_dma->dma_rx) ++ return mcspi->max_xfer_len; ++ ++ return SIZE_MAX; ++} ++ + static int omap2_mcspi_controller_setup(struct omap2_mcspi *mcspi) + { + struct spi_master *master = mcspi->master; +@@ -1373,6 +1386,11 @@ static struct omap2_mcspi_platform_config omap4_pdata = { + .regs_offset = OMAP4_MCSPI_REG_OFFSET, + }; + ++static struct omap2_mcspi_platform_config am654_pdata = { ++ .regs_offset = OMAP4_MCSPI_REG_OFFSET, ++ .max_xfer_len = SZ_4K - 1, ++}; ++ + static const struct of_device_id omap_mcspi_of_match[] = { + { + .compatible = "ti,omap2-mcspi", +@@ -1382,6 +1400,10 @@ static const struct of_device_id omap_mcspi_of_match[] = { + .compatible = "ti,omap4-mcspi", + .data = &omap4_pdata, + }, ++ { ++ .compatible = "ti,am654-mcspi", ++ .data = &am654_pdata, ++ }, + { }, + }; + MODULE_DEVICE_TABLE(of, omap_mcspi_of_match); +@@ -1439,6 +1461,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + mcspi->pin_dir = pdata->pin_dir; + } + regs_offset = pdata->regs_offset; ++ if (pdata->max_xfer_len) { ++ mcspi->max_xfer_len = pdata->max_xfer_len; ++ master->max_transfer_size = omap2_mcspi_max_xfer_size; ++ } + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + mcspi->base = devm_ioremap_resource(&pdev->dev, r); +diff --git a/include/linux/platform_data/spi-omap2-mcspi.h b/include/linux/platform_data/spi-omap2-mcspi.h +index 0bf9fddb83064..3b400b1919a9b 100644 +--- a/include/linux/platform_data/spi-omap2-mcspi.h ++++ b/include/linux/platform_data/spi-omap2-mcspi.h +@@ -11,6 +11,7 @@ struct omap2_mcspi_platform_config { + unsigned short num_cs; + unsigned int regs_offset; + unsigned int pin_dir:1; ++ size_t max_xfer_len; + }; + + struct omap2_mcspi_device_config { +-- +2.20.1 + diff --git a/queue-5.5/spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch b/queue-5.5/spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch new file mode 100644 index 00000000000..8e4eee317b4 --- /dev/null +++ b/queue-5.5/spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch @@ -0,0 +1,192 @@ +From 6c6d6be88045208c7a4565be6d9448d0f0b6ca7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2020 18:18:16 +0530 +Subject: spi: spi-omap2-mcspi: Support probe deferral for DMA channels + +From: Vignesh Raghavendra + +[ Upstream commit 32f2fc5dc3992b4b60cc6b1a6a31be605cc9c3a2 ] + +dma_request_channel() can return -EPROBE_DEFER, if DMA driver is not +ready. Currently driver just falls back to PIO mode on probe deferral. +Fix this by requesting all required channels during probe and +propagating EPROBE_DEFER error code. + +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20200204124816.16735-3-vigneshr@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 77 +++++++++++++++++------------------ + 1 file changed, 38 insertions(+), 39 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index e9bc9cf984d60..e9e256718ef4a 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -975,20 +975,12 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi, + * Note that we currently allow DMA only if we get a channel + * for both rx and tx. Otherwise we'll do PIO for both rx and tx. + */ +-static int omap2_mcspi_request_dma(struct spi_device *spi) ++static int omap2_mcspi_request_dma(struct omap2_mcspi *mcspi, ++ struct omap2_mcspi_dma *mcspi_dma) + { +- struct spi_master *master = spi->master; +- struct omap2_mcspi *mcspi; +- struct omap2_mcspi_dma *mcspi_dma; + int ret = 0; + +- mcspi = spi_master_get_devdata(master); +- mcspi_dma = mcspi->dma_channels + spi->chip_select; +- +- init_completion(&mcspi_dma->dma_rx_completion); +- init_completion(&mcspi_dma->dma_tx_completion); +- +- mcspi_dma->dma_rx = dma_request_chan(&master->dev, ++ mcspi_dma->dma_rx = dma_request_chan(mcspi->dev, + mcspi_dma->dma_rx_ch_name); + if (IS_ERR(mcspi_dma->dma_rx)) { + ret = PTR_ERR(mcspi_dma->dma_rx); +@@ -996,7 +988,7 @@ static int omap2_mcspi_request_dma(struct spi_device *spi) + goto no_dma; + } + +- mcspi_dma->dma_tx = dma_request_chan(&master->dev, ++ mcspi_dma->dma_tx = dma_request_chan(mcspi->dev, + mcspi_dma->dma_tx_ch_name); + if (IS_ERR(mcspi_dma->dma_tx)) { + ret = PTR_ERR(mcspi_dma->dma_tx); +@@ -1005,20 +997,40 @@ static int omap2_mcspi_request_dma(struct spi_device *spi) + mcspi_dma->dma_rx = NULL; + } + ++ init_completion(&mcspi_dma->dma_rx_completion); ++ init_completion(&mcspi_dma->dma_tx_completion); ++ + no_dma: + return ret; + } + ++static void omap2_mcspi_release_dma(struct spi_master *master) ++{ ++ struct omap2_mcspi *mcspi = spi_master_get_devdata(master); ++ struct omap2_mcspi_dma *mcspi_dma; ++ int i; ++ ++ for (i = 0; i < master->num_chipselect; i++) { ++ mcspi_dma = &mcspi->dma_channels[i]; ++ ++ if (mcspi_dma->dma_rx) { ++ dma_release_channel(mcspi_dma->dma_rx); ++ mcspi_dma->dma_rx = NULL; ++ } ++ if (mcspi_dma->dma_tx) { ++ dma_release_channel(mcspi_dma->dma_tx); ++ mcspi_dma->dma_tx = NULL; ++ } ++ } ++} ++ + static int omap2_mcspi_setup(struct spi_device *spi) + { + int ret; + struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); + struct omap2_mcspi_regs *ctx = &mcspi->ctx; +- struct omap2_mcspi_dma *mcspi_dma; + struct omap2_mcspi_cs *cs = spi->controller_state; + +- mcspi_dma = &mcspi->dma_channels[spi->chip_select]; +- + if (!cs) { + cs = kzalloc(sizeof *cs, GFP_KERNEL); + if (!cs) +@@ -1043,13 +1055,6 @@ static int omap2_mcspi_setup(struct spi_device *spi) + } + } + +- if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) { +- ret = omap2_mcspi_request_dma(spi); +- if (ret) +- dev_warn(&spi->dev, "not using DMA for McSPI (%d)\n", +- ret); +- } +- + ret = pm_runtime_get_sync(mcspi->dev); + if (ret < 0) { + pm_runtime_put_noidle(mcspi->dev); +@@ -1066,12 +1071,8 @@ static int omap2_mcspi_setup(struct spi_device *spi) + + static void omap2_mcspi_cleanup(struct spi_device *spi) + { +- struct omap2_mcspi *mcspi; +- struct omap2_mcspi_dma *mcspi_dma; + struct omap2_mcspi_cs *cs; + +- mcspi = spi_master_get_devdata(spi->master); +- + if (spi->controller_state) { + /* Unlink controller state from context save list */ + cs = spi->controller_state; +@@ -1080,19 +1081,6 @@ static void omap2_mcspi_cleanup(struct spi_device *spi) + kfree(cs); + } + +- if (spi->chip_select < spi->master->num_chipselect) { +- mcspi_dma = &mcspi->dma_channels[spi->chip_select]; +- +- if (mcspi_dma->dma_rx) { +- dma_release_channel(mcspi_dma->dma_rx); +- mcspi_dma->dma_rx = NULL; +- } +- if (mcspi_dma->dma_tx) { +- dma_release_channel(mcspi_dma->dma_tx); +- mcspi_dma->dma_tx = NULL; +- } +- } +- + if (gpio_is_valid(spi->cs_gpio)) + gpio_free(spi->cs_gpio); + } +@@ -1303,6 +1291,9 @@ static bool omap2_mcspi_can_dma(struct spi_master *master, + if (spi_controller_is_slave(master)) + return true; + ++ master->dma_rx = mcspi_dma->dma_rx; ++ master->dma_tx = mcspi_dma->dma_tx; ++ + return (xfer->len >= DMA_MIN_BYTES); + } + +@@ -1490,6 +1481,11 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + for (i = 0; i < master->num_chipselect; i++) { + sprintf(mcspi->dma_channels[i].dma_rx_ch_name, "rx%d", i); + sprintf(mcspi->dma_channels[i].dma_tx_ch_name, "tx%d", i); ++ ++ status = omap2_mcspi_request_dma(mcspi, ++ &mcspi->dma_channels[i]); ++ if (status == -EPROBE_DEFER) ++ goto free_master; + } + + status = platform_get_irq(pdev, 0); +@@ -1527,6 +1523,7 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); + free_master: ++ omap2_mcspi_release_dma(master); + spi_master_put(master); + return status; + } +@@ -1536,6 +1533,8 @@ static int omap2_mcspi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct omap2_mcspi *mcspi = spi_master_get_devdata(master); + ++ omap2_mcspi_release_dma(master); ++ + pm_runtime_dont_use_autosuspend(mcspi->dev); + pm_runtime_put_sync(mcspi->dev); + pm_runtime_disable(&pdev->dev); +-- +2.20.1 + diff --git a/queue-5.5/spi-spi_register_controller-free-bus-id-on-error-pat.patch b/queue-5.5/spi-spi_register_controller-free-bus-id-on-error-pat.patch new file mode 100644 index 00000000000..27b899e2179 --- /dev/null +++ b/queue-5.5/spi-spi_register_controller-free-bus-id-on-error-pat.patch @@ -0,0 +1,97 @@ +From 90f902f69c568497962b78d91d578491b5dab17c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 13:17:40 +0200 +Subject: spi: spi_register_controller(): free bus id on error paths + +From: Aaro Koskinen + +[ Upstream commit f9981d4f50b475d7dbb70f3022b87a3c8bba9fd6 ] + +Some error paths leave the bus id allocated. As a result the IDR +allocation will fail after a deferred probe. Fix by freeing the bus id +always on error. + +Signed-off-by: Aaro Koskinen +Message-Id: <20200304111740.27915-1-aaro.koskinen@nokia.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 8994545367a2d..0e70af2677fee 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2615,7 +2615,7 @@ int spi_register_controller(struct spi_controller *ctlr) + if (ctlr->use_gpio_descriptors) { + status = spi_get_gpio_descs(ctlr); + if (status) +- return status; ++ goto free_bus_id; + /* + * A controller using GPIO descriptors always + * supports SPI_CS_HIGH if need be. +@@ -2625,7 +2625,7 @@ int spi_register_controller(struct spi_controller *ctlr) + /* Legacy code path for GPIOs from DT */ + status = of_spi_get_gpio_numbers(ctlr); + if (status) +- return status; ++ goto free_bus_id; + } + } + +@@ -2633,17 +2633,14 @@ int spi_register_controller(struct spi_controller *ctlr) + * Even if it's just one always-selected device, there must + * be at least one chipselect. + */ +- if (!ctlr->num_chipselect) +- return -EINVAL; ++ if (!ctlr->num_chipselect) { ++ status = -EINVAL; ++ goto free_bus_id; ++ } + + status = device_add(&ctlr->dev); +- if (status < 0) { +- /* free bus id */ +- mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, ctlr->bus_num); +- mutex_unlock(&board_lock); +- goto done; +- } ++ if (status < 0) ++ goto free_bus_id; + dev_dbg(dev, "registered %s %s\n", + spi_controller_is_slave(ctlr) ? "slave" : "master", + dev_name(&ctlr->dev)); +@@ -2659,11 +2656,7 @@ int spi_register_controller(struct spi_controller *ctlr) + status = spi_controller_initialize_queue(ctlr); + if (status) { + device_del(&ctlr->dev); +- /* free bus id */ +- mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, ctlr->bus_num); +- mutex_unlock(&board_lock); +- goto done; ++ goto free_bus_id; + } + } + /* add statistics */ +@@ -2678,7 +2671,12 @@ int spi_register_controller(struct spi_controller *ctlr) + /* Register devices from the device tree and ACPI */ + of_register_spi_devices(ctlr); + acpi_register_spi_devices(ctlr); +-done: ++ return status; ++ ++free_bus_id: ++ mutex_lock(&board_lock); ++ idr_remove(&spi_master_idr, ctlr->bus_num); ++ mutex_unlock(&board_lock); + return status; + } + EXPORT_SYMBOL_GPL(spi_register_controller); +-- +2.20.1 + diff --git a/queue-5.5/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch b/queue-5.5/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch new file mode 100644 index 00000000000..6db2bc8a788 --- /dev/null +++ b/queue-5.5/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch @@ -0,0 +1,58 @@ +From 5a80ef8c99bfa5f0ee290fce1d41404ce210ef95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2020 17:26:43 +0100 +Subject: spi/zynqmp: remove entry that causes a cs glitch + +From: Thommy Jakobsson + +[ Upstream commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 ] + +In the public interface for chipselect, there is always an entry +commented as "Dummy generic FIFO entry" pushed down to the fifo right +after the activate/deactivate command. The dummy entry is 0x0, +irregardless if the intention was to activate or deactive the cs. This +causes the cs line to glitch rather than beeing activated in the case +when there was an activate command. + +This has been observed on oscilloscope, and have caused problems for at +least one specific flash device type connected to the qspi port. After +the change the glitch is gone and cs goes active when intended. + +The reason why this worked before (except for the glitch) was because +when sending the actual data, the CS bits are once again set. Since +most flashes uses mode 0, there is always a half clk period anyway for +cs to clk active setup time. If someone would rely on timing from a +chip_select call to a transfer_one, it would fail though. + +It is unknown why the dummy entry was there in the first place, git log +seems to be of no help in this case. The reference manual gives no +indication of the necessity of this. In fact the lower 8 bits are a +setup (or hold in case of deactivate) time expressed in cycles. So this +should not be needed to fulfill any setup/hold timings. + +Signed-off-by: Thommy Jakobsson +Reviewed-by: Naga Sureshkumar Relli +Link: https://lore.kernel.org/r/20200224162643.29102-1-thommyj@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 60c4de4e44856..7412a3042a8d2 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -401,9 +401,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high) + + zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry); + +- /* Dummy generic FIFO entry */ +- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0); +- + /* Manually start the generic FIFO command */ + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, + zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | +-- +2.20.1 + diff --git a/queue-5.5/xenbus-req-body-should-be-updated-before-req-state.patch b/queue-5.5/xenbus-req-body-should-be-updated-before-req-state.patch new file mode 100644 index 00000000000..ab1df54ca45 --- /dev/null +++ b/queue-5.5/xenbus-req-body-should-be-updated-before-req-state.patch @@ -0,0 +1,113 @@ +From f81dfab157887b3890e009a63afaddbbe4b18970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 14:14:22 -0800 +Subject: xenbus: req->body should be updated before req->state + +From: Dongli Zhang + +[ Upstream commit 1b6a51e86cce38cf4d48ce9c242120283ae2f603 ] + +The req->body should be updated before req->state is updated and the +order should be guaranteed by a barrier. + +Otherwise, read_reply() might return req->body = NULL. + +Below is sample callstack when the issue is reproduced on purpose by +reordering the updates of req->body and req->state and adding delay in +code between updates of req->state and req->body. + +[ 22.356105] general protection fault: 0000 [#1] SMP PTI +[ 22.361185] CPU: 2 PID: 52 Comm: xenwatch Not tainted 5.5.0xen+ #6 +[ 22.366727] Hardware name: Xen HVM domU, BIOS ... +[ 22.372245] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60 +... ... +[ 22.392163] RSP: 0018:ffffb2d64023fdf0 EFLAGS: 00010246 +[ 22.395933] RAX: 0000000000000000 RBX: 75746e7562755f6d RCX: 0000000000000000 +[ 22.400871] RDX: 0000000000000000 RSI: ffffb2d64023fdfc RDI: 75746e7562755f6d +[ 22.405874] RBP: 0000000000000000 R08: 00000000000001e8 R09: 0000000000cdcdcd +[ 22.410945] R10: ffffb2d6402ffe00 R11: ffff9d95395eaeb0 R12: ffff9d9535935000 +[ 22.417613] R13: ffff9d9526d4a000 R14: ffff9d9526f4f340 R15: ffff9d9537654000 +[ 22.423726] FS: 0000000000000000(0000) GS:ffff9d953bc80000(0000) knlGS:0000000000000000 +[ 22.429898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 22.434342] CR2: 000000c4206a9000 CR3: 00000001ea3fc002 CR4: 00000000001606e0 +[ 22.439645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 22.444941] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 22.450342] Call Trace: +[ 22.452509] simple_strtoull+0x27/0x70 +[ 22.455572] xenbus_transaction_start+0x31/0x50 +[ 22.459104] netback_changed+0x76c/0xcc1 [xen_netfront] +[ 22.463279] ? find_watch+0x40/0x40 +[ 22.466156] xenwatch_thread+0xb4/0x150 +[ 22.469309] ? wait_woken+0x80/0x80 +[ 22.472198] kthread+0x10e/0x130 +[ 22.474925] ? kthread_park+0x80/0x80 +[ 22.477946] ret_from_fork+0x35/0x40 +[ 22.480968] Modules linked in: xen_kbdfront xen_fbfront(+) xen_netfront xen_blkfront +[ 22.486783] ---[ end trace a9222030a747c3f7 ]--- +[ 22.490424] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60 + +The virt_rmb() is added in the 'true' path of test_reply(). The "while" +is changed to "do while" so that test_reply() is used as a read memory +barrier. + +Signed-off-by: Dongli Zhang +Link: https://lore.kernel.org/r/20200303221423.21962-1-dongli.zhang@oracle.com +Reviewed-by: Julien Grall +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_comms.c | 2 ++ + drivers/xen/xenbus/xenbus_xs.c | 9 ++++++--- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c +index d239fc3c5e3de..852ed161fc2a7 100644 +--- a/drivers/xen/xenbus/xenbus_comms.c ++++ b/drivers/xen/xenbus/xenbus_comms.c +@@ -313,6 +313,8 @@ static int process_msg(void) + req->msg.type = state.msg.type; + req->msg.len = state.msg.len; + req->body = state.body; ++ /* write body, then update state */ ++ virt_wmb(); + req->state = xb_req_state_got_reply; + req->cb(req); + } else +diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c +index ddc18da61834e..3a06eb699f333 100644 +--- a/drivers/xen/xenbus/xenbus_xs.c ++++ b/drivers/xen/xenbus/xenbus_xs.c +@@ -191,8 +191,11 @@ static bool xenbus_ok(void) + + static bool test_reply(struct xb_req_data *req) + { +- if (req->state == xb_req_state_got_reply || !xenbus_ok()) ++ if (req->state == xb_req_state_got_reply || !xenbus_ok()) { ++ /* read req->state before all other fields */ ++ virt_rmb(); + return true; ++ } + + /* Make sure to reread req->state each time. */ + barrier(); +@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req) + + static void *read_reply(struct xb_req_data *req) + { +- while (req->state != xb_req_state_got_reply) { ++ do { + wait_event(req->wq, test_reply(req)); + + if (!xenbus_ok()) +@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req) + if (req->err) + return ERR_PTR(req->err); + +- } ++ } while (req->state != xb_req_state_got_reply); + + return req->body; + } +-- +2.20.1 + diff --git a/queue-5.5/xenbus-req-err-should-be-updated-before-req-state.patch b/queue-5.5/xenbus-req-err-should-be-updated-before-req-state.patch new file mode 100644 index 00000000000..787ee4a5a8b --- /dev/null +++ b/queue-5.5/xenbus-req-err-should-be-updated-before-req-state.patch @@ -0,0 +1,40 @@ +From 6c777b28c8ce1f714ec54a581af51141566bc9e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 14:14:23 -0800 +Subject: xenbus: req->err should be updated before req->state + +From: Dongli Zhang + +[ Upstream commit 8130b9d5b5abf26f9927b487c15319a187775f34 ] + +This patch adds the barrier to guarantee that req->err is always updated +before req->state. + +Otherwise, read_reply() would not return ERR_PTR(req->err) but +req->body, when process_writes()->xb_write() is failed. + +Signed-off-by: Dongli Zhang +Link: https://lore.kernel.org/r/20200303221423.21962-2-dongli.zhang@oracle.com +Reviewed-by: Julien Grall +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_comms.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c +index 852ed161fc2a7..eb5151fc8efab 100644 +--- a/drivers/xen/xenbus/xenbus_comms.c ++++ b/drivers/xen/xenbus/xenbus_comms.c +@@ -397,6 +397,8 @@ static int process_writes(void) + if (state.req->state == xb_req_state_aborted) + kfree(state.req); + else { ++ /* write err, then update state */ ++ virt_wmb(); + state.req->state = xb_req_state_got_reply; + wake_up(&state.req->wq); + } +-- +2.20.1 + -- 2.47.3