From: Greg Kroah-Hartman Date: Thu, 23 May 2019 09:16:52 +0000 (+0200) Subject: 5.0-stable patches X-Git-Tag: v5.1.5~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=427cc94bede73eaaf4297df34d3c29096eff00b7;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch brd-re-enable-__gfp_highmem-in-brd_insert_page.patch ceph-flush-dirty-inodes-before-proceeding-with-remount.patch cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch clk-mediatek-disable-tuner_en-before-change-pll-rate.patch clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch fuse-fix-writepages-on-32bit.patch fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch intel_th-msu-fix-single-mode-with-iommu.patch iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch md-add-a-missing-endianness-conversion-in-check_sb_changes.patch md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch md-batch-flush-requests.patch media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch media-imx-csi-allow-unknown-nearest-upstream-entities.patch media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch nfs4-fix-v4.0-client-state-corruption-when-mount.patch of-fix-clang-wunsequenced-for-be32_to_cpu.patch ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch p54-drop-device-reference-count-if-fails-to-enable-device.patch parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch parisc-add-memory-clobber-to-tlb-purges.patch parisc-allow-live-patching-of-__meminit-functions.patch parisc-export-running_on_qemu-symbol-for-modules.patch parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch parisc-skip-registering-led-when-running-in-qemu.patch parisc-use-pa_asm_level-in-boot-code.patch phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch pnfs-fallback-to-mds-if-no-deviceid-found.patch proc-prevent-changes-to-overridden-credentials.patch rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch rdma-mlx5-use-get_zeroed_page-for-clock_info.patch regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch revert-md-fix-lock-contention-for-flush-bios.patch stm-class-fix-channel-bitmap-on-32-bit-systems.patch stm-class-fix-channel-free-in-stm-output-free-path.patch udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch udlfb-fix-sleeping-inside-spinlock.patch udlfb-introduce-a-rendering-mutex.patch --- diff --git a/queue-5.0/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch b/queue-5.0/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch new file mode 100644 index 00000000000..c85057a3f6f --- /dev/null +++ b/queue-5.0/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch @@ -0,0 +1,130 @@ +From c7e2d94b3d1634988a95ac4d77a72dc7487ece06 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Tue, 30 Apr 2019 09:52:25 +0800 +Subject: blk-mq: free hw queue's resource in hctx's release handler + +From: Ming Lei + +commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 upstream. + +Once blk_cleanup_queue() returns, tags shouldn't be used any more, +because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2 +("blk-mq: Fix a use-after-free") fixes this issue exactly. + +However, that commit introduces another issue. Before 45a9c9d909b2, +we are allowed to run queue during cleaning up queue if the queue's +kobj refcount is held. After that commit, queue can't be run during +queue cleaning up, otherwise oops can be triggered easily because +some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue(). + +We have invented ways for addressing this kind of issue before, such as: + + 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done") + c2856ae2f315 ("blk-mq: quiesce queue before freeing queue") + +But still can't cover all cases, recently James reports another such +kind of issue: + + https://marc.info/?l=linux-scsi&m=155389088124782&w=2 + +This issue can be quite hard to address by previous way, given +scsi_run_queue() may run requeues for other LUNs. + +Fixes the above issue by freeing hctx's resources in its release handler, and this +way is safe becasue tags isn't needed for freeing such hctx resource. + +This approach follows typical design pattern wrt. kobject's release handler. + +Cc: Dongli Zhang +Cc: James Smart +Cc: Bart Van Assche +Cc: linux-scsi@vger.kernel.org, +Cc: Martin K . Petersen , +Cc: Christoph Hellwig , +Cc: James E . J . Bottomley , +Reported-by: James Smart +Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free") +Cc: stable@vger.kernel.org +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Tested-by: James Smart +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-core.c | 2 +- + block/blk-mq-sysfs.c | 6 ++++++ + block/blk-mq.c | 8 ++------ + block/blk-mq.h | 2 +- + 4 files changed, 10 insertions(+), 8 deletions(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_qu + blk_exit_queue(q); + + if (queue_is_mq(q)) +- blk_mq_free_queue(q); ++ blk_mq_exit_queue(q); + + percpu_ref_exit(&q->q_usage_counter); + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -10,6 +10,7 @@ + #include + + #include ++#include "blk.h" + #include "blk-mq.h" + #include "blk-mq-tag.h" + +@@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(stru + { + struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx, + kobj); ++ ++ if (hctx->flags & BLK_MQ_F_BLOCKING) ++ cleanup_srcu_struct(hctx->srcu); ++ blk_free_flush_queue(hctx->fq); ++ sbitmap_free(&hctx->ctx_map); + free_cpumask_var(hctx->cpumask); + kfree(hctx->ctxs); + kfree(hctx); +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2270,12 +2270,7 @@ static void blk_mq_exit_hctx(struct requ + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); + +- if (hctx->flags & BLK_MQ_F_BLOCKING) +- cleanup_srcu_struct(hctx->srcu); +- + blk_mq_remove_cpuhp(hctx); +- blk_free_flush_queue(hctx->fq); +- sbitmap_free(&hctx->ctx_map); + } + + static void blk_mq_exit_hw_queues(struct request_queue *q, +@@ -2904,7 +2899,8 @@ err_exit: + } + EXPORT_SYMBOL(blk_mq_init_allocated_queue); + +-void blk_mq_free_queue(struct request_queue *q) ++/* tags can _not_ be used after returning from blk_mq_exit_queue */ ++void blk_mq_exit_queue(struct request_queue *q) + { + struct blk_mq_tag_set *set = q->tag_set; + +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -36,7 +36,7 @@ struct blk_mq_ctx { + struct kobject kobj; + } ____cacheline_aligned_in_smp; + +-void blk_mq_free_queue(struct request_queue *q); ++void blk_mq_exit_queue(struct request_queue *q); + int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr); + void blk_mq_wake_waiters(struct request_queue *q); + bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool); diff --git a/queue-5.0/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch b/queue-5.0/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch new file mode 100644 index 00000000000..5490c5810fc --- /dev/null +++ b/queue-5.0/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch @@ -0,0 +1,75 @@ +From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 22 Apr 2019 22:41:23 +0200 +Subject: brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs + +From: Hans de Goede + +commit b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe upstream. + +The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor +and product_name DMI strings, without this patch brcmfmac will try to load: +"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which +is way too generic. + +The DMI strings on which we are matching are somewhat generic too, but +"To be filled by O.E.M." is less common then "Default string" and the +system-sku and bios-version strings are pretty unique. Beside the DMI +strings we also check the wifi-module chip-id and revision. I'm confident +that the combination of all this is unique. + +Both the T8 and T11 use the same wifi-module, this commit adds DMI +quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt . + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852 +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -31,6 +31,10 @@ struct brcmf_dmi_data { + + /* NOTE: Please keep all entries sorted alphabetically */ + ++static const struct brcmf_dmi_data acepc_t8_data = { ++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8" ++}; ++ + static const struct brcmf_dmi_data gpd_win_pocket_data = { + BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket" + }; +@@ -45,6 +49,28 @@ static const struct brcmf_dmi_data meego + + static const struct dmi_system_id dmi_platform_data[] = { + { ++ /* ACEPC T8 Cherry Trail Z8350 mini PC */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { ++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { + /* Match for the GPDwin which unfortunately uses somewhat + * generic dmi strings, which is why we test for 4 strings. + * Comparing against 23 other byt/cht boards, board_vendor diff --git a/queue-5.0/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch b/queue-5.0/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch new file mode 100644 index 00000000000..017ce52d25a --- /dev/null +++ b/queue-5.0/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch @@ -0,0 +1,43 @@ +From f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 Mon Sep 17 00:00:00 2001 +From: Hou Tao +Date: Mon, 22 Apr 2019 21:23:21 +0800 +Subject: brd: re-enable __GFP_HIGHMEM in brd_insert_page() + +From: Hou Tao + +commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream. + +__GFP_HIGHMEM is disabled if dax is enabled on brd, however +dax support for brd has been removed since commit (7a862fbbdec6 +"brd: remove dax support"), so restore __GFP_HIGHMEM in +brd_insert_page(). + +Also remove the no longer applicable comments about DAX and highmem. + +Cc: stable@vger.kernel.org +Fixes: 7a862fbbdec6 ("brd: remove dax support") +Signed-off-by: Hou Tao +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/brd.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -96,13 +96,8 @@ static struct page *brd_insert_page(stru + /* + * Must use NOIO because we don't want to recurse back into the + * block or filesystem layers from page reclaim. +- * +- * Cannot support DAX and highmem, because our ->direct_access +- * routine for DAX must return memory that is always addressable. +- * If DAX was reworked to use pfns and kmap throughout, this +- * restriction might be able to be lifted. + */ +- gfp_flags = GFP_NOIO | __GFP_ZERO; ++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; + page = alloc_page(gfp_flags); + if (!page) + return NULL; diff --git a/queue-5.0/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch b/queue-5.0/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch new file mode 100644 index 00000000000..c6e2bf8b9b5 --- /dev/null +++ b/queue-5.0/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch @@ -0,0 +1,48 @@ +From 00abf69dd24f4444d185982379c5cc3bb7b6d1fc Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 7 May 2019 09:20:54 -0400 +Subject: ceph: flush dirty inodes before proceeding with remount + +From: Jeff Layton + +commit 00abf69dd24f4444d185982379c5cc3bb7b6d1fc upstream. + +xfstest generic/452 was triggering a "Busy inodes after umount" warning. +ceph was allowing the mount to go read-only without first flushing out +dirty inodes in the cache. Ensure we sync out the filesystem before +allowing a remount to proceed. + +Cc: stable@vger.kernel.org +Link: http://tracker.ceph.com/issues/39571 +Signed-off-by: Jeff Layton +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ceph/super.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -832,6 +832,12 @@ static void ceph_umount_begin(struct sup + return; + } + ++static int ceph_remount(struct super_block *sb, int *flags, char *data) ++{ ++ sync_filesystem(sb); ++ return 0; ++} ++ + static const struct super_operations ceph_super_ops = { + .alloc_inode = ceph_alloc_inode, + .destroy_inode = ceph_destroy_inode, +@@ -839,6 +845,7 @@ static const struct super_operations cep + .drop_inode = ceph_drop_inode, + .sync_fs = ceph_sync_fs, + .put_super = ceph_put_super, ++ .remount_fs = ceph_remount, + .show_options = ceph_show_options, + .statfs = ceph_statfs, + .umount_begin = ceph_umount_begin, diff --git a/queue-5.0/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch b/queue-5.0/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch new file mode 100644 index 00000000000..82816e04f60 --- /dev/null +++ b/queue-5.0/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch @@ -0,0 +1,62 @@ +From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001 +From: Christoph Probst +Date: Tue, 7 May 2019 17:16:40 +0200 +Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() + +From: Christoph Probst + +commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream. + +Change strcat to strncpy in the "None" case to fix a buffer overflow +when cinode->oplock is reset to 0 by another thread accessing the same +cinode. It is never valid to append "None" to any other message. + +Consolidate multiple writes to cinode->oplock to reduce raciness. + +Signed-off-by: Christoph Probst +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +CC: Stable +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2ops.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -2652,26 +2652,28 @@ smb21_set_oplock_level(struct cifsInodeI + unsigned int epoch, bool *purge_cache) + { + char message[5] = {0}; ++ unsigned int new_oplock = 0; + + oplock &= 0xFF; + if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE) + return; + +- cinode->oplock = 0; + if (oplock & SMB2_LEASE_READ_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_READ_FLG; ++ new_oplock |= CIFS_CACHE_READ_FLG; + strcat(message, "R"); + } + if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_HANDLE_FLG; ++ new_oplock |= CIFS_CACHE_HANDLE_FLG; + strcat(message, "H"); + } + if (oplock & SMB2_LEASE_WRITE_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_WRITE_FLG; ++ new_oplock |= CIFS_CACHE_WRITE_FLG; + strcat(message, "W"); + } +- if (!cinode->oplock) +- strcat(message, "None"); ++ if (!new_oplock) ++ strncpy(message, "None", sizeof(message)); ++ ++ cinode->oplock = new_oplock; + cifs_dbg(FYI, "%s Lease granted on inode %p\n", message, + &cinode->vfs_inode); + } diff --git a/queue-5.0/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch b/queue-5.0/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch new file mode 100644 index 00000000000..8a13d1edd22 --- /dev/null +++ b/queue-5.0/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch @@ -0,0 +1,44 @@ +From 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa Mon Sep 17 00:00:00 2001 +From: Leo Yan +Date: Wed, 20 Mar 2019 18:05:08 +0800 +Subject: clk: hi3660: Mark clk_gate_ufs_subsys as critical + +From: Leo Yan + +commit 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa upstream. + +clk_gate_ufs_subsys is a system bus clock, turning off it will +introduce lockup issue during system suspend flow. Let's mark +clk_gate_ufs_subsys as critical clock, thus keeps it on during +system suspend and resume. + +Fixes: d374e6fd5088 ("clk: hisilicon: Add clock driver for hi3660 SoC") +Cc: stable@vger.kernel.org +Cc: Zhong Kaihua +Cc: John Stultz +Cc: Zhangfei Gao +Suggested-by: Dong Zhang +Signed-off-by: Leo Yan +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/hisilicon/clk-hi3660.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/clk/hisilicon/clk-hi3660.c ++++ b/drivers/clk/hisilicon/clk-hi3660.c +@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi36 + "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, }, + { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2", + "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, }, ++ /* ++ * clk_gate_ufs_subsys is a system bus clock, mark it as critical ++ * clock and keep it on for system suspend and resume. ++ */ + { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus", +- CLK_SET_RATE_PARENT, 0x50, 21, 0, }, ++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, }, + { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus", + CLK_SET_RATE_PARENT, 0x50, 28, 0, }, + { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus", diff --git a/queue-5.0/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch b/queue-5.0/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch new file mode 100644 index 00000000000..eb5621d3152 --- /dev/null +++ b/queue-5.0/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch @@ -0,0 +1,113 @@ +From be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb Mon Sep 17 00:00:00 2001 +From: Owen Chen +Date: Tue, 5 Mar 2019 13:05:38 +0800 +Subject: clk: mediatek: Disable tuner_en before change PLL rate + +From: Owen Chen + +commit be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb upstream. + +PLLs with tuner_en bit, such as APLL1, need to disable +tuner_en before apply new frequency settings, or the new frequency +settings (pcw) will not be applied. +The tuner_en bit will be disabled during changing PLL rate +and be restored after new settings applied. + +Fixes: e2f744a82d725 (clk: mediatek: Add MT2712 clock support) +Cc: +Signed-off-by: Owen Chen +Signed-off-by: Weiyi Lu +Reviewed-by: James Liao +Reviewed-by: Matthias Brugger +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/mediatek/clk-pll.c | 48 +++++++++++++++++++++++++++++------------ + 1 file changed, 34 insertions(+), 14 deletions(-) + +--- a/drivers/clk/mediatek/clk-pll.c ++++ b/drivers/clk/mediatek/clk-pll.c +@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_ra + return ((unsigned long)vco + postdiv - 1) / postdiv; + } + ++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll) ++{ ++ u32 r; ++ ++ if (pll->tuner_en_addr) { ++ r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit); ++ writel(r, pll->tuner_en_addr); ++ } else if (pll->tuner_addr) { ++ r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN; ++ writel(r, pll->tuner_addr); ++ } ++} ++ ++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll) ++{ ++ u32 r; ++ ++ if (pll->tuner_en_addr) { ++ r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit); ++ writel(r, pll->tuner_en_addr); ++ } else if (pll->tuner_addr) { ++ r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN; ++ writel(r, pll->tuner_addr); ++ } ++} ++ + static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw, + int postdiv) + { +@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct + + pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN; + ++ /* disable tuner */ ++ __mtk_pll_tuner_disable(pll); ++ + /* set postdiv */ + val = readl(pll->pd_addr); + val &= ~(POSTDIV_MASK << pll->data->pd_shift); +@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct + if (pll->tuner_addr) + writel(con1 + 1, pll->tuner_addr); + ++ /* restore tuner_en */ ++ __mtk_pll_tuner_enable(pll); ++ + if (pll_en) + udelay(20); + } +@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw + r |= pll->data->en_mask; + writel(r, pll->base_addr + REG_CON0); + +- if (pll->tuner_en_addr) { +- r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit); +- writel(r, pll->tuner_en_addr); +- } else if (pll->tuner_addr) { +- r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN; +- writel(r, pll->tuner_addr); +- } ++ __mtk_pll_tuner_enable(pll); + + udelay(20); + +@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk + writel(r, pll->base_addr + REG_CON0); + } + +- if (pll->tuner_en_addr) { +- r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit); +- writel(r, pll->tuner_en_addr); +- } else if (pll->tuner_addr) { +- r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN; +- writel(r, pll->tuner_addr); +- } ++ __mtk_pll_tuner_disable(pll); + + r = readl(pll->base_addr + REG_CON0); + r &= ~CON0_BASE_EN; diff --git a/queue-5.0/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch b/queue-5.0/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch new file mode 100644 index 00000000000..6f20fac441c --- /dev/null +++ b/queue-5.0/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch @@ -0,0 +1,93 @@ +From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001 +From: Jonas Karlman +Date: Sun, 10 Mar 2019 12:00:45 +0000 +Subject: clk: rockchip: fix wrong clock definitions for rk3328 + +From: Jonas Karlman + +commit fb903392131a324a243c7731389277db1cd9f8df upstream. + +This patch fixes definition of several clock gate and select register +that is wrong for rk3328 referring to the TRM and vendor kernel. +Also use correct number of softrst registers. + +Fix clock definition for: +- clk_crypto +- aclk_h265 +- pclk_h265 +- aclk_h264 +- hclk_h264 +- aclk_axisram +- aclk_gmac +- aclk_usb3otg + +Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328") +Cc: stable@vger.kernel.org +Signed-off-by: Jonas Karlman +Tested-by: Peter Geis +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328 + RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS, + RK3328_CLKGATE_CON(2), 12, GFLAGS), + COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0, +- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS, ++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS, + RK3328_CLKGATE_CON(2), 4, GFLAGS), + COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0, + RK3328_CLKSEL_CON(22), 0, 10, DFLAGS, +@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328 + GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0, + RK3328_CLKGATE_CON(25), 1, GFLAGS), + GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0, +- RK3328_CLKGATE_CON(25), 0, GFLAGS), ++ RK3328_CLKGATE_CON(25), 2, GFLAGS), + GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0, +- RK3328_CLKGATE_CON(25), 1, GFLAGS), ++ RK3328_CLKGATE_CON(25), 3, GFLAGS), + GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0, +- RK3328_CLKGATE_CON(25), 0, GFLAGS), ++ RK3328_CLKGATE_CON(25), 4, GFLAGS), + GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0, +- RK3328_CLKGATE_CON(25), 1, GFLAGS), ++ RK3328_CLKGATE_CON(25), 5, GFLAGS), + GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED, +- RK3328_CLKGATE_CON(25), 0, GFLAGS), ++ RK3328_CLKGATE_CON(25), 6, GFLAGS), + + COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0, + RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS, +@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328 + + /* PD_GMAC */ + COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0, +- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS, ++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS, + RK3328_CLKGATE_CON(3), 2, GFLAGS), + COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0, + RK3328_CLKSEL_CON(25), 8, 3, DFLAGS, +@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328 + + /* PD_PERI */ + GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS), +- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS), ++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS), + + GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS), + GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS), +@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struc + &rk3328_cpuclk_data, rk3328_cpuclk_rates, + ARRAY_SIZE(rk3328_cpuclk_rates)); + +- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0), ++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0), + ROCKCHIP_SOFTRST_HIWORD_MASK); + + rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL); diff --git a/queue-5.0/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch b/queue-5.0/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch new file mode 100644 index 00000000000..e42119d73c5 --- /dev/null +++ b/queue-5.0/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch @@ -0,0 +1,39 @@ +From 40db569d6769ffa3864fd1b89616b1a7323568a8 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Fri, 12 Apr 2019 00:48:34 +0300 +Subject: clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider + +From: Dmitry Osipenko + +commit 40db569d6769ffa3864fd1b89616b1a7323568a8 upstream. + +There are wrongly set parenthesis in the code that are resulting in a +wrong configuration being programmed for PLLM. The original fix was made +by Danny Huang in the downstream kernel. The patch was tested on Nyan Big +Tegra124 chromebook, PLLM rate changing works correctly now and system +doesn't lock up after changing the PLLM rate due to EMC scaling. + +Cc: +Tested-by: Steev Klimaszewski +Signed-off-by: Dmitry Osipenko +Acked-By: Peter De Schrijver +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/tegra/clk-pll.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/tegra/clk-pll.c ++++ b/drivers/clk/tegra/clk-pll.c +@@ -663,8 +663,8 @@ static void _update_pll_mnp(struct tegra + pll_override_writel(val, params->pmc_divp_reg, pll); + + val = pll_override_readl(params->pmc_divnm_reg, pll); +- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) | +- ~(divn_mask(pll) << div_nmp->override_divn_shift); ++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) | ++ (divn_mask(pll) << div_nmp->override_divn_shift)); + val |= (cfg->m << div_nmp->override_divm_shift) | + (cfg->n << div_nmp->override_divn_shift); + pll_override_writel(val, params->pmc_divnm_reg, pll); diff --git a/queue-5.0/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch b/queue-5.0/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch new file mode 100644 index 00000000000..88e4fe18cbc --- /dev/null +++ b/queue-5.0/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch @@ -0,0 +1,171 @@ +From 5467a68cbf6884c9a9d91e2a89140afb1839c835 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Fri, 15 Mar 2019 22:23:19 -0400 +Subject: dcache: sort the freeing-without-RCU-delay mess for good. + +From: Al Viro + +commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream. + +For lockless accesses to dentries we don't have pinned we rely +(among other things) upon having an RCU delay between dropping +the last reference and actually freeing the memory. + +On the other hand, for things like pipes and sockets we neither +do that kind of lockless access, nor want to deal with the +overhead of an RCU delay every time a socket gets closed. + +So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags +made sure it would happen. We tried to avoid setting it unless +we knew we need it. Unfortunately, that had led to recurring +class of bugs, in which we missed the need to set it. + +We only really need it for dentries that are created by +d_alloc_pseudo(), so let's not bother with trying to be smart - +just make having an RCU delay the default. The ones that do +*not* get it set the replacement flag (DCACHE_NORCU) and we'd +better use that sparingly. d_alloc_pseudo() is the only +such user right now. + +FWIW, the race that finally prompted that switch had been +between __lock_parent() of immediate subdirectory of what's +currently the root of a disconnected tree (e.g. from +open-by-handle in progress) racing with d_splice_alias() +elsewhere picking another alias for the same inode, either +on outright corrupted fs image, or (in case of open-by-handle +on NFS) that subdirectory having been just moved on server. +It's not easy to hit, so the sky is not falling, but that's +not the first race on similar missed cases and the logics +for settinf DCACHE_RCUACCESS has gotten ridiculously +convoluted. + +Cc: stable@vger.kernel.org +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/filesystems/porting | 5 +++++ + fs/dcache.c | 24 +++++++++++++----------- + fs/nsfs.c | 3 +-- + include/linux/dcache.h | 2 +- + 4 files changed, 20 insertions(+), 14 deletions(-) + +--- a/Documentation/filesystems/porting ++++ b/Documentation/filesystems/porting +@@ -638,3 +638,8 @@ in your dentry operations instead. + inode to d_splice_alias() will also do the right thing (equivalent of + d_add(dentry, NULL); return NULL;), so that kind of special cases + also doesn't need a separate treatment. ++-- ++[mandatory] ++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the ++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any ++ business doing so. +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *d + } + } + /* if dentry was never visible to RCU, immediate free is OK */ +- if (!(dentry->d_flags & DCACHE_RCUACCESS)) ++ if (dentry->d_flags & DCACHE_NORCU) + __d_free(&dentry->d_u.d_rcu); + else + call_rcu(&dentry->d_u.d_rcu, __d_free); +@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * p + struct dentry *dentry = __d_alloc(parent->d_sb, name); + if (!dentry) + return NULL; +- dentry->d_flags |= DCACHE_RCUACCESS; + spin_lock(&parent->d_lock); + /* + * don't need child lock because it is not subject +@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct den + { + struct dentry *dentry = d_alloc_anon(parent->d_sb); + if (dentry) { +- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR; ++ dentry->d_flags |= DCACHE_DENTRY_CURSOR; + dentry->d_parent = dget(parent); + } + return dentry; +@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct den + * + * For a filesystem that just pins its dentries in memory and never + * performs lookups at all, return an unhashed IS_ROOT dentry. ++ * This is used for pipes, sockets et.al. - the stuff that should ++ * never be anyone's children or parents. Unlike all other ++ * dentries, these will not have RCU delay between dropping the ++ * last reference and freeing them. + */ + struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name) + { +- return __d_alloc(sb, name); ++ struct dentry *dentry = __d_alloc(sb, name); ++ if (likely(dentry)) ++ dentry->d_flags |= DCACHE_NORCU; ++ return dentry; + } + EXPORT_SYMBOL(d_alloc_pseudo); + +@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode + + if (root_inode) { + res = d_alloc_anon(root_inode->i_sb); +- if (res) { +- res->d_flags |= DCACHE_RCUACCESS; ++ if (res) + d_instantiate(res, root_inode); +- } else { ++ else + iput(root_inode); +- } + } + return res; + } +@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dent + copy_name(dentry, target); + target->d_hash.pprev = NULL; + dentry->d_parent->d_lockref.count++; +- if (dentry == old_parent) +- dentry->d_flags |= DCACHE_RCUACCESS; +- else ++ if (dentry != old_parent) /* wasn't IS_ROOT */ + WARN_ON(!--old_parent->d_lockref.count); + } else { + target->d_parent = old_parent; +--- a/fs/nsfs.c ++++ b/fs/nsfs.c +@@ -85,13 +85,12 @@ slow: + inode->i_fop = &ns_file_operations; + inode->i_private = ns; + +- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name); ++ dentry = d_alloc_anon(mnt->mnt_sb); + if (!dentry) { + iput(inode); + return ERR_PTR(-ENOMEM); + } + d_instantiate(dentry, inode); +- dentry->d_flags |= DCACHE_RCUACCESS; + dentry->d_fsdata = (void *)ns->ops; + d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); + if (d) { +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -176,7 +176,6 @@ struct dentry_operations { + * typically using d_splice_alias. */ + + #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */ +-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */ + + #define DCACHE_CANT_MOUNT 0x00000100 + #define DCACHE_GENOCIDE 0x00000200 +@@ -217,6 +216,7 @@ struct dentry_operations { + + #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */ + #define DCACHE_DENTRY_CURSOR 0x20000000 ++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */ + + extern seqlock_t rename_lock; + diff --git a/queue-5.0/fuse-fix-writepages-on-32bit.patch b/queue-5.0/fuse-fix-writepages-on-32bit.patch new file mode 100644 index 00000000000..41bdc7866d5 --- /dev/null +++ b/queue-5.0/fuse-fix-writepages-on-32bit.patch @@ -0,0 +1,36 @@ +From 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 24 Apr 2019 17:05:06 +0200 +Subject: fuse: fix writepages on 32bit + +From: Miklos Szeredi + +commit 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 upstream. + +Writepage requests were cropped to i_size & 0xffffffff, which meant that +mmaped writes to any file larger than 4G might be silently discarded. + +Fix by storing the file size in a properly sized variable (loff_t instead +of size_t). + +Reported-by: Antonio SJ Musumeci +Fixes: 6eaf4782eb09 ("fuse: writepages: crop secondary requests") +Cc: # v3.13 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1530,7 +1530,7 @@ __acquires(fc->lock) + { + struct fuse_conn *fc = get_fuse_conn(inode); + struct fuse_inode *fi = get_fuse_inode(inode); +- size_t crop = i_size_read(inode); ++ loff_t crop = i_size_read(inode); + struct fuse_req *req; + + while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) { diff --git a/queue-5.0/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch b/queue-5.0/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch new file mode 100644 index 00000000000..ec619f0e36a --- /dev/null +++ b/queue-5.0/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch @@ -0,0 +1,40 @@ +From 0cbade024ba501313da3b7e5dd2a188a6bc491b5 Mon Sep 17 00:00:00 2001 +From: Liu Bo +Date: Thu, 18 Apr 2019 04:04:41 +0800 +Subject: fuse: honor RLIMIT_FSIZE in fuse_file_fallocate + +From: Liu Bo + +commit 0cbade024ba501313da3b7e5dd2a188a6bc491b5 upstream. + +fstests generic/228 reported this failure that fuse fallocate does not +honor what 'ulimit -f' has set. + +This adds the necessary inode_newsize_ok() check. + +Signed-off-by: Liu Bo +Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation") +Cc: # v3.5 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2987,6 +2987,13 @@ static long fuse_file_fallocate(struct f + } + } + ++ if (!(mode & FALLOC_FL_KEEP_SIZE) && ++ offset + length > i_size_read(inode)) { ++ err = inode_newsize_ok(inode, offset + length); ++ if (err) ++ return err; ++ } ++ + if (!(mode & FALLOC_FL_KEEP_SIZE)) + set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); + diff --git a/queue-5.0/gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch b/queue-5.0/gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch new file mode 100644 index 00000000000..288a340aab9 --- /dev/null +++ b/queue-5.0/gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch @@ -0,0 +1,49 @@ +From 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e Mon Sep 17 00:00:00 2001 +From: Chris Packham +Date: Fri, 10 May 2019 21:00:25 +1200 +Subject: gcc-plugins: arm_ssp_per_task_plugin: Fix for older GCC < 6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Packham + +commit 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e upstream. + +Use gen_rtx_set instead of gen_rtx_SET. The former is a wrapper macro +that handles the difference between GCC versions implementing +the latter. + +This fixes the following error on my system with g++ 5.4.0 as the host +compiler + + HOSTCXX -fPIC scripts/gcc-plugins/arm_ssp_per_task_plugin.o + scripts/gcc-plugins/arm_ssp_per_task_plugin.c:42:14: error: macro "gen_rtx_SET" requires 3 arguments, but only 2 given + mask)), + ^ + scripts/gcc-plugins/arm_ssp_per_task_plugin.c: In function ‘unsigned int arm_pertask_ssp_rtl_execute()’: + scripts/gcc-plugins/arm_ssp_per_task_plugin.c:39:20: error: ‘gen_rtx_SET’ was not declared in this scope + emit_insn_before(gen_rtx_SET + +Signed-off-by: Chris Packham +Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries") +Cc: stable@vger.kernel.org +Tested-by: Douglas Anderson +Signed-off-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c ++++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c +@@ -36,7 +36,7 @@ static unsigned int arm_pertask_ssp_rtl_ + mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode))); + masked_sp = gen_reg_rtx(Pmode); + +- emit_insn_before(gen_rtx_SET(masked_sp, ++ emit_insn_before(gen_rtx_set(masked_sp, + gen_rtx_AND(Pmode, + stack_pointer_rtx, + mask)), diff --git a/queue-5.0/intel_th-msu-fix-single-mode-with-iommu.patch b/queue-5.0/intel_th-msu-fix-single-mode-with-iommu.patch new file mode 100644 index 00000000000..bf101b4f064 --- /dev/null +++ b/queue-5.0/intel_th-msu-fix-single-mode-with-iommu.patch @@ -0,0 +1,104 @@ +From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Fri, 3 May 2019 11:44:34 +0300 +Subject: intel_th: msu: Fix single mode with IOMMU + +From: Alexander Shishkin + +commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream. + +Currently, the pages that are allocated for the single mode of MSC are not +mapped into the device's dma space and the code is incorrectly using +*_to_phys() in place of a dma address. This fails with IOMMU enabled and +is otherwise bad practice. + +Fix the single mode buffer allocation to map the pages into the device's +DMA space. + +Signed-off-by: Alexander Shishkin +Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver") +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/msu.c | 35 ++++++++++++++++++++++++++++++++--- + 1 file changed, 32 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -84,6 +84,7 @@ struct msc_iter { + * @reg_base: register window base address + * @thdev: intel_th_device pointer + * @win_list: list of windows in multiblock mode ++ * @single_sgt: single mode buffer + * @nr_pages: total number of pages allocated for this buffer + * @single_sz: amount of data in single mode + * @single_wrap: single mode wrap occurred +@@ -104,6 +105,7 @@ struct msc { + struct intel_th_device *thdev; + + struct list_head win_list; ++ struct sg_table single_sgt; + unsigned long nr_pages; + unsigned long single_sz; + unsigned int single_wrap : 1; +@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(stru + */ + static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size) + { ++ unsigned long nr_pages = size >> PAGE_SHIFT; + unsigned int order = get_order(size); + struct page *page; ++ int ret; + + if (!size) + return 0; + ++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL); ++ if (ret) ++ goto err_out; ++ ++ ret = -ENOMEM; + page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); + if (!page) +- return -ENOMEM; ++ goto err_free_sgt; + + split_page(page, order); +- msc->nr_pages = size >> PAGE_SHIFT; ++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size); ++ ++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1, ++ DMA_FROM_DEVICE); ++ if (ret < 0) ++ goto err_free_pages; ++ ++ msc->nr_pages = nr_pages; + msc->base = page_address(page); +- msc->base_addr = page_to_phys(page); ++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl); + + return 0; ++ ++err_free_pages: ++ __free_pages(page, order); ++ ++err_free_sgt: ++ sg_free_table(&msc->single_sgt); ++ ++err_out: ++ return ret; + } + + /** +@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struc + { + unsigned long off; + ++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, ++ 1, DMA_FROM_DEVICE); ++ sg_free_table(&msc->single_sgt); ++ + for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) { + struct page *page = virt_to_page(msc->base + off); + diff --git a/queue-5.0/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch b/queue-5.0/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch new file mode 100644 index 00000000000..3b184df7652 --- /dev/null +++ b/queue-5.0/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch @@ -0,0 +1,81 @@ +From 43a0541e312f7136e081e6bf58f6c8a2e9672688 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Thu, 7 Mar 2019 01:50:07 +0300 +Subject: iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 + +From: Dmitry Osipenko + +commit 43a0541e312f7136e081e6bf58f6c8a2e9672688 upstream. + +Both Tegra30 and Tegra114 have 4 ASID's and the corresponding bitfield of +the TLB_FLUSH register differs from later Tegra generations that have 128 +ASID's. + +In a result the PTE's are now flushed correctly from TLB and this fixes +problems with graphics (randomly failing tests) on Tegra30. + +Cc: stable +Signed-off-by: Dmitry Osipenko +Acked-by: Thierry Reding +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/tegra-smmu.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +--- a/drivers/iommu/tegra-smmu.c ++++ b/drivers/iommu/tegra-smmu.c +@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegr + #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0) + #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0) + #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0) +-#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24) + #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \ + SMMU_TLB_FLUSH_VA_MATCH_SECTION) + #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \ +@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(s + { + u32 value; + +- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | +- SMMU_TLB_FLUSH_VA_MATCH_ALL; ++ if (smmu->soc->num_asids == 4) ++ value = (asid & 0x3) << 29; ++ else ++ value = (asid & 0x7f) << 24; ++ ++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL; + smmu_writel(smmu, value, SMMU_TLB_FLUSH); + } + +@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_sectio + { + u32 value; + +- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | +- SMMU_TLB_FLUSH_VA_SECTION(iova); ++ if (smmu->soc->num_asids == 4) ++ value = (asid & 0x3) << 29; ++ else ++ value = (asid & 0x7f) << 24; ++ ++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova); + smmu_writel(smmu, value, SMMU_TLB_FLUSH); + } + +@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group( + { + u32 value; + +- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | +- SMMU_TLB_FLUSH_VA_GROUP(iova); ++ if (smmu->soc->num_asids == 4) ++ value = (asid & 0x3) << 29; ++ else ++ value = (asid & 0x7f) << 24; ++ ++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova); + smmu_writel(smmu, value, SMMU_TLB_FLUSH); + } + diff --git a/queue-5.0/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch b/queue-5.0/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch new file mode 100644 index 00000000000..066e8334b28 --- /dev/null +++ b/queue-5.0/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch @@ -0,0 +1,34 @@ +From ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Thu, 4 Apr 2019 18:56:10 +0200 +Subject: md: add a missing endianness conversion in check_sb_changes + +From: Christoph Hellwig + +commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream. + +The on-disk value is little endian and we need to convert it to +native endian before storing the value in the in-core structure. + +Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode") +Cc: # 4.20+ +Acked-by: Guoqing Jiang +Signed-off-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9229,7 +9229,7 @@ static void check_sb_changes(struct mdde + * reshape is happening in the remote node, we need to + * update reshape_position and call start_reshape. + */ +- mddev->reshape_position = sb->reshape_position; ++ mddev->reshape_position = le64_to_cpu(sb->reshape_position); + if (mddev->pers->update_reshape_pos) + mddev->pers->update_reshape_pos(mddev); + if (mddev->pers->start_reshape) diff --git a/queue-5.0/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch b/queue-5.0/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..a230c5d7662 --- /dev/null +++ b/queue-5.0/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch @@ -0,0 +1,41 @@ +From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001 +From: Yufen Yu +Date: Tue, 2 Apr 2019 14:22:14 +0800 +Subject: md: add mddev->pers to avoid potential NULL pointer dereference + +From: Yufen Yu + +commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream. + +When doing re-add, we need to ensure rdev->mddev->pers is not NULL, +which can avoid potential NULL pointer derefence in fallowing +add_bound_rdev(). + +Fixes: a6da4ef85cef ("md: re-add a failed disk") +Cc: Xiao Ni +Cc: NeilBrown +Cc: # 4.4+ +Reviewed-by: NeilBrown +Signed-off-by: Yufen Yu +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2852,8 +2852,10 @@ state_store(struct md_rdev *rdev, const + err = 0; + } + } else if (cmd_match(buf, "re-add")) { +- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && +- rdev->saved_raid_disk >= 0) { ++ if (!rdev->mddev->pers) ++ err = -EINVAL; ++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && ++ rdev->saved_raid_disk >= 0) { + /* clear_bit is performed _after_ all the devices + * have their local Faulty bit cleared. If any writes + * happen in the meantime in the local node, they diff --git a/queue-5.0/md-batch-flush-requests.patch b/queue-5.0/md-batch-flush-requests.patch new file mode 100644 index 00000000000..db7e03cca25 --- /dev/null +++ b/queue-5.0/md-batch-flush-requests.patch @@ -0,0 +1,170 @@ +From 2bc13b83e6298486371761de503faeffd15b7534 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 29 Mar 2019 10:46:17 -0700 +Subject: md: batch flush requests. + +From: NeilBrown + +commit 2bc13b83e6298486371761de503faeffd15b7534 upstream. + +Currently if many flush requests are submitted to an md device is quick +succession, they are serialized and can take a long to process them all. +We don't really need to call flush all those times - a single flush call +can satisfy all requests submitted before it started. +So keep track of when the current flush started and when it finished, +allow any pending flush that was requested before the flush started +to complete without waiting any more. + +Test results from Xiao: + +Test is done on a raid10 device which is created by 4 SSDs. The tool is +dbench. + +1. The latest linux stable kernel + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 768 10.509 78.305 + Flush 2078376 0.013 10.094 + Close 21787697 0.019 18.821 + LockX 96580 0.007 3.184 + Mkdir 384 0.008 0.062 + Rename 1255883 0.191 23.534 + ReadX 46495589 0.020 14.230 + WriteX 14790591 7.123 60.706 + Unlink 5989118 0.440 54.551 + UnlockX 96580 0.005 2.736 + FIND_FIRST 10393845 0.042 12.079 + SET_FILE_INFORMATION 2415558 0.129 10.088 + QUERY_FILE_INFORMATION 4711725 0.005 8.462 + QUERY_PATH_INFORMATION 26883327 0.032 21.715 + QUERY_FS_INFORMATION 4929409 0.010 8.238 + NTCreateX 29660080 0.100 53.268 + +Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs +max_latency=60.712 ms + +2. With patch1 "Revert "MD: fix lock contention for flush bios"" + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 256 8.326 36.761 + Flush 693291 3.974 180.269 + Close 7266404 0.009 36.929 + LockX 32160 0.006 0.840 + Mkdir 128 0.008 0.021 + Rename 418755 0.063 29.945 + ReadX 15498708 0.007 7.216 + WriteX 4932310 22.482 267.928 + Unlink 1997557 0.109 47.553 + UnlockX 32160 0.004 1.110 + FIND_FIRST 3465791 0.036 7.320 + SET_FILE_INFORMATION 805825 0.015 1.561 + QUERY_FILE_INFORMATION 1570950 0.005 2.403 + QUERY_PATH_INFORMATION 8965483 0.013 14.277 + QUERY_FS_INFORMATION 1643626 0.009 3.314 + NTCreateX 9892174 0.061 41.278 + +Throughput 345.009 MB/sec (sync open) 128 clients 128 procs +max_latency=267.939 m + +3. With patch1 and patch2 + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 768 9.570 54.588 + Flush 2061354 0.666 15.102 + Close 21604811 0.012 25.697 + LockX 95770 0.007 1.424 + Mkdir 384 0.008 0.053 + Rename 1245411 0.096 12.263 + ReadX 46103198 0.011 12.116 + WriteX 14667988 7.375 60.069 + Unlink 5938936 0.173 30.905 + UnlockX 95770 0.005 4.147 + FIND_FIRST 10306407 0.041 11.715 + SET_FILE_INFORMATION 2395987 0.048 7.640 + QUERY_FILE_INFORMATION 4672371 0.005 9.291 + QUERY_PATH_INFORMATION 26656735 0.018 19.719 + QUERY_FS_INFORMATION 4887940 0.010 7.654 + NTCreateX 29410811 0.059 28.551 + +Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs +max_latency=60.075 ms + +Cc: # v4.19+ +Tested-by: Xiao Ni +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 27 +++++++++++++++++++++++---- + drivers/md/md.h | 3 +++ + 2 files changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -427,6 +427,7 @@ static void submit_flushes(struct work_s + struct mddev *mddev = container_of(ws, struct mddev, flush_work); + struct md_rdev *rdev; + ++ mddev->start_flush = ktime_get_boottime(); + INIT_WORK(&mddev->flush_work, md_submit_flush_data); + atomic_set(&mddev->flush_pending, 1); + rcu_read_lock(); +@@ -467,6 +468,7 @@ static void md_submit_flush_data(struct + * could wait for this and below md_handle_request could wait for those + * bios because of suspend check + */ ++ mddev->last_flush = mddev->start_flush; + mddev->flush_bio = NULL; + wake_up(&mddev->sb_wait); + +@@ -481,15 +483,32 @@ static void md_submit_flush_data(struct + + void md_flush_request(struct mddev *mddev, struct bio *bio) + { ++ ktime_t start = ktime_get_boottime(); + spin_lock_irq(&mddev->lock); + wait_event_lock_irq(mddev->sb_wait, +- !mddev->flush_bio, ++ !mddev->flush_bio || ++ ktime_after(mddev->last_flush, start), + mddev->lock); +- mddev->flush_bio = bio; ++ if (!ktime_after(mddev->last_flush, start)) { ++ WARN_ON(mddev->flush_bio); ++ mddev->flush_bio = bio; ++ bio = NULL; ++ } + spin_unlock_irq(&mddev->lock); + +- INIT_WORK(&mddev->flush_work, submit_flushes); +- queue_work(md_wq, &mddev->flush_work); ++ if (!bio) { ++ INIT_WORK(&mddev->flush_work, submit_flushes); ++ queue_work(md_wq, &mddev->flush_work); ++ } else { ++ /* flush was performed for some other bio while we waited. */ ++ if (bio->bi_iter.bi_size == 0) ++ /* an empty barrier - all done */ ++ bio_endio(bio); ++ else { ++ bio->bi_opf &= ~REQ_PREFLUSH; ++ mddev->pers->make_request(mddev, bio); ++ } ++ } + } + EXPORT_SYMBOL(md_flush_request); + +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -463,6 +463,9 @@ struct mddev { + */ + struct bio *flush_bio; + atomic_t flush_pending; ++ ktime_t start_flush, last_flush; /* last_flush is when the last completed ++ * flush was started. ++ */ + struct work_struct flush_work; + struct work_struct event_work; /* used by dm to report failure event */ + void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev); diff --git a/queue-5.0/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch b/queue-5.0/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch new file mode 100644 index 00000000000..4aec4311a85 --- /dev/null +++ b/queue-5.0/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch @@ -0,0 +1,55 @@ +From 107927fa597c99eaeee4f51865ca0956ec71b6a2 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:30 -0500 +Subject: media: imx: Clear fwnode link struct for each endpoint iteration + +From: Steve Longerbeam + +commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream. + +In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must +be cleared for each endpoint iteration, otherwise if the remote port +has no "reg" property, link.remote_port will not be reset to zero. +This was discovered on the i.MX53 SMD board, since the OV5642 connects +directly to ipu1_csi0 and has a single source port with no "reg" +property. + +Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays") + +Signed-off-by: Steve Longerbeam +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-media-of.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -143,15 +143,18 @@ int imx_media_create_csi_of_links(struct + struct v4l2_subdev *csi) + { + struct device_node *csi_np = csi->dev->of_node; +- struct fwnode_handle *fwnode, *csi_ep; +- struct v4l2_fwnode_link link; + struct device_node *ep; +- int ret; +- +- link.local_node = of_fwnode_handle(csi_np); +- link.local_port = CSI_SINK_PAD; + + for_each_child_of_node(csi_np, ep) { ++ struct fwnode_handle *fwnode, *csi_ep; ++ struct v4l2_fwnode_link link; ++ int ret; ++ ++ memset(&link, 0, sizeof(link)); ++ ++ link.local_node = of_fwnode_handle(csi_np); ++ link.local_port = CSI_SINK_PAD; ++ + csi_ep = of_fwnode_handle(ep); + + fwnode = fwnode_graph_get_remote_endpoint(csi_ep); diff --git a/queue-5.0/media-imx-csi-allow-unknown-nearest-upstream-entities.patch b/queue-5.0/media-imx-csi-allow-unknown-nearest-upstream-entities.patch new file mode 100644 index 00000000000..f386fc86bf7 --- /dev/null +++ b/queue-5.0/media-imx-csi-allow-unknown-nearest-upstream-entities.patch @@ -0,0 +1,70 @@ +From 904371f90b2c0c749a5ab75478c129a4682ac3d8 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:29 -0500 +Subject: media: imx: csi: Allow unknown nearest upstream entities + +From: Steve Longerbeam + +commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream. + +On i.MX6, the nearest upstream entity to the CSI can only be the +CSI video muxes or the Synopsys DW MIPI CSI-2 receiver. + +However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver. +So allow for the nearest upstream entity to the CSI to be something +other than those. + +Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest +upstream entity") + +Signed-off-by: Steve Longerbeam +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-media-csi.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -153,9 +153,10 @@ static inline bool requires_passthrough( + /* + * Parses the fwnode endpoint from the source pad of the entity + * connected to this CSI. This will either be the entity directly +- * upstream from the CSI-2 receiver, or directly upstream from the +- * video mux. The endpoint is needed to determine the bus type and +- * bus config coming into the CSI. ++ * upstream from the CSI-2 receiver, directly upstream from the ++ * video mux, or directly upstream from the CSI itself. The endpoint ++ * is needed to determine the bus type and bus config coming into ++ * the CSI. + */ + static int csi_get_upstream_endpoint(struct csi_priv *priv, + struct v4l2_fwnode_endpoint *ep) +@@ -171,7 +172,8 @@ static int csi_get_upstream_endpoint(str + if (!priv->src_sd) + return -EPIPE; + +- src = &priv->src_sd->entity; ++ sd = priv->src_sd; ++ src = &sd->entity; + + if (src->function == MEDIA_ENT_F_VID_MUX) { + /* +@@ -185,6 +187,14 @@ static int csi_get_upstream_endpoint(str + src = &sd->entity; + } + ++ /* ++ * If the source is neither the video mux nor the CSI-2 receiver, ++ * get the source pad directly upstream from CSI itself. ++ */ ++ if (src->function != MEDIA_ENT_F_VID_MUX && ++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2) ++ src = &priv->sd.entity; ++ + /* get source pad of entity directly upstream from src */ + pad = imx_media_find_upstream_pad(priv->md, src, 0); + if (IS_ERR(pad)) diff --git a/queue-5.0/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch b/queue-5.0/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch new file mode 100644 index 00000000000..8bed52ec200 --- /dev/null +++ b/queue-5.0/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch @@ -0,0 +1,47 @@ +From 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Sun, 24 Mar 2019 20:21:12 -0400 +Subject: media: ov6650: Fix sensor possibly not detected on probe + +From: Janusz Krzysztofik + +commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream. + +After removal of clock_start() from before soc_camera_init_i2c() in +soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch +I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650 +driver could no longer probe the sensor successfully because its clock +was no longer turned on in advance. The issue was initially worked +around by adding that missing clock_start() equivalent to OMAP1 camera +interface driver - the only user of this sensor - but a propoer fix +should be rather implemented in the sensor driver code itself. + +Fix the issue by inserting a delay between the clock is turned on and +the sensor I2C registers are read for the first time. + +Tested on Amstrad Delta with now out of tree but still locally +maintained omap1_camera host driver. + +Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk") + +Signed-off-by: Janusz Krzysztofik +Cc: stable@vger.kernel.org +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -814,6 +814,8 @@ static int ov6650_video_probe(struct i2c + if (ret < 0) + return ret; + ++ msleep(20); ++ + /* + * check and show product ID and manufacturer ID + */ diff --git a/queue-5.0/nfs4-fix-v4.0-client-state-corruption-when-mount.patch b/queue-5.0/nfs4-fix-v4.0-client-state-corruption-when-mount.patch new file mode 100644 index 00000000000..ad62c85d869 --- /dev/null +++ b/queue-5.0/nfs4-fix-v4.0-client-state-corruption-when-mount.patch @@ -0,0 +1,47 @@ +From f02f3755dbd14fb935d24b14650fff9ba92243b8 Mon Sep 17 00:00:00 2001 +From: ZhangXiaoxu +Date: Mon, 6 May 2019 11:57:03 +0800 +Subject: NFS4: Fix v4.0 client state corruption when mount + +From: ZhangXiaoxu + +commit f02f3755dbd14fb935d24b14650fff9ba92243b8 upstream. + +stat command with soft mount never return after server is stopped. + +When alloc a new client, the state of the client will be set to +NFS4CLNT_LEASE_EXPIRED. + +When the server is stopped, the state manager will work, and accord +the state to recover. But the state is NFS4CLNT_LEASE_EXPIRED, it +will drain the slot table and lead other task to wait queue, until +the client recovered. Then the stat command is hung. + +When discover server trunking, the client will renew the lease, +but check the client state, it lead the client state corruption. + +So, we need to call state manager to recover it when detect server +ip trunking. + +Signed-off-by: ZhangXiaoxu +Cc: stable@vger.kernel.org +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4state.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struc + /* Sustain the lease, even if it's empty. If the clientid4 + * goes stale it's of no use for trunking discovery. */ + nfs4_schedule_state_renewal(*result); ++ ++ /* If the client state need to recover, do it. */ ++ if (clp->cl_state) ++ nfs4_schedule_state_manager(clp); + } + out: + return status; diff --git a/queue-5.0/of-fix-clang-wunsequenced-for-be32_to_cpu.patch b/queue-5.0/of-fix-clang-wunsequenced-for-be32_to_cpu.patch new file mode 100644 index 00000000000..0c9b1fd3545 --- /dev/null +++ b/queue-5.0/of-fix-clang-wunsequenced-for-be32_to_cpu.patch @@ -0,0 +1,56 @@ +From 440868661f36071886ed360d91de83bd67c73b4f Mon Sep 17 00:00:00 2001 +From: Phong Tran +Date: Tue, 30 Apr 2019 21:56:24 +0700 +Subject: of: fix clang -Wunsequenced for be32_to_cpu() + +From: Phong Tran + +commit 440868661f36071886ed360d91de83bd67c73b4f upstream. + +Now, make the loop explicit to avoid clang warning. + +./include/linux/of.h:238:37: warning: multiple unsequenced modifications +to 'cell' [-Wunsequenced] + r = (r << 32) | be32_to_cpu(*(cell++)); + ^~ +./include/linux/byteorder/generic.h:95:21: note: expanded from macro +'be32_to_cpu' + ^ +./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded +from macro '__be32_to_cpu' + ^ +./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32' + ___constant_swab32(x) : \ + ^ +./include/uapi/linux/swab.h:18:12: note: expanded from macro +'___constant_swab32' + (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \ + ^ + +Signed-off-by: Phong Tran +Reported-by: Nick Desaulniers +Link: https://github.com/ClangBuiltLinux/linux/issues/460 +Suggested-by: David Laight +Reviewed-by: Nick Desaulniers +Cc: stable@vger.kernel.org +[robh: fix up whitespace] +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/of.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -234,8 +234,8 @@ extern struct device_node *of_find_all_n + static inline u64 of_read_number(const __be32 *cell, int size) + { + u64 r = 0; +- while (size--) +- r = (r << 32) | be32_to_cpu(*(cell++)); ++ for (; size--; cell++) ++ r = (r << 32) | be32_to_cpu(*cell); + return r; + } + diff --git a/queue-5.0/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch b/queue-5.0/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch new file mode 100644 index 00000000000..802da1660c9 --- /dev/null +++ b/queue-5.0/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch @@ -0,0 +1,89 @@ +From 3428030da004a1128cbdcf93dc03e16f184d845b Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Tue, 22 Jan 2019 07:01:39 +0200 +Subject: ovl: fix missing upper fs freeze protection on copy up for ioctl + +From: Amir Goldstein + +commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream. + +Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file +with data before FS_IOC_SETFLAGS ioctl. + +The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably +caused the confusion. File may be open O_RDONLY, but ioctl modifies the +file. VFS does not call mnt_want_write_file() nor lock inode mutex, but +fs-specific code for FS_IOC_SETFLAGS does. So ovl_ioctl() calls +mnt_want_write_file() for the overlay file, and fs-specific code calls +mnt_want_write_file() for upper fs file, but there was no call for +ovl_want_write() for copy up duration which prevents overlayfs from copying +up on a frozen upper fs. + +Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support") +Cc: # v4.19 +Signed-off-by: Amir Goldstein +Acked-by: Vivek Goyal +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/copy_up.c | 6 +++--- + fs/overlayfs/file.c | 5 ++--- + fs/overlayfs/overlayfs.h | 2 +- + 3 files changed, 6 insertions(+), 7 deletions(-) + +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -909,14 +909,14 @@ static bool ovl_open_need_copy_up(struct + return true; + } + +-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags) ++int ovl_maybe_copy_up(struct dentry *dentry, int flags) + { + int err = 0; + +- if (ovl_open_need_copy_up(dentry, file_flags)) { ++ if (ovl_open_need_copy_up(dentry, flags)) { + err = ovl_want_write(dentry); + if (!err) { +- err = ovl_copy_up_flags(dentry, file_flags); ++ err = ovl_copy_up_flags(dentry, flags); + ovl_drop_write(dentry); + } + } +--- a/fs/overlayfs/file.c ++++ b/fs/overlayfs/file.c +@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct f + + static int ovl_open(struct inode *inode, struct file *file) + { +- struct dentry *dentry = file_dentry(file); + struct file *realfile; + int err; + +- err = ovl_open_maybe_copy_up(dentry, file->f_flags); ++ err = ovl_maybe_copy_up(file_dentry(file), file->f_flags); + if (err) + return err; + +@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file, + if (ret) + return ret; + +- ret = ovl_copy_up_with_data(file_dentry(file)); ++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY); + if (!ret) { + ret = ovl_real_ioctl(file, cmd, arg); + +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -421,7 +421,7 @@ extern const struct file_operations ovl_ + int ovl_copy_up(struct dentry *dentry); + int ovl_copy_up_with_data(struct dentry *dentry); + int ovl_copy_up_flags(struct dentry *dentry, int flags); +-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags); ++int ovl_maybe_copy_up(struct dentry *dentry, int flags); + int ovl_copy_xattr(struct dentry *old, struct dentry *new); + int ovl_set_attr(struct dentry *upper, struct kstat *stat); + struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper); diff --git a/queue-5.0/p54-drop-device-reference-count-if-fails-to-enable-device.patch b/queue-5.0/p54-drop-device-reference-count-if-fails-to-enable-device.patch new file mode 100644 index 00000000000..89727ccc0c1 --- /dev/null +++ b/queue-5.0/p54-drop-device-reference-count-if-fails-to-enable-device.patch @@ -0,0 +1,42 @@ +From 8149069db81853570a665f5e5648c0e526dc0e43 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Wed, 17 Apr 2019 17:41:23 +0800 +Subject: p54: drop device reference count if fails to enable device + +From: Pan Bian + +commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream. + +The function p54p_probe takes an extra reference count of the PCI +device. However, the extra reference count is not dropped when it fails +to enable the PCI device. This patch fixes the bug. + +Cc: stable@vger.kernel.org +Signed-off-by: Pan Bian +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intersil/p54/p54pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intersil/p54/p54pci.c ++++ b/drivers/net/wireless/intersil/p54/p54pci.c +@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pd + err = pci_enable_device(pdev); + if (err) { + dev_err(&pdev->dev, "Cannot enable new PCI device\n"); +- return err; ++ goto err_put; + } + + mem_addr = pci_resource_start(pdev, 0); +@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pd + pci_release_regions(pdev); + err_disable_dev: + pci_disable_device(pdev); ++err_put: + pci_dev_put(pdev); + return err; + } diff --git a/queue-5.0/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch b/queue-5.0/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch new file mode 100644 index 00000000000..8bfc65dcbe5 --- /dev/null +++ b/queue-5.0/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch @@ -0,0 +1,36 @@ +From 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 27 Apr 2019 23:57:49 +0200 +Subject: parisc: Add memory barrier to asm pdc and sync instructions + +From: Helge Deller + +commit 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 upstream. + +Add compiler memory barriers to ensure the compiler doesn't reorder memory +operations around these instructions. + +Cc: stable@vger.kernel.org # v4.20+ +Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/cache.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/cache.h ++++ b/arch/parisc/include/asm/cache.h +@@ -56,10 +56,10 @@ void parisc_setup_cache_timing(void); + #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ + ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define asm_io_sync() asm volatile("sync" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ +- ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :: ) ++ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :::"memory") + + #endif /* ! __ASSEMBLY__ */ + diff --git a/queue-5.0/parisc-add-memory-clobber-to-tlb-purges.patch b/queue-5.0/parisc-add-memory-clobber-to-tlb-purges.patch new file mode 100644 index 00000000000..45b667098ec --- /dev/null +++ b/queue-5.0/parisc-add-memory-clobber-to-tlb-purges.patch @@ -0,0 +1,43 @@ +From 44224bdb99150ad17cf394973b25736cb92c246a Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sun, 21 Apr 2019 19:47:17 -0400 +Subject: parisc: Add memory clobber to TLB purges + +From: John David Anglin + +commit 44224bdb99150ad17cf394973b25736cb92c246a upstream. + +The pdtlb and pitlb instructions are strongly ordered. The asms invoking +these instructions should be compiler memory barriers to ensure the +compiler doesn't reorder memory operations around these instructions. + +Signed-off-by: John David Anglin +CC: stable@vger.kernel.org # v4.20+ +Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/cache.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/include/asm/cache.h ++++ b/arch/parisc/include/asm/cache.h +@@ -44,14 +44,14 @@ void parisc_setup_cache_timing(void); + + #define pdtlb(addr) asm volatile("pdtlb 0(%%sr1,%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define pitlb(addr) asm volatile("pitlb 0(%%sr1,%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ + ALTERNATIVE(ALT_COND_NO_SPLIT_TLB, INSN_NOP) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define pdtlb_kernel(addr) asm volatile("pdtlb 0(%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + + #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ diff --git a/queue-5.0/parisc-allow-live-patching-of-__meminit-functions.patch b/queue-5.0/parisc-allow-live-patching-of-__meminit-functions.patch new file mode 100644 index 00000000000..f7413df65d1 --- /dev/null +++ b/queue-5.0/parisc-allow-live-patching-of-__meminit-functions.patch @@ -0,0 +1,32 @@ +From d19a12906e5e558c0f6b6cfece7b7caf1012ef95 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Wed, 1 May 2019 14:59:58 +0200 +Subject: parisc: Allow live-patching of __meminit functions + +From: Helge Deller + +commit d19a12906e5e558c0f6b6cfece7b7caf1012ef95 upstream. + +When making the text sections writeable with set_kernel_text_rw(1), +include all text sections including those in the __init section. +Otherwise functions marked with __meminit will stay read-only. + +Signed-off-by: Helge Deller +Cc: # 4.20+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -512,7 +512,7 @@ static void __init map_pages(unsigned lo + + void __init set_kernel_text_rw(int enable_read_write) + { +- unsigned long start = (unsigned long) _text; ++ unsigned long start = (unsigned long) __init_begin; + unsigned long end = (unsigned long) &data_start; + + map_pages(start, __pa(start), end-start, diff --git a/queue-5.0/parisc-export-running_on_qemu-symbol-for-modules.patch b/queue-5.0/parisc-export-running_on_qemu-symbol-for-modules.patch new file mode 100644 index 00000000000..8b5520619ca --- /dev/null +++ b/queue-5.0/parisc-export-running_on_qemu-symbol-for-modules.patch @@ -0,0 +1,27 @@ +From 3e1120f4b57bc12437048494ab56648edaa5b57d Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 6 Apr 2019 16:45:14 +0200 +Subject: parisc: Export running_on_qemu symbol for modules + +From: Helge Deller + +commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream. + +Signed-off-by: Helge Deller +CC: stable@vger.kernel.org # v4.9+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/process.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *t + */ + + int running_on_qemu __read_mostly; ++EXPORT_SYMBOL(running_on_qemu); + + void __cpuidle arch_cpu_idle_dead(void) + { diff --git a/queue-5.0/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch b/queue-5.0/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch new file mode 100644 index 00000000000..44ea2a0af96 --- /dev/null +++ b/queue-5.0/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch @@ -0,0 +1,75 @@ +From 1829dda0e87f4462782ca81be474c7890efe31ce Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 5 May 2019 23:54:34 +0200 +Subject: parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code + +From: Helge Deller + +commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream. + +LEVEL is a very common word, and now after many years it suddenly +clashed with another LEVEL define in the DRBD code. +Rename it to PA_ASM_LEVEL instead. + +Reported-by: kbuild test robot +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/assembly.h | 6 +++--- + arch/parisc/kernel/head.S | 4 ++-- + arch/parisc/kernel/syscall.S | 2 +- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/parisc/include/asm/assembly.h ++++ b/arch/parisc/include/asm/assembly.h +@@ -61,14 +61,14 @@ + #define LDCW ldcw,co + #define BL b,l + # ifdef CONFIG_64BIT +-# define LEVEL 2.0w ++# define PA_ASM_LEVEL 2.0w + # else +-# define LEVEL 2.0 ++# define PA_ASM_LEVEL 2.0 + # endif + #else + #define LDCW ldcw + #define BL bl +-#define LEVEL 1.1 ++#define PA_ASM_LEVEL 1.1 + #endif + + #ifdef __ASSEMBLY__ +--- a/arch/parisc/kernel/head.S ++++ b/arch/parisc/kernel/head.S +@@ -22,7 +22,7 @@ + #include + #include + +- .level LEVEL ++ .level PA_ASM_LEVEL + + __INITDATA + ENTRY(boot_args) +@@ -258,7 +258,7 @@ stext_pdc_ret: + ldo R%PA(fault_vector_11)(%r10),%r10 + + $is_pa20: +- .level LEVEL /* restore 1.1 || 2.0w */ ++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */ + #endif /*!CONFIG_64BIT*/ + load32 PA(fault_vector_20),%r10 + +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -48,7 +48,7 @@ registers). + */ + #define KILL_INSN break 0,0 + +- .level LEVEL ++ .level PA_ASM_LEVEL + + .text + diff --git a/queue-5.0/parisc-skip-registering-led-when-running-in-qemu.patch b/queue-5.0/parisc-skip-registering-led-when-running-in-qemu.patch new file mode 100644 index 00000000000..aa59c7c3a39 --- /dev/null +++ b/queue-5.0/parisc-skip-registering-led-when-running-in-qemu.patch @@ -0,0 +1,31 @@ +From b438749044356dd1329c45e9b5a9377b6ea13eb2 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 2 Apr 2019 12:17:08 +0200 +Subject: parisc: Skip registering LED when running in QEMU + +From: Helge Deller + +commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream. + +No need to spend CPU cycles when we run on QEMU. + +Signed-off-by: Helge Deller +CC: stable@vger.kernel.org # v4.9+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parisc/led.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/parisc/led.c ++++ b/drivers/parisc/led.c +@@ -568,6 +568,9 @@ int __init register_led_driver(int model + break; + + case DISPLAY_MODEL_LASI: ++ /* Skip to register LED in QEMU */ ++ if (running_on_qemu) ++ return 1; + LED_DATA_REG = data_reg; + led_func_ptr = led_LASI_driver; + printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG); diff --git a/queue-5.0/parisc-use-pa_asm_level-in-boot-code.patch b/queue-5.0/parisc-use-pa_asm_level-in-boot-code.patch new file mode 100644 index 00000000000..512b2d764af --- /dev/null +++ b/queue-5.0/parisc-use-pa_asm_level-in-boot-code.patch @@ -0,0 +1,49 @@ +From bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 5 May 2019 23:55:02 +0200 +Subject: parisc: Use PA_ASM_LEVEL in boot code + +From: Helge Deller + +commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream. + +The LEVEL define clashed with the DRBD code. + +Reported-by: kbuild test robot +Signed-off-by: Helge Deller +Cc: # v4.14+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/boot/compressed/head.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/boot/compressed/head.S ++++ b/arch/parisc/boot/compressed/head.S +@@ -22,7 +22,7 @@ + __HEAD + + ENTRY(startup) +- .level LEVEL ++ .level PA_ASM_LEVEL + + #define PSW_W_SM 0x200 + #define PSW_W_BIT 36 +@@ -63,7 +63,7 @@ $bss_loop: + load32 BOOTADDR(decompress_kernel),%r3 + + #ifdef CONFIG_64BIT +- .level LEVEL ++ .level PA_ASM_LEVEL + ssm PSW_W_SM, %r0 /* set W-bit */ + depdi 0, 31, 32, %r3 + #endif +@@ -72,7 +72,7 @@ $bss_loop: + + startup_continue: + #ifdef CONFIG_64BIT +- .level LEVEL ++ .level PA_ASM_LEVEL + rsm PSW_W_SM, %r0 /* clear W-bit */ + #endif + diff --git a/queue-5.0/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch b/queue-5.0/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch new file mode 100644 index 00000000000..0856dfb2c10 --- /dev/null +++ b/queue-5.0/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch @@ -0,0 +1,33 @@ +From e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 19 Feb 2019 14:53:49 +0000 +Subject: phy: ti-pipe3: fix missing bit-wise or operator when assigning val + +From: Colin Ian King + +commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream. + +There seems to be a missing bit-wise or operator when setting val, +fix this by adding it in. + +Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings") +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Colin Ian King +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/ti/phy-ti-pipe3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/ti/phy-ti-pipe3.c ++++ b/drivers/phy/ti/phy-ti-pipe3.c +@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti + + val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY); + val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV); +- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT); ++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT); + ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val); + + val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES); diff --git a/queue-5.0/pnfs-fallback-to-mds-if-no-deviceid-found.patch b/queue-5.0/pnfs-fallback-to-mds-if-no-deviceid-found.patch new file mode 100644 index 00000000000..f4236c72bee --- /dev/null +++ b/queue-5.0/pnfs-fallback-to-mds-if-no-deviceid-found.patch @@ -0,0 +1,34 @@ +From b1029c9bc078a6f1515f55dd993b507dcc7e3440 Mon Sep 17 00:00:00 2001 +From: Olga Kornievskaia +Date: Tue, 7 May 2019 13:41:49 -0400 +Subject: PNFS fallback to MDS if no deviceid found + +From: Olga Kornievskaia + +commit b1029c9bc078a6f1515f55dd993b507dcc7e3440 upstream. + +If we fail to find a good deviceid while trying to pnfs instead of +propogating an error back fallback to doing IO to the MDS. Currently, +code with fals the IO with EINVAL. + +Signed-off-by: Olga Kornievskaia +Fixes: 8d40b0f14846f ("NFS filelayout:call GETDEVICEINFO after pnfs_layout_process completes" +Cc: stable@vger.kernel.org # v4.11+ +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/filelayout/filelayout.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/filelayout/filelayout.c ++++ b/fs/nfs/filelayout/filelayout.c +@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino, + status = filelayout_check_deviceid(lo, fl, gfp_flags); + if (status) { + pnfs_put_lseg(lseg); +- lseg = ERR_PTR(status); ++ lseg = NULL; + } + out: + return lseg; diff --git a/queue-5.0/proc-prevent-changes-to-overridden-credentials.patch b/queue-5.0/proc-prevent-changes-to-overridden-credentials.patch new file mode 100644 index 00000000000..2f8d383cca3 --- /dev/null +++ b/queue-5.0/proc-prevent-changes-to-overridden-credentials.patch @@ -0,0 +1,41 @@ +From 35a196bef449b5824033865b963ed9a43fb8c730 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Fri, 19 Apr 2019 14:55:12 -0400 +Subject: proc: prevent changes to overridden credentials + +From: Paul Moore + +commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream. + +Prevent userspace from changing the the /proc/PID/attr values if the +task's credentials are currently overriden. This not only makes sense +conceptually, it also prevents some really bizarre error cases caused +when trying to commit credentials to a task with overridden +credentials. + +Cc: +Reported-by: "chengjian (D)" +Signed-off-by: Paul Moore +Acked-by: John Johansen +Acked-by: James Morris +Acked-by: Casey Schaufler +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2550,6 +2550,11 @@ static ssize_t proc_pid_attr_write(struc + rcu_read_unlock(); + return -EACCES; + } ++ /* Prevent changes to overridden credentials. */ ++ if (current_cred() != current_real_cred()) { ++ rcu_read_unlock(); ++ return -EBUSY; ++ } + rcu_read_unlock(); + + if (count > PAGE_SIZE) diff --git a/queue-5.0/rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch b/queue-5.0/rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch new file mode 100644 index 00000000000..50ff988c7b3 --- /dev/null +++ b/queue-5.0/rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch @@ -0,0 +1,56 @@ +From b79656ed44c6865e17bcd93472ec39488bcc4984 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Mon, 6 May 2019 14:23:04 +0300 +Subject: RDMA/ipoib: Allow user space differentiate between valid dev_port + +From: Leon Romanovsky + +commit b79656ed44c6865e17bcd93472ec39488bcc4984 upstream. + +Systemd triggers the following warning during IPoIB device load: + + mlx5_core 0000:00:0c.0 ib0: "systemd-udevd" wants to know my dev_id. + Should it look at dev_port instead? + See Documentation/ABI/testing/sysfs-class-net for more info. + +This is caused due to user space attempt to differentiate old systems +without dev_port and new systems with dev_port. In case dev_port will be +zero, the systemd will try to read dev_id instead. + +There is no need to print a warning in such case, because it is valid +situation and it is needed to ensure systemd compatibility with old +kernels. + +Link: https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358 +Cc: # 4.19 +Fixes: f6350da41dc7 ("IB/ipoib: Log sysfs 'dev_id' accesses from userspace") +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2402,7 +2402,18 @@ static ssize_t dev_id_show(struct device + { + struct net_device *ndev = to_net_dev(dev); + +- if (ndev->dev_id == ndev->dev_port) ++ /* ++ * ndev->dev_port will be equal to 0 in old kernel prior to commit ++ * 9b8b2a323008 ("IB/ipoib: Use dev_port to expose network interface ++ * port numbers") Zero was chosen as special case for user space ++ * applications to fallback and query dev_id to check if it has ++ * different value or not. ++ * ++ * Don't print warning in such scenario. ++ * ++ * https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358 ++ */ ++ if (ndev->dev_port && ndev->dev_id == ndev->dev_port) + netdev_info_once(ndev, + "\"%s\" wants to know my dev_id. Should it look at dev_port instead? See Documentation/ABI/testing/sysfs-class-net for more info.\n", + current->comm); diff --git a/queue-5.0/rdma-mlx5-use-get_zeroed_page-for-clock_info.patch b/queue-5.0/rdma-mlx5-use-get_zeroed_page-for-clock_info.patch new file mode 100644 index 00000000000..dd2b3a2391f --- /dev/null +++ b/queue-5.0/rdma-mlx5-use-get_zeroed_page-for-clock_info.patch @@ -0,0 +1,98 @@ +From ddcdc368b1033e19fd3a5f750752e10e28a87826 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Tue, 16 Apr 2019 14:07:29 +0300 +Subject: RDMA/mlx5: Use get_zeroed_page() for clock_info + +From: Jason Gunthorpe + +commit ddcdc368b1033e19fd3a5f750752e10e28a87826 upstream. + +get_zeroed_page() returns a virtual address for the page which is better +than allocating a struct page and doing a permanent kmap on it. + +Cc: stable@vger.kernel.org +Signed-off-by: Jason Gunthorpe +Reviewed-by: Haggai Eran +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/main.c | 5 ++- + drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 30 +++++++------------- + include/linux/mlx5/driver.h | 1 + 3 files changed, 14 insertions(+), 22 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1986,11 +1986,12 @@ static int mlx5_ib_mmap_clock_info_page( + return -EPERM; + vma->vm_flags &= ~VM_MAYWRITE; + +- if (!dev->mdev->clock_info_page) ++ if (!dev->mdev->clock_info) + return -EOPNOTSUPP; + + return rdma_user_mmap_page(&context->ibucontext, vma, +- dev->mdev->clock_info_page, PAGE_SIZE); ++ virt_to_page(dev->mdev->clock_info), ++ PAGE_SIZE); + } + + static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -535,23 +535,16 @@ void mlx5_init_clock(struct mlx5_core_de + do_div(ns, NSEC_PER_SEC / HZ); + clock->overflow_period = ns; + +- mdev->clock_info_page = alloc_page(GFP_KERNEL); +- if (mdev->clock_info_page) { +- mdev->clock_info = kmap(mdev->clock_info_page); +- if (!mdev->clock_info) { +- __free_page(mdev->clock_info_page); +- mlx5_core_warn(mdev, "failed to map clock page\n"); +- } else { +- mdev->clock_info->sign = 0; +- mdev->clock_info->nsec = clock->tc.nsec; +- mdev->clock_info->cycles = clock->tc.cycle_last; +- mdev->clock_info->mask = clock->cycles.mask; +- mdev->clock_info->mult = clock->nominal_c_mult; +- mdev->clock_info->shift = clock->cycles.shift; +- mdev->clock_info->frac = clock->tc.frac; +- mdev->clock_info->overflow_period = +- clock->overflow_period; +- } ++ mdev->clock_info = ++ (struct mlx5_ib_clock_info *)get_zeroed_page(GFP_KERNEL); ++ if (mdev->clock_info) { ++ mdev->clock_info->nsec = clock->tc.nsec; ++ mdev->clock_info->cycles = clock->tc.cycle_last; ++ mdev->clock_info->mask = clock->cycles.mask; ++ mdev->clock_info->mult = clock->nominal_c_mult; ++ mdev->clock_info->shift = clock->cycles.shift; ++ mdev->clock_info->frac = clock->tc.frac; ++ mdev->clock_info->overflow_period = clock->overflow_period; + } + + INIT_WORK(&clock->pps_info.out_work, mlx5_pps_out); +@@ -599,8 +592,7 @@ void mlx5_cleanup_clock(struct mlx5_core + cancel_delayed_work_sync(&clock->overflow_work); + + if (mdev->clock_info) { +- kunmap(mdev->clock_info_page); +- __free_page(mdev->clock_info_page); ++ free_page((unsigned long)mdev->clock_info); + mdev->clock_info = NULL; + } + +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -677,7 +677,6 @@ struct mlx5_core_dev { + #endif + struct mlx5_clock clock; + struct mlx5_ib_clock_info *clock_info; +- struct page *clock_info_page; + struct mlx5_fw_tracer *tracer; + }; + diff --git a/queue-5.0/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch b/queue-5.0/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch new file mode 100644 index 00000000000..582b73207a2 --- /dev/null +++ b/queue-5.0/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch @@ -0,0 +1,54 @@ +From 70b464918e5331e488058870fcc6821d54c4e541 Mon Sep 17 00:00:00 2001 +From: Steve Twiss +Date: Mon, 18 Mar 2019 16:17:57 +0000 +Subject: regulator: core: fix error path for regulator_set_voltage_unlocked + +From: Steve Twiss + +commit 70b464918e5331e488058870fcc6821d54c4e541 upstream. + +During several error paths in the function +regulator_set_voltage_unlocked() the value of 'ret' can take on negative +error values. However, in calls that go through the 'goto out' statement, +this return value is lost and return 0 is used instead, indicating a +'pass'. + +There are several cases where this function should legitimately return a +fail instead of a pass: one such case includes constraints check during +voltage selection in the call to regulator_check_voltage(), which can +have -EINVAL for the case when an unsupported voltage is incorrectly +requested. In that case, -22 is expected as the return value, not 0. + +Fixes: 9243a195be7a ("regulator: core: Change voltage setting path") +Cc: stable +Signed-off-by: Steve Twiss +Reviewed-by: Dmitry Osipenko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -3360,15 +3360,12 @@ static int regulator_set_voltage_unlocke + + /* for not coupled regulators this will just set the voltage */ + ret = regulator_balance_voltage(rdev, state); +- if (ret < 0) +- goto out2; ++ if (ret < 0) { ++ voltage->min_uV = old_min_uV; ++ voltage->max_uV = old_max_uV; ++ } + + out: +- return 0; +-out2: +- voltage->min_uV = old_min_uV; +- voltage->max_uV = old_max_uV; +- + return ret; + } + diff --git a/queue-5.0/revert-md-fix-lock-contention-for-flush-bios.patch b/queue-5.0/revert-md-fix-lock-contention-for-flush-bios.patch new file mode 100644 index 00000000000..8ee980fe024 --- /dev/null +++ b/queue-5.0/revert-md-fix-lock-contention-for-flush-bios.patch @@ -0,0 +1,312 @@ +From 4bc034d35377196c854236133b07730a777c4aba Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 29 Mar 2019 10:46:16 -0700 +Subject: Revert "MD: fix lock contention for flush bios" + +From: NeilBrown + +commit 4bc034d35377196c854236133b07730a777c4aba upstream. + +This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85. + +This patch has two problems. + +1/ it make multiple calls to submit_bio() from inside a make_request_fn. + The bios thus submitted will be queued on current->bio_list and not + submitted immediately. As the bios are allocated from a mempool, + this can theoretically result in a deadlock - all the pool of requests + could be in various ->bio_list queues and a subsequent mempool_alloc + could block waiting for one of them to be released. + +2/ It aims to handle a case when there are many concurrent flush requests. + It handles this by submitting many requests in parallel - all of which + are identical and so most of which do nothing useful. + It would be more efficient to just send one lower-level request, but + allow that to satisfy multiple upper-level requests. + +Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") +Cc: # v4.19+ +Tested-by: Xiao Ni +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 159 +++++++++++++++++++------------------------------------- + drivers/md/md.h | 22 ++----- + 2 files changed, 62 insertions(+), 119 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev + mddev->sync_speed_max : sysctl_speed_limit_max; + } + +-static void * flush_info_alloc(gfp_t gfp_flags, void *data) +-{ +- return kzalloc(sizeof(struct flush_info), gfp_flags); +-} +-static void flush_info_free(void *flush_info, void *data) +-{ +- kfree(flush_info); +-} +- +-static void * flush_bio_alloc(gfp_t gfp_flags, void *data) +-{ +- return kzalloc(sizeof(struct flush_bio), gfp_flags); +-} +-static void flush_bio_free(void *flush_bio, void *data) +-{ +- kfree(flush_bio); +-} +- + static struct ctl_table_header *raid_table_header; + + static struct ctl_table raid_table[] = { +@@ -423,54 +405,30 @@ static int md_congested(void *data, int + /* + * Generic flush handling for md + */ +-static void submit_flushes(struct work_struct *ws) +-{ +- struct flush_info *fi = container_of(ws, struct flush_info, flush_work); +- struct mddev *mddev = fi->mddev; +- struct bio *bio = fi->bio; +- +- bio->bi_opf &= ~REQ_PREFLUSH; +- md_handle_request(mddev, bio); +- +- mempool_free(fi, mddev->flush_pool); +-} + +-static void md_end_flush(struct bio *fbio) ++static void md_end_flush(struct bio *bio) + { +- struct flush_bio *fb = fbio->bi_private; +- struct md_rdev *rdev = fb->rdev; +- struct flush_info *fi = fb->fi; +- struct bio *bio = fi->bio; +- struct mddev *mddev = fi->mddev; ++ struct md_rdev *rdev = bio->bi_private; ++ struct mddev *mddev = rdev->mddev; + + rdev_dec_pending(rdev, mddev); + +- if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) { +- /* an empty barrier - all done */ +- bio_endio(bio); +- mempool_free(fi, mddev->flush_pool); +- } else { +- INIT_WORK(&fi->flush_work, submit_flushes); +- queue_work(md_wq, &fi->flush_work); +- } ++ if (atomic_dec_and_test(&mddev->flush_pending)) { ++ /* The pre-request flush has finished */ ++ queue_work(md_wq, &mddev->flush_work); + } +- +- mempool_free(fb, mddev->flush_bio_pool); +- bio_put(fbio); ++ bio_put(bio); + } + +-void md_flush_request(struct mddev *mddev, struct bio *bio) ++static void md_submit_flush_data(struct work_struct *ws); ++ ++static void submit_flushes(struct work_struct *ws) + { ++ struct mddev *mddev = container_of(ws, struct mddev, flush_work); + struct md_rdev *rdev; +- struct flush_info *fi; +- +- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO); +- +- fi->bio = bio; +- fi->mddev = mddev; +- atomic_set(&fi->flush_pending, 1); + ++ INIT_WORK(&mddev->flush_work, md_submit_flush_data); ++ atomic_set(&mddev->flush_pending, 1); + rcu_read_lock(); + rdev_for_each_rcu(rdev, mddev) + if (rdev->raid_disk >= 0 && +@@ -480,40 +438,59 @@ void md_flush_request(struct mddev *mdde + * we reclaim rcu_read_lock + */ + struct bio *bi; +- struct flush_bio *fb; + atomic_inc(&rdev->nr_pending); + atomic_inc(&rdev->nr_pending); + rcu_read_unlock(); +- +- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO); +- fb->fi = fi; +- fb->rdev = rdev; +- + bi = bio_alloc_mddev(GFP_NOIO, 0, mddev); +- bio_set_dev(bi, rdev->bdev); + bi->bi_end_io = md_end_flush; +- bi->bi_private = fb; ++ bi->bi_private = rdev; ++ bio_set_dev(bi, rdev->bdev); + bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; +- +- atomic_inc(&fi->flush_pending); ++ atomic_inc(&mddev->flush_pending); + submit_bio(bi); +- + rcu_read_lock(); + rdev_dec_pending(rdev, mddev); + } + rcu_read_unlock(); ++ if (atomic_dec_and_test(&mddev->flush_pending)) ++ queue_work(md_wq, &mddev->flush_work); ++} + +- if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) { +- /* an empty barrier - all done */ +- bio_endio(bio); +- mempool_free(fi, mddev->flush_pool); +- } else { +- INIT_WORK(&fi->flush_work, submit_flushes); +- queue_work(md_wq, &fi->flush_work); +- } ++static void md_submit_flush_data(struct work_struct *ws) ++{ ++ struct mddev *mddev = container_of(ws, struct mddev, flush_work); ++ struct bio *bio = mddev->flush_bio; ++ ++ /* ++ * must reset flush_bio before calling into md_handle_request to avoid a ++ * deadlock, because other bios passed md_handle_request suspend check ++ * could wait for this and below md_handle_request could wait for those ++ * bios because of suspend check ++ */ ++ mddev->flush_bio = NULL; ++ wake_up(&mddev->sb_wait); ++ ++ if (bio->bi_iter.bi_size == 0) { ++ /* an empty barrier - all done */ ++ bio_endio(bio); ++ } else { ++ bio->bi_opf &= ~REQ_PREFLUSH; ++ md_handle_request(mddev, bio); + } + } ++ ++void md_flush_request(struct mddev *mddev, struct bio *bio) ++{ ++ spin_lock_irq(&mddev->lock); ++ wait_event_lock_irq(mddev->sb_wait, ++ !mddev->flush_bio, ++ mddev->lock); ++ mddev->flush_bio = bio; ++ spin_unlock_irq(&mddev->lock); ++ ++ INIT_WORK(&mddev->flush_work, submit_flushes); ++ queue_work(md_wq, &mddev->flush_work); ++} + EXPORT_SYMBOL(md_flush_request); + + static inline struct mddev *mddev_get(struct mddev *mddev) +@@ -560,6 +537,7 @@ void mddev_init(struct mddev *mddev) + atomic_set(&mddev->openers, 0); + atomic_set(&mddev->active_io, 0); + spin_lock_init(&mddev->lock); ++ atomic_set(&mddev->flush_pending, 0); + init_waitqueue_head(&mddev->sb_wait); + init_waitqueue_head(&mddev->recovery_wait); + mddev->reshape_position = MaxSector; +@@ -5511,22 +5489,6 @@ int md_run(struct mddev *mddev) + if (err) + return err; + } +- if (mddev->flush_pool == NULL) { +- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc, +- flush_info_free, mddev); +- if (!mddev->flush_pool) { +- err = -ENOMEM; +- goto abort; +- } +- } +- if (mddev->flush_bio_pool == NULL) { +- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc, +- flush_bio_free, mddev); +- if (!mddev->flush_bio_pool) { +- err = -ENOMEM; +- goto abort; +- } +- } + + spin_lock(&pers_lock); + pers = find_pers(mddev->level, mddev->clevel); +@@ -5686,11 +5648,8 @@ int md_run(struct mddev *mddev) + return 0; + + abort: +- mempool_destroy(mddev->flush_bio_pool); +- mddev->flush_bio_pool = NULL; +- mempool_destroy(mddev->flush_pool); +- mddev->flush_pool = NULL; +- ++ bioset_exit(&mddev->bio_set); ++ bioset_exit(&mddev->sync_set); + return err; + } + EXPORT_SYMBOL_GPL(md_run); +@@ -5894,14 +5853,6 @@ static void __md_stop(struct mddev *mdde + mddev->to_remove = &md_redundancy_group; + module_put(pers->owner); + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +- if (mddev->flush_bio_pool) { +- mempool_destroy(mddev->flush_bio_pool); +- mddev->flush_bio_pool = NULL; +- } +- if (mddev->flush_pool) { +- mempool_destroy(mddev->flush_pool); +- mddev->flush_pool = NULL; +- } + } + + void md_stop(struct mddev *mddev) +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -252,19 +252,6 @@ enum mddev_sb_flags { + MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */ + }; + +-#define NR_FLUSH_INFOS 8 +-#define NR_FLUSH_BIOS 64 +-struct flush_info { +- struct bio *bio; +- struct mddev *mddev; +- struct work_struct flush_work; +- atomic_t flush_pending; +-}; +-struct flush_bio { +- struct flush_info *fi; +- struct md_rdev *rdev; +-}; +- + struct mddev { + void *private; + struct md_personality *pers; +@@ -470,8 +457,13 @@ struct mddev { + * metadata and bitmap writes + */ + +- mempool_t *flush_pool; +- mempool_t *flush_bio_pool; ++ /* Generic flush handling. ++ * The last to finish preflush schedules a worker to submit ++ * the rest of the request (without the REQ_PREFLUSH flag). ++ */ ++ struct bio *flush_bio; ++ atomic_t flush_pending; ++ struct work_struct flush_work; + struct work_struct event_work; /* used by dm to report failure event */ + void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev); + struct md_cluster_info *cluster_info; diff --git a/queue-5.0/series b/queue-5.0/series index 382ae8a6f0b..e4a44b61def 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -17,3 +17,47 @@ net-mlx5e-additional-check-for-flow-destination-comparison.patch net-mlx5-imply-mlxfw-in-mlx5_core.patch net-mlx5e-fix-ethtool-rxfh-commands-when-config_mlx5_en_rxnfc-is-disabled.patch mm-gup-remove-the-write-parameter-from-gup_fast_permitted.patch +blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch +regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch +parisc-export-running_on_qemu-symbol-for-modules.patch +parisc-add-memory-clobber-to-tlb-purges.patch +parisc-skip-registering-led-when-running-in-qemu.patch +parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch +parisc-allow-live-patching-of-__meminit-functions.patch +parisc-use-pa_asm_level-in-boot-code.patch +parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch +stm-class-fix-channel-free-in-stm-output-free-path.patch +stm-class-fix-channel-bitmap-on-32-bit-systems.patch +brd-re-enable-__gfp_highmem-in-brd_insert_page.patch +proc-prevent-changes-to-overridden-credentials.patch +revert-md-fix-lock-contention-for-flush-bios.patch +md-batch-flush-requests.patch +md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch +md-add-a-missing-endianness-conversion-in-check_sb_changes.patch +dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch +intel_th-msu-fix-single-mode-with-iommu.patch +p54-drop-device-reference-count-if-fails-to-enable-device.patch +of-fix-clang-wunsequenced-for-be32_to_cpu.patch +brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch +cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch +phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch +media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch +media-imx-csi-allow-unknown-nearest-upstream-entities.patch +media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch +rdma-mlx5-use-get_zeroed_page-for-clock_info.patch +rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch +nfs4-fix-v4.0-client-state-corruption-when-mount.patch +pnfs-fallback-to-mds-if-no-deviceid-found.patch +clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch +clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch +clk-mediatek-disable-tuner_en-before-change-pll-rate.patch +clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch +udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch +udlfb-fix-sleeping-inside-spinlock.patch +udlfb-introduce-a-rendering-mutex.patch +fuse-fix-writepages-on-32bit.patch +fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch +ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch +gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch +iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch +ceph-flush-dirty-inodes-before-proceeding-with-remount.patch diff --git a/queue-5.0/stm-class-fix-channel-bitmap-on-32-bit-systems.patch b/queue-5.0/stm-class-fix-channel-bitmap-on-32-bit-systems.patch new file mode 100644 index 00000000000..74d4a7114be --- /dev/null +++ b/queue-5.0/stm-class-fix-channel-bitmap-on-32-bit-systems.patch @@ -0,0 +1,45 @@ +From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 17 Apr 2019 10:35:35 +0300 +Subject: stm class: Fix channel bitmap on 32-bit systems + +From: Alexander Shishkin + +commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream. + +Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace +Module devices") naively calculates the channel bitmap size in 64-bit +chunks regardless of the size of underlying unsigned long, making the +bitmap half as big on a 32-bit system. This leads to an out of bounds +access with the upper half of the bitmap. + +Fix this by using BITS_TO_LONGS. While at it, convert to using +struct_size() for the total size calculation of the master struct. + +Signed-off-by: Alexander Shishkin +Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices") +Reported-by: Mulu He +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig + static int stp_master_alloc(struct stm_device *stm, unsigned int idx) + { + struct stp_master *master; +- size_t size; + +- size = ALIGN(stm->data->sw_nchannels, 8) / 8; +- size += sizeof(struct stp_master); +- master = kzalloc(size, GFP_ATOMIC); ++ master = kzalloc(struct_size(master, chan_map, ++ BITS_TO_LONGS(stm->data->sw_nchannels)), ++ GFP_ATOMIC); + if (!master) + return -ENOMEM; + diff --git a/queue-5.0/stm-class-fix-channel-free-in-stm-output-free-path.patch b/queue-5.0/stm-class-fix-channel-free-in-stm-output-free-path.patch new file mode 100644 index 00000000000..e6aa1cf499b --- /dev/null +++ b/queue-5.0/stm-class-fix-channel-free-in-stm-output-free-path.patch @@ -0,0 +1,40 @@ +From ee496da4c3915de3232b5f5cd20e21ae3e46fe8d Mon Sep 17 00:00:00 2001 +From: Tingwei Zhang +Date: Wed, 17 Apr 2019 10:35:34 +0300 +Subject: stm class: Fix channel free in stm output free path + +From: Tingwei Zhang + +commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream. + +Number of free masters is not set correctly in stm +free path. Fix this by properly adding the number +of output channels before setting them to 0 in +stm_output_disclaim(). + +Currently it is equivalent to doing nothing since +master->nr_free is incremented by 0. + +Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices") +Signed-off-by: Tingwei Zhang +Signed-off-by: Sai Prakash Ranjan +Cc: stable@vger.kernel.org # v4.4 +Signed-off-by: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *s + bitmap_release_region(&master->chan_map[0], output->channel, + ilog2(output->nr_chans)); + +- output->nr_chans = 0; + master->nr_free += output->nr_chans; ++ output->nr_chans = 0; + } + + /* diff --git a/queue-5.0/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch b/queue-5.0/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch new file mode 100644 index 00000000000..de8ae508dc5 --- /dev/null +++ b/queue-5.0/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch @@ -0,0 +1,102 @@ +From bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 1 Apr 2019 17:46:56 +0200 +Subject: udlfb: delete the unused parameter for dlfb_handle_damage + +From: Mikulas Patocka + +commit bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 upstream. + +Remove the unused parameter "data" and unused variable "ret". + +Signed-off-by: Mikulas Patocka +Cc: Bernie Thompson +Cc: Ladislav Michl +Cc: +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/udlfb.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -594,10 +594,9 @@ static int dlfb_render_hline(struct dlfb + return 0; + } + +-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, +- int width, int height, char *data) ++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height) + { +- int i, ret; ++ int i; + char *cmd; + cycles_t start_cycles, end_cycles; + int bytes_sent = 0; +@@ -641,7 +640,7 @@ static int dlfb_handle_damage(struct dlf + *cmd++ = 0xAF; + /* Send partial buffer remaining before exiting */ + len = cmd - (char *) urb->transfer_buffer; +- ret = dlfb_submit_urb(dlfb, urb, len); ++ dlfb_submit_urb(dlfb, urb, len); + bytes_sent += len; + } else + dlfb_urb_completion(urb); +@@ -679,7 +678,7 @@ static ssize_t dlfb_ops_write(struct fb_ + (u32)info->var.yres); + + dlfb_handle_damage(dlfb, 0, start, info->var.xres, +- lines, info->screen_base); ++ lines); + } + + return result; +@@ -695,7 +694,7 @@ static void dlfb_ops_copyarea(struct fb_ + sys_copyarea(info, area); + + dlfb_handle_damage(dlfb, area->dx, area->dy, +- area->width, area->height, info->screen_base); ++ area->width, area->height); + } + + static void dlfb_ops_imageblit(struct fb_info *info, +@@ -706,7 +705,7 @@ static void dlfb_ops_imageblit(struct fb + sys_imageblit(info, image); + + dlfb_handle_damage(dlfb, image->dx, image->dy, +- image->width, image->height, info->screen_base); ++ image->width, image->height); + } + + static void dlfb_ops_fillrect(struct fb_info *info, +@@ -717,7 +716,7 @@ static void dlfb_ops_fillrect(struct fb_ + sys_fillrect(info, rect); + + dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width, +- rect->height, info->screen_base); ++ rect->height); + } + + /* +@@ -859,8 +858,7 @@ static int dlfb_ops_ioctl(struct fb_info + if (area.y > info->var.yres) + area.y = info->var.yres; + +- dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h, +- info->screen_base); ++ dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h); + } + + return 0; +@@ -1065,8 +1063,7 @@ static int dlfb_ops_set_par(struct fb_in + pix_framebuffer[i] = 0x37e6; + } + +- dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres, +- info->screen_base); ++ dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres); + + return 0; + } diff --git a/queue-5.0/udlfb-fix-sleeping-inside-spinlock.patch b/queue-5.0/udlfb-fix-sleeping-inside-spinlock.patch new file mode 100644 index 00000000000..9f8af96089a --- /dev/null +++ b/queue-5.0/udlfb-fix-sleeping-inside-spinlock.patch @@ -0,0 +1,147 @@ +From 6b11f9d8433b471fdd3ebed232b43a4b723be6ff Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 1 Apr 2019 17:46:56 +0200 +Subject: udlfb: fix sleeping inside spinlock + +From: Mikulas Patocka + +commit 6b11f9d8433b471fdd3ebed232b43a4b723be6ff upstream. + +If a framebuffer device is used as a console, the rendering calls +(copyarea, fillrect, imageblit) may be done with the console spinlock +held. On udlfb, these function call dlfb_handle_damage that takes a +blocking semaphore before acquiring an URB. + +In order to fix the bug, this patch changes the calls copyarea, fillrect +and imageblit to offload USB work to a workqueue. + +A side effect of this patch is 3x improvement in console scrolling speed +because the device doesn't have to be updated after each copyarea call. + +Signed-off-by: Mikulas Patocka +Cc: Bernie Thompson +Cc: Ladislav Michl +Cc: +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/udlfb.c | 56 +++++++++++++++++++++++++++++++++++++++++--- + include/video/udlfb.h | 6 ++++ + 2 files changed, 59 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -657,6 +657,50 @@ error: + return 0; + } + ++static void dlfb_init_damage(struct dlfb_data *dlfb) ++{ ++ dlfb->damage_x = INT_MAX; ++ dlfb->damage_x2 = 0; ++ dlfb->damage_y = INT_MAX; ++ dlfb->damage_y2 = 0; ++} ++ ++static void dlfb_damage_work(struct work_struct *w) ++{ ++ struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work); ++ int x, x2, y, y2; ++ ++ spin_lock_irq(&dlfb->damage_lock); ++ x = dlfb->damage_x; ++ x2 = dlfb->damage_x2; ++ y = dlfb->damage_y; ++ y2 = dlfb->damage_y2; ++ dlfb_init_damage(dlfb); ++ spin_unlock_irq(&dlfb->damage_lock); ++ ++ if (x < x2 && y < y2) ++ dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y); ++} ++ ++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height) ++{ ++ unsigned long flags; ++ int x2 = x + width; ++ int y2 = y + height; ++ ++ if (x >= x2 || y >= y2) ++ return; ++ ++ spin_lock_irqsave(&dlfb->damage_lock, flags); ++ dlfb->damage_x = min(x, dlfb->damage_x); ++ dlfb->damage_x2 = max(x2, dlfb->damage_x2); ++ dlfb->damage_y = min(y, dlfb->damage_y); ++ dlfb->damage_y2 = max(y2, dlfb->damage_y2); ++ spin_unlock_irqrestore(&dlfb->damage_lock, flags); ++ ++ schedule_work(&dlfb->damage_work); ++} ++ + /* + * Path triggered by usermode clients who write to filesystem + * e.g. cat filename > /dev/fb1 +@@ -693,7 +737,7 @@ static void dlfb_ops_copyarea(struct fb_ + + sys_copyarea(info, area); + +- dlfb_handle_damage(dlfb, area->dx, area->dy, ++ dlfb_offload_damage(dlfb, area->dx, area->dy, + area->width, area->height); + } + +@@ -704,7 +748,7 @@ static void dlfb_ops_imageblit(struct fb + + sys_imageblit(info, image); + +- dlfb_handle_damage(dlfb, image->dx, image->dy, ++ dlfb_offload_damage(dlfb, image->dx, image->dy, + image->width, image->height); + } + +@@ -715,7 +759,7 @@ static void dlfb_ops_fillrect(struct fb_ + + sys_fillrect(info, rect); + +- dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width, ++ dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width, + rect->height); + } + +@@ -940,6 +984,8 @@ static void dlfb_ops_destroy(struct fb_i + { + struct dlfb_data *dlfb = info->par; + ++ cancel_work_sync(&dlfb->damage_work); ++ + if (info->cmap.len != 0) + fb_dealloc_cmap(&info->cmap); + if (info->monspecs.modedb) +@@ -1636,6 +1682,10 @@ static int dlfb_usb_probe(struct usb_int + dlfb->ops = dlfb_ops; + info->fbops = &dlfb->ops; + ++ dlfb_init_damage(dlfb); ++ spin_lock_init(&dlfb->damage_lock); ++ INIT_WORK(&dlfb->damage_work, dlfb_damage_work); ++ + INIT_LIST_HEAD(&info->modelist); + + if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) { +--- a/include/video/udlfb.h ++++ b/include/video/udlfb.h +@@ -48,6 +48,12 @@ struct dlfb_data { + int base8; + u32 pseudo_palette[256]; + int blank_mode; /*one of FB_BLANK_ */ ++ int damage_x; ++ int damage_y; ++ int damage_x2; ++ int damage_y2; ++ spinlock_t damage_lock; ++ struct work_struct damage_work; + struct fb_ops ops; + /* blit-only rendering path metrics, exposed through sysfs */ + atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */ diff --git a/queue-5.0/udlfb-introduce-a-rendering-mutex.patch b/queue-5.0/udlfb-introduce-a-rendering-mutex.patch new file mode 100644 index 00000000000..7d1a891e849 --- /dev/null +++ b/queue-5.0/udlfb-introduce-a-rendering-mutex.patch @@ -0,0 +1,149 @@ +From babc250e278eac7b0e671bdaedf833759b43bb78 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 1 Apr 2019 17:46:57 +0200 +Subject: udlfb: introduce a rendering mutex + +From: Mikulas Patocka + +commit babc250e278eac7b0e671bdaedf833759b43bb78 upstream. + +Rendering calls may be done simultaneously from the workqueue, +dlfb_ops_write, dlfb_ops_ioctl, dlfb_ops_set_par and dlfb_dpy_deferred_io. +The code is robust enough so that it won't crash on concurrent rendering. + +However, concurrent rendering may cause display corruption if the same +pixel is simultaneously being rendered. In order to avoid this corruption, +this patch adds a mutex around the rendering calls. + +Signed-off-by: Mikulas Patocka +Cc: Bernie Thompson +Cc: Ladislav Michl +Cc: +[b.zolnierkie: replace "dlfb:" with "uldfb:" in the patch summary] +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/udlfb.c | 41 ++++++++++++++++++++++++++++++----------- + include/video/udlfb.h | 1 + + 2 files changed, 31 insertions(+), 11 deletions(-) + +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -596,7 +596,7 @@ static int dlfb_render_hline(struct dlfb + + static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height) + { +- int i; ++ int i, ret; + char *cmd; + cycles_t start_cycles, end_cycles; + int bytes_sent = 0; +@@ -606,21 +606,29 @@ static int dlfb_handle_damage(struct dlf + + start_cycles = get_cycles(); + ++ mutex_lock(&dlfb->render_mutex); ++ + aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long)); + width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long)); + x = aligned_x; + + if ((width <= 0) || + (x + width > dlfb->info->var.xres) || +- (y + height > dlfb->info->var.yres)) +- return -EINVAL; ++ (y + height > dlfb->info->var.yres)) { ++ ret = -EINVAL; ++ goto unlock_ret; ++ } + +- if (!atomic_read(&dlfb->usb_active)) +- return 0; ++ if (!atomic_read(&dlfb->usb_active)) { ++ ret = 0; ++ goto unlock_ret; ++ } + + urb = dlfb_get_urb(dlfb); +- if (!urb) +- return 0; ++ if (!urb) { ++ ret = 0; ++ goto unlock_ret; ++ } + cmd = urb->transfer_buffer; + + for (i = y; i < y + height ; i++) { +@@ -654,7 +662,11 @@ error: + >> 10)), /* Kcycles */ + &dlfb->cpu_kcycles_used); + +- return 0; ++ ret = 0; ++ ++unlock_ret: ++ mutex_unlock(&dlfb->render_mutex); ++ return ret; + } + + static void dlfb_init_damage(struct dlfb_data *dlfb) +@@ -782,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct + int bytes_identical = 0; + int bytes_rendered = 0; + ++ mutex_lock(&dlfb->render_mutex); ++ + if (!fb_defio) +- return; ++ goto unlock_ret; + + if (!atomic_read(&dlfb->usb_active)) +- return; ++ goto unlock_ret; + + start_cycles = get_cycles(); + + urb = dlfb_get_urb(dlfb); + if (!urb) +- return; ++ goto unlock_ret; + + cmd = urb->transfer_buffer; + +@@ -825,6 +839,8 @@ error: + atomic_add(((unsigned int) ((end_cycles - start_cycles) + >> 10)), /* Kcycles */ + &dlfb->cpu_kcycles_used); ++unlock_ret: ++ mutex_unlock(&dlfb->render_mutex); + } + + static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len) +@@ -986,6 +1002,8 @@ static void dlfb_ops_destroy(struct fb_i + + cancel_work_sync(&dlfb->damage_work); + ++ mutex_destroy(&dlfb->render_mutex); ++ + if (info->cmap.len != 0) + fb_dealloc_cmap(&info->cmap); + if (info->monspecs.modedb) +@@ -1682,6 +1700,7 @@ static int dlfb_usb_probe(struct usb_int + dlfb->ops = dlfb_ops; + info->fbops = &dlfb->ops; + ++ mutex_init(&dlfb->render_mutex); + dlfb_init_damage(dlfb); + spin_lock_init(&dlfb->damage_lock); + INIT_WORK(&dlfb->damage_work, dlfb_damage_work); +--- a/include/video/udlfb.h ++++ b/include/video/udlfb.h +@@ -48,6 +48,7 @@ struct dlfb_data { + int base8; + u32 pseudo_palette[256]; + int blank_mode; /*one of FB_BLANK_ */ ++ struct mutex render_mutex; + int damage_x; + int damage_y; + int damage_x2;