From: Sasha Levin Date: Sun, 1 Dec 2019 15:05:12 +0000 (-0500) Subject: fixes for 4.14 X-Git-Tag: v5.4.2~64 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4c94aa9198240deff767e8d107019d56104df351;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch b/queue-4.14/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch new file mode 100644 index 00000000000..0b655b5020e --- /dev/null +++ b/queue-4.14/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch @@ -0,0 +1,55 @@ +From 82126e60dbe7b109d58d8844c09740f64a82d3f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 18:48:37 +0000 +Subject: ACPI / APEI: Don't wait to serialise with oops messages when + panic()ing + +From: James Morse + +[ Upstream commit 78b0b690f6558ed788dccafa45965325dd11ba89 ] + +oops_begin() exists to group printk() messages with the oops message +printed by die(). To reach this caller we know that platform firmware +took this error first, then notified the OS via NMI with a 'panic' +severity. + +Don't wait for another CPU to release the die-lock before panic()ing, +our only goal is to print this fatal error and panic(). + +This code is always called in_nmi(), and since commit 42a0bb3f7138 +("printk/nmi: generic solution for safe printk in NMI"), it has been +safe to call printk() from this context. Messages are batched in a +per-cpu buffer and printed via irq-work, or a call back from panic(). + +Link: https://patchwork.kernel.org/patch/10313555/ +Acked-by: Borislav Petkov +Signed-off-by: James Morse +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 5889f6407fea8..9c31c7cd5cb5e 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -33,7 +33,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -936,7 +935,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs) + + sev = ghes_severity(ghes->estatus->error_severity); + if (sev >= GHES_SEV_PANIC) { +- oops_begin(); + ghes_print_queued_estatus(); + __ghes_panic(ghes); + } +-- +2.20.1 + diff --git a/queue-4.14/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch b/queue-4.14/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch new file mode 100644 index 00000000000..2ca8fe67b6d --- /dev/null +++ b/queue-4.14/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch @@ -0,0 +1,93 @@ +From 805f7a4412b9fc757e9694b228159f8c01cc85e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 18:48:39 +0000 +Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory + +From: James Morse + +[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ] + +The ghes code is careful to parse and round firmware's advertised +memory requirements for CPER records, up to a maximum of 64K. +However when ghes_estatus_pool_expand() does its work, it splits +the requested size into PAGE_SIZE granules. + +This means if firmware generates 5K of CPER records, and correctly +describes this in the table, __process_error() will silently fail as it +is unable to allocate more than PAGE_SIZE. + +Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory +may fault and be fixed up by vmalloc_fault(). To prevent this call +vmalloc_sync_all() before an NMI handler could discover the memory. + +Signed-off-by: James Morse +Reviewed-by: Borislav Petkov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 9c31c7cd5cb5e..cd6fae6ad4c2a 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -170,40 +170,40 @@ static int ghes_estatus_pool_init(void) + return 0; + } + +-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool, ++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool, + struct gen_pool_chunk *chunk, + void *data) + { +- free_page(chunk->start_addr); ++ vfree((void *)chunk->start_addr); + } + + static void ghes_estatus_pool_exit(void) + { + gen_pool_for_each_chunk(ghes_estatus_pool, +- ghes_estatus_pool_free_chunk_page, NULL); ++ ghes_estatus_pool_free_chunk, NULL); + gen_pool_destroy(ghes_estatus_pool); + } + + static int ghes_estatus_pool_expand(unsigned long len) + { +- unsigned long i, pages, size, addr; +- int ret; ++ unsigned long size, addr; + + ghes_estatus_pool_size_request += PAGE_ALIGN(len); + size = gen_pool_size(ghes_estatus_pool); + if (size >= ghes_estatus_pool_size_request) + return 0; +- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE; +- for (i = 0; i < pages; i++) { +- addr = __get_free_page(GFP_KERNEL); +- if (!addr) +- return -ENOMEM; +- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1); +- if (ret) +- return ret; +- } + +- return 0; ++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len)); ++ if (!addr) ++ return -ENOMEM; ++ ++ /* ++ * New allocation must be visible in all pgd before it can be found by ++ * an NMI allocating from the pool. ++ */ ++ vmalloc_sync_all(); ++ ++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); + } + + static int map_gen_v2(struct ghes *ghes) +-- +2.20.1 + diff --git a/queue-4.14/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch b/queue-4.14/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch new file mode 100644 index 00000000000..b82f9d1c3de --- /dev/null +++ b/queue-4.14/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch @@ -0,0 +1,54 @@ +From fdefbc672139f51cf5e1793012940d0bd3f52cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Dec 2018 13:59:24 +0100 +Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value + +From: Hans de Goede + +[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ] + +Ignore acpi_device_fix_up_power() return value. If we return an error +we end up with acpi_default_enumeration() still creating a platform- +device for the device and we end up with the device still being used +but without the special LPSS related handling which is not useful. + +Specicifically ignoring the error fixes the touchscreen no longer +working after a suspend/resume on a Prowise PT301 tablet. + +This tablet has a broken _PS0 method on the touchscreen's I2C controller, +causing acpi_device_fix_up_power() to fail, causing fallback to standard +platform-dev handling and specifically causing acpi_lpss_save/restore_ctx +to not run. + +The I2C controllers _PS0 method does actually turn on the device, but then +does some more nonsense which fails when run during early boot trying to +use I2C opregion handling on another not-yet registered I2C controller. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_lpss.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 1ab8d7223b252..84b1d30f699cf 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -518,12 +518,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev, + * have _PS0 and _PS3 without _PSC (and no power resources), so + * acpi_bus_init_power() will assume that the BIOS has put them into D0. + */ +- ret = acpi_device_fix_up_power(adev); +- if (ret) { +- /* Skip the device, but continue the namespace scan. */ +- ret = 0; +- goto err_out; +- } ++ acpi_device_fix_up_power(adev); + + adev->driver_data = pdata; + pdev = acpi_create_platform_device(adev, dev_desc->properties); +-- +2.20.1 + diff --git a/queue-4.14/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch b/queue-4.14/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch new file mode 100644 index 00000000000..e1f019ad43d --- /dev/null +++ b/queue-4.14/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch @@ -0,0 +1,43 @@ +From b93a297f8f8facb012d5483461c07a521fbaaeb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Feb 2019 10:21:23 +0000 +Subject: apparmor: delete the dentry in aafs_remove() to avoid a leak + +From: Chris Coulson + +[ Upstream commit 201218e4d3dfa1346e30997f48725acce3f26d01 ] + +Although the apparmorfs dentries are always dropped from the dentry cache +when the usage count drops to zero, there is no guarantee that this will +happen in aafs_remove(), as another thread might still be using it. In +this scenario, this means that the dentry will temporarily continue to +appear in the results of lookups, even after the call to aafs_remove(). + +In the case of removal of a profile - it also causes simple_rmdir() +on the profile directory to fail, as the directory won't be empty until +the usage counts of all child dentries have decreased to zero. This +results in the dentry for the profile directory leaking and appearing +empty in the file system tree forever. + +Signed-off-by: Chris Coulson +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/apparmorfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index dd746bd69a9b2..c106988c1b254 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -363,6 +363,7 @@ static void aafs_remove(struct dentry *dentry) + simple_rmdir(dir, dentry); + else + simple_unlink(dir, dentry); ++ d_delete(dentry); + dput(dentry); + } + inode_unlock(dir); +-- +2.20.1 + diff --git a/queue-4.14/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch b/queue-4.14/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch new file mode 100644 index 00000000000..260c07fb578 --- /dev/null +++ b/queue-4.14/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch @@ -0,0 +1,70 @@ +From bf92ffc9e6ca7eeabd4e9305aa771f6f7c5dd5b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:04:16 +0100 +Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ] + +If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART +is used for the debug output. If however debugging is off don't only +hide the then unused config item but drop it completely by using a +dependency instead of a conditional prompt. + +This fixes DEBUG_IMX_UART_PORT being present in the kernel config even +if DEBUG_LL is disabled. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig.debug | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index 954ba8b810521..fd4b679945d3a 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -1376,21 +1376,21 @@ config DEBUG_OMAP2PLUS_UART + depends on ARCH_OMAP2PLUS + + config DEBUG_IMX_UART_PORT +- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \ +- DEBUG_IMX25_UART || \ +- DEBUG_IMX21_IMX27_UART || \ +- DEBUG_IMX31_UART || \ +- DEBUG_IMX35_UART || \ +- DEBUG_IMX50_UART || \ +- DEBUG_IMX51_UART || \ +- DEBUG_IMX53_UART || \ +- DEBUG_IMX6Q_UART || \ +- DEBUG_IMX6SL_UART || \ +- DEBUG_IMX6SX_UART || \ +- DEBUG_IMX6UL_UART || \ +- DEBUG_IMX7D_UART ++ int "i.MX Debug UART Port Selection" ++ depends on DEBUG_IMX1_UART || \ ++ DEBUG_IMX25_UART || \ ++ DEBUG_IMX21_IMX27_UART || \ ++ DEBUG_IMX31_UART || \ ++ DEBUG_IMX35_UART || \ ++ DEBUG_IMX50_UART || \ ++ DEBUG_IMX51_UART || \ ++ DEBUG_IMX53_UART || \ ++ DEBUG_IMX6Q_UART || \ ++ DEBUG_IMX6SL_UART || \ ++ DEBUG_IMX6SX_UART || \ ++ DEBUG_IMX6UL_UART || \ ++ DEBUG_IMX7D_UART + default 1 +- depends on ARCH_MXC + help + Choose UART port on which kernel low-level debug messages + should be output. +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-fix-up-sq201-flash-access.patch b/queue-4.14/arm-dts-fix-up-sq201-flash-access.patch new file mode 100644 index 00000000000..87ac587fc01 --- /dev/null +++ b/queue-4.14/arm-dts-fix-up-sq201-flash-access.patch @@ -0,0 +1,78 @@ +From 55f80080dc2729bba711aa64f34f282cee5b49bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 09:00:51 +0200 +Subject: ARM: dts: Fix up SQ201 flash access + +From: Linus Walleij + +[ Upstream commit d88b11ef91b15d0af9c0676cbf4f441a0dff0c56 ] + +This sets the partition information on the SQ201 to be read +out from the RedBoot partition table, removes the static +partition table and sets our boot options to mount root from +/dev/mtdblock2 where the squashfs+JFFS2 resides. + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/gemini-sq201.dts | 37 ++++-------------------------- + 1 file changed, 5 insertions(+), 32 deletions(-) + +diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts +index 63c02ca9513c4..e9e2f6ff0c583 100644 +--- a/arch/arm/boot/dts/gemini-sq201.dts ++++ b/arch/arm/boot/dts/gemini-sq201.dts +@@ -20,7 +20,7 @@ + }; + + chosen { +- bootargs = "console=ttyS0,115200n8"; ++ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait"; + stdout-path = &uart0; + }; + +@@ -71,37 +71,10 @@ + /* 16MB of flash */ + reg = <0x30000000 0x01000000>; + +- partition@0 { +- label = "RedBoot"; +- reg = <0x00000000 0x00120000>; +- read-only; +- }; +- partition@120000 { +- label = "Kernel"; +- reg = <0x00120000 0x00200000>; +- }; +- partition@320000 { +- label = "Ramdisk"; +- reg = <0x00320000 0x00600000>; +- }; +- partition@920000 { +- label = "Application"; +- reg = <0x00920000 0x00600000>; +- }; +- partition@f20000 { +- label = "VCTL"; +- reg = <0x00f20000 0x00020000>; +- read-only; +- }; +- partition@f40000 { +- label = "CurConf"; +- reg = <0x00f40000 0x000a0000>; +- read-only; +- }; +- partition@fe0000 { +- label = "FIS directory"; +- reg = <0x00fe0000 0x00020000>; +- read-only; ++ partitions { ++ compatible = "redboot-fis"; ++ /* Eraseblock at 0xfe0000 */ ++ fis-index-block = <0x1fc>; + }; + }; + +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch b/queue-4.14/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch new file mode 100644 index 00000000000..7301b973cf9 --- /dev/null +++ b/queue-4.14/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch @@ -0,0 +1,44 @@ +From 17eedb80dad717784060a51f66a037584dc12d11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 16:10:01 -0200 +Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication + +From: Fabio Estevam + +[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ] + +imx53-voipac-dmm-668 has two memory nodes, but the correct representation +would be to use a single one with two reg entries - one for each RAM chip +select, so fix it accordingly. + +Reported-by: Marco Franchi +Signed-off-by: Fabio Estevam +Signed-off-by: Marco Franchi +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi +index df8dafe2564dd..2297ed90ee895 100644 +--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi ++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi +@@ -17,12 +17,8 @@ + + memory@70000000 { + device_type = "memory"; +- reg = <0x70000000 0x20000000>; +- }; +- +- memory@b0000000 { +- device_type = "memory"; +- reg = <0xb0000000 0x20000000>; ++ reg = <0x70000000 0x20000000>, ++ <0xb0000000 0x20000000>; + }; + + regulators { +-- +2.20.1 + diff --git a/queue-4.14/arm-ks8695-fix-section-mismatch-warning.patch b/queue-4.14/arm-ks8695-fix-section-mismatch-warning.patch new file mode 100644 index 00000000000..0b9dd366781 --- /dev/null +++ b/queue-4.14/arm-ks8695-fix-section-mismatch-warning.patch @@ -0,0 +1,38 @@ +From 6b159afcd5574310742a0ee6a259e3f18db5ba72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 22:58:38 +0100 +Subject: ARM: ks8695: fix section mismatch warning + +From: Arnd Bergmann + +[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ] + +WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown) +The function acs5k_i2c_init() references +the (unknown reference) __initdata (unknown). +This is often because acs5k_i2c_init lacks a __initdata +annotation or the annotation of (unknown) is wrong. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-ks8695/board-acs5k.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c +index e4d709c8ed32f..76d3083f1f634 100644 +--- a/arch/arm/mach-ks8695/board-acs5k.c ++++ b/arch/arm/mach-ks8695/board-acs5k.c +@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = { + }, + }; + +-static void acs5k_i2c_init(void) ++static void __init acs5k_i2c_init(void) + { + /* The gpio interface */ + platform_device_register(&acs5k_i2c_device); +-- +2.20.1 + diff --git a/queue-4.14/arm-omap1-fix-usb-configuration-for-device-only-setu.patch b/queue-4.14/arm-omap1-fix-usb-configuration-for-device-only-setu.patch new file mode 100644 index 00000000000..4ace4c80fdc --- /dev/null +++ b/queue-4.14/arm-omap1-fix-usb-configuration-for-device-only-setu.patch @@ -0,0 +1,51 @@ +From 9d512d5064b9bac4d613a4383db7c4e6144d0a2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 19:57:42 +0200 +Subject: ARM: OMAP1: fix USB configuration for device-only setups + +From: Aaro Koskinen + +[ Upstream commit c7b7b5cbd0c859b1546a5a3455d457708bdadf4c ] + +Currently we do USB configuration only if the host mode (CONFIG_USB) +is enabled. But it should be done also in the case of device-only setups, +so change the condition to CONFIG_USB_SUPPORT. This allows to use +omap_udc on Palm Tungsten E. + +Signed-off-by: Aaro Koskinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/Makefile | 2 +- + arch/arm/mach-omap1/include/mach/usb.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile +index e8ccf51c6f292..ec0235899de20 100644 +--- a/arch/arm/mach-omap1/Makefile ++++ b/arch/arm/mach-omap1/Makefile +@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y) + + led-y := leds.o + +-usb-fs-$(CONFIG_USB) := usb.o ++usb-fs-$(CONFIG_USB_SUPPORT) := usb.o + obj-y += $(usb-fs-m) $(usb-fs-y) + + # Specific board support +diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h +index 77867778d4ec7..5429d86c7190d 100644 +--- a/arch/arm/mach-omap1/include/mach/usb.h ++++ b/arch/arm/mach-omap1/include/mach/usb.h +@@ -11,7 +11,7 @@ + + #include + +-#if IS_ENABLED(CONFIG_USB) ++#if IS_ENABLED(CONFIG_USB_SUPPORT) + void omap1_usb_init(struct omap_usb_config *pdata); + #else + static inline void omap1_usb_init(struct omap_usb_config *pdata) +-- +2.20.1 + diff --git a/queue-4.14/arm64-mm-prevent-mismatched-52-bit-va-support.patch b/queue-4.14/arm64-mm-prevent-mismatched-52-bit-va-support.patch new file mode 100644 index 00000000000..66e40f4b829 --- /dev/null +++ b/queue-4.14/arm64-mm-prevent-mismatched-52-bit-va-support.patch @@ -0,0 +1,101 @@ +From 0fe8222bd59729d46bc3122266be0caa04fcdfc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 22:50:40 +0000 +Subject: arm64: mm: Prevent mismatched 52-bit VA support + +From: Steve Capper + +[ Upstream commit a96a33b1ca57dbea4285893dedf290aeb8eb090b ] + +For cases where there is a mismatch in ARMv8.2-LVA support between CPUs +we have to be careful in allowing secondary CPUs to boot if 52-bit +virtual addresses have already been enabled on the boot CPU. + +This patch adds code to the secondary startup path. If the boot CPU has +enabled 52-bit VAs then ID_AA64MMFR2_EL1 is checked to see if the +secondary can also enable 52-bit support. If not, the secondary is +prevented from booting and an error message is displayed indicating why. + +Technically this patch could be implemented using the cpufeature code +when considering 52-bit userspace support. However, we employ low level +checks here as the cpufeature code won't be able to run if we have +mismatched 52-bit kernel va support. + +Signed-off-by: Steve Capper +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/head.S | 26 ++++++++++++++++++++++++++ + arch/arm64/kernel/smp.c | 5 +++++ + 2 files changed, 31 insertions(+) + +diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S +index 92cc7b51f1002..9c00fd2acc2a4 100644 +--- a/arch/arm64/kernel/head.S ++++ b/arch/arm64/kernel/head.S +@@ -594,6 +594,7 @@ secondary_startup: + /* + * Common entry point for secondary CPUs. + */ ++ bl __cpu_secondary_check52bitva + bl __cpu_setup // initialise processor + bl __enable_mmu + ldr x8, =__secondary_switched +@@ -668,6 +669,31 @@ ENTRY(__enable_mmu) + ret + ENDPROC(__enable_mmu) + ++ENTRY(__cpu_secondary_check52bitva) ++#ifdef CONFIG_ARM64_52BIT_VA ++ ldr_l x0, vabits_user ++ cmp x0, #52 ++ b.ne 2f ++ ++ mrs_s x0, SYS_ID_AA64MMFR2_EL1 ++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT) ++ cbnz x0, 2f ++ ++ adr_l x0, va52mismatch ++ mov w1, #1 ++ strb w1, [x0] ++ dmb sy ++ dc ivac, x0 // Invalidate potentially stale cache line ++ ++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1 ++1: wfe ++ wfi ++ b 1b ++ ++#endif ++2: ret ++ENDPROC(__cpu_secondary_check52bitva) ++ + __no_granule_support: + /* Indicate that this CPU can't boot and is stuck in the kernel */ + update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2 +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index a683cd4995157..0881dfab10f8f 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -106,6 +106,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle) + } + + static DECLARE_COMPLETION(cpu_running); ++bool va52mismatch __ro_after_init; + + int __cpu_up(unsigned int cpu, struct task_struct *idle) + { +@@ -135,6 +136,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + + if (!cpu_online(cpu)) { + pr_crit("CPU%u: failed to come online\n", cpu); ++ ++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch) ++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu); ++ + ret = -EIO; + } + } else { +-- +2.20.1 + diff --git a/queue-4.14/arm64-smp-handle-errors-reported-by-the-firmware.patch b/queue-4.14/arm64-smp-handle-errors-reported-by-the-firmware.patch new file mode 100644 index 00000000000..e7391dfbab7 --- /dev/null +++ b/queue-4.14/arm64-smp-handle-errors-reported-by-the-firmware.patch @@ -0,0 +1,39 @@ +From 9c749f7cf8eb255be0d259acc7c15c83e6404351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 18:07:33 +0000 +Subject: arm64: smp: Handle errors reported by the firmware + +From: Suzuki K Poulose + +[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ] + +The __cpu_up() routine ignores the errors reported by the firmware +for a CPU bringup operation and looks for the error status set by the +booting CPU. If the CPU never entered the kernel, we could end up +in assuming stale error status, which otherwise would have been +set/cleared appropriately by the booting CPU. + +Reported-by: Steve Capper +Cc: Will Deacon +Signed-off-by: Suzuki K Poulose +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/smp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 0881dfab10f8f..909bf3926fd23 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -144,6 +144,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + } + } else { + pr_err("CPU%u: failed to boot: %d\n", cpu, ret); ++ return ret; + } + + secondary_data.task = NULL; +-- +2.20.1 + diff --git a/queue-4.14/asoc-compress-fix-unsigned-integer-overflow-check.patch b/queue-4.14/asoc-compress-fix-unsigned-integer-overflow-check.patch new file mode 100644 index 00000000000..ef38cd7cbb1 --- /dev/null +++ b/queue-4.14/asoc-compress-fix-unsigned-integer-overflow-check.patch @@ -0,0 +1,38 @@ +From 38a07a11b977c8c5325c9faca4a0c5ced2678a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2019 10:54:32 +0100 +Subject: ASoC: compress: fix unsigned integer overflow check + +From: Xiaojun Sang + +[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ] + +Parameter fragments and fragment_size are type of u32. U32_MAX is +the correct check. + +Signed-off-by: Xiaojun Sang +Signed-off-by: Srinivas Kandagatla +Acked-by: Vinod Koul +Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 2e2d184684911..7ae8e24dc1e61 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size || + params->buffer.fragments == 0) + return -EINVAL; + +-- +2.20.1 + diff --git a/queue-4.14/asoc-kirkwood-fix-external-clock-probe-defer.patch b/queue-4.14/asoc-kirkwood-fix-external-clock-probe-defer.patch new file mode 100644 index 00000000000..45d516741db --- /dev/null +++ b/queue-4.14/asoc-kirkwood-fix-external-clock-probe-defer.patch @@ -0,0 +1,51 @@ +From 946112e2b3f9aabaf1016f4a0f7b8d34a6275cb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 14:46:44 +0100 +Subject: ASoC: kirkwood: fix external clock probe defer + +From: Russell King + +[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ] + +When our call to get the external clock fails, we forget to clean up +the enabled internal clock correctly. Enable the clock after we have +obtained all our resources. + +Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time") +Signed-off-by: Russell King +Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c +index 105a73cc51585..149b7cba10fb7 100644 +--- a/sound/soc/kirkwood/kirkwood-i2s.c ++++ b/sound/soc/kirkwood/kirkwood-i2s.c +@@ -569,10 +569,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk); + } + +- err = clk_prepare_enable(priv->clk); +- if (err < 0) +- return err; +- + priv->extclk = devm_clk_get(&pdev->dev, "extclk"); + if (IS_ERR(priv->extclk)) { + if (PTR_ERR(priv->extclk) == -EPROBE_DEFER) +@@ -588,6 +584,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + } + } + ++ err = clk_prepare_enable(priv->clk); ++ if (err < 0) ++ return err; ++ + /* Some sensible defaults - this reflects the powerup values */ + priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24; + priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24; +-- +2.20.1 + diff --git a/queue-4.14/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch b/queue-4.14/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch new file mode 100644 index 00000000000..74cd29df7da --- /dev/null +++ b/queue-4.14/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch @@ -0,0 +1,56 @@ +From f65f4bfe40d6c152f42ffebf8b9becf087821484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Oct 2019 17:30:06 +0200 +Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX + +From: Stephan Gerhold + +[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ] + +According to the PM8916 Hardware Register Description, +CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL) +to switch between RX1 (0) and RX2 (1). It is not possible to +disable it entirely to achieve the "ZERO" state. + +However, at the moment the "RDAC2 MUX" mixer defines three possible +values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO" +actually configures it to RX1. Setting the mixer to "RX1" has +(seemingly) no effect. + +Remove "ZERO" and replace it with "RX1" to fix this. + +Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec") +Signed-off-by: Stephan Gerhold +Acked-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/msm8916-wcd-analog.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 0b9b014b4bb6c..969283737787f 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv { + }; + + static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" }; +-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" }; ++static const char *const rdac2_mux_text[] = { "RX1", "RX2" }; + static const char *const hph_text[] = { "ZERO", "Switch", }; + + static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT( +@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT( + + /* RDAC2 MUX */ + static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE( +- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text); ++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text); + + static const struct snd_kcontrol_new spkr_switch[] = { + SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0) +-- +2.20.1 + diff --git a/queue-4.14/ath6kl-fix-off-by-one-error-in-scan-completion.patch b/queue-4.14/ath6kl-fix-off-by-one-error-in-scan-completion.patch new file mode 100644 index 00000000000..c3a3cc40560 --- /dev/null +++ b/queue-4.14/ath6kl-fix-off-by-one-error-in-scan-completion.patch @@ -0,0 +1,38 @@ +From aa612ac7317ebec6e67374d9877fc3f45c67f824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 09:43:13 +0200 +Subject: ath6kl: Fix off by one error in scan completion + +From: Kyle Roeschley + +[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ] + +When ath6kl was reworked to share code between regular and scheduled scans +in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"), +probed SSID entry changed from 1-index to 0-indexed. However, +ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its +indexing so that we correctly clear out the probed SSID list. + +Signed-off-by: Kyle Roeschley +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c +index f790d8021fa17..37deb9bae3643 100644 +--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c ++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c +@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted) + if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) { + for (i = 0; i < vif->scan_req->n_ssids; i++) { + ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx, +- i + 1, DISABLE_SSID_FLAG, ++ i, DISABLE_SSID_FLAG, + 0, NULL); + } + } +-- +2.20.1 + diff --git a/queue-4.14/ath6kl-only-use-match-sets-when-firmware-supports-it.patch b/queue-4.14/ath6kl-only-use-match-sets-when-firmware-supports-it.patch new file mode 100644 index 00000000000..8279c8970dd --- /dev/null +++ b/queue-4.14/ath6kl-only-use-match-sets-when-firmware-supports-it.patch @@ -0,0 +1,40 @@ +From 12c07ce28bf9d5caeb68d6229249cf408c5eeea4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 09:43:11 +0200 +Subject: ath6kl: Only use match sets when firmware supports it + +From: Kyle Roeschley + +[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ] + +Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan") +merged the probed and matched SSID lists before sending them to the +firmware. In the process, it assumed match set support is always available +in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check +that the firmware supports matching SSIDs in scheduled scans before setting +MATCH_SSID_FLAG. + +Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan") +Signed-off-by: Kyle Roeschley +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c +index 414b5b596efcd..f790d8021fa17 100644 +--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c ++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c +@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar, + else + ssid_list[i].flag = ANY_SSID_FLAG; + +- if (n_match_ssid == 0) ++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0) + ssid_list[i].flag |= MATCH_SSID_FLAG; + } + +-- +2.20.1 + diff --git a/queue-4.14/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch b/queue-4.14/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch new file mode 100644 index 00000000000..fd78056109b --- /dev/null +++ b/queue-4.14/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch @@ -0,0 +1,37 @@ +From dbe78740d7c4049723a9dcf67784f6f9bd2ce450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Dec 2018 22:23:19 -0600 +Subject: atl1e: checking the status of atl1e_write_phy_reg + +From: Kangjie Lu + +[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ] + +atl1e_write_phy_reg() could fail. The fix issues an error message when +it fails. + +Signed-off-by: Kangjie Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +index 4f7e195af0bc6..0d08039981b54 100644 +--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +@@ -472,7 +472,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id, + { + struct atl1e_adapter *adapter = netdev_priv(netdev); + +- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val); ++ if (atl1e_write_phy_reg(&adapter->hw, ++ reg_num & MDIO_REG_ADDR_MASK, val)) ++ netdev_err(netdev, "write phy register failed\n"); + } + + static int atl1e_mii_ioctl(struct net_device *netdev, +-- +2.20.1 + diff --git a/queue-4.14/blktrace-show-requests-without-sector.patch b/queue-4.14/blktrace-show-requests-without-sector.patch new file mode 100644 index 00000000000..a375f8c3731 --- /dev/null +++ b/queue-4.14/blktrace-show-requests-without-sector.patch @@ -0,0 +1,45 @@ +From 223f696268e24c742343dc513f15a467bcfa9d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Feb 2019 11:55:39 +0100 +Subject: blktrace: Show requests without sector + +From: Jan Kara + +[ Upstream commit 0803de78049fe1b0baf44bcddc727b036fb9139b ] + +Currently, blktrace will not show requests that don't have any data as +rq->__sector is initialized to -1 which is out of device range and thus +discarded by act_log_check(). This is most notably the case for cache +flush requests sent to the device. Fix the problem by making +blk_rq_trace_sector() return 0 for requests without initialized sector. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: Jan Kara +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blktrace_api.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h +index 8804753805ac5..7bb2d8de9f308 100644 +--- a/include/linux/blktrace_api.h ++++ b/include/linux/blktrace_api.h +@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes); + + static inline sector_t blk_rq_trace_sector(struct request *rq) + { +- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq); ++ /* ++ * Tracing should ignore starting sector for passthrough requests and ++ * requests where starting sector didn't get set. ++ */ ++ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1) ++ return 0; ++ return blk_rq_pos(rq); + } + + static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq) +-- +2.20.1 + diff --git a/queue-4.14/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch b/queue-4.14/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch new file mode 100644 index 00000000000..fd9119cac72 --- /dev/null +++ b/queue-4.14/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch @@ -0,0 +1,35 @@ +From dcd55fa9c98a58b35d1f5cddbc4c4108698d3528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 10:48:47 +0300 +Subject: block: drbd: remove a stray unlock in __drbd_send_protocol() + +From: Dan Carpenter + +[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ] + +There are two callers of this function and they both unlock the mutex so +this ends up being a double unlock. + +Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf") +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 8cb3791898ae9..7ea13b5497fdc 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -795,7 +795,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm + + if (nc->tentative && connection->agreed_pro_version < 92) { + rcu_read_unlock(); +- mutex_unlock(&sock->mutex); + drbd_err(connection, "--dry-run is not supported by peer"); + return -EOPNOTSUPP; + } +-- +2.20.1 + diff --git a/queue-4.14/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch b/queue-4.14/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch new file mode 100644 index 00000000000..82a7ca9d914 --- /dev/null +++ b/queue-4.14/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch @@ -0,0 +1,84 @@ +From 1ffd1d8ddca5fe17f268820aea971da0b4d5ab7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Dec 2018 12:22:28 +0100 +Subject: Bluetooth: hci_bcm: Handle specific unknown packets after firmware + loading +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Bakker + +[ Upstream commit 22bba80500fdf624a7cfbb65fdfa97a038ae224d ] + +The Broadcom controller on aries S5PV210 boards sends out a couple of +unknown packets after the firmware is loaded. This will cause +logging of errors such as: + Bluetooth: hci0: Frame reassembly failed (-84) + +This is probably also the case with other boards, as there are related +Android userspace patches for custom ROMs such as +https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/ +Since this appears to be intended behaviour, treated them as diagnostic +packets. + +Note that this is another variant of commit 01d5e44ace8a +("Bluetooth: hci_bcm: Handle empty packet after firmware loading") + +Signed-off-by: Jonathan Bakker +Signed-off-by: Paweł Chmiel +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 6d41b2023f09d..61971ddbd2313 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -50,6 +50,12 @@ + #define BCM_LM_DIAG_PKT 0x07 + #define BCM_LM_DIAG_SIZE 63 + ++#define BCM_TYPE49_PKT 0x31 ++#define BCM_TYPE49_SIZE 0 ++ ++#define BCM_TYPE52_PKT 0x34 ++#define BCM_TYPE52_SIZE 0 ++ + #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */ + + /* platform device driver resources */ +@@ -483,12 +489,28 @@ finalize: + .lsize = 0, \ + .maxlen = BCM_NULL_SIZE + ++#define BCM_RECV_TYPE49 \ ++ .type = BCM_TYPE49_PKT, \ ++ .hlen = BCM_TYPE49_SIZE, \ ++ .loff = 0, \ ++ .lsize = 0, \ ++ .maxlen = BCM_TYPE49_SIZE ++ ++#define BCM_RECV_TYPE52 \ ++ .type = BCM_TYPE52_PKT, \ ++ .hlen = BCM_TYPE52_SIZE, \ ++ .loff = 0, \ ++ .lsize = 0, \ ++ .maxlen = BCM_TYPE52_SIZE ++ + static const struct h4_recv_pkt bcm_recv_pkts[] = { + { H4_RECV_ACL, .recv = hci_recv_frame }, + { H4_RECV_SCO, .recv = hci_recv_frame }, + { H4_RECV_EVENT, .recv = hci_recv_frame }, + { BCM_RECV_LM_DIAG, .recv = hci_recv_diag }, + { BCM_RECV_NULL, .recv = hci_recv_diag }, ++ { BCM_RECV_TYPE49, .recv = hci_recv_diag }, ++ { BCM_RECV_TYPE52, .recv = hci_recv_diag }, + }; + + static int bcm_recv(struct hci_uart *hu, const void *data, int count) +-- +2.20.1 + diff --git a/queue-4.14/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch b/queue-4.14/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch new file mode 100644 index 00000000000..36f44781bdd --- /dev/null +++ b/queue-4.14/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch @@ -0,0 +1,68 @@ +From f0791ad411ffa7637db6f8db728415d754a4ccc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Dec 2018 18:46:31 -0500 +Subject: bnxt_en: query force speeds before disabling autoneg mode. + +From: Vasundhara Volam + +[ Upstream commit 56d374624778652d2a999e18c87a25338b127b41 ] + +With autoneg enabled, PHY loopback test fails. To disable autoneg, +driver needs to send a valid forced speed to FW. FW is not sending +async event for invalid speeds. To fix this, query forced speeds +and send the correct speed when disabling autoneg mode. + +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 22 ++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 4879371ad0c75..fc8e185718a1d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2258,17 +2258,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable) + return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); + } + ++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds) ++{ ++ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr; ++ struct hwrm_port_phy_qcaps_input req = {0}; ++ int rc; ++ ++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1); ++ mutex_lock(&bp->hwrm_cmd_lock); ++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (!rc) ++ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode); ++ ++ mutex_unlock(&bp->hwrm_cmd_lock); ++ return rc; ++} ++ + static int bnxt_disable_an_for_lpbk(struct bnxt *bp, + struct hwrm_port_phy_cfg_input *req) + { + struct bnxt_link_info *link_info = &bp->link_info; +- u16 fw_advertising = link_info->advertising; ++ u16 fw_advertising; + u16 fw_speed; + int rc; + + if (!link_info->autoneg) + return 0; + ++ rc = bnxt_query_force_speeds(bp, &fw_advertising); ++ if (rc) ++ return rc; ++ + fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB; + if (netif_carrier_ok(bp->dev)) + fw_speed = bp->link_info.link_speed; +-- +2.20.1 + diff --git a/queue-4.14/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch b/queue-4.14/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch new file mode 100644 index 00000000000..f526127db5c --- /dev/null +++ b/queue-4.14/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch @@ -0,0 +1,149 @@ +From 4abbc4bb4814dde76945a7984bdd18f28bc84493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Dec 2018 18:46:28 -0500 +Subject: bnxt_en: Return linux standard errors in bnxt_ethtool.c + +From: Vasundhara Volam + +[ Upstream commit 7c675421afef18253a86ffc383f57bc15ef32ea8 ] + +Currently firmware specific errors are returned directly in flash_device +and reset ethtool hooks. Modify it to return linux standard errors +to userspace when flashing operations fail. + +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 56 +++++++++++++------ + 1 file changed, 39 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index a22336fef66b2..4879371ad0c75 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1339,14 +1339,22 @@ static int bnxt_flash_nvram(struct net_device *dev, + rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT); + dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle); + ++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to flash the device\n"); ++ rc = -EACCES; ++ } else if (rc) { ++ rc = -EIO; ++ } + return rc; + } + + static int bnxt_firmware_reset(struct net_device *dev, + u16 dir_type) + { +- struct bnxt *bp = netdev_priv(dev); + struct hwrm_fw_reset_input req = {0}; ++ struct bnxt *bp = netdev_priv(dev); ++ int rc; + + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1); + +@@ -1380,7 +1388,15 @@ static int bnxt_firmware_reset(struct net_device *dev, + return -EINVAL; + } + +- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to reset the device\n"); ++ rc = -EACCES; ++ } else if (rc) { ++ rc = -EIO; ++ } ++ return rc; + } + + static int bnxt_flash_firmware(struct net_device *dev, +@@ -1587,9 +1603,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr; + struct hwrm_nvm_install_update_input install = {0}; + const struct firmware *fw; ++ int rc, hwrm_err = 0; + u32 item_len; + u16 index; +- int rc; + + bnxt_hwrm_fw_set_time(bp); + +@@ -1632,15 +1648,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + memcpy(kmem, fw->data, fw->size); + modify.host_src_addr = cpu_to_le64(dma_handle); + +- rc = hwrm_send_message(bp, &modify, sizeof(modify), +- FLASH_PACKAGE_TIMEOUT); ++ hwrm_err = hwrm_send_message(bp, &modify, ++ sizeof(modify), ++ FLASH_PACKAGE_TIMEOUT); + dma_free_coherent(&bp->pdev->dev, fw->size, kmem, + dma_handle); + } + } + release_firmware(fw); +- if (rc) +- return rc; ++ if (rc || hwrm_err) ++ goto err_exit; + + if ((install_type & 0xffff) == 0) + install_type >>= 16; +@@ -1648,12 +1665,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + install.install_type = cpu_to_le32(install_type); + + mutex_lock(&bp->hwrm_cmd_lock); +- rc = _hwrm_send_message(bp, &install, sizeof(install), +- INSTALL_PACKAGE_TIMEOUT); +- if (rc) { +- rc = -EOPNOTSUPP; ++ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install), ++ INSTALL_PACKAGE_TIMEOUT); ++ if (hwrm_err) + goto flash_pkg_exit; +- } + + if (resp->error_code) { + u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err; +@@ -1661,12 +1676,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) { + install.flags |= cpu_to_le16( + NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG); +- rc = _hwrm_send_message(bp, &install, sizeof(install), +- INSTALL_PACKAGE_TIMEOUT); +- if (rc) { +- rc = -EOPNOTSUPP; ++ hwrm_err = _hwrm_send_message(bp, &install, ++ sizeof(install), ++ INSTALL_PACKAGE_TIMEOUT); ++ if (hwrm_err) + goto flash_pkg_exit; +- } + } + } + +@@ -1677,6 +1691,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + } + flash_pkg_exit: + mutex_unlock(&bp->hwrm_cmd_lock); ++err_exit: ++ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { ++ netdev_info(dev, ++ "PF does not have admin privileges to flash the device\n"); ++ rc = -EACCES; ++ } else if (hwrm_err) { ++ rc = -EOPNOTSUPP; ++ } + return rc; + } + +-- +2.20.1 + diff --git a/queue-4.14/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch b/queue-4.14/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch new file mode 100644 index 00000000000..c5d1b616051 --- /dev/null +++ b/queue-4.14/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch @@ -0,0 +1,39 @@ +From a104dc7bff5fd874e344baec01b7f2c42246f287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Feb 2019 22:15:37 +0800 +Subject: bpf: decrease usercnt if bpf_map_new_fd() fails in + bpf_map_get_fd_by_id() + +From: Peng Sun + +[ Upstream commit 781e62823cb81b972dc8652c1827205cda2ac9ac ] + +In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero() +to increase the refcount, both map->refcnt and map->usercnt. Then, if +bpf_map_new_fd() fails, should handle map->usercnt too. + +Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID") +Signed-off-by: Peng Sun +Acked-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 59d2e94ecb798..34110450a78f2 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1354,7 +1354,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr) + + fd = bpf_map_new_fd(map); + if (fd < 0) +- bpf_map_put(map); ++ bpf_map_put_with_uref(map); + + return fd; + } +-- +2.20.1 + diff --git a/queue-4.14/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch b/queue-4.14/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch new file mode 100644 index 00000000000..ee13683f9f8 --- /dev/null +++ b/queue-4.14/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch @@ -0,0 +1,45 @@ +From bc241c6f67f1681bd88c8ca219b1eee9751647e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Feb 2019 22:36:25 +0800 +Subject: bpf: drop refcount if bpf_map_new_fd() fails in map_create() + +From: Peng Sun + +[ Upstream commit 352d20d611414715353ee65fc206ee57ab1a6984 ] + +In bpf/syscall.c, map_create() first set map->usercnt to 1, a file +descriptor is supposed to return to userspace. When bpf_map_new_fd() +fails, drop the refcount. + +Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID") +Signed-off-by: Peng Sun +Acked-by: Martin KaFai Lau +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 34110450a78f2..f5c1d5479ba3d 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -348,12 +348,12 @@ static int map_create(union bpf_attr *attr) + err = bpf_map_new_fd(map); + if (err < 0) { + /* failed to allocate fd. +- * bpf_map_put() is needed because the above ++ * bpf_map_put_with_uref() is needed because the above + * bpf_map_alloc_id() has published the map + * to the userspace and the userspace may + * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID. + */ +- bpf_map_put(map); ++ bpf_map_put_with_uref(map); + return err; + } + +-- +2.20.1 + diff --git a/queue-4.14/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch b/queue-4.14/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch new file mode 100644 index 00000000000..b6eadc6f32a --- /dev/null +++ b/queue-4.14/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch @@ -0,0 +1,66 @@ +From 9289021ff2982a31a50b6dfcb90744016f003a30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2019 20:54:28 +0100 +Subject: bridge: ebtables: don't crash when using dnat target in output chains +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Westphal + +[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ] + +xt_in() returns NULL in the output hook, skip the pkt_type change for +that case, redirection only makes sense in broute/prerouting hooks. + +Reported-by: Tom Yan +Cc: Linus Lüssing +Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c +index dfc86a0199dab..1d8c834d90189 100644 +--- a/net/bridge/netfilter/ebt_dnat.c ++++ b/net/bridge/netfilter/ebt_dnat.c +@@ -19,7 +19,6 @@ static unsigned int + ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_nat_info *info = par->targinfo; +- struct net_device *dev; + + if (!skb_make_writable(skb, 0)) + return EBT_DROP; +@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + else + skb->pkt_type = PACKET_MULTICAST; + } else { +- if (xt_hooknum(par) != NF_BR_BROUTING) +- dev = br_port_get_rcu(xt_in(par))->br->dev; +- else ++ const struct net_device *dev; ++ ++ switch (xt_hooknum(par)) { ++ case NF_BR_BROUTING: + dev = xt_in(par); ++ break; ++ case NF_BR_PRE_ROUTING: ++ dev = br_port_get_rcu(xt_in(par))->br->dev; ++ break; ++ default: ++ dev = NULL; ++ break; ++ } ++ ++ if (!dev) /* NF_BR_LOCAL_OUT */ ++ return info->target; + + if (ether_addr_equal(info->mac, dev->dev_addr)) + skb->pkt_type = PACKET_HOST; +-- +2.20.1 + diff --git a/queue-4.14/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch b/queue-4.14/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch new file mode 100644 index 00000000000..1257756104e --- /dev/null +++ b/queue-4.14/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch @@ -0,0 +1,51 @@ +From 1c842e3a835f418044547ca93dee77ac6fdbc428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 10:20:32 -0500 +Subject: btrfs: only track ref_heads in delayed_ref_updates + +From: Josef Bacik + +[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ] + +We use this number to figure out how many delayed refs to run, but +__btrfs_run_delayed_refs really only checks every time we need a new +delayed ref head, so we always run at least one ref head completely no +matter what the number of items on it. Fix the accounting to only be +adjusted when we add/remove a ref head. + +In addition to using this number to limit the number of delayed refs +run, a future patch is also going to use it to calculate the amount of +space required for delayed refs space reservation. + +Reviewed-by: Nikolay Borisov +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/delayed-ref.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c +index 93ffa898df6d8..d56bd36254681 100644 +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -195,8 +195,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans, + ref->in_tree = 0; + btrfs_put_delayed_ref(ref); + atomic_dec(&delayed_refs->num_entries); +- if (trans->delayed_ref_updates) +- trans->delayed_ref_updates--; + } + + static bool merge_ref(struct btrfs_trans_handle *trans, +@@ -458,7 +456,6 @@ add_tail: + if (ref->action == BTRFS_ADD_DELAYED_REF) + list_add_tail(&ref->add_list, &href->ref_add_list); + atomic_inc(&root->num_entries); +- trans->delayed_ref_updates++; + spin_unlock(&href->lock); + return ret; + } +-- +2.20.1 + diff --git a/queue-4.14/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch b/queue-4.14/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch new file mode 100644 index 00000000000..d2f321239b5 --- /dev/null +++ b/queue-4.14/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch @@ -0,0 +1,79 @@ +From 17996a0c9a42b575ae9acb16396c3a69ee6b047f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 21:01:20 +0000 +Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on + open + +From: Jeroen Hofstee + +[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ] + +When the CAN interface is closed it the hardwre is put in power down +mode, but does not reset the error counters / state. Reset the D_CAN on +open, so the reported state and the actual state match. + +According to [1], the C_CAN module doesn't have the software reset. + +[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf + +Signed-off-by: Jeroen Hofstee +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 9b61bfbea6cd1..24c6015f6c92b 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -52,6 +52,7 @@ + #define CONTROL_EX_PDR BIT(8) + + /* control register */ ++#define CONTROL_SWR BIT(15) + #define CONTROL_TEST BIT(7) + #define CONTROL_CCE BIT(6) + #define CONTROL_DISABLE_AR BIT(5) +@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev) + IF_MCONT_RCV_EOB); + } + ++static int c_can_software_reset(struct net_device *dev) ++{ ++ struct c_can_priv *priv = netdev_priv(dev); ++ int retry = 0; ++ ++ if (priv->type != BOSCH_D_CAN) ++ return 0; ++ ++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT); ++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) { ++ msleep(20); ++ if (retry++ > 100) { ++ netdev_err(dev, "CCTRL: software reset failed\n"); ++ return -EIO; ++ } ++ } ++ ++ return 0; ++} ++ + /* + * Configure C_CAN chip: + * - enable/disable auto-retransmission +@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev) + static int c_can_chip_config(struct net_device *dev) + { + struct c_can_priv *priv = netdev_priv(dev); ++ int err; ++ ++ err = c_can_software_reset(dev); ++ if (err) ++ return err; + + /* enable automatic retransmission */ + priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR); +-- +2.20.1 + diff --git a/queue-4.14/can-peak_usb-report-bus-recovery-as-well.patch b/queue-4.14/can-peak_usb-report-bus-recovery-as-well.patch new file mode 100644 index 00000000000..ae924bf957d --- /dev/null +++ b/queue-4.14/can-peak_usb-report-bus-recovery-as-well.patch @@ -0,0 +1,67 @@ +From 526b581809788aec69102532b23027317ec35130 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 08:58:45 +0000 +Subject: can: peak_usb: report bus recovery as well + +From: Jeroen Hofstee + +[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ] + +While the state changes are reported when the error counters increase +and decrease, there is no event when the bus recovers and the error +counters decrease again. So add those as well. + +Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING -> +ERROR_ACTIVE instead of directly to ERROR_ACTIVE again. + +Signed-off-by: Jeroen Hofstee +Cc: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c +index e626c2afbbb11..0e1fc6c4360e7 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c +@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) { + /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ new_state = CAN_STATE_ERROR_ACTIVE; ++ break; + } + break; + +@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + + if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) { +- /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ /* no error (back to warning state) */ ++ new_state = CAN_STATE_ERROR_WARNING; ++ break; + } + break; + +@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + mc->pdev->dev.can.can_stats.error_warning++; + break; + ++ case CAN_STATE_ERROR_ACTIVE: ++ cf->can_id |= CAN_ERR_CRTL; ++ cf->data[1] = CAN_ERR_CRTL_ACTIVE; ++ break; ++ + default: + /* CAN_STATE_MAX (trick to handle other errors) */ + cf->can_id |= CAN_ERR_CRTL; +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch b/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch new file mode 100644 index 00000000000..40a59807a29 --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch @@ -0,0 +1,55 @@ +From fd46a5f806fc17f4af3cbbbedf3ed338def11adc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 18:45:38 +0000 +Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error + +From: Marc Kleine-Budde + +[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ] + +In case of a resource shortage, i.e. the rx_offload queue will overflow +or a skb fails to be allocated (due to OOM), +can_rx_offload_offload_one() will call mailbox_read() to discard the +mailbox and return an ERR_PTR. + +If the hardware FIFO is empty can_rx_offload_offload_one() will return +NULL. + +In case a CAN frame was read from the hardware, +can_rx_offload_offload_one() returns the skb containing it. + +Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb +returned, regardless of the reason. + +Similar to can_rx_offload_irq_offload_timestamp() in case of a resource +shortage the whole FIFO should be discarded, to avoid an IRQ storm and +give the system some time to recover. However if the FIFO is empty the +loop can be left. + +With this patch the loop is left in case of empty FIFO, but not on +errors. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index fef6534f163b7..54ffd1e91a693 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -257,7 +257,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + + while (1) { + skb = can_rx_offload_offload_one(offload, 0); +- if (IS_ERR_OR_NULL(skb)) ++ if (IS_ERR(skb)) ++ continue; ++ if (!skb) + break; + + skb_queue_tail(&offload->skb_queue, skb); +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch b/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch new file mode 100644 index 00000000000..b3688fdc8e5 --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch @@ -0,0 +1,46 @@ +From f0b770f1423ae7b02ced86f09633a178d4b1d1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 18:45:38 +0000 +Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on + error + +From: Jeroen Hofstee + +[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ] + +In case of a resource shortage, i.e. the rx_offload queue will overflow +or a skb fails to be allocated (due to OOM), +can_rx_offload_offload_one() will call mailbox_read() to discard the +mailbox and return an ERR_PTR. + +However can_rx_offload_irq_offload_timestamp() bails out in the error +case. In case of a resource shortage all mailboxes should be discarded, +to avoid an IRQ storm and give the system some time to recover. + +Since can_rx_offload_irq_offload_timestamp() is typically called from a +while loop, all message will eventually be discarded. So let's continue +on error instead to discard them directly. + +Signed-off-by: Jeroen Hofstee +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 840aef094f208..fef6534f163b7 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -225,7 +225,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen + + skb = can_rx_offload_offload_one(offload, i); + if (IS_ERR_OR_NULL(skb)) +- break; ++ continue; + + __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); + } +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch new file mode 100644 index 00000000000..94790efc4eb --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch @@ -0,0 +1,43 @@ +From be459038ef0ea2e93303d469522461cd0e6fa16a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 16:03:18 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the + skb_queue beyond skb_queue_len_max + +From: Marc Kleine-Budde + +[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ] + +The skb_queue is a linked list, holding the skb to be processed in the +next NAPI call. + +Without this patch, the queue length in can_rx_offload_offload_one() is +limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no +array or other resources are accessed out-of-bound, however this +behaviour is counterintuitive. + +This patch limits the rx-offload skb_queue length to skb_queue_len_max. + +Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index b26987a136203..c0e51a2f8e4fc 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -124,7 +124,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload + int ret; + + /* If queue is full or skb not available, read to discard mailbox */ +- if (likely(skb_queue_len(&offload->skb_queue) <= ++ if (likely(skb_queue_len(&offload->skb_queue) < + offload->skb_queue_len_max)) + skb = alloc_can_skb(offload->dev, &cf); + +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_offload_one-increment-.patch b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-increment-.patch new file mode 100644 index 00000000000..a3c571e4853 --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-increment-.patch @@ -0,0 +1,40 @@ +From fbe3b8faceee3ac9358eec27f410bc71820e052b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:15:07 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): increment + rx_fifo_errors on queue overflow or OOM + +From: Marc Kleine-Budde + +[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ] + +If the rx-offload skb_queue is full or the skb allocation fails (due to OOM), +the mailbox contents is discarded. + +This patch adds the incrementing of the rx_fifo_errors statistics counter. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index c0e51a2f8e4fc..b068e2320c794 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -134,8 +134,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload + + ret = offload->mailbox_read(offload, &cf_overflow, + ×tamp, n); +- if (ret) ++ if (ret) { + offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ } + + return NULL; + } +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch new file mode 100644 index 00000000000..7416a5dbcf6 --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch @@ -0,0 +1,166 @@ +From 3111b4c925df84197cbbbc72b0625fa74a4b2893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 21:00:32 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to + propagate error value in case of errors + +From: Marc Kleine-Budde + +[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ] + +Before this patch can_rx_offload_offload_one() returns a pointer to a +skb containing the read CAN frame or a NULL pointer. + +However the meaning of the NULL pointer is ambiguous, it can either mean +the requested mailbox is empty or there was an error. + +This patch fixes this situation by returning: +- pointer to skb on success +- NULL pointer if mailbox is empty +- ERR_PTR() in case of an error + +All users of can_rx_offload_offload_one() have been adopted, no +functional change intended. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------ + 1 file changed, 73 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index b068e2320c794..840aef094f208 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -116,39 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b) + return cb_b->timestamp - cb_a->timestamp; + } + +-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) ++/** ++ * can_rx_offload_offload_one() - Read one CAN frame from HW ++ * @offload: pointer to rx_offload context ++ * @n: number of mailbox to read ++ * ++ * The task of this function is to read a CAN frame from mailbox @n ++ * from the device and return the mailbox's content as a struct ++ * sk_buff. ++ * ++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue ++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be ++ * allocated, the mailbox contents is discarded by reading it into an ++ * overflow buffer. This way the mailbox is marked as free by the ++ * driver. ++ * ++ * Return: A pointer to skb containing the CAN frame on success. ++ * ++ * NULL if the mailbox @n is empty. ++ * ++ * ERR_PTR() in case of an error ++ */ ++static struct sk_buff * ++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) + { +- struct sk_buff *skb = NULL; ++ struct sk_buff *skb = NULL, *skb_error = NULL; + struct can_rx_offload_cb *cb; + struct can_frame *cf; + int ret; + +- /* If queue is full or skb not available, read to discard mailbox */ + if (likely(skb_queue_len(&offload->skb_queue) < +- offload->skb_queue_len_max)) ++ offload->skb_queue_len_max)) { + skb = alloc_can_skb(offload->dev, &cf); ++ if (unlikely(!skb)) ++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */ ++ } else { ++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */ ++ } + +- if (!skb) { ++ /* If queue is full or skb not available, drop by reading into ++ * overflow buffer. ++ */ ++ if (unlikely(skb_error)) { + struct can_frame cf_overflow; + u32 timestamp; + + ret = offload->mailbox_read(offload, &cf_overflow, + ×tamp, n); +- if (ret) { +- offload->dev->stats.rx_dropped++; +- offload->dev->stats.rx_fifo_errors++; +- } + +- return NULL; ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) ++ return NULL; ++ ++ /* Mailbox has been read and we're dropping it or ++ * there was a problem reading the mailbox. ++ * ++ * Increment error counters in any case. ++ */ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ /* There was a problem reading the mailbox, propagate ++ * error value. ++ */ ++ if (unlikely(ret < 0)) ++ return ERR_PTR(ret); ++ ++ return skb_error; + } + + cb = can_rx_offload_get_cb(skb); + ret = offload->mailbox_read(offload, cf, &cb->timestamp, n); +- if (!ret) { ++ ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) { + kfree_skb(skb); + return NULL; + } + ++ /* There was a problem reading the mailbox, propagate error value. */ ++ if (unlikely(ret < 0)) { ++ kfree_skb(skb); ++ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ return ERR_PTR(ret); ++ } ++ ++ /* Mailbox was read. */ + return skb; + } + +@@ -168,7 +224,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen + continue; + + skb = can_rx_offload_offload_one(offload, i); +- if (!skb) ++ if (IS_ERR_OR_NULL(skb)) + break; + + __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); +@@ -199,7 +255,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + struct sk_buff *skb; + int received = 0; + +- while ((skb = can_rx_offload_offload_one(offload, 0))) { ++ while (1) { ++ skb = can_rx_offload_offload_one(offload, 0); ++ if (IS_ERR_OR_NULL(skb)) ++ break; ++ + skb_queue_tail(&offload->skb_queue, skb); + received++; + } +-- +2.20.1 + diff --git a/queue-4.14/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch b/queue-4.14/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch new file mode 100644 index 00000000000..0188ed1e4aa --- /dev/null +++ b/queue-4.14/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch @@ -0,0 +1,51 @@ +From f85cd602573e6b99d0b4bfc1effb03a8bec35763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:48:48 +0200 +Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling, + avoid skb mem leak + +From: Marc Kleine-Budde + +[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ] + +If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not +queue the skb and return with an error. + +This patch frees the skb in case of a full queue, which brings +can_rx_offload_queue_tail() in line with the +can_rx_offload_queue_sorted() function, which has been adjusted in the +previous patch. + +The return value is adjusted to -ENOBUFS to better reflect the actual +problem. + +The device stats handling is left to the caller. + +Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading") +Reported-by: Kurt Van Dijck +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 1a7c183e66783..b26987a136203 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -261,8 +261,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, + struct sk_buff *skb) + { + if (skb_queue_len(&offload->skb_queue) > +- offload->skb_queue_len_max) +- return -ENOMEM; ++ offload->skb_queue_len_max) { ++ kfree_skb(skb); ++ return -ENOBUFS; ++ } + + skb_queue_tail(&offload->skb_queue, skb); + can_rx_offload_schedule(offload); +-- +2.20.1 + diff --git a/queue-4.14/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch b/queue-4.14/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch new file mode 100644 index 00000000000..dd048562e50 --- /dev/null +++ b/queue-4.14/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch @@ -0,0 +1,63 @@ +From 7e1011d1db1e7806bfd6f4b173e48b1a73066f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 09:39:32 -0500 +Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support + +From: Jeff Layton + +[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ] + +If someone requests fscache on the mount, and the kernel doesn't +support it, it should fail the mount. + +[ Drop ceph prefix -- it's provided by pr_err. ] + +Signed-off-by: Jeff Layton +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/super.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index f0694293b31a2..088c4488b4492 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -232,6 +232,7 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + break; + case Opt_fscache_uniq: ++#ifdef CONFIG_CEPH_FSCACHE + kfree(fsopt->fscache_uniq); + fsopt->fscache_uniq = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, +@@ -240,7 +241,10 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + break; +- /* misc */ ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_wsize: + if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + return -EINVAL; +@@ -312,8 +316,13 @@ static int parse_fsopt_token(char *c, void *private) + fsopt->flags &= ~CEPH_MOUNT_OPT_INO32; + break; + case Opt_fscache: ++#ifdef CONFIG_CEPH_FSCACHE + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + break; ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_nofscache: + fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE; + break; +-- +2.20.1 + diff --git a/queue-4.14/clk-at91-avoid-sleeping-early.patch b/queue-4.14/clk-at91-avoid-sleeping-early.patch new file mode 100644 index 00000000000..cce0af71f51 --- /dev/null +++ b/queue-4.14/clk-at91-avoid-sleeping-early.patch @@ -0,0 +1,104 @@ +From 0d34b914337dfb852c8ee27ae16445dc4d5221ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 17:39:06 +0200 +Subject: clk: at91: avoid sleeping early +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ] + +It is not allowed to sleep to early in the boot process and this may lead +to kernel issues if the bootloader didn't prepare the slow clock and main +clock. + +This results in the following error and dump stack on the AriettaG25: + bad: scheduling from the idle thread! + +Ensure it is possible to sleep, else simply have a delay. + +Reported-by: Uwe Kleine-König +Signed-off-by: Alexandre Belloni +Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com +Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver") +Tested-by: Uwe Kleine-König +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-main.c | 5 ++++- + drivers/clk/at91/sckc.c | 20 ++++++++++++++++---- + 2 files changed, 20 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c +index 2f97a843d6d6b..fb5c14af8cc8d 100644 +--- a/drivers/clk/at91/clk-main.c ++++ b/drivers/clk/at91/clk-main.c +@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap) + regmap_read(regmap, AT91_CKGR_MCFR, &mcfr); + if (mcfr & AT91_PMC_MAINRDY) + return 0; +- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(MAINF_LOOP_MIN_WAIT); ++ else ++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); + } while (time_before(prep_time, timeout)); + + return -ETIMEDOUT; +diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c +index ab6ecefc49ad8..43ba2a8b03faf 100644 +--- a/drivers/clk/at91/sckc.c ++++ b/drivers/clk/at91/sckc.c +@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw) + + writel(tmp | AT91_SCKC_OSC32EN, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw) + + writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index) + + writel(tmp, sckcr); + +- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(SLOWCK_SW_TIME_USEC); ++ else ++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); + + return 0; + } +@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw) + return 0; + } + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + osc->prepared = true; + + return 0; +-- +2.20.1 + diff --git a/queue-4.14/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch b/queue-4.14/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch new file mode 100644 index 00000000000..01c525353f3 --- /dev/null +++ b/queue-4.14/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch @@ -0,0 +1,41 @@ +From 67efb70324ed4361d98f1a54ae24195d3d447968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Sep 2019 17:04:11 +0200 +Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate + +From: Martin Blumenstingl + +[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ] + +The meson-saradc driver manually sets the input clock for +sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB, +GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up +to sar_adc_clk_sel which will let the common clock framework select the +best matching parent clock if we want that. + +This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk +drivers, which both also specify CLK_SET_RATE_PARENT. + +Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/gxbb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 92168348ffa6e..f2d27addf485c 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -687,6 +687,7 @@ static struct clk_divider gxbb_sar_adc_clk_div = { + .ops = &clk_divider_ops, + .parent_names = (const char *[]){ "sar_adc_clk_sel" }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + }, + }; + +-- +2.20.1 + diff --git a/queue-4.14/clk-samsung-exynos5420-preserve-pll-configuration-du.patch b/queue-4.14/clk-samsung-exynos5420-preserve-pll-configuration-du.patch new file mode 100644 index 00000000000..63b11cf76fd --- /dev/null +++ b/queue-4.14/clk-samsung-exynos5420-preserve-pll-configuration-du.patch @@ -0,0 +1,51 @@ +From 0cd3e6bde6af109dedaf564de3b5ecdb9da86712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 11:02:01 +0200 +Subject: clk: samsung: exynos5420: Preserve PLL configuration during + suspend/resume + +From: Marek Szyprowski + +[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ] + +Properly save and restore all top PLL related configuration registers +during suspend/resume cycle. So far driver only handled EPLL and RPLL +clocks, all other were reset to default values after suspend/resume cycle. +This caused for example lower G3D (MALI Panfrost) performance after system +resume, even if performance governor has been selected. + +Reported-by: Reported-by: Marian Mihailescu +Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list") +Signed-off-by: Marek Szyprowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos5420.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index a882f7038bcec..47a14f93f8693 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -170,12 +170,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = { + GATE_BUS_CPU, + GATE_SCLK_CPU, + CLKOUT_CMU_CPU, ++ CPLL_CON0, ++ DPLL_CON0, + EPLL_CON0, + EPLL_CON1, + EPLL_CON2, + RPLL_CON0, + RPLL_CON1, + RPLL_CON2, ++ IPLL_CON0, ++ SPLL_CON0, ++ VPLL_CON0, ++ MPLL_CON0, + SRC_TOP0, + SRC_TOP1, + SRC_TOP2, +-- +2.20.1 + diff --git a/queue-4.14/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch b/queue-4.14/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch new file mode 100644 index 00000000000..4a30bbb776a --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch @@ -0,0 +1,39 @@ +From 06ca8c9a874516a5f54d313b2e3f383a624083a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 12:28:09 +0100 +Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 + +From: Colin Ian King + +[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ] + +The zero'ing of bits 16 and 18 is incorrect. Currently the code +is masking with the bitwise-and of BIT(16) & BIT(18) which is +0, so the updated value for val is always zero. Fix this by bitwise +and-ing value with the correct mask that will zero bits 16 and 18. + +Addresses-Coverity: (" Suspicious &= or |= constant expression") +Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU") +Signed-off-by: Colin Ian King +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +index 8936ef87652c0..c14bf782b2b33 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c ++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev) + + /* Enforce d1 = 0, d2 = 0 for Audio PLL */ + val = readl(reg + SUN9I_A80_PLL_AUDIO_REG); +- val &= (BIT(16) & BIT(18)); ++ val &= ~(BIT(16) | BIT(18)); + writel(val, reg + SUN9I_A80_PLL_AUDIO_REG); + + /* Enforce P = 1 for both CPU cluster PLLs */ +-- +2.20.1 + diff --git a/queue-4.14/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch b/queue-4.14/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch new file mode 100644 index 00000000000..ce0801ba3d1 --- /dev/null +++ b/queue-4.14/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch @@ -0,0 +1,47 @@ +From 9a35dc430413e9da192e7d23498b6c5a650d25e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 11:34:36 +0300 +Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call + +From: Peter Ujfalusi + +[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ] + +ti_clk_register() calls it already so the driver should not create +duplicated alias. + +Signed-off-by: Peter Ujfalusi +Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-dra7-atl.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c +index 1488154704313..beb672a215b6c 100644 +--- a/drivers/clk/ti/clk-dra7-atl.c ++++ b/drivers/clk/ti/clk-dra7-atl.c +@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + struct clk_init_data init = { NULL }; + const char **parent_names = NULL; + struct clk *clk; +- int ret; + + clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL); + if (!clk_hw) { +@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + clk = ti_clk_register(NULL, &clk_hw->hw, node->name); + + if (!IS_ERR(clk)) { +- ret = ti_clk_add_alias(NULL, clk, node->name); +- if (ret) { +- clk_unregister(clk); +- goto cleanup; +- } + of_clk_add_provider(node, of_clk_src_simple_get, clk); + kfree(parent_names); + return; +-- +2.20.1 + diff --git a/queue-4.14/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch b/queue-4.14/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch new file mode 100644 index 00000000000..c27e0ea7c2e --- /dev/null +++ b/queue-4.14/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch @@ -0,0 +1,206 @@ +From c336bfbdd9dde0ebb66aa9c58b56d6514ed3271e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 14:53:50 -0700 +Subject: clocksource/drivers/fttmr010: Fix invalid interrupt register access + +From: Tao Ren + +[ Upstream commit 86fe57fc47b17b3528fa5497fc57e158d846c4ea ] + +TIMER_INTR_MASK register (Base Address of Timer + 0x38) is not designed +for masking interrupts on ast2500 chips, and it's not even listed in +ast2400 datasheet, so it's not safe to access TIMER_INTR_MASK on aspeed +chips. + +Similarly, TIMER_INTR_STATE register (Base Address of Timer + 0x34) is +not interrupt status register on ast2400 and ast2500 chips. Although +there is no side effect to reset the register in fttmr010_common_init(), +it's just misleading to do so. + +Besides, "count_down" is renamed to "is_aspeed" in "fttmr010" structure, +and more comments are added so the code is more readble. + +Signed-off-by: Tao Ren +Reviewed-by: Linus Walleij +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-fttmr010.c | 73 ++++++++++++++++------------ + 1 file changed, 42 insertions(+), 31 deletions(-) + +diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c +index cdfe1c82f3f00..3928f3999015e 100644 +--- a/drivers/clocksource/timer-fttmr010.c ++++ b/drivers/clocksource/timer-fttmr010.c +@@ -21,7 +21,7 @@ + #include + + /* +- * Register definitions for the timers ++ * Register definitions common for all the timer variants. + */ + #define TIMER1_COUNT (0x00) + #define TIMER1_LOAD (0x04) +@@ -36,9 +36,10 @@ + #define TIMER3_MATCH1 (0x28) + #define TIMER3_MATCH2 (0x2c) + #define TIMER_CR (0x30) +-#define TIMER_INTR_STATE (0x34) +-#define TIMER_INTR_MASK (0x38) + ++/* ++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers. ++ */ + #define TIMER_1_CR_ENABLE BIT(0) + #define TIMER_1_CR_CLOCK BIT(1) + #define TIMER_1_CR_INT BIT(2) +@@ -53,8 +54,9 @@ + #define TIMER_3_CR_UPDOWN BIT(11) + + /* +- * The Aspeed AST2400 moves bits around in the control register +- * and lacks bits for setting the timer to count upwards. ++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers. ++ * The aspeed timers move bits around in the control register and lacks ++ * bits for setting the timer to count upwards. + */ + #define TIMER_1_CR_ASPEED_ENABLE BIT(0) + #define TIMER_1_CR_ASPEED_CLOCK BIT(1) +@@ -66,6 +68,18 @@ + #define TIMER_3_CR_ASPEED_CLOCK BIT(9) + #define TIMER_3_CR_ASPEED_INT BIT(10) + ++/* ++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart ++ * timers. ++ * The registers don't exist and they are not needed on aspeed timers ++ * because: ++ * - aspeed timer overflow interrupt is controlled by bits in Control ++ * Register (TMC30). ++ * - aspeed timers always generate interrupt when either one of the ++ * Match registers equals to Status register. ++ */ ++#define TIMER_INTR_STATE (0x34) ++#define TIMER_INTR_MASK (0x38) + #define TIMER_1_INT_MATCH1 BIT(0) + #define TIMER_1_INT_MATCH2 BIT(1) + #define TIMER_1_INT_OVERFLOW BIT(2) +@@ -80,7 +94,7 @@ + struct fttmr010 { + void __iomem *base; + unsigned int tick_rate; +- bool count_down; ++ bool is_aspeed; + u32 t1_enable_val; + struct clock_event_device clkevt; + #ifdef CONFIG_ARM +@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles, + cr &= ~fttmr010->t1_enable_val; + writel(cr, fttmr010->base + TIMER_CR); + +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + /* + * ASPEED Timer Controller will load TIMER1_LOAD register + * into TIMER1_COUNT register when the timer is re-enabled. +@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt) + + /* Setup counter start from 0 or ~0 */ + writel(0, fttmr010->base + TIMER1_COUNT); +- if (fttmr010->count_down) ++ if (fttmr010->is_aspeed) { + writel(~0, fttmr010->base + TIMER1_LOAD); +- else ++ } else { + writel(0, fttmr010->base + TIMER1_LOAD); + +- /* Enable interrupt */ +- cr = readl(fttmr010->base + TIMER_INTR_MASK); +- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); +- cr |= TIMER_1_INT_MATCH1; +- writel(cr, fttmr010->base + TIMER_INTR_MASK); ++ /* Enable interrupt */ ++ cr = readl(fttmr010->base + TIMER_INTR_MASK); ++ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); ++ cr |= TIMER_1_INT_MATCH1; ++ writel(cr, fttmr010->base + TIMER_INTR_MASK); ++ } + + return 0; + } +@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt) + writel(cr, fttmr010->base + TIMER_CR); + + /* Setup timer to fire at 1/HZ intervals. */ +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + writel(period, fttmr010->base + TIMER1_LOAD); +- writel(0, fttmr010->base + TIMER1_MATCH1); + } else { + cr = 0xffffffff - (period - 1); + writel(cr, fttmr010->base + TIMER1_COUNT); +@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + } + + /* +- * The Aspeed AST2400 moves bits around in the control register, +- * otherwise it works the same. ++ * The Aspeed timers move bits around in the control register. + */ + if (is_aspeed) { + fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE | + TIMER_1_CR_ASPEED_INT; +- /* Downward not available */ +- fttmr010->count_down = true; ++ fttmr010->is_aspeed = true; + } else { + fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT; +- } + +- /* +- * Reset the interrupt mask and status +- */ +- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); +- writel(0, fttmr010->base + TIMER_INTR_STATE); ++ /* ++ * Reset the interrupt mask and status ++ */ ++ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); ++ writel(0, fttmr010->base + TIMER_INTR_STATE); ++ } + + /* + * Enable timer 1 count up, timer 2 count up, except on Aspeed, +@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + if (is_aspeed) + val = TIMER_2_CR_ASPEED_ENABLE; + else { +- val = TIMER_2_CR_ENABLE; +- if (!fttmr010->count_down) +- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN; ++ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN | ++ TIMER_2_CR_UPDOWN; + } + writel(val, fttmr010->base + TIMER_CR); + +@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + writel(0, fttmr010->base + TIMER2_MATCH1); + writel(0, fttmr010->base + TIMER2_MATCH2); + +- if (fttmr010->count_down) { ++ if (fttmr010->is_aspeed) { + writel(~0, fttmr010->base + TIMER2_LOAD); + clocksource_mmio_init(fttmr010->base + TIMER2_COUNT, + "FTTMR010-TIMER2", +@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) + + #ifdef CONFIG_ARM + /* Also use this timer for delays */ +- if (fttmr010->count_down) ++ if (fttmr010->is_aspeed) + fttmr010->delay_timer.read_current_timer = + fttmr010_read_current_timer_down; + else +-- +2.20.1 + diff --git a/queue-4.14/crypto-mxc-scc-fix-build-warnings-on-arm64.patch b/queue-4.14/crypto-mxc-scc-fix-build-warnings-on-arm64.patch new file mode 100644 index 00000000000..2017e2dc938 --- /dev/null +++ b/queue-4.14/crypto-mxc-scc-fix-build-warnings-on-arm64.patch @@ -0,0 +1,71 @@ +From 50d6b6c05391df0496e7f273f3d6e48f84b0fbf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 07:52:32 -0200 +Subject: crypto: mxc-scc - fix build warnings on ARM64 + +From: Fabio Estevam + +[ Upstream commit 2326828ee40357b3d2b1359b8ca7526af201495b ] + +The following build warnings are seen when building for ARM64 allmodconfig: + +drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] +drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] +drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] +drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] +drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + +Fix them by using the %zu specifier to print a size_t variable and using +a plain %x to print the result of a readl(). + +Signed-off-by: Fabio Estevam +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxc-scc.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c +index e01c46387df8d..519086730791b 100644 +--- a/drivers/crypto/mxc-scc.c ++++ b/drivers/crypto/mxc-scc.c +@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx, + else + from = scc->black_memory; + +- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from, ++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from, + ctx->dst_nents * 8); + len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents, + from, ctx->size, ctx->offset); + if (!len) { +- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len); ++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len); + return -EINVAL; + } + +@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx, + len = sg_pcopy_to_buffer(req->src, ctx->src_nents, + to, len, ctx->offset); + if (!len) { +- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len); ++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len); + return -EINVAL; + } + +@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx, + return; + } + +- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n", +- (void *)readl(scc->base + SCC_SCM_RED_START), +- (void *)readl(scc->base + SCC_SCM_BLACK_START)); ++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n", ++ readl(scc->base + SCC_SCM_RED_START), ++ readl(scc->base + SCC_SCM_BLACK_START)); + + /* clear interrupt control registers */ + writel(SCC_SCM_INTR_CTRL_CLR_INTR, +-- +2.20.1 + diff --git a/queue-4.14/crypto-user-support-incremental-algorithm-dumps.patch b/queue-4.14/crypto-user-support-incremental-algorithm-dumps.patch new file mode 100644 index 00000000000..08e5616469c --- /dev/null +++ b/queue-4.14/crypto-user-support-incremental-algorithm-dumps.patch @@ -0,0 +1,116 @@ +From 8ac8734c3535fffb75f9d17a04d95ae0488f1ef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 15:55:41 -0800 +Subject: crypto: user - support incremental algorithm dumps + +From: Eric Biggers + +[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ] + +CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all +registered crypto algorithms, because it doesn't support incremental +dumps. crypto_dump_report() only permits itself to be called once, yet +the netlink subsystem allocates at most ~64 KiB for the skb being dumped +to. Thus only the first recvmsg() returns data, and it may only include +a subset of the crypto algorithms even if the user buffer passed to +recvmsg() is large enough to hold all of them. + +Fix this by using one of the arguments in the netlink_callback structure +to keep track of the current position in the algorithm list. Then +userspace can do multiple recvmsg() on the socket after sending the dump +request. This is the way netlink dumps work elsewhere in the kernel; +it's unclear why this was different (probably just an oversight). + +Also fix an integer overflow when calculating the dump buffer size hint. + +Fixes: a38f7907b926 ("crypto: Add userspace configuration API") +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/crypto_user.c | 37 ++++++++++++++++++++----------------- + 1 file changed, 20 insertions(+), 17 deletions(-) + +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 2b8fb8f1391e0..5e457a7dd1c92 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -296,30 +296,33 @@ drop_alg: + + static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb) + { +- struct crypto_alg *alg; ++ const size_t start_pos = cb->args[0]; ++ size_t pos = 0; + struct crypto_dump_info info; +- int err; +- +- if (cb->args[0]) +- goto out; +- +- cb->args[0] = 1; ++ struct crypto_alg *alg; ++ int res; + + info.in_skb = cb->skb; + info.out_skb = skb; + info.nlmsg_seq = cb->nlh->nlmsg_seq; + info.nlmsg_flags = NLM_F_MULTI; + ++ down_read(&crypto_alg_sem); + list_for_each_entry(alg, &crypto_alg_list, cra_list) { +- err = crypto_report_alg(alg, &info); +- if (err) +- goto out_err; ++ if (pos >= start_pos) { ++ res = crypto_report_alg(alg, &info); ++ if (res == -EMSGSIZE) ++ break; ++ if (res) ++ goto out; ++ } ++ pos++; + } +- ++ cb->args[0] = pos; ++ res = skb->len; + out: +- return skb->len; +-out_err: +- return err; ++ up_read(&crypto_alg_sem); ++ return res; + } + + static int crypto_dump_report_done(struct netlink_callback *cb) +@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && + (nlh->nlmsg_flags & NLM_F_DUMP))) { + struct crypto_alg *alg; +- u16 dump_alloc = 0; ++ unsigned long dump_alloc = 0; + + if (link->dump == NULL) + return -EINVAL; +@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + down_read(&crypto_alg_sem); + list_for_each_entry(alg, &crypto_alg_list, cra_list) + dump_alloc += CRYPTO_REPORT_MAXSIZE; ++ up_read(&crypto_alg_sem); + + { + struct netlink_dump_control c = { + .dump = link->dump, + .done = link->done, +- .min_dump_alloc = dump_alloc, ++ .min_dump_alloc = min(dump_alloc, 65535UL), + }; + err = netlink_dump_start(crypto_nlsk, skb, nlh, &c); + } +- up_read(&crypto_alg_sem); + + return err; + } +-- +2.20.1 + diff --git a/queue-4.14/decnet-fix-dn_ifreq_size.patch b/queue-4.14/decnet-fix-dn_ifreq_size.patch new file mode 100644 index 00000000000..e97883865ee --- /dev/null +++ b/queue-4.14/decnet-fix-dn_ifreq_size.patch @@ -0,0 +1,67 @@ +From 9efc025a2898868edda05b9a37ef271d7d9cd230 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Jan 2019 21:12:19 +0100 +Subject: decnet: fix DN_IFREQ_SIZE + +From: Johannes Berg + +[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ] + +Digging through the ioctls with Al because of the previous +patches, we found that on 64-bit decnet's dn_dev_ioctl() +is wrong, because struct ifreq::ifr_ifru is actually 24 +bytes (not 16 as expected from struct sockaddr) due to the +ifru_map and ifru_settings members. + +Clearly, decnet expects the ioctl to be called with a struct +like + struct ifreq_dn { + char ifr_name[IFNAMSIZ]; + struct sockaddr_dn ifr_addr; + }; + +since it does + struct ifreq *ifr = ...; + struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr; + +This means that DN_IFREQ_SIZE is too big for what it wants on +64-bit, as it is + sizeof(struct ifreq) - sizeof(struct sockaddr) + + sizeof(struct sockaddr_dn) + +This assumes that sizeof(struct sockaddr) is the size of ifr_ifru +but that isn't true. + +Fix this to use offsetof(struct ifreq, ifr_ifru). + +This indeed doesn't really matter much - the result is that we +copy in/out 8 bytes more than we should on 64-bit platforms. In +case the "struct ifreq_dn" lands just on the end of a page though +it might lead to faults. + +As far as I can tell, it has been like this forever, so it seems +very likely that nobody cares. + +Signed-off-by: Johannes Berg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/decnet/dn_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c +index df042b6d80b83..22876a197ebec 100644 +--- a/net/decnet/dn_dev.c ++++ b/net/decnet/dn_dev.c +@@ -56,7 +56,7 @@ + #include + #include + +-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn)) ++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn)) + + static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00}; + static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00}; +-- +2.20.1 + diff --git a/queue-4.14/dm-flakey-properly-corrupt-multi-page-bios.patch b/queue-4.14/dm-flakey-properly-corrupt-multi-page-bios.patch new file mode 100644 index 00000000000..efc06bd90fb --- /dev/null +++ b/queue-4.14/dm-flakey-properly-corrupt-multi-page-bios.patch @@ -0,0 +1,76 @@ +From 69c2c59369e3caca7591011479dfa8da0253aecd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 08:04:24 -0500 +Subject: dm flakey: Properly corrupt multi-page bios. + +From: Sweet Tea + +[ Upstream commit a00f5276e26636cbf72f24f79831026d2e2868e7 ] + +The flakey target is documented to be able to corrupt the Nth byte in +a bio, but does not corrupt byte indices after the first biovec in the +bio. Change the corrupting function to actually corrupt the Nth byte +no matter in which biovec that index falls. + +A test device generating two-page bios, atop a flakey device configured +to corrupt a byte index on the second page, verified both the failure +to corrupt before this patch and the expected corruption after this +change. + +Signed-off-by: John Dorminy +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++----------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 0c1ef63c3461b..b1b68e01b889c 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -282,20 +282,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio) + + static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) + { +- unsigned bio_bytes = bio_cur_bytes(bio); +- char *data = bio_data(bio); ++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1; ++ ++ struct bvec_iter iter; ++ struct bio_vec bvec; ++ ++ if (!bio_has_data(bio)) ++ return; + + /* +- * Overwrite the Nth byte of the data returned. ++ * Overwrite the Nth byte of the bio's data, on whichever page ++ * it falls. + */ +- if (data && bio_bytes >= fc->corrupt_bio_byte) { +- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value; +- +- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " +- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n", +- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, +- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, +- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes); ++ bio_for_each_segment(bvec, bio, iter) { ++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) { ++ char *segment = (page_address(bio_iter_page(bio, iter)) ++ + bio_iter_offset(bio, iter)); ++ segment[corrupt_bio_byte] = fc->corrupt_bio_value; ++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " ++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", ++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, ++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, ++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size); ++ break; ++ } ++ corrupt_bio_byte -= bio_iter_len(bio, iter); + } + } + +-- +2.20.1 + diff --git a/queue-4.14/drbd-do-not-block-when-adjusting-disk-options-while-.patch b/queue-4.14/drbd-do-not-block-when-adjusting-disk-options-while-.patch new file mode 100644 index 00000000000..98f254f553d --- /dev/null +++ b/queue-4.14/drbd-do-not-block-when-adjusting-disk-options-while-.patch @@ -0,0 +1,91 @@ +From 70cfea86061a62a748f59ad98730980dc0550296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Dec 2018 17:23:37 +0100 +Subject: drbd: do not block when adjusting "disk-options" while IO is frozen + +From: Lars Ellenberg + +[ Upstream commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 ] + +"suspending" IO is overloaded. +It can mean "do not allow new requests" (obviously), +but it also may mean "must not complete pending IO", +for example while the fencing handlers do their arbitration. + +When adjusting disk options, we suspend io (disallow new requests), then +wait for the activity-log to become unused (drain all IO completions), +and possibly replace it with a new activity log of different size. + +If the other "suspend IO" aspect is active, pending IO completions won't +happen, and we would block forever (unkillable drbdsetup process). + +Fix this by skipping the activity log adjustment if the "al-extents" +setting did not change. Also, in case it did change, fail early without +blocking if it looks like we would block forever. + +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_nl.c | 37 ++++++++++++++++++++++++++++-------- + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index a675a0f61f9c0..31d7fe4480afd 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis + } + } + ++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc) ++{ ++ int err = -EBUSY; ++ ++ if (device->act_log && ++ device->act_log->nr_elements == dc->al_extents) ++ return 0; ++ ++ drbd_suspend_io(device); ++ /* If IO completion is currently blocked, we would likely wait ++ * "forever" for the activity log to become unused. So we don't. */ ++ if (atomic_read(&device->ap_bio_cnt)) ++ goto out; ++ ++ wait_event(device->al_wait, lc_try_lock(device->act_log)); ++ drbd_al_shrink(device); ++ err = drbd_check_al_size(device, dc); ++ lc_unlock(device->act_log); ++ wake_up(&device->al_wait); ++out: ++ drbd_resume_io(device); ++ return err; ++} ++ + int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) + { + struct drbd_config_context adm_ctx; +@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) + } + } + +- drbd_suspend_io(device); +- wait_event(device->al_wait, lc_try_lock(device->act_log)); +- drbd_al_shrink(device); +- err = drbd_check_al_size(device, new_disk_conf); +- lc_unlock(device->act_log); +- wake_up(&device->al_wait); +- drbd_resume_io(device); +- ++ err = disk_opts_check_al_size(device, new_disk_conf); + if (err) { ++ /* Could be just "busy". Ignore? ++ * Introduce dedicated error code? */ ++ drbd_msg_put_info(adm_ctx.reply_skb, ++ "Try again without changing current al-extents setting"); + retcode = ERR_NOMEM; + goto fail_unlock; + } +-- +2.20.1 + diff --git a/queue-4.14/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch b/queue-4.14/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch new file mode 100644 index 00000000000..0ab574ea35e --- /dev/null +++ b/queue-4.14/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch @@ -0,0 +1,39 @@ +From 50b1d0033d928e8552e83c866a59b8e6f1273d31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Dec 2018 17:23:39 +0100 +Subject: drbd: fix print_st_err()'s prototype to match the definition + +From: Luc Van Oostenryck + +[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ] + +print_st_err() is defined with its 4th argument taking an +'enum drbd_state_rv' but its prototype use an int for it. + +Fix this by using 'enum drbd_state_rv' in the prototype too. + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Roland Kammerer +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_state.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h +index ea58301d0895c..b2a390ba73a05 100644 +--- a/drivers/block/drbd/drbd_state.h ++++ b/drivers/block/drbd/drbd_state.h +@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state + enum chg_state_flags, + struct completion *done); + extern void print_st_err(struct drbd_device *, union drbd_state, +- union drbd_state, int); ++ union drbd_state, enum drbd_state_rv); + + enum drbd_state_rv + _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val, +-- +2.20.1 + diff --git a/queue-4.14/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch b/queue-4.14/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch new file mode 100644 index 00000000000..216618bd8ee --- /dev/null +++ b/queue-4.14/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch @@ -0,0 +1,116 @@ +From 682a8bd94a5559b6288fa12f669ec0aefb24c16e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Dec 2018 17:23:31 +0100 +Subject: drbd: ignore "all zero" peer volume sizes in handshake + +From: Lars Ellenberg + +[ Upstream commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 ] + +During handshake, if we are diskless ourselves, we used to accept any size +presented by the peer. + +Which could be zero if that peer was just brought up and connected +to us without having a disk attached first, in which case both +peers would just "flip" their volume sizes. + +Now, even a diskless node will ignore "zero" sizes +presented by a diskless peer. + +Also a currently Diskless Primary will refuse to shrink during handshake: +it may be frozen, and waiting for a "suitable" local disk or peer to +re-appear (on-no-data-accessible suspend-io). If the peer is smaller +than what we used to be, it is not suitable. + +The logic for a diskless node during handshake is now supposed to be: +believe the peer, if + - I don't have a current size myself + - we agree on the size anyways + - I do have a current size, am Secondary, and he has the only disk + - I do have a current size, am Primary, and he has the only disk, + which is larger than my current size + +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_receiver.c | 33 +++++++++++++++++++++++++++--- + 1 file changed, 30 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 8fbdfaacc2226..08586bc5219bf 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -3977,6 +3977,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL; + enum determine_dev_size dd = DS_UNCHANGED; + sector_t p_size, p_usize, p_csize, my_usize; ++ sector_t new_size, cur_size; + int ldsc = 0; /* local disk size changed */ + enum dds_flags ddsf; + +@@ -3984,6 +3985,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + if (!peer_device) + return config_unknown_volume(connection, pi); + device = peer_device->device; ++ cur_size = drbd_get_capacity(device->this_bdev); + + p_size = be64_to_cpu(p->d_size); + p_usize = be64_to_cpu(p->u_size); +@@ -3994,7 +3996,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + device->p_size = p_size; + + if (get_ldev(device)) { +- sector_t new_size, cur_size; + rcu_read_lock(); + my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size; + rcu_read_unlock(); +@@ -4012,7 +4013,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + /* Never shrink a device with usable data during connect. + But allow online shrinking if we are connected. */ + new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0); +- cur_size = drbd_get_capacity(device->this_bdev); + if (new_size < cur_size && + device->state.disk >= D_OUTDATED && + device->state.conn < C_CONNECTED) { +@@ -4077,9 +4077,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info + * + * However, if he sends a zero current size, + * take his (user-capped or) backing disk size anyways. ++ * ++ * Unless of course he does not have a disk himself. ++ * In which case we ignore this completely. + */ ++ sector_t new_size = p_csize ?: p_usize ?: p_size; + drbd_reconsider_queue_parameters(device, NULL, o); +- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size); ++ if (new_size == 0) { ++ /* Ignore, peer does not know nothing. */ ++ } else if (new_size == cur_size) { ++ /* nothing to do */ ++ } else if (cur_size != 0 && p_size == 0) { ++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n", ++ (unsigned long long)new_size, (unsigned long long)cur_size); ++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) { ++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n", ++ (unsigned long long)new_size, (unsigned long long)cur_size); ++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD); ++ return -EIO; ++ } else { ++ /* I believe the peer, if ++ * - I don't have a current size myself ++ * - we agree on the size anyways ++ * - I do have a current size, am Secondary, ++ * and he has the only disk ++ * - I do have a current size, am Primary, ++ * and he has the only disk, ++ * which is larger than my current size ++ */ ++ drbd_set_my_capacity(device, new_size); ++ } + } + + if (get_ldev(device)) { +-- +2.20.1 + diff --git a/queue-4.14/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch b/queue-4.14/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch new file mode 100644 index 00000000000..a831deacc3e --- /dev/null +++ b/queue-4.14/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch @@ -0,0 +1,102 @@ +From 4eddb619b0080664cabe9e6b986c5b27cf82d8f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Dec 2018 17:23:35 +0100 +Subject: drbd: reject attach of unsuitable uuids even if connected + +From: Lars Ellenberg + +[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ] + +Multiple failure scenario: +a) all good + Connected Primary/Secondary UpToDate/UpToDate +b) lose disk on Primary, + Connected Primary/Secondary Diskless/UpToDate +c) continue to write to the device, + changes only make it to the Secondary storage. +d) lose disk on Secondary, + Connected Primary/Secondary Diskless/Diskless +e) now try to re-attach on Primary + +This would have succeeded before, even though that is clearly the +wrong data set to attach to (missing the modifications from c). +Because we only compared our "effective" and the "to-be-attached" +data generation uuid tags if (device->state.conn < C_CONNECTED). + +Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE) +compare the uuids, and reject the attach. + +This patch also tries to improve the reverse scenario: +first lose Secondary, then Primary disk, +then try to attach the disk on Secondary. + +Before this patch, the attach on the Secondary succeeds, but since commit +drbd: disconnect, if the wrong UUIDs are attached on a connected peer +the Primary will notice unsuitable data, and drop the connection hard. + +Though unfortunately at a point in time during the handshake where +we cannot easily abort the attach on the peer without more +refactoring of the handshake. + +We now reject any attach to "unsuitable" uuids, +as long as we can see a Primary role, +unless we already have access to "good" data. + +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_nl.c | 6 +++--- + drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index ad13ec66c8e4d..a675a0f61f9c0 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -1935,9 +1935,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info) + } + } + +- if (device->state.conn < C_CONNECTED && +- device->state.role == R_PRIMARY && device->ed_uuid && +- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { ++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid && ++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) && ++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { + drbd_err(device, "Can only attach to data with current UUID=%016llX\n", + (unsigned long long)device->ed_uuid); + retcode = ERR_DATA_NOT_CURRENT; +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 08586bc5219bf..a7c180426c601 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -4392,6 +4392,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info + if (peer_state.conn == C_AHEAD) + ns.conn = C_BEHIND; + ++ /* TODO: ++ * if (primary and diskless and peer uuid != effective uuid) ++ * abort attach on peer; ++ * ++ * If this node does not have good data, was already connected, but ++ * the peer did a late attach only now, trying to "negotiate" with me, ++ * AND I am currently Primary, possibly frozen, with some specific ++ * "effective" uuid, this should never be reached, really, because ++ * we first send the uuids, then the current state. ++ * ++ * In this scenario, we already dropped the connection hard ++ * when we received the unsuitable uuids (receive_uuids(). ++ * ++ * Should we want to change this, that is: not drop the connection in ++ * receive_uuids() already, then we would need to add a branch here ++ * that aborts the attach of "unsuitable uuids" on the peer in case ++ * this node is currently Diskless Primary. ++ */ ++ + if (device->p_uuid && peer_state.disk >= D_NEGOTIATING && + get_ldev_if_state(device, D_NEGOTIATING)) { + int cr; /* consider resync */ +-- +2.20.1 + diff --git a/queue-4.14/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch b/queue-4.14/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch new file mode 100644 index 00000000000..b1467e94345 --- /dev/null +++ b/queue-4.14/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch @@ -0,0 +1,83 @@ +From 7201500e21232fdf6a283008590d1e46b7a9ec67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jan 2019 15:29:05 -0800 +Subject: drivers/base/platform.c: kmemleak ignore a known leak + +From: Qian Cai + +[ Upstream commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 ] + +unreferenced object 0xffff808ec6dc5a80 (size 128): + comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s) + hex dump (first 32 bytes): + ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk + 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + backtrace: + [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500 + [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8 + [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450 + [<00000000ef135642>] acpi_default_enumeration+0x34/0x78 + [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0 + [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0 + [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0 + [<000000002968643e>] acpi_bus_scan+0xb0/0x110 + [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410 + [<00000000965b3c5a>] acpi_init+0x408/0x49c + [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4 + [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c + [<0000000070ea6c15>] kernel_init+0x18/0x138 + [<00000000fb8fff06>] ret_from_fork+0x10/0x1c + [<0000000041273a0d>] 0xffffffffffffffff + +Then, faddr2line pointed out this line, + +/* + * This memory isn't freed when the device is put, + * I don't have a nice idea for that though. Conceptually + * dma_mask in struct device should not be a pointer. + * See http://thread.gmane.org/gmane.linux.kernel.pci/9081 + */ +pdev->dev.dma_mask = + kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL); + +Since this leak has existed for more than 8 years and it does not +reference other parts of the memory, let kmemleak ignore it, so users +don't need to waste time reporting this in the future. + +Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us +Signed-off-by: Qian Cai +Reviewed-by: Andrew Morton +Cc: Greg Kroah-Hartman +Cc: "Rafael J . Wysocki" +Cc: Catalin Marinas +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 9045c5f3734e8..f1105de0d9fed 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include "base.h" + #include "power/power.h" +@@ -526,6 +527,8 @@ struct platform_device *platform_device_register_full( + if (!pdev->dev.dma_mask) + goto err; + ++ kmemleak_ignore(pdev->dev.dma_mask); ++ + *pdev->dev.dma_mask = pdevinfo->dma_mask; + pdev->dev.coherent_dma_mask = pdevinfo->dma_mask; + } +-- +2.20.1 + diff --git a/queue-4.14/drivers-regulator-fix-a-missing-check-of-return-valu.patch b/queue-4.14/drivers-regulator-fix-a-missing-check-of-return-valu.patch new file mode 100644 index 00000000000..50992c1fed3 --- /dev/null +++ b/queue-4.14/drivers-regulator-fix-a-missing-check-of-return-valu.patch @@ -0,0 +1,46 @@ +From fcd112c35fffdd1d6e13c3b5bbf05b0068530cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 23:04:13 -0600 +Subject: drivers/regulator: fix a missing check of return value + +From: Kangjie Lu + +[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ] + +If palmas_smps_read() fails, we should not use the read data in "reg" +which may contain random value. The fix inserts a check for the return +value of palmas_smps_read(): If it fails, we return the error code +upstream and stop using "reg". + +Signed-off-by: Kangjie Lu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/palmas-regulator.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c +index bb5ab7d78895b..c2cc392a27d40 100644 +--- a/drivers/regulator/palmas-regulator.c ++++ b/drivers/regulator/palmas-regulator.c +@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg, + static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode) + { + int id = rdev_get_id(dev); ++ int ret; + struct palmas_pmic *pmic = rdev_get_drvdata(dev); + struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata; + struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id]; + unsigned int reg; + bool rail_enable = true; + +- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); ++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); ++ if (ret) ++ return ret; + + reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK; + +-- +2.20.1 + diff --git a/queue-4.14/exofs_mount-fix-leaks-on-failure-exits.patch b/queue-4.14/exofs_mount-fix-leaks-on-failure-exits.patch new file mode 100644 index 00000000000..f8f63ce0735 --- /dev/null +++ b/queue-4.14/exofs_mount-fix-leaks-on-failure-exits.patch @@ -0,0 +1,94 @@ +From fde257d2d3dcda8d1f8280fa83e8f123c8c9ae63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 22:26:42 -0500 +Subject: exofs_mount(): fix leaks on failure exits + +From: Al Viro + +[ Upstream commit 26cb5a328c6b2bda9e859307ce4cfc60df3a2c28 ] + +... and don't abuse mount_nodev(), while we are at it. + +Signed-off-by: Al Viro +Reviewed-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/exofs/super.c | 37 +++++++++++++++++++++++++++++-------- + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/fs/exofs/super.c b/fs/exofs/super.c +index c9ec652e2fcd2..881d5798a1814 100644 +--- a/fs/exofs/super.c ++++ b/fs/exofs/super.c +@@ -702,21 +702,18 @@ out: + /* + * Read the superblock from the OSD and fill in the fields + */ +-static int exofs_fill_super(struct super_block *sb, void *data, int silent) ++static int exofs_fill_super(struct super_block *sb, ++ struct exofs_mountopt *opts, ++ struct exofs_sb_info *sbi, ++ int silent) + { + struct inode *root; +- struct exofs_mountopt *opts = data; +- struct exofs_sb_info *sbi; /*extended info */ + struct osd_dev *od; /* Master device */ + struct exofs_fscb fscb; /*on-disk superblock info */ + struct ore_comp comp; + unsigned table_count; + int ret; + +- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); +- if (!sbi) +- return -ENOMEM; +- + /* use mount options to fill superblock */ + if (opts->is_osdname) { + struct osd_dev_info odi = {.systemid_len = 0}; +@@ -860,7 +857,9 @@ static struct dentry *exofs_mount(struct file_system_type *type, + int flags, const char *dev_name, + void *data) + { ++ struct super_block *s; + struct exofs_mountopt opts; ++ struct exofs_sb_info *sbi; + int ret; + + ret = parse_options(data, &opts); +@@ -869,9 +868,31 @@ static struct dentry *exofs_mount(struct file_system_type *type, + return ERR_PTR(ret); + } + ++ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); ++ if (!sbi) { ++ kfree(opts.dev_name); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ s = sget(type, NULL, set_anon_super, flags, NULL); ++ ++ if (IS_ERR(s)) { ++ kfree(opts.dev_name); ++ kfree(sbi); ++ return ERR_CAST(s); ++ } ++ + if (!opts.dev_name) + opts.dev_name = dev_name; +- return mount_nodev(type, flags, &opts, exofs_fill_super); ++ ++ ++ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0); ++ if (ret) { ++ deactivate_locked_super(s); ++ return ERR_PTR(ret); ++ } ++ s->s_flags |= SB_ACTIVE; ++ return dget(s->s_root); + } + + /* +-- +2.20.1 + diff --git a/queue-4.14/f2fs-fix-to-data-block-override-node-segment-by-mist.patch b/queue-4.14/f2fs-fix-to-data-block-override-node-segment-by-mist.patch new file mode 100644 index 00000000000..eb9f9285d5e --- /dev/null +++ b/queue-4.14/f2fs-fix-to-data-block-override-node-segment-by-mist.patch @@ -0,0 +1,69 @@ +From 533b6950b413fd564fb6a3e1f64f53e959c9b999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2019 09:32:25 +0800 +Subject: f2fs: fix to data block override node segment by mistake + +From: zhengliang + +[ Upstream commit a0770e13c8da83bdb64738c0209ab02dd3cfff8b ] + +v4: Rearrange the previous three versions. + +The following scenario could lead to data block override by mistake. + +TASK A | TASK kworker | TASK B | TASK C + | | | +open | | | +write | | | +close | | | + | f2fs_write_data_pages | | + | f2fs_write_cache_pages | | + | f2fs_outplace_write_data | | + | f2fs_allocate_data_block (get block in seg S, | | + | S is full, and only | | + | have this valid data | | + | block) | | + | allocate_segment | | + | locate_dirty_segment (mark S as PRE) | | + | f2fs_submit_page_write (submit but is not | | + | written on dev) | | +unlink | | | + iput_final | | | + f2fs_drop_inode | | | + f2fs_truncate | | | + (not evict) | | | + | | write_checkpoint | + | | flush merged bio but not wait file data writeback | + | | set_prefree_as_free (mark S as FREE) | + | | | update NODE/DATA + | | | allocate_segment (select S) + | writeback done | | + +So we need to guarantee io complete before truncate inode in f2fs_drop_inode. + +Reviewed-by: Chao Yu +Signed-off-by: Zheng Liang +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index e4aabfc21bd43..9554338f9c35d 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -668,6 +668,10 @@ static int f2fs_drop_inode(struct inode *inode) + sb_start_intwrite(inode->i_sb); + f2fs_i_size_write(inode, 0); + ++ f2fs_submit_merged_write_cond(F2FS_I_SB(inode), ++ inode, NULL, 0, DATA); ++ truncate_inode_pages_final(inode->i_mapping); ++ + if (F2FS_HAS_BLOCKS(inode)) + f2fs_truncate(inode); + +-- +2.20.1 + diff --git a/queue-4.14/f2fs-fix-to-dirty-inode-synchronously.patch b/queue-4.14/f2fs-fix-to-dirty-inode-synchronously.patch new file mode 100644 index 00000000000..9c2f0ec2f5a --- /dev/null +++ b/queue-4.14/f2fs-fix-to-dirty-inode-synchronously.patch @@ -0,0 +1,36 @@ +From 3dce5e0aba6b8034d7e8f7fd062bb16c71f5a2b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 19:20:17 +0800 +Subject: f2fs: fix to dirty inode synchronously + +From: Chao Yu + +[ Upstream commit b32e019049e959ee10ec359893c9dd5d057dad55 ] + +If user change inode's i_flags via ioctl, let's add it into global +dirty list, so that checkpoint can guarantee its persistence before +fsync, it can make checkpoint keeping strong consistency. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 1b17921994459..d68b0132718a6 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1593,7 +1593,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags) + + inode->i_ctime = current_time(inode); + f2fs_set_inode_flags(inode); +- f2fs_mark_inode_dirty_sync(inode, false); ++ f2fs_mark_inode_dirty_sync(inode, true); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/fork-fix-some-wmissing-prototypes-warnings.patch b/queue-4.14/fork-fix-some-wmissing-prototypes-warnings.patch new file mode 100644 index 00000000000..5b56642b878 --- /dev/null +++ b/queue-4.14/fork-fix-some-wmissing-prototypes-warnings.patch @@ -0,0 +1,83 @@ +From 0fba5b6aabc750749f6b2666db064ab6c2145169 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jan 2019 15:28:03 -0800 +Subject: fork: fix some -Wmissing-prototypes warnings + +From: Yi Wang + +[ Upstream commit fb5bf31722d0805a3f394f7d59f2e8cd07acccb7 ] + +We get a warning when building kernel with W=1: + + kernel/fork.c:167:13: warning: no previous prototype for `arch_release_thread_stack' [-Wmissing-prototypes] + kernel/fork.c:779:13: warning: no previous prototype for `fork_init' [-Wmissing-prototypes] + +Add the missing declaration in head file to fix this. + +Also, remove arch_release_thread_stack() completely because no arch +seems to implement it since bb9d81264 (arch: remove tile port). + +Link: http://lkml.kernel.org/r/1542170087-23645-1-git-send-email-wang.yi59@zte.com.cn +Signed-off-by: Yi Wang +Acked-by: Michal Hocko +Acked-by: Mike Rapoport +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/sched/task.h | 2 ++ + init/main.c | 1 - + kernel/fork.c | 5 ----- + 3 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h +index a74ec619ac510..11b4fba82950f 100644 +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void); + + extern void proc_caches_init(void); + ++extern void fork_init(void); ++ + extern void release_task(struct task_struct * p); + + #ifdef CONFIG_HAVE_COPY_THREAD_TLS +diff --git a/init/main.c b/init/main.c +index 51067e2db509d..b1ab36fe1a55c 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -98,7 +98,6 @@ + static int kernel_init(void *); + + extern void init_IRQ(void); +-extern void fork_init(void); + extern void radix_tree_init(void); + + /* +diff --git a/kernel/fork.c b/kernel/fork.c +index 3352fdbd5e20d..3d9d6a28e21d9 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -162,10 +162,6 @@ static inline void free_task_struct(struct task_struct *tsk) + } + #endif + +-void __weak arch_release_thread_stack(unsigned long *stack) +-{ +-} +- + #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR + + /* +@@ -348,7 +344,6 @@ static void release_task_stack(struct task_struct *tsk) + return; /* Better to leak the stack than to free prematurely */ + + account_kernel_stack(tsk, -1); +- arch_release_thread_stack(tsk->stack); + free_thread_stack(tsk); + tsk->stack = NULL; + #ifdef CONFIG_VMAP_STACK +-- +2.20.1 + diff --git a/queue-4.14/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch b/queue-4.14/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch new file mode 100644 index 00000000000..007926043f7 --- /dev/null +++ b/queue-4.14/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch @@ -0,0 +1,37 @@ +From ea37350230f478b81f79f3ea7a7ca59e7d059c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 08:29:32 -0600 +Subject: gfs2: take jdata unstuff into account in do_grow + +From: Bob Peterson + +[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ] + +Before this patch, function do_grow would not reserve enough journal +blocks in the transaction to unstuff jdata files while growing them. +This patch adds the logic to add one more block if the file to grow +is jdata. + +Signed-off-by: Bob Peterson +Reviewed-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/bmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 09432b25fe9b8..b3a1b16d4e3e3 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1445,6 +1445,8 @@ static int do_grow(struct inode *inode, u64 size) + } + + error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT + ++ (unstuff && ++ gfs2_is_jdata(ip) ? RES_JDATA : 0) + + (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ? + 0 : RES_QUOTA), 0); + if (error) +-- +2.20.1 + diff --git a/queue-4.14/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch b/queue-4.14/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch new file mode 100644 index 00000000000..4429c03d7a2 --- /dev/null +++ b/queue-4.14/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch @@ -0,0 +1,39 @@ +From 2c6b3f891ddfe27b969bf004e199e35c3d2e273a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 10:45:49 +0100 +Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB + +From: Krzysztof Kozlowski + +[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ] + +If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return +the same type of error as regular version: NULL. All the callers +compare the return value of gpio_to_desc() against NULL, so returned +ERR_PTR would be treated as non-error case leading to dereferencing of +error value. + +Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + include/linux/gpio/consumer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h +index c4a350d835788..79ad4f8b889dc 100644 +--- a/include/linux/gpio/consumer.h ++++ b/include/linux/gpio/consumer.h +@@ -404,7 +404,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) + + static inline struct gpio_desc *gpio_to_desc(unsigned gpio) + { +- return ERR_PTR(-EINVAL); ++ return NULL; + } + + static inline int desc_to_gpio(const struct gpio_desc *desc) +-- +2.20.1 + diff --git a/queue-4.14/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch b/queue-4.14/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch new file mode 100644 index 00000000000..bfaa8f1e7bb --- /dev/null +++ b/queue-4.14/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch @@ -0,0 +1,62 @@ +From 5aebd80f3d11a3cae6fca0eb2d04c1ce1269f850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 16:46:29 +0100 +Subject: gpu: ipu-v3: pre: don't trigger update if buffer address doesn't + change + +From: Lucas Stach + +[ Upstream commit eb0200a4357da100064971689d3a0e9e3cf57f33 ] + +On a NOP double buffer update where current buffer address is the same +as the next buffer address, the SDW_UPDATE bit clears too late. As we +are now using this bit to determine when it is safe to signal flip +completion to userspace this will delay completion of atomic commits +where one plane doesn't change the buffer by a whole frame period. + +Fix this by remembering the last buffer address and just skip the +double buffer update if it would not change the buffer address. + +Signed-off-by: Lucas Stach +[p.zabel@pengutronix.de: initialize last_bufaddr in ipu_pre_configure] +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-pre.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c +index 1d1612e28854b..6fd4af647f599 100644 +--- a/drivers/gpu/ipu-v3/ipu-pre.c ++++ b/drivers/gpu/ipu-v3/ipu-pre.c +@@ -102,6 +102,7 @@ struct ipu_pre { + void *buffer_virt; + bool in_use; + unsigned int safe_window_end; ++ unsigned int last_bufaddr; + }; + + static DEFINE_MUTEX(ipu_pre_list_mutex); +@@ -177,6 +178,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width, + + writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF); + writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); ++ pre->last_bufaddr = bufaddr; + + val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) | + IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) | +@@ -218,7 +220,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr) + unsigned short current_yblock; + u32 val; + ++ if (bufaddr == pre->last_bufaddr) ++ return; ++ + writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); ++ pre->last_bufaddr = bufaddr; + + do { + if (time_after(jiffies, timeout)) { +-- +2.20.1 + diff --git a/queue-4.14/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch b/queue-4.14/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch new file mode 100644 index 00000000000..6e23a7c031f --- /dev/null +++ b/queue-4.14/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch @@ -0,0 +1,32 @@ +From 3ff5f52aed51118629bf80f53c39e42d071c7055 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 11:28:51 +1000 +Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT + +From: Peter Hutterer + +[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ] + +Signed-off-by: Peter Hutterer +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + Documentation/hid/uhid.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt +index c8656dd029a91..958fff9453044 100644 +--- a/Documentation/hid/uhid.txt ++++ b/Documentation/hid/uhid.txt +@@ -160,7 +160,7 @@ them but you should handle them according to your needs. + UHID_OUTPUT: + This is sent if the HID device driver wants to send raw data to the I/O + device on the interrupt channel. You should read the payload and forward it to +- the device. The payload is of type "struct uhid_data_req". ++ the device. The payload is of type "struct uhid_output_req". + This may be received even though you haven't received UHID_OPEN, yet. + + UHID_GET_REPORT: +-- +2.20.1 + diff --git a/queue-4.14/hid-intel-ish-hid-fixes-incorrect-error-handling.patch b/queue-4.14/hid-intel-ish-hid-fixes-incorrect-error-handling.patch new file mode 100644 index 00000000000..ceaa4c22098 --- /dev/null +++ b/queue-4.14/hid-intel-ish-hid-fixes-incorrect-error-handling.patch @@ -0,0 +1,37 @@ +From fd48023afc8e2bc22be510a6e585b7d2f04117c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 08:52:33 +0800 +Subject: HID: intel-ish-hid: fixes incorrect error handling + +From: Pan Bian + +[ Upstream commit 6e0856d317440a950b17c00a9283114f025e5699 ] + +The memory chunk allocated by hid_allocate_device() should be released +by hid_destroy_device(), not kfree(). + +Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver") +Signed-off-by: Pan Bian +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c +index cd23903ddcf19..e918d78e541c0 100644 +--- a/drivers/hid/intel-ish-hid/ishtp-hid.c ++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c +@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, + err_hid_device: + kfree(hid_data); + err_hid_data: +- kfree(hid); ++ hid_destroy_device(hid); + return rv; + } + +-- +2.20.1 + diff --git a/queue-4.14/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch b/queue-4.14/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch new file mode 100644 index 00000000000..1ea2fa3268e --- /dev/null +++ b/queue-4.14/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch @@ -0,0 +1,38 @@ +From 9f57342da70f810e71ae1101bf292a2c17c198de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Dec 2018 10:05:36 +0300 +Subject: IB/qib: Fix an error code in qib_sdma_verbs_send() + +From: Dan Carpenter + +[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ] + +We accidentally return success on this error path. + +Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") +Signed-off-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qib/qib_sdma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c +index 891873b38a1e6..5f3f197678b78 100644 +--- a/drivers/infiniband/hw/qib/qib_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_sdma.c +@@ -600,8 +600,10 @@ retry: + dw = (len + 3) >> 2; + addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr, + dw << 2, DMA_TO_DEVICE); +- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) ++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) { ++ ret = -ENOMEM; + goto unmap; ++ } + sdmadesc[0] = 0; + make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset); + /* SDmaUseLargeBuf has to be set in every descriptor */ +-- +2.20.1 + diff --git a/queue-4.14/ib-rxe-make-counters-thread-safe.patch b/queue-4.14/ib-rxe-make-counters-thread-safe.patch new file mode 100644 index 00000000000..63855cd9fc4 --- /dev/null +++ b/queue-4.14/ib-rxe-make-counters-thread-safe.patch @@ -0,0 +1,62 @@ +From c3e976f4e99644a79ee4ef2e01bdb40654ccf3f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 00:32:42 -0600 +Subject: IB/rxe: Make counters thread safe + +From: Parav Pandit + +[ Upstream commit d5108e69fe013ff47ab815b849caba9cc33ca1e5 ] + +Current rxe device counters are not thread safe. +When multiple QPs are used, they can be racy. +Make them thread safe by making it atomic64. + +Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats") +Signed-off-by: Parav Pandit +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_hw_counters.c | 2 +- + drivers/infiniband/sw/rxe/rxe_verbs.h | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c +index 6aeb7a165e469..ea4542a9d69e6 100644 +--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c ++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c +@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev, + return -EINVAL; + + for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++) +- stats->value[cnt] = dev->stats_counters[cnt]; ++ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]); + + return ARRAY_SIZE(rxe_counter_name); + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index b2b76a316ebae..d1cc89f6f2e33 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -410,16 +410,16 @@ struct rxe_dev { + spinlock_t mmap_offset_lock; /* guard mmap_offset */ + int mmap_offset; + +- u64 stats_counters[RXE_NUM_OF_COUNTERS]; ++ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS]; + + struct rxe_port port; + struct list_head list; + struct crypto_shash *tfm; + }; + +-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt) ++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index) + { +- rxe->stats_counters[cnt]++; ++ atomic64_inc(&rxe->stats_counters[index]); + } + + static inline struct rxe_dev *to_rdev(struct ib_device *dev) +-- +2.20.1 + diff --git a/queue-4.14/idr-fix-idr_alloc_u32-on-32-bit-systems.patch b/queue-4.14/idr-fix-idr_alloc_u32-on-32-bit-systems.patch new file mode 100644 index 00000000000..890357b19ba --- /dev/null +++ b/queue-4.14/idr-fix-idr_alloc_u32-on-32-bit-systems.patch @@ -0,0 +1,35 @@ +From 5ca9aec84d88fce8b42f48e0979e1918f0aa1d5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2019 00:25:08 -0400 +Subject: idr: Fix idr_alloc_u32 on 32-bit systems + +From: Matthew Wilcox (Oracle) + +[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ] + +Attempting to allocate an entry at 0xffffffff when one is already +present would succeed in allocating one at 2^32, which would confuse +everything. Return -ENOSPC in this case, as expected. + +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + lib/radix-tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index d172f0341b807..ff00c816266b1 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -2184,7 +2184,7 @@ void __rcu **idr_get_free_cmn(struct radix_tree_root *root, + offset = radix_tree_find_next_bit(node, IDR_FREE, + offset + 1); + start = next_index(start, node, offset); +- if (start > max) ++ if (start > max || start == 0) + return ERR_PTR(-ENOSPC); + while (offset == RADIX_TREE_MAP_SIZE) { + offset = node->offset + 1; +-- +2.20.1 + diff --git a/queue-4.14/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch b/queue-4.14/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch new file mode 100644 index 00000000000..d84d0e34720 --- /dev/null +++ b/queue-4.14/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch @@ -0,0 +1,44 @@ +From 5932a1347b2ae51ec61654bca50714c3f44eb3f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2019 21:53:24 +0800 +Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid + +From: Aaron Ma + +[ Upstream commit bb6bccba390c7d743c1e4427de4ef284c8cc6869 ] + +Add a non-NULL check to fix potential NULL pointer dereference +Cleanup code to call function once. + +Signed-off-by: Aaron Ma +Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 07b6cf58fd99b..d09c24825734e 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key; + static inline int match_hid_uid(struct device *dev, + struct acpihid_map_entry *entry) + { ++ struct acpi_device *adev = ACPI_COMPANION(dev); + const char *hid, *uid; + +- hid = acpi_device_hid(ACPI_COMPANION(dev)); +- uid = acpi_device_uid(ACPI_COMPANION(dev)); ++ if (!adev) ++ return -ENODEV; ++ ++ hid = acpi_device_hid(adev); ++ uid = acpi_device_uid(adev); + + if (!hid || !(*hid)) + return -ENODEV; +-- +2.20.1 + diff --git a/queue-4.14/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch b/queue-4.14/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch new file mode 100644 index 00000000000..1b0c41f0e07 --- /dev/null +++ b/queue-4.14/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch @@ -0,0 +1,53 @@ +From a9bf31f674f7d416faa0cac3356c696c8f10162a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jan 2019 13:11:25 +0800 +Subject: ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel + +From: wenxu + +[ Upstream commit d71b57532d70c03f4671dd04e84157ac6bf021b0 ] + +ip l add dev tun type gretap key 1000 +ip a a dev tun 10.0.0.1/24 + +Packets with tun-id 1000 can be recived by tun dev. But packet can't +be sent through dev tun for non-tunnel-dst + +With this patch: tunnel-dst can be get through lwtunnel like beflow: +ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun + +Signed-off-by: wenxu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_tunnel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index fabc299cb875f..7a31287ff1232 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -661,13 +661,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + dst = tnl_params->daddr; + if (dst == 0) { + /* NBMA tunnel */ ++ struct ip_tunnel_info *tun_info; + + if (!skb_dst(skb)) { + dev->stats.tx_fifo_errors++; + goto tx_error; + } + +- if (skb->protocol == htons(ETH_P_IP)) { ++ tun_info = skb_tunnel_info(skb); ++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) && ++ ip_tunnel_info_af(tun_info) == AF_INET && ++ tun_info->key.u.ipv4.dst) ++ dst = tun_info->key.u.ipv4.dst; ++ else if (skb->protocol == htons(ETH_P_IP)) { + rt = skb_rtable(skb); + dst = rt_nexthop(rt, inner_iph->daddr); + } +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch b/queue-4.14/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch new file mode 100644 index 00000000000..dd99a1228ec --- /dev/null +++ b/queue-4.14/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch @@ -0,0 +1,130 @@ +From a15f22460764a17554e81e835175cd17bb0b8f8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Aug 2018 09:23:08 +0300 +Subject: iwlwifi: move iwl_nvm_check_version() into dvm + +From: Luca Coelho + +[ Upstream commit 64866e5da1eabd0c52ff45029b245f5465920031 ] + +This function is only half-used by mvm (i.e. only the nvm_version part +matters, since the calibration version is irrelevant), so it's +pointless to export it from iwlwifi. If mvm uses this function, it +has the additional complexity of setting the calib version to a bogus +value on all cfg structs. + +To avoid this, move the function to dvm and make a simple comparison +of the nvm_version in mvm instead. + +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/dvm/main.c | 17 +++++++++++++++++ + .../wireless/intel/iwlwifi/iwl-eeprom-parse.c | 19 ------------------- + .../wireless/intel/iwlwifi/iwl-eeprom-parse.h | 5 ++--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++- + 4 files changed, 22 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +index 2acd94da9efeb..051a2fea95724 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +@@ -1229,6 +1229,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv) + return 0; + } + ++static int iwl_nvm_check_version(struct iwl_nvm_data *data, ++ struct iwl_trans *trans) ++{ ++ if (data->nvm_version >= trans->cfg->nvm_ver || ++ data->calib_version >= trans->cfg->nvm_calib_ver) { ++ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", ++ data->nvm_version, data->calib_version); ++ return 0; ++ } ++ ++ IWL_ERR(trans, ++ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", ++ data->nvm_version, trans->cfg->nvm_ver, ++ data->calib_version, trans->cfg->nvm_calib_ver); ++ return -EINVAL; ++} ++ + static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, + const struct iwl_cfg *cfg, + const struct iwl_fw *fw, +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c +index 3199d345b4274..92727f7e42db7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c +@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, + return NULL; + } + IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data); +- +-/* helper functions */ +-int iwl_nvm_check_version(struct iwl_nvm_data *data, +- struct iwl_trans *trans) +-{ +- if (data->nvm_version >= trans->cfg->nvm_ver || +- data->calib_version >= trans->cfg->nvm_calib_ver) { +- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", +- data->nvm_version, data->calib_version); +- return 0; +- } +- +- IWL_ERR(trans, +- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", +- data->nvm_version, trans->cfg->nvm_ver, +- data->calib_version, trans->cfg->nvm_calib_ver); +- return -EINVAL; +-} +-IWL_EXPORT_SYMBOL(iwl_nvm_check_version); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h +index b33888991b946..5545210151cd9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h +@@ -7,6 +7,7 @@ + * + * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -33,6 +34,7 @@ + * + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -121,9 +123,6 @@ struct iwl_nvm_data * + iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, + const u8 *eeprom, size_t eeprom_size); + +-int iwl_nvm_check_version(struct iwl_nvm_data *data, +- struct iwl_trans *trans); +- + int iwl_init_sband_channels(struct iwl_nvm_data *data, + struct ieee80211_supported_band *sband, + int n_channels, enum nl80211_band band); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 534c0ea7b232e..78228f870f8f5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -501,7 +501,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm) + if (mvm->nvm_file_name) + iwl_mvm_load_nvm_to_nic(mvm); + +- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans)); ++ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver, ++ "Too old NVM version (0x%0x, required = 0x%0x)", ++ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver); + + /* + * abort after reading the nvm in case RF Kill is on, we will complete +-- +2.20.1 + diff --git a/queue-4.14/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch b/queue-4.14/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch new file mode 100644 index 00000000000..79e73624912 --- /dev/null +++ b/queue-4.14/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch @@ -0,0 +1,45 @@ +From c1b193c13b7aab4957cc1e6c83ce3374fccb0c2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 16:12:57 +0100 +Subject: kprobes/x86/xen: blacklist non-attachable xen interrupt functions + +From: Andrea Righi + +[ Upstream commit bf9445a33ae6ac2f0822d2f1ce1365408387d568 ] + +Blacklist symbols in Xen probe-prohibited areas, so that user can see +these prohibited symbols in debugfs. + +See also: a50480cb6d61. + +Signed-off-by: Andrea Righi +Acked-by: Masami Hiramatsu +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/xen-asm_64.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S +index 3a6feed76dfc1..a93d8a7cef26c 100644 +--- a/arch/x86/xen/xen-asm_64.S ++++ b/arch/x86/xen/xen-asm_64.S +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #include + +@@ -24,6 +25,7 @@ ENTRY(xen_\name) + pop %r11 + jmp \name + END(xen_\name) ++_ASM_NOKPROBE(xen_\name) + .endm + + xen_pv_trap divide_error +-- +2.20.1 + diff --git a/queue-4.14/kvm-properly-check-debugfs-dentry-before-using-it.patch b/queue-4.14/kvm-properly-check-debugfs-dentry-before-using-it.patch new file mode 100644 index 00000000000..6d79e2205d2 --- /dev/null +++ b/queue-4.14/kvm-properly-check-debugfs-dentry-before-using-it.patch @@ -0,0 +1,49 @@ +From ecdfc7aa3cd932ba557ec52d5bba24c037b91ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Feb 2019 16:34:37 +0100 +Subject: kvm: properly check debugfs dentry before using it +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Kroah-Hartman + +[ Upstream commit 8ed0579c12b2fe56a1fac2f712f58fc26c1dc49b ] + +debugfs can now report an error code if something went wrong instead of +just NULL. So if the return value is to be used as a "real" dentry, it +needs to be checked if it is an error before dereferencing it. + +This is now happening because of ff9fb72bc077 ("debugfs: return error +values, not NULL"). syzbot has found a way to trigger multiple debugfs +files attempting to be created, which fails, and then the error code +gets passed to dentry_path_raw() which obviously does not like it. + +Reported-by: Eric Biggers +Reported-and-tested-by: syzbot+7857962b4d45e602b8ad@syzkaller.appspotmail.com +Cc: "Radim Krčmář" +Cc: kvm@vger.kernel.org +Acked-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + virt/kvm/kvm_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index cdaacdf7bc877..deff4b3eb9722 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -3989,7 +3989,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) + } + add_uevent_var(env, "PID=%d", kvm->userspace_pid); + +- if (kvm->debugfs_dentry) { ++ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) { + char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL); + + if (p) { +-- +2.20.1 + diff --git a/queue-4.14/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch b/queue-4.14/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch new file mode 100644 index 00000000000..4000d77dacc --- /dev/null +++ b/queue-4.14/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch @@ -0,0 +1,67 @@ +From b7d52adc0a23a645a397c740c1287408d6461980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 15:32:06 +0100 +Subject: KVM: s390: unregister debug feature on failing arch init + +From: Michael Mueller + +[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ] + +Make sure the debug feature and its allocated resources get +released upon unsuccessful architecture initialization. + +A related indication of the issue will be reported as kernel +message. + +Signed-off-by: Michael Mueller +Reviewed-by: Cornelia Huck +Reviewed-by: Pierre Morel +Reviewed-by: David Hildenbrand +Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com> +Signed-off-by: Christian Borntraeger +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index ff62a4fe2159a..91c24e87fe10a 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -361,19 +361,30 @@ static void kvm_s390_cpu_feat_init(void) + + int kvm_arch_init(void *opaque) + { ++ int rc; ++ + kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long)); + if (!kvm_s390_dbf) + return -ENOMEM; + + if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) { +- debug_unregister(kvm_s390_dbf); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto out_debug_unreg; + } + + kvm_s390_cpu_feat_init(); + + /* Register floating interrupt controller interface. */ +- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ if (rc) { ++ pr_err("Failed to register FLIC rc=%d\n", rc); ++ goto out_debug_unreg; ++ } ++ return 0; ++ ++out_debug_unreg: ++ debug_unregister(kvm_s390_dbf); ++ return rc; + } + + void kvm_arch_exit(void) +-- +2.20.1 + diff --git a/queue-4.14/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch b/queue-4.14/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch new file mode 100644 index 00000000000..59ce653f475 --- /dev/null +++ b/queue-4.14/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch @@ -0,0 +1,52 @@ +From 798d2efcc9ff90615e2942b5871ec2ae93fb6fc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 15:28:58 -0800 +Subject: kvm: vmx: Set IA32_TSC_AUX for legacy mode guests + +From: Jim Mattson + +[ Upstream commit 0023ef39dc35c773c436eaa46ca539a26b308b55 ] + +RDTSCP is supported in legacy mode as well as long mode. The +IA32_TSC_AUX MSR should be set to the correct guest value before +entering any guest that supports RDTSCP. + +Fixes: 4e47c7a6d714 ("KVM: VMX: Add instruction rdtscp support for guest") +Signed-off-by: Jim Mattson +Reviewed-by: Peter Shier +Reviewed-by: Marc Orr +Reviewed-by: Liran Alon +Reviewed-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f67fc0f359ff3..76f353aef577f 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2818,9 +2818,6 @@ static void setup_msrs(struct vcpu_vmx *vmx) + index = __find_msr_index(vmx, MSR_CSTAR); + if (index >= 0) + move_msr_up(vmx, index, save_nmsrs++); +- index = __find_msr_index(vmx, MSR_TSC_AUX); +- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) +- move_msr_up(vmx, index, save_nmsrs++); + /* + * MSR_STAR is only needed on long mode guests, and only + * if efer.sce is enabled. +@@ -2833,6 +2830,9 @@ static void setup_msrs(struct vcpu_vmx *vmx) + index = __find_msr_index(vmx, MSR_EFER); + if (index >= 0 && update_transition_efer(vmx, index)) + move_msr_up(vmx, index, save_nmsrs++); ++ index = __find_msr_index(vmx, MSR_TSC_AUX); ++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) ++ move_msr_up(vmx, index, save_nmsrs++); + + vmx->save_nmsrs = save_nmsrs; + +-- +2.20.1 + diff --git a/queue-4.14/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch b/queue-4.14/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch new file mode 100644 index 00000000000..267051cd6f3 --- /dev/null +++ b/queue-4.14/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch @@ -0,0 +1,167 @@ +From 8030afaf5e422aabf6d00ce2a2d10906ba78cb7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jan 2019 15:26:44 -0800 +Subject: lib/genalloc.c: fix allocation of aligned buffer from non-aligned + chunk + +From: Alexey Skidanov + +[ Upstream commit 52fbf1134d479234d7e64ba9dcbaea23405f229e ] + +gen_pool_alloc_algo() uses different allocation functions implementing +different allocation algorithms. With gen_pool_first_fit_align() +allocation function, the returned address should be aligned on the +requested boundary. + +If chunk start address isn't aligned on the requested boundary, the +returned address isn't aligned too. The only way to get properly +aligned address is to initialize the pool with chunks aligned on the +requested boundary. If want to have an ability to allocate buffers +aligned on different boundaries (for example, 4K, 1MB, ...), the chunk +start address should be aligned on the max possible alignment. + +This happens because gen_pool_first_fit_align() looks for properly +aligned memory block without taking into account the chunk start address +alignment. + +To fix this, we provide chunk start address to +gen_pool_first_fit_align() and change its implementation such that it +starts looking for properly aligned block with appropriate offset +(exactly as is done in CMA). + +Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com +Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com +Signed-off-by: Alexey Skidanov +Reviewed-by: Andrew Morton +Cc: Logan Gunthorpe +Cc: Daniel Mentz +Cc: Mathieu Desnoyers +Cc: Laura Abbott +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/genalloc.h | 13 +++++++------ + lib/genalloc.c | 20 ++++++++++++-------- + 2 files changed, 19 insertions(+), 14 deletions(-) + +diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h +index 872f930f1b06d..dd0a452373e71 100644 +--- a/include/linux/genalloc.h ++++ b/include/linux/genalloc.h +@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map, + unsigned long size, + unsigned long start, + unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, ++ unsigned long start_addr); + + /* + * General purpose special memory pool descriptor. +@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo, + + extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool); ++ struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_fixed_alloc(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_first_fit_align(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + + extern unsigned long gen_pool_first_fit_order_align(unsigned long *map, + unsigned long size, unsigned long start, unsigned int nr, +- void *data, struct gen_pool *pool); ++ void *data, struct gen_pool *pool, unsigned long start_addr); + + extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool); ++ struct gen_pool *pool, unsigned long start_addr); + + + extern struct gen_pool *devm_gen_pool_create(struct device *dev, +diff --git a/lib/genalloc.c b/lib/genalloc.c +index ca06adc4f4451..5deb25c40a5a1 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -311,7 +311,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, + end_bit = chunk_size(chunk) >> order; + retry: + start_bit = algo(chunk->bits, end_bit, start_bit, +- nbits, data, pool); ++ nbits, data, pool, chunk->start_addr); + if (start_bit >= end_bit) + continue; + remain = bitmap_set_ll(chunk->bits, start_bit, nbits); +@@ -525,7 +525,7 @@ EXPORT_SYMBOL(gen_pool_set_algo); + */ + unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + return bitmap_find_next_zero_area(map, size, start, nr, 0); + } +@@ -543,16 +543,19 @@ EXPORT_SYMBOL(gen_pool_first_fit); + */ + unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + struct genpool_data_align *alignment; +- unsigned long align_mask; ++ unsigned long align_mask, align_off; + int order; + + alignment = data; + order = pool->min_alloc_order; + align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1; +- return bitmap_find_next_zero_area(map, size, start, nr, align_mask); ++ align_off = (start_addr & (alignment->align - 1)) >> order; ++ ++ return bitmap_find_next_zero_area_off(map, size, start, nr, ++ align_mask, align_off); + } + EXPORT_SYMBOL(gen_pool_first_fit_align); + +@@ -567,7 +570,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align); + */ + unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + struct genpool_data_fixed *fixed_data; + int order; +@@ -601,7 +604,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc); + */ + unsigned long gen_pool_first_fit_order_align(unsigned long *map, + unsigned long size, unsigned long start, +- unsigned int nr, void *data, struct gen_pool *pool) ++ unsigned int nr, void *data, struct gen_pool *pool, ++ unsigned long start_addr) + { + unsigned long align_mask = roundup_pow_of_two(nr) - 1; + +@@ -624,7 +628,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align); + */ + unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, + unsigned long start, unsigned int nr, void *data, +- struct gen_pool *pool) ++ struct gen_pool *pool, unsigned long start_addr) + { + unsigned long start_bit = size; + unsigned long len = size + 1; +-- +2.20.1 + diff --git a/queue-4.14/lib-genalloc.c-include-vmalloc.h.patch b/queue-4.14/lib-genalloc.c-include-vmalloc.h.patch new file mode 100644 index 00000000000..5fbfddbccbf --- /dev/null +++ b/queue-4.14/lib-genalloc.c-include-vmalloc.h.patch @@ -0,0 +1,43 @@ +From 760a42a4a528814c9a1649a811b0222c39445502 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jan 2019 13:21:18 -0800 +Subject: lib/genalloc.c: include vmalloc.h + +From: Olof Johansson + +[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ] + +Fixes build break on most ARM/ARM64 defconfigs: + + lib/genalloc.c: In function 'gen_pool_add_virt': + lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'? + lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + lib/genalloc.c: In function 'gen_pool_destroy': + lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'? + +Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap') +Cc: Huang Shijie +Cc: Andrew Morton +Cc: Alexey Skidanov +Signed-off-by: Olof Johansson +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/genalloc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/genalloc.c b/lib/genalloc.c +index f365d71cdc774..7e85d1e37a6ea 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + static inline size_t chunk_size(const struct gen_pool_chunk *chunk) + { +-- +2.20.1 + diff --git a/queue-4.14/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch b/queue-4.14/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch new file mode 100644 index 00000000000..464e91b2891 --- /dev/null +++ b/queue-4.14/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch @@ -0,0 +1,52 @@ +From 4a68eb8d9cc1953398d2864a199877ad48214d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jan 2019 15:26:51 -0800 +Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap + +From: Huang Shijie + +[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ] + +Some devices may have big memory on chip, such as over 1G. In some +cases, the nbytes maybe bigger then 4M which is the bounday of the +memory buddy system (4K default). + +So use vzalloc_node() to allocate the bitmap. Also use vfree to free +it. + +Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai +Signed-off-by: Huang Shijie +Reviewed-by: Andrew Morton +Cc: Alexey Skidanov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/genalloc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/genalloc.c b/lib/genalloc.c +index 5deb25c40a5a1..f365d71cdc774 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + int nbytes = sizeof(struct gen_pool_chunk) + + BITS_TO_LONGS(nbits) * sizeof(long); + +- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid); ++ chunk = vzalloc_node(nbytes, nid); + if (unlikely(chunk == NULL)) + return -ENOMEM; + +@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool) + bit = find_next_bit(chunk->bits, end_bit, 0); + BUG_ON(bit < end_bit); + +- kfree(chunk); ++ vfree(chunk); + } + kfree_const(pool->name); + kfree(pool); +-- +2.20.1 + diff --git a/queue-4.14/mac80211-fix-station-inactive_time-shortly-after-boo.patch b/queue-4.14/mac80211-fix-station-inactive_time-shortly-after-boo.patch new file mode 100644 index 00000000000..c3e287234de --- /dev/null +++ b/queue-4.14/mac80211-fix-station-inactive_time-shortly-after-boo.patch @@ -0,0 +1,47 @@ +From 40546a35019a2c406eeed7d0c83700ffdc421e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 06:12:43 -0600 +Subject: mac80211: fix station inactive_time shortly after boot + +From: Ahmed Zaki + +[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ] + +In the first 5 minutes after boot (time of INITIAL_JIFFIES), +ieee80211_sta_last_active() returns zero if last_ack is zero. This +leads to "inactive time" showing jiffies_to_msecs(jiffies). + + # iw wlan0 station get fc:ec:da:64:a6:dd + Station fc:ec:da:64:a6:dd (on wlan0) + inactive time: 4294894049 ms + . + . + connected time: 70 seconds + +Fix by returning last_rx if last_ack == 0. + +Signed-off-by: Ahmed Zaki +Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index f1b496222bda6..1a86974b02e39 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2313,7 +2313,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta) + { + struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta); + +- if (time_after(stats->last_rx, sta->status_stats.last_ack)) ++ if (!sta->status_stats.last_ack || ++ time_after(stats->last_rx, sta->status_stats.last_ack)) + return stats->last_rx; + return sta->status_stats.last_ack; + } +-- +2.20.1 + diff --git a/queue-4.14/microblaze-adjust-the-help-to-the-real-behavior.patch b/queue-4.14/microblaze-adjust-the-help-to-the-real-behavior.patch new file mode 100644 index 00000000000..6b2864b5b1c --- /dev/null +++ b/queue-4.14/microblaze-adjust-the-help-to-the-real-behavior.patch @@ -0,0 +1,61 @@ +From d736f0da3c690441ad4599f48f66599147c2da5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 20:33:52 +0900 +Subject: microblaze: adjust the help to the real behavior + +From: Masahiro Yamada + +[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ] + +"make ARCH=microblaze help" mentions simpleImage.
.unstrip, +but it is not a real Make target. It does not work because Makefile +assumes "system.unstrip" is the name of DT. + +$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip + [ snip ] +make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'. Stop. +make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2 +make: *** Waiting for unfinished jobs.... + +simpleImage.
works like a phony target that generates multiple +images. Reflect the real behavior. I removed the DT directory path +information because it is already explained a few lines below. + +While I am here, I deleted the redundant *_defconfig explanation. + +The top-level Makefile caters to list available defconfig files: + + mmu_defconfig - Build for mmu + nommu_defconfig - Build for nommu + +Signed-off-by: Masahiro Yamada +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/microblaze/Makefile | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile +index d269dd4b82795..188f07bba0959 100644 +--- a/arch/microblaze/Makefile ++++ b/arch/microblaze/Makefile +@@ -91,11 +91,11 @@ define archhelp + echo '* linux.bin - Create raw binary' + echo ' linux.bin.gz - Create compressed raw binary' + echo ' linux.bin.ub - Create U-Boot wrapped raw binary' +- echo ' simpleImage.
- ELF image with $(arch)/boot/dts/
.dts linked in' +- echo ' - stripped elf with fdt blob' +- echo ' simpleImage.
.unstrip - full ELF image with fdt blob' +- echo ' *_defconfig - Select default config from arch/microblaze/configs' +- echo '' ++ echo ' simpleImage.
- Create the following images with
.dtb linked in' ++ echo ' simpleImage.
: raw image' ++ echo ' simpleImage.
.ub : raw image with U-Boot header' ++ echo ' simpleImage.
.unstrip: ELF (identical to vmlinux)' ++ echo ' simpleImage.
.strip : stripped ELF' + echo ' Targets with
embed a device tree blob inside the image' + echo ' These targets support board with firmware that does not' + echo ' support passing a device tree directly. Replace
with the' +-- +2.20.1 + diff --git a/queue-4.14/microblaze-move-.-is-ready-messages-to-arch-microbla.patch b/queue-4.14/microblaze-move-.-is-ready-messages-to-arch-microbla.patch new file mode 100644 index 00000000000..1dea9cf7a5f --- /dev/null +++ b/queue-4.14/microblaze-move-.-is-ready-messages-to-arch-microbla.patch @@ -0,0 +1,66 @@ +From f5674e2161197bfc7f02b65ba33914a8c70c9ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 20:33:53 +0900 +Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile + +From: Masahiro Yamada + +[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ] + +To prepare for more fixes, move this to arch/microblaze/Makefile. +Otherwise, the same "... is ready" would be printed multiple times. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/microblaze/Makefile | 2 ++ + arch/microblaze/boot/Makefile | 4 ---- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile +index 188f07bba0959..fe5e48184c3c2 100644 +--- a/arch/microblaze/Makefile ++++ b/arch/microblaze/Makefile +@@ -83,9 +83,11 @@ archclean: + + linux.bin linux.bin.gz linux.bin.ub: vmlinux + $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ ++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' + + simpleImage.%: vmlinux + $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ ++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' + + define archhelp + echo '* linux.bin - Create raw binary' +diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile +index 7c2f52d4a0e45..49dbd1063d717 100644 +--- a/arch/microblaze/boot/Makefile ++++ b/arch/microblaze/boot/Makefile +@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary + + $(obj)/linux.bin: vmlinux FORCE + $(call if_changed,objcopy) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE + $(call if_changed,uimage) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE + $(call if_changed,gzip) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' + + quiet_cmd_cp = CP $< $@$2 + cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) +@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE + $(call if_changed,objcopy) + $(call if_changed,uimage) + $(call if_changed,strip,.strip) +- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' + + clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb +-- +2.20.1 + diff --git a/queue-4.14/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch b/queue-4.14/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch new file mode 100644 index 00000000000..2bb402b843c --- /dev/null +++ b/queue-4.14/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch @@ -0,0 +1,181 @@ +From 2fe6d3340c6c66b16de064110b959b46392f0d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 16:18:25 +0100 +Subject: mmc: meson-gx: make sure the descriptor is stopped on errors + +From: Jerome Brunet + +[ Upstream commit 18f92bc02f1739b5c4d5b70009fbb7eada45bca3 ] + +On errors, if we don't stop the descriptor chain, it may continue to +run and raise IRQ after we have called mmc_request_done(). This is bad +because we won't be able to get cmd anymore and properly deal with the +IRQ. + +This patch makes sure the descriptor chain is stopped before +calling mmc_request_done() + +Fixes: 79ed05e329c3 ("mmc: meson-gx: add support for descriptor chain mode") +Signed-off-by: Jerome Brunet +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++++----- + 1 file changed, 63 insertions(+), 10 deletions(-) + +diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c +index 08a55c2e96e1b..53ce1bb83d2c5 100644 +--- a/drivers/mmc/host/meson-gx-mmc.c ++++ b/drivers/mmc/host/meson-gx-mmc.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -74,9 +75,11 @@ + #define CFG_CLK_ALWAYS_ON BIT(18) + #define CFG_CHK_DS BIT(20) + #define CFG_AUTO_CLK BIT(23) ++#define CFG_ERR_ABORT BIT(27) + + #define SD_EMMC_STATUS 0x48 + #define STATUS_BUSY BIT(31) ++#define STATUS_DESC_BUSY BIT(30) + #define STATUS_DATI GENMASK(23, 16) + + #define SD_EMMC_IRQ_EN 0x4c +@@ -905,6 +908,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd) + + cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode); + cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */ ++ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */ + + meson_mmc_set_response_bits(cmd, &cmd_cfg); + +@@ -999,6 +1003,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) + u32 irq_en, status, raw_status; + irqreturn_t ret = IRQ_NONE; + ++ irq_en = readl(host->regs + SD_EMMC_IRQ_EN); ++ raw_status = readl(host->regs + SD_EMMC_STATUS); ++ status = raw_status & irq_en; ++ ++ if (!status) { ++ dev_dbg(host->dev, ++ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n", ++ irq_en, raw_status); ++ return IRQ_NONE; ++ } ++ + if (WARN_ON(!host) || WARN_ON(!host->cmd)) + return IRQ_NONE; + +@@ -1006,22 +1021,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) + + cmd = host->cmd; + data = cmd->data; +- irq_en = readl(host->regs + SD_EMMC_IRQ_EN); +- raw_status = readl(host->regs + SD_EMMC_STATUS); +- status = raw_status & irq_en; +- + cmd->error = 0; + if (status & IRQ_CRC_ERR) { + dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status); + cmd->error = -EILSEQ; +- ret = IRQ_HANDLED; ++ ret = IRQ_WAKE_THREAD; + goto out; + } + + if (status & IRQ_TIMEOUTS) { + dev_dbg(host->dev, "Timeout - status 0x%08x\n", status); + cmd->error = -ETIMEDOUT; +- ret = IRQ_HANDLED; ++ ret = IRQ_WAKE_THREAD; + goto out; + } + +@@ -1046,17 +1057,49 @@ out: + /* ack all enabled interrupts */ + writel(irq_en, host->regs + SD_EMMC_STATUS); + ++ if (cmd->error) { ++ /* Stop desc in case of errors */ ++ u32 start = readl(host->regs + SD_EMMC_START); ++ ++ start &= ~START_DESC_BUSY; ++ writel(start, host->regs + SD_EMMC_START); ++ } ++ + if (ret == IRQ_HANDLED) + meson_mmc_request_done(host->mmc, cmd->mrq); +- else if (ret == IRQ_NONE) +- dev_warn(host->dev, +- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n", +- raw_status, irq_en); + + spin_unlock(&host->lock); + return ret; + } + ++static int meson_mmc_wait_desc_stop(struct meson_host *host) ++{ ++ int loop; ++ u32 status; ++ ++ /* ++ * It may sometimes take a while for it to actually halt. Here, we ++ * are giving it 5ms to comply ++ * ++ * If we don't confirm the descriptor is stopped, it might raise new ++ * IRQs after we have called mmc_request_done() which is bad. ++ */ ++ for (loop = 50; loop; loop--) { ++ status = readl(host->regs + SD_EMMC_STATUS); ++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) ++ udelay(100); ++ else ++ break; ++ } ++ ++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) { ++ dev_err(host->dev, "Timed out waiting for host to stop\n"); ++ return -ETIMEDOUT; ++ } ++ ++ return 0; ++} ++ + static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) + { + struct meson_host *host = dev_id; +@@ -1067,6 +1110,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) + if (WARN_ON(!cmd)) + return IRQ_NONE; + ++ if (cmd->error) { ++ meson_mmc_wait_desc_stop(host); ++ meson_mmc_request_done(host->mmc, cmd->mrq); ++ ++ return IRQ_HANDLED; ++ } ++ + data = cmd->data; + if (meson_mmc_bounce_buf_read(data)) { + xfer_bytes = data->blksz * data->blocks; +@@ -1107,6 +1157,9 @@ static void meson_mmc_cfg_init(struct meson_host *host) + cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP)); + cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE)); + ++ /* abort chain on R/W errors */ ++ cfg |= CFG_ERR_ABORT; ++ + writel(cfg, host->regs + SD_EMMC_CFG); + } + +-- +2.20.1 + diff --git a/queue-4.14/mtd-check-add_mtd_device-ret-code.patch b/queue-4.14/mtd-check-add_mtd_device-ret-code.patch new file mode 100644 index 00000000000..3303e8de823 --- /dev/null +++ b/queue-4.14/mtd-check-add_mtd_device-ret-code.patch @@ -0,0 +1,113 @@ +From dd022c3a53d5de1e1a7e34b3457b20afa2564387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jan 2019 15:36:54 +0100 +Subject: mtd: Check add_mtd_device() ret code + +From: Boris Brezillon + +[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ] + +add_mtd_device() can fail. We should always check its return value +and gracefully handle the failure case. Fix the call sites where this +not done (in mtdpart.c) and add a __must_check attribute to the +prototype to avoid this kind of mistakes. + +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.h | 2 +- + drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++----- + 2 files changed, 32 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h +index 37accfd0400e5..24480b75a88dd 100644 +--- a/drivers/mtd/mtdcore.h ++++ b/drivers/mtd/mtdcore.h +@@ -7,7 +7,7 @@ + extern struct mutex mtd_table_mutex; + + struct mtd_info *__mtd_next_device(int i); +-int add_mtd_device(struct mtd_info *mtd); ++int __must_check add_mtd_device(struct mtd_info *mtd); + int del_mtd_device(struct mtd_info *mtd); + int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int); + int del_mtd_partitions(struct mtd_info *); +diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c +index a308e707392d5..27d9785487d69 100644 +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -684,10 +684,22 @@ int mtd_add_partition(struct mtd_info *parent, const char *name, + list_add(&new->list, &mtd_partitions); + mutex_unlock(&mtd_partitions_mutex); + +- add_mtd_device(&new->mtd); ++ ret = add_mtd_device(&new->mtd); ++ if (ret) ++ goto err_remove_part; + + mtd_add_partition_attrs(new); + ++ return 0; ++ ++err_remove_part: ++ mutex_lock(&mtd_partitions_mutex); ++ list_del(&new->list); ++ mutex_unlock(&mtd_partitions_mutex); ++ ++ free_partition(new); ++ pr_info("%s:%i\n", __func__, __LINE__); ++ + return ret; + } + EXPORT_SYMBOL_GPL(mtd_add_partition); +@@ -778,22 +790,31 @@ int add_mtd_partitions(struct mtd_info *master, + { + struct mtd_part *slave; + uint64_t cur_offset = 0; +- int i; ++ int i, ret; + + printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name); + + for (i = 0; i < nbparts; i++) { + slave = allocate_partition(master, parts + i, i, cur_offset); + if (IS_ERR(slave)) { +- del_mtd_partitions(master); +- return PTR_ERR(slave); ++ ret = PTR_ERR(slave); ++ goto err_del_partitions; + } + + mutex_lock(&mtd_partitions_mutex); + list_add(&slave->list, &mtd_partitions); + mutex_unlock(&mtd_partitions_mutex); + +- add_mtd_device(&slave->mtd); ++ ret = add_mtd_device(&slave->mtd); ++ if (ret) { ++ mutex_lock(&mtd_partitions_mutex); ++ list_del(&slave->list); ++ mutex_unlock(&mtd_partitions_mutex); ++ ++ free_partition(slave); ++ goto err_del_partitions; ++ } ++ + mtd_add_partition_attrs(slave); + if (parts[i].types) + mtd_parse_part(slave, parts[i].types); +@@ -802,6 +823,11 @@ int add_mtd_partitions(struct mtd_info *master, + } + + return 0; ++ ++err_del_partitions: ++ del_mtd_partitions(master); ++ ++ return ret; + } + + static DEFINE_SPINLOCK(part_parser_lock); +-- +2.20.1 + diff --git a/queue-4.14/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch b/queue-4.14/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch new file mode 100644 index 00000000000..ecc111fa744 --- /dev/null +++ b/queue-4.14/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch @@ -0,0 +1,38 @@ +From 3816fefeda6f45ceec4c3d5b5331eec8a9f6af7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Dec 2018 09:34:17 +0100 +Subject: mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET + +From: Boris Brezillon + +[ Upstream commit 732774437ae01d9882e60314e303898e63c7f038 ] + +The opcodes used by the controller when doing batched page prog should +be written in NFC_REG_WCMD_SET not FC_REG_RCMD_SET. Luckily, the +default NFC_REG_WCMD_SET value matches the one we set in the driver +which explains why we didn't notice the problem. + +Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations") +Signed-off-by: Boris Brezillon +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/sunxi_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index 9589748215821..8e52314823976 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -1435,7 +1435,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd, + sunxi_nfc_randomizer_enable(mtd); + + writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG, +- nfc->regs + NFC_REG_RCMD_SET); ++ nfc->regs + NFC_REG_WCMD_SET); + + dma_async_issue_pending(nfc->dmac); + +-- +2.20.1 + diff --git a/queue-4.14/mtd-remove-a-debug-trace-in-mtdpart.c.patch b/queue-4.14/mtd-remove-a-debug-trace-in-mtdpart.c.patch new file mode 100644 index 00000000000..36b9193db6d --- /dev/null +++ b/queue-4.14/mtd-remove-a-debug-trace-in-mtdpart.c.patch @@ -0,0 +1,35 @@ +From d8bb4ab519a3e8943d4224932a2b721e8161b2b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jan 2019 09:47:00 +0100 +Subject: mtd: Remove a debug trace in mtdpart.c + +From: Boris Brezillon + +[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ] + +Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained +a leftover of the debug session that led to this bug fix. Remove this +pr_info(). + +Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdpart.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c +index 27d9785487d69..45626b0eed643 100644 +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -698,7 +698,6 @@ err_remove_part: + mutex_unlock(&mtd_partitions_mutex); + + free_partition(new); +- pr_info("%s:%i\n", __func__, __LINE__); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.14/mwifiex-debugfs-correct-histogram-spacing-formatting.patch b/queue-4.14/mwifiex-debugfs-correct-histogram-spacing-formatting.patch new file mode 100644 index 00000000000..a8c30028565 --- /dev/null +++ b/queue-4.14/mwifiex-debugfs-correct-histogram-spacing-formatting.patch @@ -0,0 +1,67 @@ +From ab421d8390ed481e627063431306008ab49d3f61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 14:26:55 -0800 +Subject: mwifiex: debugfs: correct histogram spacing, formatting + +From: Brian Norris + +[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ] + +Currently, snippets of this file look like: + +rx rates (in Mbps): 0=1M 1=2M2=5.5M 3=11M 4=6M 5=9M 6=12M +7=18M 8=24M 9=36M 10=48M 11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40) +44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80) +... +noise_flr[--96dBm] = 22 +noise_flr[--95dBm] = 149 +noise_flr[--94dBm] = 9 +noise_flr[--93dBm] = 2 + +We're missing some spaces, and we're adding a minus sign ('-') on values +that are already negative signed integers. + +Signed-off-by: Brian Norris +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/debugfs.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c +index 6f4239be609d0..49ca84ef1a992 100644 +--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c ++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c +@@ -296,15 +296,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + "total samples = %d\n", + atomic_read(&phist_data->num_samples)); + +- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M"); +- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n"); +- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M"); +- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); ++ p += sprintf(p, ++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n" ++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); + + if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) { +- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)"); +- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)"); +- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n"); ++ p += sprintf(p, ++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n"); + } else { + p += sprintf(p, "\n"); + } +@@ -333,7 +331,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, + for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) { + value = atomic_read(&phist_data->noise_flr[i]); + if (value) +- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n", ++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n", + (int)(i-128), value); + } + for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) { +-- +2.20.1 + diff --git a/queue-4.14/mwifiex-fix-potential-null-dereference-and-use-after.patch b/queue-4.14/mwifiex-fix-potential-null-dereference-and-use-after.patch new file mode 100644 index 00000000000..3179b4713fe --- /dev/null +++ b/queue-4.14/mwifiex-fix-potential-null-dereference-and-use-after.patch @@ -0,0 +1,55 @@ +From 81c355cacdeadcb2969ace22d751436c97db597a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 18:25:19 +0800 +Subject: mwifiex: fix potential NULL dereference and use after free + +From: Pan Bian + +[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ] + +There are two defects: (1) passing a NULL bss to +mwifiex_save_hidden_ssid_channels will result in NULL dereference, +(2) using bss after dropping the reference to it via cfg80211_put_bss. +To fix them, the patch moves the buggy code to the branch that bss is +not NULL and puts it before cfg80211_put_bss. + +Signed-off-by: Pan Bian +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index 67c3342210777..c013c94fbf15f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -1901,15 +1901,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, + ETH_ALEN)) + mwifiex_update_curr_bss_params(priv, + bss); +- cfg80211_put_bss(priv->wdev.wiphy, bss); +- } + +- if ((chan->flags & IEEE80211_CHAN_RADAR) || +- (chan->flags & IEEE80211_CHAN_NO_IR)) { +- mwifiex_dbg(adapter, INFO, +- "radar or passive channel %d\n", +- channel); +- mwifiex_save_hidden_ssid_channels(priv, bss); ++ if ((chan->flags & IEEE80211_CHAN_RADAR) || ++ (chan->flags & IEEE80211_CHAN_NO_IR)) { ++ mwifiex_dbg(adapter, INFO, ++ "radar or passive channel %d\n", ++ channel); ++ mwifiex_save_hidden_ssid_channels(priv, ++ bss); ++ } ++ ++ cfg80211_put_bss(priv->wdev.wiphy, bss); + } + } + } else { +-- +2.20.1 + diff --git a/queue-4.14/net-bcmgenet-reapply-manual-settings-to-the-phy.patch b/queue-4.14/net-bcmgenet-reapply-manual-settings-to-the-phy.patch new file mode 100644 index 00000000000..fc2f1243b79 --- /dev/null +++ b/queue-4.14/net-bcmgenet-reapply-manual-settings-to-the-phy.patch @@ -0,0 +1,58 @@ +From 8e91a2344c180d9283ceb16e81ad5310f685cf46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 11:07:26 -0800 +Subject: net: bcmgenet: reapply manual settings to the PHY + +From: Doug Berger + +[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ] + +The phy_init_hw() function may reset the PHY to a configuration +that does not match manual network settings stored in the phydev +structure. If the phy state machine is polled rather than event +driven this can create a timing hazard where the phy state machine +might alter the settings stored in the phydev structure from the +value read from the BMCR. + +This commit follows invocations of phy_init_hw() by the bcmgenet +driver with invocations of the genphy_config_aneg() function to +ensure that the BMCR is written to match the settings held in the +phydev structure. This prevents the risk of manual settings being +accidentally altered. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index b6af286fa5c7e..3e3044fe32066 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2611,8 +2611,10 @@ static void bcmgenet_irq_task(struct work_struct *work) + } + + if (status & UMAC_IRQ_PHY_DET_R && +- priv->dev->phydev->autoneg != AUTONEG_ENABLE) ++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) { + phy_init_hw(priv->dev->phydev); ++ genphy_config_aneg(priv->dev->phydev); ++ } + + /* Link UP/DOWN event */ + if (status & UMAC_IRQ_LINK_EVENT) +@@ -3688,6 +3690,7 @@ static int bcmgenet_resume(struct device *d) + + phy_init_hw(priv->phydev); + /* Speed settings must be restored */ ++ genphy_config_aneg(dev->phydev); + bcmgenet_mii_config(priv->dev, false); + + /* disable ethernet MAC while updating its registers */ +-- +2.20.1 + diff --git a/queue-4.14/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch b/queue-4.14/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch new file mode 100644 index 00000000000..d43460c5c38 --- /dev/null +++ b/queue-4.14/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch @@ -0,0 +1,37 @@ +From 366c2598dc4763d309f367aec16aa87d026ba11d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jan 2019 13:38:43 +0300 +Subject: net/core/neighbour: fix kmemleak minimal reference count for hash + tables + +From: Konstantin Khlebnikov + +[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ] + +This should be 1 for normal allocations, 0 disables leak reporting. + +Signed-off-by: Konstantin Khlebnikov +Reported-by: Cong Wang +Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 9a28a21a51f05..2664ad58e5c01 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -368,7 +368,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift) + buckets = (struct neighbour __rcu **) + __get_free_pages(GFP_ATOMIC | __GFP_ZERO, + get_order(size)); +- kmemleak_alloc(buckets, size, 0, GFP_ATOMIC); ++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC); + } + if (!buckets) { + kfree(ret); +-- +2.20.1 + diff --git a/queue-4.14/net-core-neighbour-tell-kmemleak-about-hash-tables.patch b/queue-4.14/net-core-neighbour-tell-kmemleak-about-hash-tables.patch new file mode 100644 index 00000000000..0e6cd862c79 --- /dev/null +++ b/queue-4.14/net-core-neighbour-tell-kmemleak-about-hash-tables.patch @@ -0,0 +1,83 @@ +From 5f322f736a7546da4d56582410d199c93288b9af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jan 2019 12:30:00 +0300 +Subject: net/core/neighbour: tell kmemleak about hash tables + +From: Konstantin Khlebnikov + +[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ] + +This fixes false-positive kmemleak reports about leaked neighbour entries: + +unreferenced object 0xffff8885c6e4d0a8 (size 1024): + comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,...... + 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}..... + backtrace: + [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40 + [<0000000036d7a0d8>] ip6_output+0x1ba/0x600 + [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0 + [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0 + [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0 + [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0 + [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0 + [<000000008698009d>] __sys_sendmsg+0xde/0x170 + [<00000000889dacf1>] do_syscall_64+0x9b/0x400 + [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + [<000000005767ed39>] 0xffffffffffffffff + +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index eb3efeabac91d..9a28a21a51f05 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -18,6 +18,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -361,12 +362,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift) + ret = kmalloc(sizeof(*ret), GFP_ATOMIC); + if (!ret) + return NULL; +- if (size <= PAGE_SIZE) ++ if (size <= PAGE_SIZE) { + buckets = kzalloc(size, GFP_ATOMIC); +- else ++ } else { + buckets = (struct neighbour __rcu **) + __get_free_pages(GFP_ATOMIC | __GFP_ZERO, + get_order(size)); ++ kmemleak_alloc(buckets, size, 0, GFP_ATOMIC); ++ } + if (!buckets) { + kfree(ret); + return NULL; +@@ -386,10 +389,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head) + size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *); + struct neighbour __rcu **buckets = nht->hash_buckets; + +- if (size <= PAGE_SIZE) ++ if (size <= PAGE_SIZE) { + kfree(buckets); +- else ++ } else { ++ kmemleak_free(buckets); + free_pages((unsigned long)buckets, get_order(size)); ++ } + kfree(nht); + } + +-- +2.20.1 + diff --git a/queue-4.14/net-cpts-fix-a-missing-check-of-clk_prepare.patch b/queue-4.14/net-cpts-fix-a-missing-check-of-clk_prepare.patch new file mode 100644 index 00000000000..59d64ba7041 --- /dev/null +++ b/queue-4.14/net-cpts-fix-a-missing-check-of-clk_prepare.patch @@ -0,0 +1,37 @@ +From 34239d346a293c1ab928c00b47410e0f42c018e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Dec 2018 20:55:37 -0600 +Subject: net: (cpts) fix a missing check of clk_prepare + +From: Kangjie Lu + +[ Upstream commit 2d822f2dbab7f4c820f72eb8570aacf3f35855bd ] + +clk_prepare() could fail, so let's check its status, and if it fails, +return its error code upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpts.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index e7b76f6b4f67e..7d1281d812480 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -567,7 +567,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs, + return ERR_PTR(PTR_ERR(cpts->refclk)); + } + +- clk_prepare(cpts->refclk); ++ ret = clk_prepare(cpts->refclk); ++ if (ret) ++ return ERR_PTR(ret); + + cpts->cc.read = cpts_systim_read; + cpts->cc.mask = CLOCKSOURCE_MASK(32); +-- +2.20.1 + diff --git a/queue-4.14/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch b/queue-4.14/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch new file mode 100644 index 00000000000..51edc1483c8 --- /dev/null +++ b/queue-4.14/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch @@ -0,0 +1,35 @@ +From fe42aabcee86701a300d6ea88e891eb61d6c2e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Feb 2019 13:37:26 +0300 +Subject: net: dev: Use unsigned integer as an argument to left-shift + +From: Andy Shevchenko + +[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ] + +1 << 31 is Undefined Behaviour according to the C standard. +Use U type modifier to avoid theoretical overflow. + +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/netdevice.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 40b830d55fe50..4725a9d9597fc 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3522,7 +3522,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits) + if (debug_value == 0) /* no output */ + return 0; + /* set low N bits */ +- return (1 << debug_value) - 1; ++ return (1U << debug_value) - 1; + } + + static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu) +-- +2.20.1 + diff --git a/queue-4.14/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch b/queue-4.14/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch new file mode 100644 index 00000000000..fd6c59ed3de --- /dev/null +++ b/queue-4.14/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch @@ -0,0 +1,41 @@ +From 5281e2f1da78a74999a133a48f43c4589d40b409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Dec 2018 22:08:18 -0600 +Subject: net: dsa: bcm_sf2: Propagate error value from mdio_write + +From: Kangjie Lu + +[ Upstream commit e49505f7255be8ced695919c08a29bf2c3d79616 ] + +Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's +return their error codes upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c +index af666951a9592..94ad2fdd6ef0d 100644 +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -432,11 +432,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum, + * send them to our master MDIO bus controller + */ + if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr)) +- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); ++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); + else +- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val); +- +- return 0; ++ return mdiobus_write_nested(priv->master_mii_bus, addr, ++ regnum, val); + } + + static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id) +-- +2.20.1 + diff --git a/queue-4.14/net-fec-add-missed-clk_disable_unprepare-in-remove.patch b/queue-4.14/net-fec-add-missed-clk_disable_unprepare-in-remove.patch new file mode 100644 index 00000000000..9ba9929f711 --- /dev/null +++ b/queue-4.14/net-fec-add-missed-clk_disable_unprepare-in-remove.patch @@ -0,0 +1,35 @@ +From ac576fdd680f7c4673560f6cc9b04f2cb0e40973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 23:50:00 +0800 +Subject: net: fec: add missed clk_disable_unprepare in remove + +From: Chuhong Yuan + +[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ] + +This driver forgets to disable and unprepare clks when remove. +Add calls to clk_disable_unprepare to fix it. + +Signed-off-by: Chuhong Yuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 0ae6532b02e09..0237221059bfd 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3574,6 +3574,8 @@ fec_drv_remove(struct platform_device *pdev) + regulator_disable(fep->reg_phy); + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ clk_disable_unprepare(fep->clk_ahb); ++ clk_disable_unprepare(fep->clk_ipg); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +-- +2.20.1 + diff --git a/queue-4.14/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch b/queue-4.14/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch new file mode 100644 index 00000000000..e28226ca267 --- /dev/null +++ b/queue-4.14/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch @@ -0,0 +1,52 @@ +From 816d97122080a3bbfeeff6f4b0b6a529c9f6ca0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Feb 2019 12:26:27 -0800 +Subject: net: fix possible overflow in __sk_mem_raise_allocated() + +From: Eric Dumazet + +[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ] + +With many active TCP sockets, fat TCP sockets could fool +__sk_mem_raise_allocated() thanks to an overflow. + +They would increase their share of the memory, instead +of decreasing it. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + net/core/sock.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 780c6c0a86f04..0af46cbd3649c 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1232,7 +1232,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk) + percpu_counter_inc(sk->sk_prot->sockets_allocated); + } + +-static inline int ++static inline u64 + sk_sockets_allocated_read_positive(struct sock *sk) + { + return percpu_counter_read_positive(sk->sk_prot->sockets_allocated); +diff --git a/net/core/sock.c b/net/core/sock.c +index 7ccbcd853cbce..90ccbbf9e6b00 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2357,7 +2357,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind) + } + + if (sk_has_memory_pressure(sk)) { +- int alloc; ++ u64 alloc; + + if (!sk_under_memory_pressure(sk)) + return 1; +-- +2.20.1 + diff --git a/queue-4.14/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch b/queue-4.14/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch new file mode 100644 index 00000000000..f11995bc30b --- /dev/null +++ b/queue-4.14/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch @@ -0,0 +1,51 @@ +From 7c42853ffba9e03765fbdc7ab52ed72641c4250a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 07:39:34 +0800 +Subject: net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED + +From: Yunsheng Lin + +[ Upstream commit 4a402f47cfce904051cd8b31bef4fe2910d9dce9 ] + +According to firmware error code definition, the error code of 2 +means NOT_SUPPORTED, this patch changes it to NOT_SUPPORTED. + +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +index 8b511e6e0ce9d..396ea0db71023 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +@@ -251,6 +251,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num) + if ((enum hclge_cmd_return_status)desc_ret == + HCLGE_CMD_EXEC_SUCCESS) + retval = 0; ++ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED) ++ retval = -EOPNOTSUPP; + else + retval = -EIO; + hw->cmq.last_status = (enum hclge_cmd_status)desc_ret; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index 758cf39481312..3823ae6303ad6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -52,7 +52,7 @@ struct hclge_cmq_ring { + enum hclge_cmd_return_status { + HCLGE_CMD_EXEC_SUCCESS = 0, + HCLGE_CMD_NO_AUTH = 1, +- HCLGE_CMD_NOT_EXEC = 2, ++ HCLGE_CMD_NOT_SUPPORTED = 2, + HCLGE_CMD_QUEUE_FULL = 3, + }; + +-- +2.20.1 + diff --git a/queue-4.14/net-mlx5-continue-driver-initialization-despite-debu.patch b/queue-4.14/net-mlx5-continue-driver-initialization-despite-debu.patch new file mode 100644 index 00000000000..652c4eb7fc3 --- /dev/null +++ b/queue-4.14/net-mlx5-continue-driver-initialization-despite-debu.patch @@ -0,0 +1,44 @@ +From 4f99c9be8f07078d31a389aa1cb2af9e2b9223e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 13:15:11 +0200 +Subject: net/mlx5: Continue driver initialization despite debugfs failure + +From: Leon Romanovsky + +[ Upstream commit 199fa087dc6b503baad06712716fac645a983e8a ] + +The failure to create debugfs entry is unpleasant event, but not enough +to abort drier initialization. Align the mlx5_core code to debugfs design +and continue execution whenever debugfs_create_dir() successes or not. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Reviewed-by: Saeed Mahameed +Signed-off-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 97874c2568fc9..1ac0e173da12c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -838,11 +838,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + + priv->numa_node = dev_to_node(&dev->pdev->dev); + +- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root); +- if (!priv->dbg_root) { +- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n"); +- return -ENOMEM; +- } ++ if (mlx5_debugfs_root) ++ priv->dbg_root = ++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root); + + err = mlx5_pci_enable_device(dev); + if (err) { +-- +2.20.1 + diff --git a/queue-4.14/net-net_namespace-check-the-return-value-of-register.patch b/queue-4.14/net-net_namespace-check-the-return-value-of-register.patch new file mode 100644 index 00000000000..af5a01e77f0 --- /dev/null +++ b/queue-4.14/net-net_namespace-check-the-return-value-of-register.patch @@ -0,0 +1,38 @@ +From 0666a968fcae4c81ac3262c3f57b2aab476a0531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Dec 2018 19:42:38 -0600 +Subject: net/net_namespace: Check the return value of register_pernet_subsys() + +From: Aditya Pakki + +[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ] + +In net_ns_init(), register_pernet_subsys() could fail while registering +network namespace subsystems. The fix checks the return value and +sends a panic() on failure. + +Signed-off-by: Aditya Pakki +Reviewed-by: Kirill Tkhai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/net_namespace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index 60b88718b1d48..1af25d53f63ca 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -854,7 +854,8 @@ static int __init net_ns_init(void) + + mutex_unlock(&net_mutex); + +- register_pernet_subsys(&net_ns_ops); ++ if (register_pernet_subsys(&net_ns_ops)) ++ panic("Could not register network namespace subsystems"); + + rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, + RTNL_FLAG_DOIT_UNLOCKED); +-- +2.20.1 + diff --git a/queue-4.14/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch b/queue-4.14/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch new file mode 100644 index 00000000000..e3224cfae20 --- /dev/null +++ b/queue-4.14/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch @@ -0,0 +1,41 @@ +From f64d2971ae0684b2089ecbb1f68af4977b679214 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Dec 2018 18:54:53 -0600 +Subject: net/netlink_compat: Fix a missing check of nla_parse_nested + +From: Aditya Pakki + +[ Upstream commit 89dfd0083751d00d5d7ead36f6d8b045bf89c5e1 ] + +In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return +an error. To be consistent with other invocations of the function call, +on error, the fix passes the return value upstream. + +Signed-off-by: Aditya Pakki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/netlink_compat.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index ad4dcc663c6de..1c8ac0c11008c 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -1021,8 +1021,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg, + u32 node; + struct nlattr *con[TIPC_NLA_CON_MAX + 1]; + +- nla_parse_nested(con, TIPC_NLA_CON_MAX, +- sock[TIPC_NLA_SOCK_CON], NULL, NULL); ++ err = nla_parse_nested(con, TIPC_NLA_CON_MAX, ++ sock[TIPC_NLA_SOCK_CON], NULL, NULL); ++ ++ if (err) ++ return err; + + node = nla_get_u32(con[TIPC_NLA_CON_NODE]); + tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>", +-- +2.20.1 + diff --git a/queue-4.14/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch b/queue-4.14/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch new file mode 100644 index 00000000000..de977663f16 --- /dev/null +++ b/queue-4.14/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch @@ -0,0 +1,49 @@ +From 1bccd168a0726f3ce21b4e64f5f3cdb82ffbcdf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jan 2019 18:51:02 +0100 +Subject: net/smc: prevent races between smc_lgr_terminate() and + smc_conn_free() + +From: Karsten Graul + +[ Upstream commit 77f838ace755d2f466536c44dac6c856f62cd901 ] + +To prevent races between smc_lgr_terminate() and smc_conn_free() add an +extra check of the lgr field before accessing it, and cancel a delayed +free_work when a new smc connection is created. +This fixes the problem that free_work cleared the lgr variable but +smc_lgr_terminate() or smc_conn_free() still access it in parallel. + +Signed-off-by: Karsten Graul +Signed-off-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index f04a037dc9677..0de788fa43e95 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -103,6 +103,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn) + struct smc_link_group *lgr = conn->lgr; + int reduced = 0; + ++ if (!lgr) ++ return; + write_lock_bh(&lgr->conns_lock); + if (conn->alert_token_local) { + reduced = 1; +@@ -431,6 +433,8 @@ int smc_conn_create(struct smc_sock *smc, __be32 peer_in_addr, + local_contact = SMC_REUSE_CONTACT; + conn->lgr = lgr; + smc_lgr_register_conn(conn); /* add smc conn to lgr */ ++ if (delayed_work_pending(&lgr->free_work)) ++ cancel_delayed_work(&lgr->free_work); + write_unlock_bh(&lgr->conns_lock); + break; + } +-- +2.20.1 + diff --git a/queue-4.14/net-stmicro-fix-a-missing-check-of-clk_prepare.patch b/queue-4.14/net-stmicro-fix-a-missing-check-of-clk_prepare.patch new file mode 100644 index 00000000000..f7372f23bfd --- /dev/null +++ b/queue-4.14/net-stmicro-fix-a-missing-check-of-clk_prepare.patch @@ -0,0 +1,37 @@ +From 2fe6b6691d63f3325701622a67a98050e2e043c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Dec 2018 20:57:14 -0600 +Subject: net: stmicro: fix a missing check of clk_prepare + +From: Kangjie Lu + +[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ] + +clk_prepare() could fail, so let's check its status, and if it fails, +return its error code upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index d07520fb969e6..62ccbd47c1db2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + gmac->clk_enabled = 1; + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); +- clk_prepare(gmac->tx_clk); ++ ret = clk_prepare(gmac->tx_clk); ++ if (ret) ++ return ret; + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.14/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch b/queue-4.14/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch new file mode 100644 index 00000000000..63500d8f069 --- /dev/null +++ b/queue-4.14/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch @@ -0,0 +1,39 @@ +From e7182651ff11722963262b561d962487f5df7dd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 16:28:30 +0800 +Subject: net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe() + +From: Wen Yang + +[ Upstream commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 ] + +This patch fixes potential double frees if register_hdlc_device() fails. + +Signed-off-by: Wen Yang +Reviewed-by: Peng Hao +CC: Zhao Qiang +CC: "David S. Miller" +CC: netdev@vger.kernel.org +CC: linuxppc-dev@lists.ozlabs.org +CC: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/fsl_ucc_hdlc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index 18b648648adb2..289dff262948d 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -1114,7 +1114,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev) + if (register_hdlc_device(dev)) { + ret = -ENOBUFS; + pr_err("ucc_hdlc: unable to register hdlc device\n"); +- free_netdev(dev); + goto free_dev; + } + +-- +2.20.1 + diff --git a/queue-4.14/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch b/queue-4.14/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch new file mode 100644 index 00000000000..7177bce71d0 --- /dev/null +++ b/queue-4.14/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch @@ -0,0 +1,57 @@ +From 4f0e9cc37baba59d514e72e5e453d542a9f78905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Dec 2018 00:32:53 -0800 +Subject: ocfs2: clear journal dirty flag after shutdown journal + +From: Junxiao Bi + +[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ] + +Dirty flag of the journal should be cleared at the last stage of umount, +if do it before jbd2_journal_destroy(), then some metadata in uncommitted +transaction could be lost due to io error, but as dirty flag of journal +was already cleared, we can't find that until run a full fsck. This may +cause system panic or other corruption. + +Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com +Signed-off-by: Junxiao Bi +Reviewed-by: Yiwen Jiang +Reviewed-by: Joseph Qi +Cc: Jun Piao +Cc: Changwei Ge +Cc: Joel Becker +Cc: Mark Fasheh +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/journal.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index f7fba58618ef3..2459ae9d2234f 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) + mlog_errno(status); + } + +- if (status == 0) { ++ /* Shutdown the kernel journal system */ ++ if (!jbd2_journal_destroy(journal->j_journal) && !status) { + /* + * Do not toggle if flush was unsuccessful otherwise + * will leave dirty metadata in a "clean" journal +@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) + if (status < 0) + mlog_errno(status); + } +- +- /* Shutdown the kernel journal system */ +- jbd2_journal_destroy(journal->j_journal); + journal->j_journal = NULL; + + OCFS2_I(inode)->ip_open_count--; +-- +2.20.1 + diff --git a/queue-4.14/openrisc-fix-broken-paths-to-arch-or32.patch b/queue-4.14/openrisc-fix-broken-paths-to-arch-or32.patch new file mode 100644 index 00000000000..69911e5b21a --- /dev/null +++ b/queue-4.14/openrisc-fix-broken-paths-to-arch-or32.patch @@ -0,0 +1,49 @@ +From 56009023fc40f5a01bdb3881499b9bea0d86d3a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 13:20:47 +0100 +Subject: openrisc: Fix broken paths to arch/or32 + +From: Geert Uytterhoeven + +[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ] + +OpenRISC was mainlined as "openrisc", not "or32". +vmlinux.lds is generated from vmlinux.lds.S. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/entry.S | 2 +- + arch/openrisc/kernel/head.S | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index b16e95a4e875f..1107d34e45bf1 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -184,7 +184,7 @@ handler: ;\ + * occured. in fact they never do. if you need them use + * values saved on stack (for SPR_EPC, SPR_ESR) or content + * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE() +- * in 'arch/or32/kernel/head.S' ++ * in 'arch/openrisc/kernel/head.S' + */ + + /* =====================================================[ exceptions] === */ +diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S +index 90979acdf165b..4d878d13b8606 100644 +--- a/arch/openrisc/kernel/head.S ++++ b/arch/openrisc/kernel/head.S +@@ -1551,7 +1551,7 @@ _string_nl: + + /* + * .data section should be page aligned +- * (look into arch/or32/kernel/vmlinux.lds) ++ * (look into arch/openrisc/kernel/vmlinux.lds.S) + */ + .section .data,"aw" + .align 8192 +-- +2.20.1 + diff --git a/queue-4.14/parisc-fix-hp-sdc-hpa-address-output.patch b/queue-4.14/parisc-fix-hp-sdc-hpa-address-output.patch new file mode 100644 index 00000000000..a08f3a944ca --- /dev/null +++ b/queue-4.14/parisc-fix-hp-sdc-hpa-address-output.patch @@ -0,0 +1,36 @@ +From 2a1f6ce84e8693d67c1c8ec8c96b575cf8dc0c73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 21:06:34 +0100 +Subject: parisc: Fix HP SDC hpa address output + +From: Helge Deller + +[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ] + +Show the hpa address of the HP SDC instead of a hashed value, e.g.: +HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24) + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/input/serio/hp_sdc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c +index 8eef6849d0660..5585823ced19d 100644 +--- a/drivers/input/serio/hp_sdc.c ++++ b/drivers/input/serio/hp_sdc.c +@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void) + "HP SDC NMI", &hp_sdc)) + goto err2; + +- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n", +- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); ++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n", ++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); + + hp_sdc_status_in8(); + hp_sdc_data_in8(); +-- +2.20.1 + diff --git a/queue-4.14/parisc-fix-serio-address-output.patch b/queue-4.14/parisc-fix-serio-address-output.patch new file mode 100644 index 00000000000..21745527738 --- /dev/null +++ b/queue-4.14/parisc-fix-serio-address-output.patch @@ -0,0 +1,40 @@ +From 924e819f1469afcfa6b45cf9f4b9b328cf554d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 21:09:59 +0100 +Subject: parisc: Fix serio address output + +From: Helge Deller + +[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ] + +We want the hpa addresses printed in the serio modules, not some +virtual ioremap()ed address, e.g.: + + serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11 + serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12 + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/input/serio/gscps2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c +index aa9f29b875dea..d84e3b70215ad 100644 +--- a/drivers/input/serio/gscps2.c ++++ b/drivers/input/serio/gscps2.c +@@ -382,9 +382,9 @@ static int __init gscps2_probe(struct parisc_device *dev) + goto fail; + #endif + +- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n", ++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n", + ps2port->port->name, +- ps2port->addr, ++ hpa, + ps2port->padev->irq, + ps2port->port->phys); + +-- +2.20.1 + diff --git a/queue-4.14/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch b/queue-4.14/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch new file mode 100644 index 00000000000..df23f4c1bf8 --- /dev/null +++ b/queue-4.14/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch @@ -0,0 +1,97 @@ +From 1aab9b9241a9814a1cb2383bca95d45839fe7d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jan 2019 17:31:29 -0600 +Subject: PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() + +From: Ming Lei + +[ Upstream commit 77f88abd4a6f73a1a68dbdc0e3f21575fd508fc3 ] + +The API of pci_alloc_irq_vectors_affinity() says it returns -ENOSPC if +fewer than @min_vecs interrupt vectors are available for @dev. + +However, if a device supports MSI-X but not MSI and a caller requests +@min_vecs that can't be satisfied by MSI-X, we previously returned -EINVAL +(from the failed attempt to enable MSI), not -ENOSPC. + +When -ENOSPC is returned, callers may reduce the number IRQs they request +and try again. Most callers can use the @min_vecs and @max_vecs +parameters to avoid this retry loop, but that doesn't work when using IRQ +affinity "nr_sets" because rebalancing the sets is driver-specific. + +This return value bug has been present since pci_alloc_irq_vectors() was +added in v4.10 by aff171641d18 ("PCI: Provide sensible IRQ vector +alloc/free routines"), but it wasn't an issue because @min_vecs/@max_vecs +removed the need for callers to iteratively reduce the number of IRQs +requested and retry the allocation, so they didn't need to distinguish +-ENOSPC from -EINVAL. + +In v5.0, 6da4b3ab9a6e ("genirq/affinity: Add support for allocating +interrupt sets") added IRQ sets to the interface, which reintroduced the +need to check for -ENOSPC and possibly reduce the number of IRQs requested +and retry the allocation. + +Signed-off-by: Ming Lei +[bhelgaas: changelog] +Signed-off-by: Bjorn Helgaas +Cc: Jens Axboe +Cc: Keith Busch +Cc: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/pci/msi.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 536e9a5cd2b14..d66ef88e13cf1 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -1156,7 +1156,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + const struct irq_affinity *affd) + { + static const struct irq_affinity msi_default_affd; +- int vecs = -ENOSPC; ++ int msix_vecs = -ENOSPC; ++ int msi_vecs = -ENOSPC; + + if (flags & PCI_IRQ_AFFINITY) { + if (!affd) +@@ -1167,16 +1168,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + } + + if (flags & PCI_IRQ_MSIX) { +- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs, +- affd); +- if (vecs > 0) +- return vecs; ++ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs, ++ max_vecs, affd); ++ if (msix_vecs > 0) ++ return msix_vecs; + } + + if (flags & PCI_IRQ_MSI) { +- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd); +- if (vecs > 0) +- return vecs; ++ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, ++ affd); ++ if (msi_vecs > 0) ++ return msi_vecs; + } + + /* use legacy irq if allowed */ +@@ -1187,7 +1189,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, + } + } + +- return vecs; ++ if (msix_vecs == -ENOSPC) ++ return -ENOSPC; ++ return msi_vecs; + } + EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity); + +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch b/queue-4.14/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch new file mode 100644 index 00000000000..d603cc5a695 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch @@ -0,0 +1,57 @@ +From d876089b3cf0a2eb9dd79af9e1789d193df66f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 14:09:56 +0100 +Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration + +From: Geert Uytterhoeven + +[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ] + +The Port F Control Register 3 (PFCR3) contains only a single field. +However, counting from left to right, it is the fourth field, not the +first field. +Insert the missing dummy configuration values (3 fields of 16 values) to +fix this. + +The descriptor for the Port F Control Register 0 (PFCR0) lacks the +description for the 4th field (PF0 Mode, PF0MD[2:0]). +Add the missing configuration values to fix this. + +Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c +index 8070765311dbf..e1c34e19222ee 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c +@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + }, + + { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) { ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + PF12MD_000, PF12MD_001, 0, PF12MD_011, + PF12MD_100, PF12MD_101, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 } +@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + 0, 0, 0, 0, 0, 0, 0, 0, + PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011, + PF1MD_100, PF1MD_101, 0, 0, +- 0, 0, 0, 0, 0, 0, 0, 0 +- } ++ 0, 0, 0, 0, 0, 0, 0, 0, ++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011, ++ PF0MD_100, PF0MD_101, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0 } + }, + + { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) { +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch b/queue-4.14/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch new file mode 100644 index 00000000000..c995787a59a --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch @@ -0,0 +1,62 @@ +From 75a1154fb7d3aec0144bfa07e2d94314ccccac0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 14:41:11 +0100 +Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10 + +From: Geert Uytterhoeven + +[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ] + +Some values in the Peripheral Function Select Register 10 descriptor are +shifted by one position, which may cause a peripheral function to be +programmed incorrectly. + +Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was +already the case for the HSCK0 pin in field IP10[5:3]. + +Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 6502e676d3686..33232041ee86d 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP10_22 [1] */ + FN_CAN_CLK_A, FN_RX4_D, + /* IP10_21_19 [3] */ +- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B, +- FN_LCD_M_DISP_B, 0, 0, 0, ++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B, ++ FN_LCD_M_DISP_B, 0, 0, + /* IP10_18_16 [3] */ +- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B, +- FN_LCD_VEPWC_B, 0, 0, 0, ++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B, ++ FN_LCD_VEPWC_B, 0, 0, + /* IP10_15 [1] */ + FN_AUDIO_CLKB_A, FN_LCD_CLK_B, + /* IP10_14_12 [3] */ + FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B, + FN_LCD_FLM_B, 0, 0, 0, + /* IP10_11_9 [3] */ +- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B, +- FN_LCD_CL2_B, 0, 0, 0, ++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B, ++ FN_LCD_CL2_B, 0, 0, + /* IP10_8_6 [3] */ +- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B, +- FN_LCD_CL1_B, 0, 0, 0, ++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B, ++ FN_LCD_CL1_B, 0, 0, + /* IP10_5_3 [3] */ + FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B, + FN_LCD_DON_B, 0, 0, 0, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch b/queue-4.14/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch new file mode 100644 index 00000000000..8790846a267 --- /dev/null +++ b/queue-4.14/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch @@ -0,0 +1,89 @@ +From 0e435ff820d29d46c6db2faef4fbe58b913550f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 08:48:25 +0100 +Subject: pinctrl: xway: fix gpio-hog related boot issues + +From: Martin Schiller + +[ Upstream commit 9b4924da4711674e62d97d4f5360446cc78337af ] + +This patch is based on commit a86caa9ba5d7 ("pinctrl: msm: fix gpio-hog +related boot issues"). + +It fixes the issue that the gpio ranges needs to be defined before +gpiochip_add(). + +Therefore, we also have to swap the order of registering the pinctrl +driver and registering the gpio chip. + +You also have to add the "gpio-ranges" property to the pinctrl device +node to get it finally working. + +Signed-off-by: Martin Schiller +Acked-by: John Crispin +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-xway.c | 39 +++++++++++++++++++++++----------- + 1 file changed, 27 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c +index f9e98a7d4f0ce..1b0c5958c56a7 100644 +--- a/drivers/pinctrl/pinctrl-xway.c ++++ b/drivers/pinctrl/pinctrl-xway.c +@@ -1748,14 +1748,6 @@ static int pinmux_xway_probe(struct platform_device *pdev) + } + xway_pctrl_desc.pins = xway_info.pads; + +- /* register the gpio chip */ +- xway_chip.parent = &pdev->dev; +- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); +- if (ret) { +- dev_err(&pdev->dev, "Failed to register gpio chip\n"); +- return ret; +- } +- + /* setup the data needed by pinctrl */ + xway_pctrl_desc.name = dev_name(&pdev->dev); + xway_pctrl_desc.npins = xway_chip.ngpio; +@@ -1777,10 +1769,33 @@ static int pinmux_xway_probe(struct platform_device *pdev) + return ret; + } + +- /* finish with registering the gpio range in pinctrl */ +- xway_gpio_range.npins = xway_chip.ngpio; +- xway_gpio_range.base = xway_chip.base; +- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); ++ /* register the gpio chip */ ++ xway_chip.parent = &pdev->dev; ++ xway_chip.owner = THIS_MODULE; ++ xway_chip.of_node = pdev->dev.of_node; ++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); ++ if (ret) { ++ dev_err(&pdev->dev, "Failed to register gpio chip\n"); ++ return ret; ++ } ++ ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) { ++ /* finish with registering the gpio range in pinctrl */ ++ xway_gpio_range.npins = xway_chip.ngpio; ++ xway_gpio_range.base = xway_chip.base; ++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); ++ } ++ + dev_info(&pdev->dev, "Init done\n"); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch b/queue-4.14/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch new file mode 100644 index 00000000000..5ea528683d6 --- /dev/null +++ b/queue-4.14/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch @@ -0,0 +1,37 @@ +From 3aefaa67c67c83391d49154d5c37ef7df967afd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Dec 2018 21:52:11 +0100 +Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is + not needed + +From: Thomas Meyer + +[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ] + +NULL check before some freeing functions is not needed. + +Signed-off-by: Thomas Meyer +Reviewed-by: Kevin Hilman +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/power/avs/smartreflex.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c +index 974fd684bab2c..4b6fddc183948 100644 +--- a/drivers/power/avs/smartreflex.c ++++ b/drivers/power/avs/smartreflex.c +@@ -994,8 +994,7 @@ static int omap_sr_remove(struct platform_device *pdev) + + if (sr_info->autocomp_active) + sr_stop_vddautocomp(sr_info); +- if (sr_info->dbg_dir) +- debugfs_remove_recursive(sr_info->dbg_dir); ++ debugfs_remove_recursive(sr_info->dbg_dir); + + pm_runtime_disable(&pdev->dev); + list_del(&sr_info->node); +-- +2.20.1 + diff --git a/queue-4.14/powerpc-44x-bamboo-fix-pci-range.patch b/queue-4.14/powerpc-44x-bamboo-fix-pci-range.patch new file mode 100644 index 00000000000..4721aafcf8c --- /dev/null +++ b/queue-4.14/powerpc-44x-bamboo-fix-pci-range.patch @@ -0,0 +1,44 @@ +From bfae2888e6ec910267d3006ade2b4108a853d026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Dec 2018 13:27:33 +1100 +Subject: powerpc/44x/bamboo: Fix PCI range + +From: Benjamin Herrenschmidt + +[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ] + +The bamboo dts has a bug: it uses a non-naturally aligned range +for PCI memory space. This isnt' supported by the code, thus +causing PCI to break on this system. + +This is due to the fact that while the chip memory map has 1G +reserved for PCI memory, it's only 512M aligned. The code doesn't +know how to split that into 2 different PMMs and fails, so limit +the region to 512M. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/bamboo.dts | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts +index aa68911f6560a..084b82ba74933 100644 +--- a/arch/powerpc/boot/dts/bamboo.dts ++++ b/arch/powerpc/boot/dts/bamboo.dts +@@ -268,8 +268,10 @@ + /* Outbound ranges, one memory and one IO, + * later cannot be changed. Chip supports a second + * IO range but we don't use it for now ++ * The chip also supports a larger memory range but ++ * it's not naturally aligned, so our code will break + */ +- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000 ++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000 + 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000 + 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>; + +-- +2.20.1 + diff --git a/queue-4.14/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch b/queue-4.14/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch new file mode 100644 index 00000000000..74ee3543b5f --- /dev/null +++ b/queue-4.14/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch @@ -0,0 +1,142 @@ +From 8fae83a640cdbb235c3695ba109e6e562199ac98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 11:41:29 +0000 +Subject: powerpc/83xx: handle machine check caused by watchdog timer + +From: Christophe Leroy + +[ Upstream commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 ] + +When the watchdog timer is set in interrupt mode, it causes a +machine check when it times out. The purpose of this mode is to +ease debugging, not to crash the kernel and reboot the machine. + +This patch implements a special handling for that, in order to not +crash the kernel if the watchdog times out while in interrupt or +within the idle task. + +Signed-off-by: Christophe Leroy +[scottwood: added missing #include] +Signed-off-by: Scott Wood +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/cputable.h | 1 + + arch/powerpc/include/asm/reg.h | 2 ++ + arch/powerpc/kernel/cputable.c | 10 ++++++---- + arch/powerpc/platforms/83xx/misc.c | 17 +++++++++++++++++ + 4 files changed, 26 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +index 7e3ccf21830e6..e4451b30d7e32 100644 +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -45,6 +45,7 @@ extern int machine_check_e500(struct pt_regs *regs); + extern int machine_check_e200(struct pt_regs *regs); + extern int machine_check_47x(struct pt_regs *regs); + int machine_check_8xx(struct pt_regs *regs); ++int machine_check_83xx(struct pt_regs *regs); + + extern void cpu_down_flush_e500v2(void); + extern void cpu_down_flush_e500mc(void); +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index b779f3ccd4126..05f3c2b3aa0ec 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -733,6 +733,8 @@ + #define SRR1_PROGTRAP 0x00020000 /* Trap */ + #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */ + ++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */ ++ + #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */ + #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */ + #define HSRR1_DENORM 0x00100000 /* Denorm exception */ +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index 760872916013d..da4b0e3792380 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -1185,6 +1185,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .machine_check = machine_check_generic, + .platform = "ppc603", + }, ++#ifdef CONFIG_PPC_83xx + { /* e300c1 (a 603e core, plus some) on 83xx */ + .pvr_mask = 0x7fff0000, + .pvr_value = 0x00830000, +@@ -1195,7 +1196,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .platform = "ppc603", + }, + { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */ +@@ -1209,7 +1210,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .platform = "ppc603", + }, + { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */ +@@ -1223,7 +1224,7 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .num_pmcs = 4, + .oprofile_cpu_type = "ppc/e300", + .oprofile_type = PPC_OPROFILE_FSL_EMB, +@@ -1240,12 +1241,13 @@ static struct cpu_spec __initdata cpu_specs[] = { + .icache_bsize = 32, + .dcache_bsize = 32, + .cpu_setup = __setup_cpu_603, +- .machine_check = machine_check_generic, ++ .machine_check = machine_check_83xx, + .num_pmcs = 4, + .oprofile_cpu_type = "ppc/e300", + .oprofile_type = PPC_OPROFILE_FSL_EMB, + .platform = "ppc603", + }, ++#endif + { /* default match, we assume split I/D cache & TB (non-601)... */ + .pvr_mask = 0x00000000, + .pvr_value = 0x00000000, +diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c +index d75c9816a5c92..2b6589fe812dd 100644 +--- a/arch/powerpc/platforms/83xx/misc.c ++++ b/arch/powerpc/platforms/83xx/misc.c +@@ -14,6 +14,7 @@ + #include + #include + ++#include + #include + #include + #include +@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void) + + mpc83xx_setup_pci(); + } ++ ++int machine_check_83xx(struct pt_regs *regs) ++{ ++ u32 mask = 1 << (31 - IPIC_MCP_WDT); ++ ++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask)) ++ return machine_check_generic(regs); ++ ipic_clear_mcp_status(mask); ++ ++ if (debugger_fault_handler(regs)) ++ return 1; ++ ++ die("Watchdog NMI Reset", regs, 0); ++ ++ return 1; ++} +-- +2.20.1 + diff --git a/queue-4.14/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch b/queue-4.14/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch new file mode 100644 index 00000000000..1c9d7242256 --- /dev/null +++ b/queue-4.14/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch @@ -0,0 +1,44 @@ +From 6cc9690748f2134cc982626a62b4059da920c927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 17:27:42 +0000 +Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped() + +From: Christophe Leroy + +[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ] + +This patch fixes the loop in p_block_mapped() and v_block_mapped() +to scan the entire bat_addrs[] array. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/ppc_mmu_32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c +index 2a049fb8523d5..96c52271e9c2d 100644 +--- a/arch/powerpc/mm/ppc_mmu_32.c ++++ b/arch/powerpc/mm/ppc_mmu_32.c +@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */ + phys_addr_t v_block_mapped(unsigned long va) + { + int b; +- for (b = 0; b < 4; ++b) ++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) + if (va >= bat_addrs[b].start && va < bat_addrs[b].limit) + return bat_addrs[b].phys + (va - bat_addrs[b].start); + return 0; +@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va) + unsigned long p_block_mapped(phys_addr_t pa) + { + int b; +- for (b = 0; b < 4; ++b) ++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) + if (pa >= bat_addrs[b].phys + && pa < (bat_addrs[b].limit-bat_addrs[b].start) + +bat_addrs[b].phys) +-- +2.20.1 + diff --git a/queue-4.14/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch b/queue-4.14/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch new file mode 100644 index 00000000000..2e916e60a2f --- /dev/null +++ b/queue-4.14/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch @@ -0,0 +1,63 @@ +From 63a669e1b70546b2e4d2d99605434010cab70b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 15:23:33 +0000 +Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults. + +From: Christophe Leroy + +[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ] + +As several other arches including x86, this patch makes it explicit +that a bad page fault is a NULL pointer dereference when the fault +address is lower than PAGE_SIZE + +In the mean time, this page makes all bad_page_fault() messages +shorter so that they remain on one single line. And it prefixes them +by "BUG: " so that they get easily grepped. + +Signed-off-by: Christophe Leroy +[mpe: Avoid pr_cont()] +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/fault.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 52863deed65df..5fc8a010fdf07 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -581,21 +581,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig) + switch (regs->trap) { + case 0x300: + case 0x380: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "data at address 0x%08lx\n", regs->dar); ++ pr_alert("BUG: %s at 0x%08lx\n", ++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" : ++ "Unable to handle kernel data access", regs->dar); + break; + case 0x400: + case 0x480: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "instruction fetch\n"); ++ pr_alert("BUG: Unable to handle kernel instruction fetch%s", ++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n"); + break; + case 0x600: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "unaligned access at address 0x%08lx\n", regs->dar); ++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n", ++ regs->dar); + break; + default: +- printk(KERN_ALERT "Unable to handle kernel paging request for " +- "unknown fault\n"); ++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n", ++ regs->dar); + break; + } + printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n", +-- +2.20.1 + diff --git a/queue-4.14/powerpc-perf-fix-unit_sel-cache_sel-checks.patch b/queue-4.14/powerpc-perf-fix-unit_sel-cache_sel-checks.patch new file mode 100644 index 00000000000..c55975ee9e0 --- /dev/null +++ b/queue-4.14/powerpc-perf-fix-unit_sel-cache_sel-checks.patch @@ -0,0 +1,98 @@ +From 963fcb8968d89e0f8a59a4c956511bbfda020d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2017 19:42:40 +0530 +Subject: powerpc/perf: Fix unit_sel/cache_sel checks + +From: Madhavan Srinivasan + +[ Upstream commit 2d46d4877b1afd14059393a48bdb8ce27955174c ] + +Raw event code has couple of fields "unit" and "cache" in it, to capture +the "unit" to monitor for a given pmcxsel and cache reload qualifier to +program in MMCR1. + +isa207_get_constraint() refers "unit" field to update the MMCRC (L2/L3) +Event bus control fields with "cache" bits of the raw event code. +These are power8 specific and not supported by PowerISA v3.0 pmu. So wrap +the checks to be power8 specific. Also, "cache" bit field is referred to +update MMCR1[16:17] and this check can be power8 specific. + +Fixes: 7ffd948fae4cd ('powerpc/perf: factor out power8 pmu functions') +Signed-off-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/isa207-common.c | 25 ++++++++++++++++++------- + arch/powerpc/perf/isa207-common.h | 4 ++-- + 2 files changed, 20 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index cf9c35aa0cf45..7ecea7143e587 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -150,6 +150,14 @@ static bool is_thresh_cmp_valid(u64 event) + return true; + } + ++static unsigned int dc_ic_rld_quad_l1_sel(u64 event) ++{ ++ unsigned int cache; ++ ++ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK; ++ return cache; ++} ++ + static inline u64 isa207_find_source(u64 idx, u32 sub_idx) + { + u64 ret = PERF_MEM_NA; +@@ -290,10 +298,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) + * have a cache selector of zero. The bank selector (bit 3) is + * irrelevant, as long as the rest of the value is 0. + */ +- if (cache & 0x7) ++ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7)) + return -1; + +- } else if (event & EVENT_IS_L1) { ++ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) { + mask |= CNST_L1_QUAL_MASK; + value |= CNST_L1_QUAL_VAL(cache); + } +@@ -396,11 +404,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev, + /* In continuous sampling mode, update SDAR on TLB miss */ + mmcra_sdar_mode(event[i], &mmcra); + +- if (event[i] & EVENT_IS_L1) { +- cache = event[i] >> EVENT_CACHE_SEL_SHIFT; +- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT; +- cache >>= 1; +- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT; ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) { ++ cache = dc_ic_rld_quad_l1_sel(event[i]); ++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; ++ } else { ++ if (event[i] & EVENT_IS_L1) { ++ cache = dc_ic_rld_quad_l1_sel(event[i]); ++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; ++ } + } + + if (is_event_marked(event[i])) { +diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h +index 6c737d675792e..493e5cc5fa8a6 100644 +--- a/arch/powerpc/perf/isa207-common.h ++++ b/arch/powerpc/perf/isa207-common.h +@@ -232,8 +232,8 @@ + #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1)) + #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8) + #define MMCR1_FAB_SHIFT 36 +-#define MMCR1_DC_QUAL_SHIFT 47 +-#define MMCR1_IC_QUAL_SHIFT 46 ++#define MMCR1_DC_IC_QUAL_MASK 0x3 ++#define MMCR1_DC_IC_QUAL_SHIFT 46 + + /* MMCR1 Combine bits macro for power9 */ + #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2)) +-- +2.20.1 + diff --git a/queue-4.14/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch b/queue-4.14/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch new file mode 100644 index 00000000000..6f96147fb10 --- /dev/null +++ b/queue-4.14/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch @@ -0,0 +1,85 @@ +From f76d702907344a9fc4f027353399eb978e47b720 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 15:25:17 +1100 +Subject: powerpc/powernv/eeh/npu: Fix uninitialized variables in + opal_pci_eeh_freeze_status + +From: Alexey Kardashevskiy + +[ Upstream commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 ] + +The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in +skiboot's NPU driver does not touch the pci_error_type parameter so +it might have garbage but the powernv code analyzes it nevertheless. + +This initializes pcierr and fstate to zero in all call sites. + +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++---- + arch/powerpc/platforms/powernv/pci-ioda.c | 4 ++-- + arch/powerpc/platforms/powernv/pci.c | 4 ++-- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c +index 8864065eba227..fa2965c96155b 100644 +--- a/arch/powerpc/platforms/powernv/eeh-powernv.c ++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c +@@ -548,8 +548,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe) + static int pnv_eeh_get_phb_state(struct eeh_pe *pe) + { + struct pnv_phb *phb = pe->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + s64 rc; + int result = 0; + +@@ -587,8 +587,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe) + static int pnv_eeh_get_pe_state(struct eeh_pe *pe) + { + struct pnv_phb *phb = pe->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + s64 rc; + int result; + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index ddef22e00ddd7..d3d5796f7df60 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -598,8 +598,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt) + static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no) + { + struct pnv_ioda_pe *slave, *pe; +- u8 fstate, state; +- __be16 pcierr; ++ u8 fstate = 0, state; ++ __be16 pcierr = 0; + s64 rc; + + /* Sanity check on PE number */ +diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c +index 5422f4a6317ca..e2d031a3ec157 100644 +--- a/arch/powerpc/platforms/powernv/pci.c ++++ b/arch/powerpc/platforms/powernv/pci.c +@@ -600,8 +600,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no) + static void pnv_pci_config_check_eeh(struct pci_dn *pdn) + { + struct pnv_phb *phb = pdn->phb->private_data; +- u8 fstate; +- __be16 pcierr; ++ u8 fstate = 0; ++ __be16 pcierr = 0; + unsigned int pe_no; + s64 rc; + +-- +2.20.1 + diff --git a/queue-4.14/powerpc-prom-fix-early-debug-messages.patch b/queue-4.14/powerpc-prom-fix-early-debug-messages.patch new file mode 100644 index 00000000000..1d6940aa5bf --- /dev/null +++ b/queue-4.14/powerpc-prom-fix-early-debug-messages.patch @@ -0,0 +1,55 @@ +From 8a7be5d3bfb21ef1d53f9d644406eda00469cc0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 10:27:47 +0000 +Subject: powerpc/prom: fix early DEBUG messages + +From: Christophe Leroy + +[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ] + +This patch fixes early DEBUG messages in prom.c: +- Use %px instead of %p to see the addresses +- Cast memblock_phys_mem_size() with (unsigned long long) to +avoid build failure when phys_addr_t is not 64 bits. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index f830562974417..d96b284150904 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -128,7 +128,7 @@ static void __init move_device_tree(void) + p = __va(memblock_alloc(size, PAGE_SIZE)); + memcpy(p, initial_boot_params, size); + initial_boot_params = p; +- DBG("Moved device tree to 0x%p\n", p); ++ DBG("Moved device tree to 0x%px\n", p); + } + + DBG("<- move_device_tree\n"); +@@ -662,7 +662,7 @@ void __init early_init_devtree(void *params) + { + phys_addr_t limit; + +- DBG(" -> early_init_devtree(%p)\n", params); ++ DBG(" -> early_init_devtree(%px)\n", params); + + /* Too early to BUG_ON(), do it by hand */ + if (!early_init_dt_verify(params)) +@@ -722,7 +722,7 @@ void __init early_init_devtree(void *params) + memblock_allow_resize(); + memblock_dump_all(); + +- DBG("Phys. mem: %llx\n", memblock_phys_mem_size()); ++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size()); + + /* We may need to relocate the flat tree, do it now. + * FIXME .. and the initrd too? */ +-- +2.20.1 + diff --git a/queue-4.14/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch b/queue-4.14/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch new file mode 100644 index 00000000000..f34fefea15c --- /dev/null +++ b/queue-4.14/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch @@ -0,0 +1,39 @@ +From c688dbcdd10d43f192acfc68753f96ed19ea9eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 May 2019 10:42:40 +0800 +Subject: powerpc/pseries/dlpar: Fix a missing check in + dlpar_parse_cc_property() + +From: Gen Zhang + +[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ] + +In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup(). +kstrdup() may return NULL, so it should be checked and handle error. +And prop should be freed if 'prop->name' is NULL. + +Signed-off-by: Gen Zhang +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/dlpar.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index f4e6565dd7a94..fb2876a84fbe6 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa) + + name = (char *)ccwa + be32_to_cpu(ccwa->name_offset); + prop->name = kstrdup(name, GFP_KERNEL); ++ if (!prop->name) { ++ dlpar_free_cc_property(prop); ++ return NULL; ++ } + + prop->length = be32_to_cpu(ccwa->prop_length); + value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset); +-- +2.20.1 + diff --git a/queue-4.14/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch b/queue-4.14/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch new file mode 100644 index 00000000000..670581298dc --- /dev/null +++ b/queue-4.14/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch @@ -0,0 +1,36 @@ +From 90fb495e00bb56cb9339d7ddfd0d69d0f589a0d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 19:16:44 +1100 +Subject: powerpc/pseries: Fix node leak in update_lmb_associativity_index() + +From: Michael Ellerman + +[ Upstream commit 47918bc68b7427e961035949cc1501a864578a69 ] + +In update_lmb_associativity_index() we lookup dr_node using +of_find_node_by_path() which takes a reference for us. In the +non-error case we forget to drop the reference. Note that +find_aa_index() does modify properties of the node, but doesn't need +an extra reference held once it's returned. + +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/hotplug-memory.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 99a3cf51c5ba4..fdfce7a46d733 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -295,6 +295,7 @@ static u32 lookup_lmb_associativity_index(struct of_drconf_cell *lmb) + + aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc); + ++ of_node_put(dr_node); + dlpar_free_cc_nodes(lmb_node); + return aa_index; + } +-- +2.20.1 + diff --git a/queue-4.14/powerpc-xmon-fix-dump_segments.patch b/queue-4.14/powerpc-xmon-fix-dump_segments.patch new file mode 100644 index 00000000000..9313d3e1d02 --- /dev/null +++ b/queue-4.14/powerpc-xmon-fix-dump_segments.patch @@ -0,0 +1,35 @@ +From 533ec2f9eae1caf88954db9d4ae3bfff69498b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 17:31:08 +0000 +Subject: powerpc/xmon: fix dump_segments() + +From: Christophe Leroy + +[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ] + +mfsrin() takes segment num from bits 31-28 (IBM bits 0-3). + +Signed-off-by: Christophe Leroy +[mpe: Clarify bit numbering] +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/xmon/xmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 5a739588aa505..51a53fd517229 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -3293,7 +3293,7 @@ void dump_segments(void) + + printf("sr0-15 ="); + for (i = 0; i < 16; ++i) +- printf(" %x", mfsrin(i)); ++ printf(" %x", mfsrin(i << 28)); + printf("\n"); + } + #endif +-- +2.20.1 + diff --git a/queue-4.14/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch b/queue-4.14/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch new file mode 100644 index 00000000000..5d4c3af2318 --- /dev/null +++ b/queue-4.14/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch @@ -0,0 +1,40 @@ +From a2be2cccf8a7b1d28fe16e331fea6752b7329607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 21:22:18 +0200 +Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ] + +The owner member of struct pwm_ops must be set to THIS_MODULE to +increase the reference count of the module such that the module cannot +be removed while its code is in use. + +Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Florian Fainelli +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-bcm-iproc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index d961a8207b1cb..31b01035d0ab3 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm, + static const struct pwm_ops iproc_pwm_ops = { + .apply = iproc_pwmc_apply, + .get_state = iproc_pwmc_get_state, ++ .owner = THIS_MODULE, + }; + + static int iproc_pwmc_probe(struct platform_device *pdev) +-- +2.20.1 + diff --git a/queue-4.14/pwm-clps711x-fix-period-calculation.patch b/queue-4.14/pwm-clps711x-fix-period-calculation.patch new file mode 100644 index 00000000000..25f6076c100 --- /dev/null +++ b/queue-4.14/pwm-clps711x-fix-period-calculation.patch @@ -0,0 +1,47 @@ +From f1f1396df828826da3f2f4fd0375f70a1e5a5e4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Dec 2018 13:39:24 +0300 +Subject: pwm: clps711x: Fix period calculation + +From: Alexander Shiyan + +[ Upstream commit b0f17570b8203c22f139459c86cfbaa0311313ed ] + +Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has +changed the variable for the period for clps711x-pwm driver, so now +pwm_get/set_period() works with pwm->state.period variable instead +of pwm->args.period. +This patch changes the period variable in other places where it is used. + +Signed-off-by: Alexander Shiyan +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-clps711x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c +index 26ec24e457b12..7e16b7def0dcb 100644 +--- a/drivers/pwm/pwm-clps711x.c ++++ b/drivers/pwm/pwm-clps711x.c +@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v) + static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v) + { + /* Duty cycle 0..15 max */ +- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm)); ++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period); + } + + static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) +@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + struct clps711x_chip *priv = to_clps711x_chip(chip); + unsigned int duty; + +- if (period_ns != pwm_get_period(pwm)) ++ if (period_ns != pwm->args.period) + return -EINVAL; + + duty = clps711x_get_duty(pwm, duty_ns); +-- +2.20.1 + diff --git a/queue-4.14/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch b/queue-4.14/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch new file mode 100644 index 00000000000..600cc382464 --- /dev/null +++ b/queue-4.14/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch @@ -0,0 +1,38 @@ +From 13ed1c68a38fa7a336f5f4b22f1658eb0a1735b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Dec 2018 13:20:36 -0800 +Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer + +From: Bart Van Assche + +[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ] + +This patch avoids that the SCSI mid-layer keeps retrying forever if +ib_post_send() fails. This was discovered while testing immediate +data support and passing a too large num_sge value to ib_post_send(). + +Cc: Sergey Gorenko +Cc: Max Gurtovoy +Cc: Laurence Oberman +Signed-off-by: Bart Van Assche +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 3f5b5893792cd..9f7287f45d06f 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2210,6 +2210,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd) + + if (srp_post_send(ch, iu, len)) { + shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n"); ++ scmnd->result = DID_ERROR << 16; + goto err_unmap; + } + +-- +2.20.1 + diff --git a/queue-4.14/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch b/queue-4.14/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch new file mode 100644 index 00000000000..39c568dedf1 --- /dev/null +++ b/queue-4.14/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch @@ -0,0 +1,38 @@ +From 606116f71fa1343a21ec11b3a4e34c73e7ebbd2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 17:17:25 +0200 +Subject: RDMA/vmw_pvrdma: Use atomic memory allocation in create AH + +From: Gal Pressman + +[ Upstream commit a276a4d93bf1580d737f38d1810e5f4b166f3edd ] + +Create address handle callback should not sleep, use GFP_ATOMIC instead of +GFP_KERNEL for memory allocation. + +Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") +Cc: Adit Ranadive +Signed-off-by: Gal Pressman +Reviewed-by: Yuval Shaia +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +index aa533f08e0171..5c7aa6ff15382 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +@@ -550,7 +550,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr, + if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah)) + return ERR_PTR(-ENOMEM); + +- ah = kzalloc(sizeof(*ah), GFP_KERNEL); ++ ah = kzalloc(sizeof(*ah), GFP_ATOMIC); + if (!ah) { + atomic_dec(&dev->num_ahs); + return ERR_PTR(-ENOMEM); +-- +2.20.1 + diff --git a/queue-4.14/regulator-tps65910-fix-a-missing-check-of-return-val.patch b/queue-4.14/regulator-tps65910-fix-a-missing-check-of-return-val.patch new file mode 100644 index 00000000000..dd2261e0f23 --- /dev/null +++ b/queue-4.14/regulator-tps65910-fix-a-missing-check-of-return-val.patch @@ -0,0 +1,38 @@ +From e03fc1a2f2e7d76f9b6f0a2801bbcbc185c79335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Dec 2018 00:29:19 -0600 +Subject: regulator: tps65910: fix a missing check of return value + +From: Kangjie Lu + +[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ] + +tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so, +returns with its error code. + +Signed-off-by: Kangjie Lu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/tps65910-regulator.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c +index 81672a58fcc23..194fa0cbbc048 100644 +--- a/drivers/regulator/tps65910-regulator.c ++++ b/drivers/regulator/tps65910-regulator.c +@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, pmic); + + /* Give control of all register to control port */ +- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, ++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, + DEVCTRL_SR_CTL_I2C_SEL_MASK); ++ if (err < 0) ++ return err; + + switch (tps65910_chip_id(tps65910)) { + case TPS65910: +-- +2.20.1 + diff --git a/queue-4.14/reset-fix-memory-leak-in-reset_control_array_put.patch b/queue-4.14/reset-fix-memory-leak-in-reset_control_array_put.patch new file mode 100644 index 00000000000..7b765e96bd2 --- /dev/null +++ b/queue-4.14/reset-fix-memory-leak-in-reset_control_array_put.patch @@ -0,0 +1,55 @@ +From d1be92656e0e51586ba97a8ba97dae3b00282ed6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 14:06:23 +0530 +Subject: reset: Fix memory leak in reset_control_array_put() + +From: Kishon Vijay Abraham I + +[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ] + +Memory allocated for 'struct reset_control_array' in +of_reset_control_array_get() is never freed in +reset_control_array_put() resulting in kmemleak showing +the following backtrace. + + backtrace: + [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0 + [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180 + [<000000004cc02754>] 0xffff800008c669e4 + [<0000000050a83b24>] platform_drv_probe+0x50/0xa0 + [<00000000d3a0b0bc>] really_probe+0x108/0x348 + [<000000005aa458ac>] driver_probe_device+0x58/0x100 + [<000000008853626c>] device_driver_attach+0x6c/0x90 + [<0000000085308d19>] __driver_attach+0x84/0xc8 + [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8 + [<00000000dd7f015b>] driver_attach+0x20/0x28 + [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0 + [<0000000061473b66>] driver_register+0x60/0x110 + [<00000000c5bec167>] __platform_driver_register+0x40/0x48 + [<000000007c764b4f>] 0xffff800008c6c020 + [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0 + [<0000000093d4b50d>] do_init_module+0x54/0x1d0 + +Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets") +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 72b96b5c75a8f..7e0a14211c88a 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -513,6 +513,7 @@ static void reset_control_array_put(struct reset_control_array *resets) + for (i = 0; i < resets->num_rstcs; i++) + __reset_control_put_internal(resets->rstc[i]); + mutex_unlock(&reset_list_mutex); ++ kfree(resets); + } + + /** +-- +2.20.1 + diff --git a/queue-4.14/reset-fix-reset_control_ops-kerneldoc-comment.patch b/queue-4.14/reset-fix-reset_control_ops-kerneldoc-comment.patch new file mode 100644 index 00000000000..41573bbd2a8 --- /dev/null +++ b/queue-4.14/reset-fix-reset_control_ops-kerneldoc-comment.patch @@ -0,0 +1,35 @@ +From 85a8675c102fad3f725a0768db76937d9833744b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 20:57:06 -0700 +Subject: reset: fix reset_control_ops kerneldoc comment + +From: Randy Dunlap + +[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ] + +Add a missing short description to the reset_control_ops documentation. + +Signed-off-by: Randy Dunlap +[p.zabel@pengutronix.de: rebased and updated commit message] +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset-controller.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h +index adb88f8cefbcd..576caaf0c9af5 100644 +--- a/include/linux/reset-controller.h ++++ b/include/linux/reset-controller.h +@@ -7,7 +7,7 @@ + struct reset_controller_dev; + + /** +- * struct reset_control_ops ++ * struct reset_control_ops - reset controller driver callbacks + * + * @reset: for self-deasserting resets, does all necessary + * things to reset the device +-- +2.20.1 + diff --git a/queue-4.14/rtl818x-fix-potential-use-after-free.patch b/queue-4.14/rtl818x-fix-potential-use-after-free.patch new file mode 100644 index 00000000000..3a735e717d5 --- /dev/null +++ b/queue-4.14/rtl818x-fix-potential-use-after-free.patch @@ -0,0 +1,43 @@ +From 4113d02e738d6a120de287a4ed7b275c96db6fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 18:48:10 +0800 +Subject: rtl818x: fix potential use after free + +From: Pan Bian + +[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ] + +entry is released via usb_put_urb just after calling usb_submit_urb. +However, entry is used if the submission fails, resulting in a use after +free bug. The patch fixes this. + +Signed-off-by: Pan Bian +ACKed-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +index 9a1d15b3ce453..518caaaf8a987 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev) + skb_queue_tail(&priv->rx_queue, skb); + usb_anchor_urb(entry, &priv->anchored); + ret = usb_submit_urb(entry, GFP_KERNEL); +- usb_put_urb(entry); + if (ret) { + skb_unlink(skb, &priv->rx_queue); + usb_unanchor_urb(entry); ++ usb_put_urb(entry); + goto err; + } ++ usb_put_urb(entry); + } + return ret; + +-- +2.20.1 + diff --git a/queue-4.14/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch b/queue-4.14/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch new file mode 100644 index 00000000000..2554323fa25 --- /dev/null +++ b/queue-4.14/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch @@ -0,0 +1,59 @@ +From 6c08b5606863a359afa6db0db4d88137c3a7602d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 21:17:06 -0800 +Subject: scripts/gdb: fix debugging modules compiled with hot/cold + partitioning + +From: Ilya Leoshkevich + +[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ] + +gcc's -freorder-blocks-and-partition option makes it group frequently +and infrequently used code in .text.hot and .text.unlikely sections +respectively. At least when building modules on s390, this option is +used by default. + +gdb assumes that all code is located in .text section, and that .text +section is located at module load address. With such modules this is no +longer the case: there is code in .text.hot and .text.unlikely, and +either of them might precede .text. + +Fix by explicitly telling gdb the addresses of code sections. + +It might be tempting to do this for all sections, not only the ones in +the white list. Unfortunately, gdb appears to have an issue, when +telling it about e.g. loadable .note.gnu.build-id section causes it to +think that non-loadable .note.Linux section is loaded at address 0, +which in turn causes NULL pointers to be resolved to bogus symbols. So +keep using the white list approach for the time being. + +Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com +Signed-off-by: Ilya Leoshkevich +Reviewed-by: Jan Kiszka +Cc: Kieran Bingham +Cc: Heiko Carstens +Cc: Vasily Gorbik +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/symbols.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index 004b0ac7fa72d..4644f1a83b578 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -99,7 +99,8 @@ lx-symbols command.""" + attrs[n]['name'].string(): attrs[n]['address'] + for n in range(int(sect_attrs['nsections']))} + args = [] +- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]: ++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", ++ ".text", ".text.hot", ".text.unlikely"]: + address = section_name_to_address.get(section_name) + if address: + args.append(" -s {name} {addr}".format( +-- +2.20.1 + diff --git a/queue-4.14/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch b/queue-4.14/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch new file mode 100644 index 00000000000..d137016873f --- /dev/null +++ b/queue-4.14/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch @@ -0,0 +1,35 @@ +From 4ce58afc3821ff64eede5c7a88da34fb2b226186 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Dec 2018 15:42:50 +0530 +Subject: scsi: csiostor: fix incorrect dma device in case of vport + +From: Varun Prakash + +[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ] + +In case of ->vport_create() call scsi_add_host_with_dma() instead of +scsi_add_host() to pass correct dma device. + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/csiostor/csio_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c +index 28a9c7d706cb0..03c7b1603dbc1 100644 +--- a/drivers/scsi/csiostor/csio_init.c ++++ b/drivers/scsi/csiostor/csio_init.c +@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev, + if (csio_lnode_init(ln, hw, pln)) + goto err_shost_put; + +- if (scsi_add_host(shost, dev)) ++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev)) + goto err_lnode_exit; + + return ln; +-- +2.20.1 + diff --git a/queue-4.14/scsi-libsas-check-smp-phy-control-function-result.patch b/queue-4.14/scsi-libsas-check-smp-phy-control-function-result.patch new file mode 100644 index 00000000000..2cc7cc6de96 --- /dev/null +++ b/queue-4.14/scsi-libsas-check-smp-phy-control-function-result.patch @@ -0,0 +1,50 @@ +From 9849f40fd2dc6b34015b37bbb77eef72f4be383d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jan 2019 00:01:27 +0800 +Subject: scsi: libsas: Check SMP PHY control function result + +From: John Garry + +[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ] + +Currently the SMP PHY control execution result is checked, however the +function result for the command is not. + +As such, we may be missing all potential errors, like SMP FUNCTION FAILED, +INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has +failed. + +In some scenarios we need to ensure the function result is accepted, so add +a check for this. + +Tested-by: Jian Luo +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 63c44eaabf69e..f77d72f01da91 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id, + } + + res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE); +- ++ if (res) { ++ pr_err("ex %016llx phy%02d PHY control failed: %d\n", ++ SAS_ADDR(dev->sas_addr), phy_id, res); ++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) { ++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n", ++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]); ++ res = pc_resp[2]; ++ } + kfree(pc_resp); + kfree(pc_req); + return res; +-- +2.20.1 + diff --git a/queue-4.14/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch b/queue-4.14/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch new file mode 100644 index 00000000000..6bb08677ae8 --- /dev/null +++ b/queue-4.14/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch @@ -0,0 +1,101 @@ +From 701d7303950c9fee312ae0fdc07628f0a8efae4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jan 2019 00:01:28 +0800 +Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during + discovery + +From: John Garry + +[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ] + + +----------+ +----------+ + | | | | + | |--- 3.0 G ---| |--- 6.0 G --- SAS disk + | | | | + | |--- 3.0 G ---| |--- 6.0 G --- SAS disk + |initiator | | | + | device |--- 3.0 G ---| Expander |--- 6.0 G --- SAS disk + | | | | + | |--- 3.0 G ---| |--- 6.0 G --- SATA disk -->failed to connect + | | | | + | | | |--- 6.0 G --- SATA disk -->failed to connect + | | | | + +----------+ +----------+ + +According to Serial Attached SCSI - 1.1 (SAS-1.1): +If an expander PHY attached to a SATA PHY is using a physical link rate +greater than the maximum connection rate supported by the pathway from an +STP initiator port, a management application client should use the SMP PHY +CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL +LINK RATE field of the expander PHY to the maximum connection rate +supported by the pathway from that STP initiator port. + +Currently libsas does not support checking if this condition occurs, nor +rectifying when it does. + +Such a condition is not at all common, however it has been seen on some +pre-silicon environments where the initiator PHY only supports a 1.5 Gbit +maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy. + +This patch adds support for checking and rectifying this condition during +initial device discovery only. + +We do support checking min pathway connection rate during revalidation phase, +when new devices can be detected in the topology. However we do not +support in the case of the the user reprogramming PHY linkrates, such that +min pathway condition is not met/maintained. + +A note on root port PHY rates: +The libsas root port PHY rates calculation is broken. Libsas sets the +rates (min, max, and current linkrate) of a root port to the same linkrate +of the first PHY member of that same port. In doing so, it assumes that +all other PHYs which subsequently join the port to have the same +negotiated linkrate, when they could actually be different. + +In practice this doesn't happen, as initiator and expander PHYs are +normally initialised with consistent min/max linkrates. + +This has not caused an issue so far, so leave alone for now. + +Tested-by: Jian Luo +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 7f2d00354a850..63c44eaabf69e 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -817,6 +817,26 @@ static struct domain_device *sas_ex_discover_end_dev( + + #ifdef CONFIG_SCSI_SAS_ATA + if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) { ++ if (child->linkrate > parent->min_linkrate) { ++ struct sas_phy_linkrates rates = { ++ .maximum_linkrate = parent->min_linkrate, ++ .minimum_linkrate = parent->min_linkrate, ++ }; ++ int ret; ++ ++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n", ++ SAS_ADDR(child->sas_addr), phy_id); ++ ret = sas_smp_phy_control(parent, phy_id, ++ PHY_FUNC_LINK_RESET, &rates); ++ if (ret) { ++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n", ++ SAS_ADDR(child->sas_addr), phy_id, ret); ++ goto out_free; ++ } ++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n", ++ SAS_ADDR(child->sas_addr), phy_id); ++ child->linkrate = child->min_linkrate; ++ } + res = sas_get_ata_info(child, phy); + if (res) + goto out_free; +-- +2.20.1 + diff --git a/queue-4.14/scsi-lpfc-enable-management-features-for-if_type-6.patch b/queue-4.14/scsi-lpfc-enable-management-features-for-if_type-6.patch new file mode 100644 index 00000000000..f6d457a15ea --- /dev/null +++ b/queue-4.14/scsi-lpfc-enable-management-features-for-if_type-6.patch @@ -0,0 +1,110 @@ +From d82b9e8fdc9109b53031c616b91fec20a8fb7a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 19:37:01 -0800 +Subject: scsi: lpfc: Enable Management features for IF_TYPE=6 + +From: James Smart + +[ Upstream commit 719162bd5bb968203397b9b1d0dd30a9797bbd09 ] + +Addition of support for if_type=6 missed several checks for interface type, +resulting in the failure of several key management features such as +firmware dump and loopback testing. + +Correct the checks on the if_type so that both SLI4 IF_TYPE's 2 and 6 are +supported. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_attr.c | 4 ++-- + drivers/scsi/lpfc/lpfc_bsg.c | 6 +++--- + drivers/scsi/lpfc/lpfc_els.c | 2 +- + drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index 3da242201cb45..82ce5d1930189 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1178,7 +1178,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) + return -EACCES; + + if ((phba->sli_rev < LPFC_SLI_REV4) || +- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2)) + return -EPERM; + +@@ -4056,7 +4056,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr, + uint32_t prev_val, if_type; + + if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf); +- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 && ++ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 && + phba->hba_flag & HBA_FORCED_LINK_SPEED) + return -EPERM; + +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index d89816222b230..6dde21dc82a3c 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job) + + if (phba->sli_rev < LPFC_SLI_REV4) + rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job); +- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) == ++ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= + LPFC_SLI_INTF_IF_TYPE_2) + rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job); + else +@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job) + + if (phba->sli_rev < LPFC_SLI_REV4) + return -ENODEV; +- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) + return -ENODEV; + +@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job) + rc = -ENODEV; + goto job_error; + } +- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) { + rc = -ENODEV; + goto job_error; +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index a31f87eb1e621..c851fd14ff3e9 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -5550,7 +5550,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, + struct ls_rjt stat; + + if (phba->sli_rev < LPFC_SLI_REV4 || +- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != ++ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < + LPFC_SLI_INTF_IF_TYPE_2) { + rjt_err = LSRJT_UNABLE_TPC; + rjt_expl = LSEXP_REQ_UNSUPPORTED; +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index d850077c5e226..3f88f3d796227 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -4769,7 +4769,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + if (phba->sli_rev == LPFC_SLI_REV4 && + (!(vport->load_flag & FC_UNLOADING)) && + (bf_get(lpfc_sli_intf_if_type, +- &phba->sli4_hba.sli_intf) == ++ &phba->sli4_hba.sli_intf) >= + LPFC_SLI_INTF_IF_TYPE_2) && + (kref_read(&ndlp->kref) > 0)) { + mbox->context1 = lpfc_nlp_get(ndlp); +-- +2.20.1 + diff --git a/queue-4.14/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch b/queue-4.14/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch new file mode 100644 index 00000000000..dd04a2d1641 --- /dev/null +++ b/queue-4.14/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch @@ -0,0 +1,77 @@ +From ce9a5e2e5a8391bb81afcc1d1db4a68be8401952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 16:09:40 -0800 +Subject: scsi: lpfc: Fix dif and first burst use in write commands + +From: James Smart + +[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ] + +When dif and first burst is used in a write command wqe, the driver was not +properly setting fields in the io command request. This resulted in no dif +bytes being sent and invalid xfer_rdy's, resulting in the io being aborted +by the hardware. + +Correct the wqe initializaton when both dif and first burst are used. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 07cb671bb8550..2eba0c39ac1c4 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -2714,6 +2714,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, + int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; + int prot_group_type = 0; + int fcpdl; ++ struct lpfc_vport *vport = phba->pport; + + /* + * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd +@@ -2819,6 +2820,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, + */ + iocb_cmd->un.fcpi.fcpi_parm = fcpdl; + ++ /* ++ * For First burst, we may need to adjust the initial transfer ++ * length for DIF ++ */ ++ if (iocb_cmd->un.fcpi.fcpi_XRdy && ++ (fcpdl < vport->cfg_first_burst_size)) ++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; ++ + return 0; + err: + if (lpfc_cmd->seg_cnt) +@@ -3371,6 +3380,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; + int prot_group_type = 0; + int fcpdl; ++ struct lpfc_vport *vport = phba->pport; + + /* + * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd +@@ -3486,6 +3496,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + */ + iocb_cmd->un.fcpi.fcpi_parm = fcpdl; + ++ /* ++ * For First burst, we may need to adjust the initial transfer ++ * length for DIF ++ */ ++ if (iocb_cmd->un.fcpi.fcpi_XRdy && ++ (fcpdl < vport->cfg_first_burst_size)) ++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; ++ + /* + * If the OAS driver feature is enabled and the lun is enabled for + * OAS, set the oas iocb related flags. +-- +2.20.1 + diff --git a/queue-4.14/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch b/queue-4.14/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch new file mode 100644 index 00000000000..477b991d7f2 --- /dev/null +++ b/queue-4.14/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch @@ -0,0 +1,93 @@ +From 64d138567e10bdf34c6445e9cfedec0bb7a1c6e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 16:09:32 -0800 +Subject: scsi: lpfc: Fix kernel Oops due to null pring pointers + +From: James Smart + +[ Upstream commit 5a9eeff57f340238c39c95d8e7e54c96fc722de7 ] + +Driver is hitting null pring pointers in lpfc_do_work(). + +Pointer assignment occurs based on SLI-revision. If recovering after an +error, its possible the sli revision for the port was cleared, making the +lpfc_phba_elsring() not return a ring pointer, thus the null pointer. + +Add SLI revision checking to lpfc_phba_elsring() and status checking to all +callers. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc.h | 6 ++++++ + drivers/scsi/lpfc/lpfc_els.c | 2 ++ + drivers/scsi/lpfc/lpfc_init.c | 7 ++++++- + drivers/scsi/lpfc/lpfc_sli.c | 2 ++ + 4 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index bc61cc8bc6f02..03e95a3216c8c 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1239,6 +1239,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba) + static inline struct lpfc_sli_ring * + lpfc_phba_elsring(struct lpfc_hba *phba) + { ++ /* Return NULL if sli_rev has become invalid due to bad fw */ ++ if (phba->sli_rev != LPFC_SLI_REV4 && ++ phba->sli_rev != LPFC_SLI_REV3 && ++ phba->sli_rev != LPFC_SLI_REV2) ++ return NULL; ++ + if (phba->sli_rev == LPFC_SLI_REV4) { + if (phba->sli4_hba.els_wq) + return phba->sli4_hba.els_wq->pring; +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index e5db20e8979d5..a31f87eb1e621 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1337,6 +1337,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba) + Fabric_DID); + + pring = lpfc_phba_elsring(phba); ++ if (unlikely(!pring)) ++ return -EIO; + + /* + * Check the txcmplq for an iocb that matches the nport the driver is +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 15bcd00dd7a23..c69c2a2b2eadf 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -1773,7 +1773,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action, + lpfc_offline(phba); + /* release interrupt for possible resource change */ + lpfc_sli4_disable_intr(phba); +- lpfc_sli_brdrestart(phba); ++ rc = lpfc_sli_brdrestart(phba); ++ if (rc) { ++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, ++ "6309 Failed to restart board\n"); ++ return rc; ++ } + /* request and enable interrupt */ + intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode); + if (intr_mode == LPFC_INTR_ERROR) { +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index ebf7d3cda3677..62bea4ffdc25a 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -4421,6 +4421,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba) + hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED; + + rc = lpfc_sli4_brdreset(phba); ++ if (rc) ++ return rc; + + spin_lock_irq(&phba->hbalock); + phba->pport->stopped = 0; +-- +2.20.1 + diff --git a/queue-4.14/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch b/queue-4.14/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch new file mode 100644 index 00000000000..222196c7889 --- /dev/null +++ b/queue-4.14/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch @@ -0,0 +1,127 @@ +From ff5b4afaee1411f85cceb524888e96839ccb52af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 16:48:45 -0700 +Subject: scsi: qla2xxx: deadlock by configfs_depend_item + +From: Anatoliy Glagolev + +[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ] + +The intent of invoking configfs_depend_item in commit 7474f52a82d51 +("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg") +was to prevent a physical Fibre Channel port removal when +virtual (NPIV) ports announced through that physical port are active. +The change does not work as expected: it makes enabled physical port +dependent on target configfs subsystem (the port's parent), something +the configfs guarantees anyway. + +Besides, scheduling work in a worker thread and waiting for the work's +completion is not really a valid workaround for the requirement not to call +configfs_depend_item from a configfs callback: the call occasionally +deadlocks. + +Thus, removing configfs_depend_item calls does not break anything and fixes +the deadlock problem. + +Signed-off-by: Anatoliy Glagolev +Acked-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++------------------------- + drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 -- + 2 files changed, 8 insertions(+), 43 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index 2fcdaadd10fa5..e08ac431bc496 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -903,38 +903,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item, + atomic_read(&tpg->lport_tpg_enabled)); + } + +-static void tcm_qla2xxx_depend_tpg(struct work_struct *work) +-{ +- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, +- struct tcm_qla2xxx_tpg, tpg_base_work); +- struct se_portal_group *se_tpg = &base_tpg->se_tpg; +- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; +- +- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) { +- atomic_set(&base_tpg->lport_tpg_enabled, 1); +- qlt_enable_vha(base_vha); +- } +- complete(&base_tpg->tpg_base_comp); +-} +- +-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work) +-{ +- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, +- struct tcm_qla2xxx_tpg, tpg_base_work); +- struct se_portal_group *se_tpg = &base_tpg->se_tpg; +- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; +- +- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) { +- atomic_set(&base_tpg->lport_tpg_enabled, 0); +- target_undepend_item(&se_tpg->tpg_group.cg_item); +- } +- complete(&base_tpg->tpg_base_comp); +-} +- + static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, + const char *page, size_t count) + { + struct se_portal_group *se_tpg = to_tpg(item); ++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn; ++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn, ++ struct tcm_qla2xxx_lport, lport_wwn); ++ struct scsi_qla_host *vha = lport->qla_vha; + struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg, + struct tcm_qla2xxx_tpg, se_tpg); + unsigned long op; +@@ -953,24 +929,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, + if (atomic_read(&tpg->lport_tpg_enabled)) + return -EEXIST; + +- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg); ++ atomic_set(&tpg->lport_tpg_enabled, 1); ++ qlt_enable_vha(vha); + } else { + if (!atomic_read(&tpg->lport_tpg_enabled)) + return count; + +- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg); ++ atomic_set(&tpg->lport_tpg_enabled, 0); ++ qlt_stop_phase1(vha->vha_tgt.qla_tgt); + } +- init_completion(&tpg->tpg_base_comp); +- schedule_work(&tpg->tpg_base_work); +- wait_for_completion(&tpg->tpg_base_comp); + +- if (op) { +- if (!atomic_read(&tpg->lport_tpg_enabled)) +- return -ENODEV; +- } else { +- if (atomic_read(&tpg->lport_tpg_enabled)) +- return -EPERM; +- } + return count; + } + +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h +index 7550ba2831c36..147cf6c903666 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h +@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg { + struct tcm_qla2xxx_tpg_attrib tpg_attrib; + /* Returned by tcm_qla2xxx_make_tpg() */ + struct se_portal_group se_tpg; +- /* Items for dealing with configfs_depend_item */ +- struct completion tpg_base_comp; +- struct work_struct tpg_base_work; + }; + + struct tcm_qla2xxx_fc_loopid { +-- +2.20.1 + diff --git a/queue-4.14/sctp-don-t-compare-hb_timer-expire-date-before-start.patch b/queue-4.14/sctp-don-t-compare-hb_timer-expire-date-before-start.patch new file mode 100644 index 00000000000..4ce81c6ebd4 --- /dev/null +++ b/queue-4.14/sctp-don-t-compare-hb_timer-expire-date-before-start.patch @@ -0,0 +1,59 @@ +From b2e2a0f9245b582de9581a61d3890faf9ca7435b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Feb 2019 09:45:26 +0100 +Subject: sctp: don't compare hb_timer expire date before starting it + +From: Maciej Kwiecien + +[ Upstream commit d1f20c03f48102e52eb98b8651d129b83134cae4 ] + +hb_timer might not start at all for a particular transport because its +start is conditional. In a result a node is not sending heartbeats. + +Function sctp_transport_reset_hb_timer has two roles: + - initial start of hb_timer for a given transport, + - update expire date of hb_timer for a given transport. +The function is optimized to update timer's expire only if it is before +a new calculated one but this comparison is invalid for a timer which +has not yet started. Such a timer has expire == 0 and if a new expire +value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will +fail and timer will not start resulting in no heartbeat packets send by +the node. + +This was found when association was initialized within first 5 mins +after system boot due to jiffies init value which is near to MAX_JIFFIES. + +Test kernel version: 4.9.154 (ARCH=arm) +hb_timer.expire = 0; //initialized, not started timer +new_expire = MAX_JIFFIES / 2 + 2; //or more +time_before(hb_timer.expire, new_expire) == false + +Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often") +Reported-by: Marcin Stojek +Tested-by: Marcin Stojek +Signed-off-by: Maciej Kwiecien +Reviewed-by: Alexander Sverdlin +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/transport.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index 43105cf04bc45..274df899e7bfa 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -210,7 +210,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport) + + /* When a data chunk is sent, reset the heartbeat interval. */ + expires = jiffies + sctp_transport_timeout(transport); +- if (time_before(transport->hb_timer.expires, expires) && ++ if ((time_before(transport->hb_timer.expires, expires) || ++ !timer_pending(&transport->hb_timer)) && + !mod_timer(&transport->hb_timer, + expires + prandom_u32_max(transport->rto))) + sctp_transport_hold(transport); +-- +2.20.1 + diff --git a/queue-4.14/serial-8250-fix-serial8250-initialization-crash.patch b/queue-4.14/serial-8250-fix-serial8250-initialization-crash.patch new file mode 100644 index 00000000000..833d2d8737a --- /dev/null +++ b/queue-4.14/serial-8250-fix-serial8250-initialization-crash.patch @@ -0,0 +1,72 @@ +From c0a127630b5e15f08bdb5042e474487e277b0594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jan 2019 17:00:19 +0800 +Subject: serial: 8250: Fix serial8250 initialization crash + +From: He Zhe + +[ Upstream commit 352c4cf40c4a7d439fa5d30aa2160f54b394da82 ] + +The initialization code of interrupt backoff work might reference NULL +pointer and cause the following crash, if no port was found. + +[ 10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c +---- snip ---- +[ 11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac +[ 11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0 +[ 11.789301] [<80728450>] platform_drv_probe+0x40/0x94 +[ 11.830515] [<807264f8>] really_probe+0xf8/0x318 +[ 11.870876] [<80726b7c>] __driver_attach+0x110/0x12c +[ 11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc +[ 11.951134] [<80725958>] bus_add_driver+0x200/0x234 +[ 11.989756] [<807273d8>] driver_register+0x84/0x148 +[ 12.029832] [<80d72f84>] serial8250_init+0x138/0x198 +[ 12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0 +[ 12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484 +[ 12.150722] [<80a49420>] kernel_init+0x10/0xf8 +[ 12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c + +This patch makes sure the initialization code can be reached only if a port +is found. + +Fixes: 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns") +Signed-off-by: He Zhe +Reviewed-by: Darwin Dingel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_core.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index ceeea4b159c4b..c698ebab6d3bd 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -1077,15 +1077,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up) + + ret = 0; + } +- } + +- /* Initialise interrupt backoff work if required */ +- if (up->overrun_backoff_time_ms > 0) { +- uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms; +- INIT_DELAYED_WORK(&uart->overrun_backoff, +- serial_8250_overrun_backoff_work); +- } else { +- uart->overrun_backoff_time_ms = 0; ++ /* Initialise interrupt backoff work if required */ ++ if (up->overrun_backoff_time_ms > 0) { ++ uart->overrun_backoff_time_ms = ++ up->overrun_backoff_time_ms; ++ INIT_DELAYED_WORK(&uart->overrun_backoff, ++ serial_8250_overrun_backoff_work); ++ } else { ++ uart->overrun_backoff_time_ms = 0; ++ } + } + + mutex_unlock(&serial_mutex); +-- +2.20.1 + diff --git a/queue-4.14/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch b/queue-4.14/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch new file mode 100644 index 00000000000..ccc4b09947e --- /dev/null +++ b/queue-4.14/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch @@ -0,0 +1,146 @@ +From 2d455ae8123589f24c0cd233ac4d18e9ea53523a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 11:29:09 +1300 +Subject: serial: 8250: Rate limit serial port rx interrupts during input + overruns + +From: Darwin Dingel + +[ Upstream commit 6d7f677a2afa1c82d7fc7af7f9159cbffd5dc010 ] + +When a serial port gets faulty or gets flooded with inputs, its interrupt +handler starts to work double time to get the characters to the workqueue +for the tty layer to handle them. When this busy time on the serial/tty +subsystem happens during boot, where it is also busy on the userspace +trying to initialise, some processes can continuously get preempted +and will be on hold until the interrupts subside. + +The fix is to backoff on processing received characters for a specified +amount of time when an input overrun is seen (received a new character +before the previous one is processed). This only stops receive and will +continue to transmit characters to serial port. After the backoff period +is done, it receive will be re-enabled. This is optional and will only +be enabled by setting 'overrun-throttle-ms' in the dts. + +Signed-off-by: Darwin Dingel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_core.c | 25 +++++++++++++++++++++++++ + drivers/tty/serial/8250/8250_fsl.c | 23 ++++++++++++++++++++++- + drivers/tty/serial/8250/8250_of.c | 5 +++++ + include/linux/serial_8250.h | 4 ++++ + 4 files changed, 56 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index d29b512a7d9fa..ceeea4b159c4b 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -953,6 +953,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port * + return NULL; + } + ++static void serial_8250_overrun_backoff_work(struct work_struct *work) ++{ ++ struct uart_8250_port *up = ++ container_of(to_delayed_work(work), struct uart_8250_port, ++ overrun_backoff); ++ struct uart_port *port = &up->port; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&port->lock, flags); ++ up->ier |= UART_IER_RLSI | UART_IER_RDI; ++ up->port.read_status_mask |= UART_LSR_DR; ++ serial_out(up, UART_IER, up->ier); ++ spin_unlock_irqrestore(&port->lock, flags); ++} ++ + /** + * serial8250_register_8250_port - register a serial port + * @up: serial port template +@@ -1063,6 +1078,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up) + ret = 0; + } + } ++ ++ /* Initialise interrupt backoff work if required */ ++ if (up->overrun_backoff_time_ms > 0) { ++ uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms; ++ INIT_DELAYED_WORK(&uart->overrun_backoff, ++ serial_8250_overrun_backoff_work); ++ } else { ++ uart->overrun_backoff_time_ms = 0; ++ } ++ + mutex_unlock(&serial_mutex); + + return ret; +diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c +index 910bfee5a88b7..cc138c24ae889 100644 +--- a/drivers/tty/serial/8250/8250_fsl.c ++++ b/drivers/tty/serial/8250/8250_fsl.c +@@ -48,8 +48,29 @@ int fsl8250_handle_irq(struct uart_port *port) + + lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR); + +- if (lsr & (UART_LSR_DR | UART_LSR_BI)) ++ /* Process incoming characters first */ ++ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) && ++ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) { + lsr = serial8250_rx_chars(up, lsr); ++ } ++ ++ /* Stop processing interrupts on input overrun */ ++ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) { ++ unsigned long delay; ++ ++ up->ier = port->serial_in(port, UART_IER); ++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ port->ops->stop_rx(port); ++ } else { ++ /* Keep restarting the timer until ++ * the input overrun subsides. ++ */ ++ cancel_delayed_work(&up->overrun_backoff); ++ } ++ ++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms); ++ schedule_delayed_work(&up->overrun_backoff, delay); ++ } + + serial8250_modem_status(up); + +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index ec510e342e06c..c51044ba503c3 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -232,6 +232,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev) + if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control")) + port8250.capabilities |= UART_CAP_AFE; + ++ if (of_property_read_u32(ofdev->dev.of_node, ++ "overrun-throttle-ms", ++ &port8250.overrun_backoff_time_ms) != 0) ++ port8250.overrun_backoff_time_ms = 0; ++ + ret = serial8250_register_8250_port(&port8250); + if (ret < 0) + goto err_dispose; +diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h +index a27ef5f564317..791a6be0e3949 100644 +--- a/include/linux/serial_8250.h ++++ b/include/linux/serial_8250.h +@@ -134,6 +134,10 @@ struct uart_8250_port { + void (*dl_write)(struct uart_8250_port *, int); + + struct uart_8250_em485 *em485; ++ ++ /* Serial port overrun backoff */ ++ struct delayed_work overrun_backoff; ++ u32 overrun_backoff_time_ms; + }; + + static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up) +-- +2.20.1 + diff --git a/queue-4.14/serial-max310x-fix-tx_empty-callback.patch b/queue-4.14/serial-max310x-fix-tx_empty-callback.patch new file mode 100644 index 00000000000..70b4e593c23 --- /dev/null +++ b/queue-4.14/serial-max310x-fix-tx_empty-callback.patch @@ -0,0 +1,43 @@ +From cc60d99f3595c0c1b5e1322261c2362a84ecade5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Dec 2018 14:19:20 +0300 +Subject: serial: max310x: Fix tx_empty() callback + +From: Alexander Shiyan + +[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ] + +Function max310x_tx_empty() accesses the IRQSTS register, which is +cleared by IC when reading, so if there is an interrupt status, we +will lose it. This patch implement the transmitter check only by +the current FIFO level. + +Signed-off-by: Alexander Shiyan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 0969a0d97b2be..cec995ec11eab 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -769,12 +769,9 @@ static void max310x_start_tx(struct uart_port *port) + + static unsigned int max310x_tx_empty(struct uart_port *port) + { +- unsigned int lvl, sts; ++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); + +- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); +- sts = max310x_port_read(port, MAX310X_IRQSTS_REG); +- +- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0; ++ return lvl ? 0 : TIOCSER_TEMT; + } + + static unsigned int max310x_get_mctrl(struct uart_port *port) +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..172e9ddede0 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,155 @@ +clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch +asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch +asoc-compress-fix-unsigned-integer-overflow-check.patch +reset-fix-memory-leak-in-reset_control_array_put.patch +asoc-kirkwood-fix-external-clock-probe-defer.patch +clk-samsung-exynos5420-preserve-pll-configuration-du.patch +reset-fix-reset_control_ops-kerneldoc-comment.patch +clk-at91-avoid-sleeping-early.patch +clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch +idr-fix-idr_alloc_u32-on-32-bit-systems.patch +x86-resctrl-prevent-null-pointer-dereference-when-re.patch +clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch +net-fec-add-missed-clk_disable_unprepare-in-remove.patch +bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch +can-peak_usb-report-bus-recovery-as-well.patch +can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch +can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch +can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch +can-rx-offload-can_rx_offload_offload_one-increment-.patch +can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch +can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch +can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch +watchdog-meson-fix-the-wrong-value-of-left-time.patch +scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch +net-bcmgenet-reapply-manual-settings-to-the-phy.patch +ceph-return-einval-if-given-fsc-mount-option-on-kern.patch +mac80211-fix-station-inactive_time-shortly-after-boo.patch +block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch +pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch +scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch +scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch +arm-dts-fix-up-sq201-flash-access.patch +arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch +arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch +parisc-fix-serio-address-output.patch +parisc-fix-hp-sdc-hpa-address-output.patch +arm64-mm-prevent-mismatched-52-bit-va-support.patch +arm64-smp-handle-errors-reported-by-the-firmware.patch +arm-omap1-fix-usb-configuration-for-device-only-setu.patch +rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch +pm-avs-smartreflex-null-check-before-some-freeing-fu.patch +arm-ks8695-fix-section-mismatch-warning.patch +acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch +scsi-lpfc-enable-management-features-for-if_type-6.patch +crypto-user-support-incremental-algorithm-dumps.patch +mwifiex-fix-potential-null-dereference-and-use-after.patch +mwifiex-debugfs-correct-histogram-spacing-formatting.patch +rtl818x-fix-potential-use-after-free.patch +xfs-require-both-realtime-inodes-to-mount.patch +ubi-put-mtd-device-after-it-is-not-used.patch +ubi-do-not-drop-ubi-device-reference-before-using.patch +microblaze-adjust-the-help-to-the-real-behavior.patch +microblaze-move-.-is-ready-messages-to-arch-microbla.patch +iwlwifi-move-iwl_nvm_check_version-into-dvm.patch +gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch +kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch +vsock-bind-to-random-port-for-vmaddr_port_any.patch +mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch +mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch +btrfs-only-track-ref_heads-in-delayed_ref_updates.patch +hid-intel-ish-hid-fixes-incorrect-error-handling.patch +serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch +kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch +xen-pciback-check-dev_data-before-using-it.patch +vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch +pinctrl-xway-fix-gpio-hog-related-boot-issues.patch +net-mlx5-continue-driver-initialization-despite-debu.patch +exofs_mount-fix-leaks-on-failure-exits.patch +bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch +bnxt_en-query-force-speeds-before-disabling-autoneg-.patch +kvm-s390-unregister-debug-feature-on-failing-arch-in.patch +pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch +pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch +hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch +dm-flakey-properly-corrupt-multi-page-bios.patch +gfs2-take-jdata-unstuff-into-account-in-do_grow.patch +xfs-align-compat-attrlist_by_handle-with-native-impl.patch +xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch +ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch +clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch +vxlan-fix-error-path-in-__vxlan_dev_create.patch +powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch +powerpc-xmon-fix-dump_segments.patch +drivers-regulator-fix-a-missing-check-of-return-valu.patch +bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch +serial-max310x-fix-tx_empty-callback.patch +openrisc-fix-broken-paths-to-arch-or32.patch +rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch +scsi-qla2xxx-deadlock-by-configfs_depend_item.patch +scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch +ath6kl-only-use-match-sets-when-firmware-supports-it.patch +ath6kl-fix-off-by-one-error-in-scan-completion.patch +powerpc-perf-fix-unit_sel-cache_sel-checks.patch +powerpc-prom-fix-early-debug-messages.patch +powerpc-mm-make-null-pointer-deferences-explicit-on-.patch +powerpc-44x-bamboo-fix-pci-range.patch +vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch +powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch +drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch +drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch +drbd-do-not-block-when-adjusting-disk-options-while-.patch +drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch +ib-rxe-make-counters-thread-safe.patch +regulator-tps65910-fix-a-missing-check-of-return-val.patch +powerpc-83xx-handle-machine-check-caused-by-watchdog.patch +powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch +crypto-mxc-scc-fix-build-warnings-on-arm64.patch +pwm-clps711x-fix-period-calculation.patch +net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch +net-net_namespace-check-the-return-value-of-register.patch +f2fs-fix-to-dirty-inode-synchronously.patch +um-make-gcov-depend-on-kcov.patch +net-cpts-fix-a-missing-check-of-clk_prepare.patch +net-stmicro-fix-a-missing-check-of-clk_prepare.patch +net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch +atl1e-checking-the-status-of-atl1e_write_phy_reg.patch +tipc-fix-a-missing-check-of-genlmsg_put.patch +net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch +ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch +vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch +lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch +lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch +fork-fix-some-wmissing-prototypes-warnings.patch +drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch +lib-genalloc.c-include-vmalloc.h.patch +mtd-check-add_mtd_device-ret-code.patch +tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch +net-core-neighbour-tell-kmemleak-about-hash-tables.patch +pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch +net-core-neighbour-fix-kmemleak-minimal-reference-co.patch +serial-8250-fix-serial8250-initialization-crash.patch +gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch +sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch +ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch +decnet-fix-dn_ifreq_size.patch +net-smc-prevent-races-between-smc_lgr_terminate-and-.patch +blktrace-show-requests-without-sector.patch +tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch +sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch +net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch +sctp-don-t-compare-hb_timer-expire-date-before-start.patch +bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch +net-dev-use-unsigned-integer-as-an-argument-to-left-.patch +kvm-properly-check-debugfs-dentry-before-using-it.patch +bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch +net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch +iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch +apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch +scsi-libsas-support-sata-phy-connection-rate-unmatch.patch +acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch +acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch +scsi-libsas-check-smp-phy-control-function-result.patch +f2fs-fix-to-data-block-override-node-segment-by-mist.patch +powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch +mtd-remove-a-debug-trace-in-mtdpart.c.patch diff --git a/queue-4.14/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch b/queue-4.14/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch new file mode 100644 index 00000000000..9598e7272af --- /dev/null +++ b/queue-4.14/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch @@ -0,0 +1,37 @@ +From d51d229f70e0b1a6b82e9f79cb599126ce803af3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Feb 2019 13:10:00 +0000 +Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe + +From: Bert Kenward + +[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ] + +The bitmap of found partitions in efx_ef10_mtd_probe was not +initialised, causing partitions to be suppressed based off whatever +value was in the bitmap at the start. + +Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe") +Signed-off-by: Bert Kenward +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index cc3be94d05622..2d92a9fe4606c 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -5918,7 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + static int efx_ef10_mtd_probe(struct efx_nic *efx) + { + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); +- DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT); ++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 }; + struct efx_mcdi_mtd_partition *parts; + size_t outlen, n_parts_total, i, n_parts; + unsigned int type; +-- +2.20.1 + diff --git a/queue-4.14/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch b/queue-4.14/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch new file mode 100644 index 00000000000..7b3977db36c --- /dev/null +++ b/queue-4.14/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch @@ -0,0 +1,100 @@ +From ff69edf325b8d455122e699e82472f86b71689e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jan 2019 19:02:17 +0000 +Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe + +From: Edward Cree + +[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ] + +Use a bitmap to keep track of which partition types we've already seen; + for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and + thus skip adding that partition. +Duplicate partitions occur because of the A/B backup scheme used by newer + sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because + they have the same name, causing us not to expose any MTDs at all. + +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 09352ee43b55c..cc3be94d05622 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -5852,22 +5852,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = { + { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" }, + { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" }, + }; ++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types) + + static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + struct efx_mcdi_mtd_partition *part, +- unsigned int type) ++ unsigned int type, ++ unsigned long *found) + { + MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN); + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX); + const struct efx_ef10_nvram_type_info *info; + size_t size, erase_size, outlen; ++ int type_idx = 0; + bool protected; + int rc; + +- for (info = efx_ef10_nvram_types; ; info++) { +- if (info == +- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types)) ++ for (type_idx = 0; ; type_idx++) { ++ if (type_idx == EF10_NVRAM_PARTITION_COUNT) + return -ENODEV; ++ info = efx_ef10_nvram_types + type_idx; + if ((type & ~info->type_mask) == info->type) + break; + } +@@ -5880,6 +5883,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + if (protected) + return -ENODEV; /* hide it */ + ++ /* If we've already exposed a partition of this type, hide this ++ * duplicate. All operations on MTDs are keyed by the type anyway, ++ * so we can't act on the duplicate. ++ */ ++ if (__test_and_set_bit(type_idx, found)) ++ return -EEXIST; ++ + part->nvram_type = type; + + MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type); +@@ -5908,6 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + static int efx_ef10_mtd_probe(struct efx_nic *efx) + { + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); ++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT); + struct efx_mcdi_mtd_partition *parts; + size_t outlen, n_parts_total, i, n_parts; + unsigned int type; +@@ -5936,11 +5947,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) + for (i = 0; i < n_parts_total; i++) { + type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID, + i); +- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type); +- if (rc == 0) +- n_parts++; +- else if (rc != -ENODEV) ++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type, ++ found); ++ if (rc == -EEXIST || rc == -ENODEV) ++ continue; ++ if (rc) + goto fail; ++ n_parts++; + } + + rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); +-- +2.20.1 + diff --git a/queue-4.14/tipc-fix-a-missing-check-of-genlmsg_put.patch b/queue-4.14/tipc-fix-a-missing-check-of-genlmsg_put.patch new file mode 100644 index 00000000000..aed6501472a --- /dev/null +++ b/queue-4.14/tipc-fix-a-missing-check-of-genlmsg_put.patch @@ -0,0 +1,35 @@ +From 0698e10dfc6290111453c290b6b84c56b1e0248b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 00:09:04 -0600 +Subject: tipc: fix a missing check of genlmsg_put + +From: Kangjie Lu + +[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ] + +genlmsg_put could fail. The fix inserts a check of its return value, and +if it fails, returns -EMSGSIZE. + +Signed-off-by: Kangjie Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/netlink_compat.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index 1c8ac0c11008c..91d51a595ac23 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -974,6 +974,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock) + + hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI, + TIPC_NL_PUBL_GET); ++ if (!hdr) ++ return -EMSGSIZE; + + nest = nla_nest_start(args, TIPC_NLA_SOCK); + if (!nest) { +-- +2.20.1 + diff --git a/queue-4.14/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch b/queue-4.14/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch new file mode 100644 index 00000000000..1e47221e2c6 --- /dev/null +++ b/queue-4.14/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch @@ -0,0 +1,42 @@ +From 5ccf526ece1fe7c8fd93ac68f074af5bd7b125ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jan 2019 10:52:23 -0600 +Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump + +From: Gustavo A. R. Silva + +[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ] + +There is a memory leak in case genlmsg_put fails. + +Fix this by freeing *args* before return. + +Addresses-Coverity-ID: 1476406 ("Resource leak") +Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put") +Signed-off-by: Gustavo A. R. Silva +Acked-by: Ying Xue +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/netlink_compat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index 91d51a595ac23..bbd05707c4e07 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -974,8 +974,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock) + + hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI, + TIPC_NL_PUBL_GET); +- if (!hdr) ++ if (!hdr) { ++ kfree_skb(args); + return -EMSGSIZE; ++ } + + nest = nla_nest_start(args, TIPC_NLA_SOCK); + if (!nest) { +-- +2.20.1 + diff --git a/queue-4.14/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch b/queue-4.14/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch new file mode 100644 index 00000000000..2b614d7898d --- /dev/null +++ b/queue-4.14/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch @@ -0,0 +1,48 @@ +From 287ba5648f601d9c31fd7c690ad707bc97581b41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Feb 2019 09:18:28 +0700 +Subject: tipc: fix skb may be leaky in tipc_link_input + +From: Hoang Le + +[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ] + +When we free skb at tipc_data_input, we return a 'false' boolean. +Then, skb passed to subcalling tipc_link_input in tipc_link_rcv, + + +1303 int tipc_link_rcv: +... +1354 if (!tipc_data_input(l, skb, l->inputq)) +1355 rc |= tipc_link_input(l, skb, l->inputq); + + +Fix it by simple changing to a 'true' boolean when skb is being free-ed. +Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above +condition. + +Acked-by: Ying Xue +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/link.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/link.c b/net/tipc/link.c +index 631bfc7e9127e..da749916faac4 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -1073,7 +1073,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, + default: + pr_warn("Dropping received illegal msg type\n"); + kfree_skb(skb); +- return false; ++ return true; + }; + } + +-- +2.20.1 + diff --git a/queue-4.14/ubi-do-not-drop-ubi-device-reference-before-using.patch b/queue-4.14/ubi-do-not-drop-ubi-device-reference-before-using.patch new file mode 100644 index 00000000000..b6f3e5c886d --- /dev/null +++ b/queue-4.14/ubi-do-not-drop-ubi-device-reference-before-using.patch @@ -0,0 +1,41 @@ +From 2c1209a19c0ff62b8e06c9752903a66a4b2d6331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 11:20:03 +0800 +Subject: ubi: Do not drop UBI device reference before using + +From: Pan Bian + +[ Upstream commit e542087701f09418702673631a908429feb3eae0 ] + +The UBI device reference is dropped but then the device is used as a +parameter of ubi_err. The bug is introduced in changing ubi_err's +behavior. The old ubi_err does not require a UBI device as its first +parameter, but the new one does. + +Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities") +Signed-off-by: Pan Bian +Reviewed-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/kapi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c +index d4b2e87444986..c2cf6bd3c162a 100644 +--- a/drivers/mtd/ubi/kapi.c ++++ b/drivers/mtd/ubi/kapi.c +@@ -227,9 +227,9 @@ out_unlock: + out_free: + kfree(desc); + out_put_ubi: +- ubi_put_device(ubi); + ubi_err(ubi, "cannot open device %d, volume %d, error %d", + ubi_num, vol_id, err); ++ ubi_put_device(ubi); + return ERR_PTR(err); + } + EXPORT_SYMBOL_GPL(ubi_open_volume); +-- +2.20.1 + diff --git a/queue-4.14/ubi-put-mtd-device-after-it-is-not-used.patch b/queue-4.14/ubi-put-mtd-device-after-it-is-not-used.patch new file mode 100644 index 00000000000..1c7fbf487e0 --- /dev/null +++ b/queue-4.14/ubi-put-mtd-device-after-it-is-not-used.patch @@ -0,0 +1,40 @@ +From a6b19ae308e338ea6780a8971d8fba49df1c7aeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:57:33 +0800 +Subject: ubi: Put MTD device after it is not used + +From: Pan Bian + +[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ] + +The MTD device reference is dropped via put_mtd_device, however its +field ->index is read and passed to ubi_msg. To fix this, the patch +moves the reference dropping after calling ubi_msg. + +Signed-off-by: Pan Bian +Reviewed-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/build.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index 6445c693d9359..0104d9537329f 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -1092,10 +1092,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway) + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +- put_mtd_device(ubi->mtd); + vfree(ubi->peb_buf); + vfree(ubi->fm_buf); + ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index); ++ put_mtd_device(ubi->mtd); + put_device(&ubi->dev); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/um-make-gcov-depend-on-kcov.patch b/queue-4.14/um-make-gcov-depend-on-kcov.patch new file mode 100644 index 00000000000..1cf044af069 --- /dev/null +++ b/queue-4.14/um-make-gcov-depend-on-kcov.patch @@ -0,0 +1,34 @@ +From e396963ba945705a3479498203591826a92dfa15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 12:58:12 +0100 +Subject: um: Make GCOV depend on !KCOV + +From: Richard Weinberger + +[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ] + +Both do more or less the same thing and are mutually exclusive. +If both are enabled the build will fail. +Sooner or later we can kill UML's GCOV. + +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug +index 967d3109689ff..39d44bfb241d5 100644 +--- a/arch/um/Kconfig.debug ++++ b/arch/um/Kconfig.debug +@@ -19,6 +19,7 @@ config GPROF + config GCOV + bool "Enable gcov support" + depends on DEBUG_INFO ++ depends on !KCOV + help + This option allows developers to retrieve coverage data from a UML + session. +-- +2.20.1 + diff --git a/queue-4.14/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch b/queue-4.14/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch new file mode 100644 index 00000000000..cb46ed3198b --- /dev/null +++ b/queue-4.14/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch @@ -0,0 +1,152 @@ +From a5ad66fd4ac418a3bbc1e2031055d81b06c2400b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 11:04:27 -0700 +Subject: vfio-mdev/samples: Use u8 instead of char for handle functions + +From: Nathan Chancellor + +[ Upstream commit 8ba35b3a0046d6573c98f00461d9bd1b86250d35 ] + +Clang warns: + +samples/vfio-mdev/mtty.c:592:39: warning: implicit conversion from 'int' +to 'char' changes value from 162 to -94 [-Wconstant-conversion] + *buf = UART_MSR_DSR | UART_MSR_DDSR | UART_MSR_DCD; + ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~ +1 warning generated. + +Turns out that all uses of buf in this function ultimately end up stored +or cast to an unsigned type. Just use u8, which has the same number of +bits but can store this larger number so Clang no longer warns. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + samples/vfio-mdev/mtty.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c +index ca495686b9c31..f8c7249fa705d 100644 +--- a/samples/vfio-mdev/mtty.c ++++ b/samples/vfio-mdev/mtty.c +@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid) + return NULL; + } + +-void dump_buffer(char *buf, uint32_t count) ++void dump_buffer(u8 *buf, uint32_t count) + { + #if defined(DEBUG) + int i; +@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state) + } + + static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, +- char *buf, u32 count) ++ u8 *buf, u32 count) + { + u32 cfg_addr, bar_mask, bar_index = 0; + +@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, + } + + static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, +- u16 offset, char *buf, u32 count) ++ u16 offset, u8 *buf, u32 count) + { + u8 data = *buf; + +@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, + } + + static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state, +- u16 offset, char *buf, u32 count) ++ u16 offset, u8 *buf, u32 count) + { + /* Handle read requests by guest */ + switch (offset) { +@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state) + } + } + +-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, ++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count, + loff_t pos, bool is_write) + { + struct mdev_state *mdev_state; +@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, + #if defined(DEBUG_REGS) + pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n", + __func__, index, offset, wr_reg[offset], +- (u8)*buf, mdev_state->s[index].dlab); ++ *buf, mdev_state->s[index].dlab); + #endif + handle_bar_write(index, mdev_state, offset, buf, count); + } else { +@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, + #if defined(DEBUG_REGS) + pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n", + __func__, index, offset, rd_reg[offset], +- (u8)*buf, mdev_state->s[index].dlab); ++ *buf, mdev_state->s[index].dlab); + #endif + } + break; +@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + if (count >= 4 && !(*ppos % 4)) { + u32 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + } else if (count >= 2 && !(*ppos % 2)) { + u16 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, + } else { + u8 val; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, false); + if (ret <= 0) + goto read_err; +@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, + if (copy_from_user(&val, buf, sizeof(val))) + goto write_err; + +- ret = mdev_access(mdev, (char *)&val, sizeof(val), ++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), + *ppos, true); + if (ret <= 0) + goto write_err; +-- +2.20.1 + diff --git a/queue-4.14/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch b/queue-4.14/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch new file mode 100644 index 00000000000..878a2ec8fb0 --- /dev/null +++ b/queue-4.14/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch @@ -0,0 +1,56 @@ +From e71d5c2d166a6eb1850e26796d89be534ef575f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Oct 2018 13:22:31 +1000 +Subject: vfio/spapr_tce: Get rid of possible infinite loop + +From: Alexey Kardashevskiy + +[ Upstream commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 ] + +As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered +memory. If there is a bug in memory release, the loop in +tce_iommu_release() becomes infinite; this actually happened to me. + +This makes the loop finite and prints a warning on every failure to make +the code more bug prone. + +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: David Gibson +Acked-by: Alex Williamson +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index b4c68f3b82be9..eba9aaf3cc17c 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -409,6 +409,7 @@ static void tce_iommu_release(void *iommu_data) + { + struct tce_container *container = iommu_data; + struct tce_iommu_group *tcegrp; ++ struct tce_iommu_prereg *tcemem, *tmtmp; + long i; + + while (tce_groups_attached(container)) { +@@ -431,13 +432,8 @@ static void tce_iommu_release(void *iommu_data) + tce_iommu_free_table(container, tbl); + } + +- while (!list_empty(&container->prereg_list)) { +- struct tce_iommu_prereg *tcemem; +- +- tcemem = list_first_entry(&container->prereg_list, +- struct tce_iommu_prereg, next); +- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem)); +- } ++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next) ++ WARN_ON(tce_iommu_prereg_free(container, tcemem)); + + tce_iommu_disable(container); + if (container->mm) +-- +2.20.1 + diff --git a/queue-4.14/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch b/queue-4.14/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch new file mode 100644 index 00000000000..98b24f193ef --- /dev/null +++ b/queue-4.14/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch @@ -0,0 +1,78 @@ +From 7aae3298013bed6ad103d921630760f3c0d65567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Dec 2018 00:34:36 -0800 +Subject: vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA + is n + +From: Wei Yang + +[ Upstream commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 ] + +Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that +fail zone_reclaim() as full") changed the return value of +node_reclaim(). The original return value 0 means NODE_RECLAIM_SOME +after this commit. + +While the return value of node_reclaim() when CONFIG_NUMA is n is not +changed. This will leads to call zone_watermark_ok() again. + +This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN. +Since node_reclaim() is only called in page_alloc.c, move it to +mm/internal.h. + +Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com +Signed-off-by: Wei Yang +Acked-by: Michal Hocko +Reviewed-by: Matthew Wilcox +Cc: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/swap.h | 6 ------ + mm/internal.h | 10 ++++++++++ + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/include/linux/swap.h b/include/linux/swap.h +index e643866912b70..411953964c345 100644 +--- a/include/linux/swap.h ++++ b/include/linux/swap.h +@@ -363,14 +363,8 @@ extern unsigned long vm_total_pages; + extern int node_reclaim_mode; + extern int sysctl_min_unmapped_ratio; + extern int sysctl_min_slab_ratio; +-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); + #else + #define node_reclaim_mode 0 +-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, +- unsigned int order) +-{ +- return 0; +-} + #endif + + extern int page_evictable(struct page *page); +diff --git a/mm/internal.h b/mm/internal.h +index 1df011f624801..a182506242c43 100644 +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -455,6 +455,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn, + #define NODE_RECLAIM_SOME 0 + #define NODE_RECLAIM_SUCCESS 1 + ++#ifdef CONFIG_NUMA ++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); ++#else ++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, ++ unsigned int order) ++{ ++ return NODE_RECLAIM_NOSCAN; ++} ++#endif ++ + extern int hwpoison_filter(struct page *p); + + extern u32 hwpoison_filter_dev_major; +-- +2.20.1 + diff --git a/queue-4.14/vsock-bind-to-random-port-for-vmaddr_port_any.patch b/queue-4.14/vsock-bind-to-random-port-for-vmaddr_port_any.patch new file mode 100644 index 00000000000..40139e4ff65 --- /dev/null +++ b/queue-4.14/vsock-bind-to-random-port-for-vmaddr_port_any.patch @@ -0,0 +1,55 @@ +From 5fbc694ceb37755090309441dd3ad315105cf985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Dec 2018 11:12:55 -0800 +Subject: VSOCK: bind to random port for VMADDR_PORT_ANY + +From: Lepton Wu + +[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ] + +The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes +when VMM crashed, there is still orphaned vsock which is waiting for +close timer, then it could cause connection time out for new started VM +if they are trying to connect to same port with same guest cid since the +new packets could hit that orphaned vsock. We could also fix this by doing +more in vhost_vsock_reset_orphans, but any way, it should be better to start +from a random local port instead of a fixed one. + +Signed-off-by: Lepton Wu +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 1939b77e98b72..73eac97e19fb1 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -107,6 +107,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -487,9 +488,13 @@ out: + static int __vsock_bind_stream(struct vsock_sock *vsk, + struct sockaddr_vm *addr) + { +- static u32 port = LAST_RESERVED_PORT + 1; ++ static u32 port = 0; + struct sockaddr_vm new_addr; + ++ if (!port) ++ port = LAST_RESERVED_PORT + 1 + ++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT); ++ + vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port); + + if (addr->svm_port == VMADDR_PORT_ANY) { +-- +2.20.1 + diff --git a/queue-4.14/vxlan-fix-error-path-in-__vxlan_dev_create.patch b/queue-4.14/vxlan-fix-error-path-in-__vxlan_dev_create.patch new file mode 100644 index 00000000000..c4713d680c6 --- /dev/null +++ b/queue-4.14/vxlan-fix-error-path-in-__vxlan_dev_create.patch @@ -0,0 +1,83 @@ +From 4449a337cb0da78805aae727151f245bdad50df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 13:16:00 +0000 +Subject: vxlan: Fix error path in __vxlan_dev_create() + +From: Petr Machata + +[ Upstream commit 6db9246871394b3a136cd52001a0763676563840 ] + +When a failure occurs in rtnl_configure_link(), the current code +calls unregister_netdevice() to roll back the earlier call to +register_netdevice(), and jumps to errout, which calls +vxlan_fdb_destroy(). + +However unregister_netdevice() calls transitively ndo_uninit, which is +vxlan_uninit(), and that already takes care of deleting the default FDB +entry by calling vxlan_fdb_delete_default(). Since the entry added +earlier in __vxlan_dev_create() is exactly the default entry, the +cleanup code in the errout block always leads to double free and thus a +panic. + +Besides, since vxlan_fdb_delete_default() always destroys the FDB entry +with notification enabled, the deletion of the default entry is notified +even before the addition was notified. + +Instead, move the unregister_netdevice() call after the manual destroy, +which solves both problems. + +Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create") +Signed-off-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 6d26bbd190dd6..153a81ece9fe4 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3217,6 +3217,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + struct vxlan_net *vn = net_generic(net, vxlan_net_id); + struct vxlan_dev *vxlan = netdev_priv(dev); + struct vxlan_fdb *f = NULL; ++ bool unregister = false; + int err; + + err = vxlan_dev_configure(net, dev, conf, false, extack); +@@ -3242,12 +3243,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + err = register_netdevice(dev); + if (err) + goto errout; ++ unregister = true; + + err = rtnl_configure_link(dev, NULL); +- if (err) { +- unregister_netdevice(dev); ++ if (err) + goto errout; +- } + + /* notify default fdb entry */ + if (f) +@@ -3255,9 +3255,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + + list_add(&vxlan->next, &vn->vxlan_list); + return 0; ++ + errout: ++ /* unregister_netdevice() destroys the default FDB entry with deletion ++ * notification. But the addition notification was not sent yet, so ++ * destroy the entry by hand here. ++ */ + if (f) + vxlan_fdb_destroy(vxlan, f, false); ++ if (unregister) ++ unregister_netdevice(dev); + return err; + } + +-- +2.20.1 + diff --git a/queue-4.14/watchdog-meson-fix-the-wrong-value-of-left-time.patch b/queue-4.14/watchdog-meson-fix-the-wrong-value-of-left-time.patch new file mode 100644 index 00000000000..eb1c75d15ab --- /dev/null +++ b/queue-4.14/watchdog-meson-fix-the-wrong-value-of-left-time.patch @@ -0,0 +1,47 @@ +From 95d348d2d9571c83a3093d72511858f420bb499d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 18:53:49 +0800 +Subject: watchdog: meson: Fix the wrong value of left time + +From: Xingyu Chen + +[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ] + +The left time value is wrong when we get it by sysfs. The left time value +should be equal to preset timeout value minus elapsed time value. According +to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value +is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved +to BIT[16-31] of the WATCHDOG_TCNT. + +[0]: http://linux-meson.com + +Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver") +Signed-off-by: Xingyu Chen +Acked-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/meson_gxbb_wdt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c +index 69a5a57f14462..61297a6ab43a0 100644 +--- a/drivers/watchdog/meson_gxbb_wdt.c ++++ b/drivers/watchdog/meson_gxbb_wdt.c +@@ -137,8 +137,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev) + + reg = readl(data->reg_base + GXBB_WDT_TCNT_REG); + +- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) - +- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000; ++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) - ++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000; + } + + static const struct watchdog_ops meson_gxbb_wdt_ops = { +-- +2.20.1 + diff --git a/queue-4.14/x86-resctrl-prevent-null-pointer-dereference-when-re.patch b/queue-4.14/x86-resctrl-prevent-null-pointer-dereference-when-re.patch new file mode 100644 index 00000000000..11c5527a729 --- /dev/null +++ b/queue-4.14/x86-resctrl-prevent-null-pointer-dereference-when-re.patch @@ -0,0 +1,59 @@ +From 7f9bc8f5775521302ab2eab69a45fc4e46ef9869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 13:25:02 +0800 +Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata + +From: Xiaochen Shen + +[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ] + +When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED +in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed +until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later. + +During the window of deleting a mon group, if an application calls +rdtgroup_mondata_show() to read mondata under this mon group, +'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when +rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path: +rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count(). +Thus it results in NULL pointer dereference in mon_event_count(). + +Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT +immediately when reading mondata during the window of deleting a mon +group. + +Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data") +Signed-off-by: Xiaochen Shen +Signed-off-by: Borislav Petkov +Reviewed-by: Fenghua Yu +Reviewed-by: Tony Luck +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: pei.p.jia@intel.com +Cc: Reinette Chatre +Cc: Thomas Gleixner +Cc: x86-ml +Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +index f6ea94f8954a7..f892cb0b485e1 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c ++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +@@ -313,6 +313,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg) + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); ++ if (!rdtgrp) { ++ ret = -ENOENT; ++ goto out; ++ } + + md.priv = of->kn->priv; + resid = md.u.rid; +-- +2.20.1 + diff --git a/queue-4.14/xen-pciback-check-dev_data-before-using-it.patch b/queue-4.14/xen-pciback-check-dev_data-before-using-it.patch new file mode 100644 index 00000000000..f1513949f6e --- /dev/null +++ b/queue-4.14/xen-pciback-check-dev_data-before-using-it.patch @@ -0,0 +1,38 @@ +From 697ed25db6adb283f73835a95d83aed7c096f31b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 12:55:45 +0000 +Subject: xen/pciback: Check dev_data before using it + +From: Ross Lagerwall + +[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ] + +If pcistub_init_device fails, the release function will be called with +dev_data set to NULL. Check it before using it to avoid a NULL pointer +dereference. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/xen-pciback/pci_stub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c +index 9e480fdebe1f0..8c250f4a3a97a 100644 +--- a/drivers/xen/xen-pciback/pci_stub.c ++++ b/drivers/xen/xen-pciback/pci_stub.c +@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref) + * is called from "unbind" which takes a device_lock mutex. + */ + __pci_reset_function_locked(dev); +- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) ++ if (dev_data && ++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) + dev_info(&dev->dev, "Could not reload PCI state\n"); + else + pci_restore_state(dev); +-- +2.20.1 + diff --git a/queue-4.14/xfs-align-compat-attrlist_by_handle-with-native-impl.patch b/queue-4.14/xfs-align-compat-attrlist_by_handle-with-native-impl.patch new file mode 100644 index 00000000000..365b7912cd0 --- /dev/null +++ b/queue-4.14/xfs-align-compat-attrlist_by_handle-with-native-impl.patch @@ -0,0 +1,56 @@ +From 651d6848e24c169cf6fe8ed965ce9ffc95dc2c67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Dec 2018 09:35:27 -0800 +Subject: xfs: Align compat attrlist_by_handle with native implementation. + +From: Nick Bowler + +[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ] + +While inspecting the ioctl implementations, I noticed that the compat +implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the +same thing as the native implementation. Specifically, the "cursor" +does not appear to be written out to userspace on the compat path, +like it is on the native path. + +This adjusts the compat implementation to copy out the cursor just +like the native implementation does. The attrlist cursor does not +require any special compat handling. This fixes xfstests xfs/269 +on both IA-32 and x32 userspace, when running on an amd64 kernel. + +Signed-off-by: Nick Bowler +Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace") +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_ioctl32.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c +index fa0bc4d46065a..d3c0e4b8bf421 100644 +--- a/fs/xfs/xfs_ioctl32.c ++++ b/fs/xfs/xfs_ioctl32.c +@@ -347,6 +347,7 @@ xfs_compat_attrlist_by_handle( + { + int error; + attrlist_cursor_kern_t *cursor; ++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg; + compat_xfs_fsop_attrlist_handlereq_t al_hreq; + struct dentry *dentry; + char *kbuf; +@@ -381,6 +382,11 @@ xfs_compat_attrlist_by_handle( + if (error) + goto out_kfree; + ++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) { ++ error = -EFAULT; ++ goto out_kfree; ++ } ++ + if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen)) + error = -EFAULT; + +-- +2.20.1 + diff --git a/queue-4.14/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch b/queue-4.14/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch new file mode 100644 index 00000000000..8c963fc4bee --- /dev/null +++ b/queue-4.14/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch @@ -0,0 +1,94 @@ +From 92b35359d620346cc107784a097e2da43d2ace03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Dec 2018 09:35:27 -0800 +Subject: xfs: Fix bulkstat compat ioctls on x32 userspace. + +From: Nick Bowler + +[ Upstream commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 ] + +The bulkstat family of ioctls are problematic on x32, because there is +a mixup of native 32-bit and 64-bit conventions. The xfs_fsop_bulkreq +struct contains pointers and 32-bit integers so that matches the native +32-bit layout, and that means the ioctl implementation goes into the +regular compat path on x32. + +However, the 'ubuffer' member of that struct in turn refers to either +struct xfs_inogrp or xfs_bstat (or an array of these). On x32, those +structures match the native 64-bit layout. The compat implementation +writes out the 32-bit version of these structures. This is not the +expected format for x32 userspace, causing problems. + +Fortunately the functions which actually output these xfs_inogrp and +xfs_bstat structures have an easy way to select which output format +is required, so we just need a little tweak to select the right format +on x32. + +Signed-off-by: Nick Bowler +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++---- + 1 file changed, 30 insertions(+), 4 deletions(-) + +diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c +index d3c0e4b8bf421..5f616a6a5358d 100644 +--- a/fs/xfs/xfs_ioctl32.c ++++ b/fs/xfs/xfs_ioctl32.c +@@ -252,6 +252,32 @@ xfs_compat_ioc_bulkstat( + int done; + int error; + ++ /* ++ * Output structure handling functions. Depending on the command, ++ * either the xfs_bstat and xfs_inogrp structures are written out ++ * to userpace memory via bulkreq.ubuffer. Normally the compat ++ * functions and structure size are the correct ones to use ... ++ */ ++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat; ++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat; ++ size_t bs_one_size = sizeof(struct compat_xfs_bstat); ++ ++#ifdef CONFIG_X86_X32 ++ if (in_x32_syscall()) { ++ /* ++ * ... but on x32 the input xfs_fsop_bulkreq has pointers ++ * which must be handled in the "compat" (32-bit) way, while ++ * the xfs_bstat and xfs_inogrp structures follow native 64- ++ * bit layout convention. So adjust accordingly, otherwise ++ * the data written out in compat layout will not match what ++ * x32 userspace expects. ++ */ ++ inumbers_func = xfs_inumbers_fmt; ++ bs_one_func = xfs_bulkstat_one; ++ bs_one_size = sizeof(struct xfs_bstat); ++ } ++#endif ++ + /* done = 1 if there are more stats to get and if bulkstat */ + /* should be called again (unused here, but used in dmapi) */ + +@@ -283,15 +309,15 @@ xfs_compat_ioc_bulkstat( + + if (cmd == XFS_IOC_FSINUMBERS_32) { + error = xfs_inumbers(mp, &inlast, &count, +- bulkreq.ubuffer, xfs_inumbers_fmt_compat); ++ bulkreq.ubuffer, inumbers_func); + } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) { + int res; + +- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer, +- sizeof(compat_xfs_bstat_t), NULL, &res); ++ error = bs_one_func(mp, inlast, bulkreq.ubuffer, ++ bs_one_size, NULL, &res); + } else if (cmd == XFS_IOC_FSBULKSTAT_32) { + error = xfs_bulkstat(mp, &inlast, &count, +- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t), ++ bs_one_func, bs_one_size, + bulkreq.ubuffer, &done); + } else + error = -EINVAL; +-- +2.20.1 + diff --git a/queue-4.14/xfs-require-both-realtime-inodes-to-mount.patch b/queue-4.14/xfs-require-both-realtime-inodes-to-mount.patch new file mode 100644 index 00000000000..026ea9dcdf0 --- /dev/null +++ b/queue-4.14/xfs-require-both-realtime-inodes-to-mount.patch @@ -0,0 +1,45 @@ +From 21beaa11e346d5ac5dbe04a4e807221be0799433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 15:18:52 -0800 +Subject: xfs: require both realtime inodes to mount + +From: Darrick J. Wong + +[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ] + +Since mkfs always formats the filesystem with the realtime bitmap and +summary inodes immediately after the root directory, we should expect +that both of them are present and loadable, even if there isn't a +realtime volume attached. There's no reason to skip this if rbmino == +NULLFSINO; in fact, this causes an immediate crash if the there /is/ a +realtime volume and someone writes to it. + +Signed-off-by: Darrick J. Wong +Reviewed-by: Bill O'Donnell +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_rtalloc.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c +index 488719d43ca82..cdcb7235e41ae 100644 +--- a/fs/xfs/xfs_rtalloc.c ++++ b/fs/xfs/xfs_rtalloc.c +@@ -1214,13 +1214,11 @@ xfs_rtmount_inodes( + xfs_sb_t *sbp; + + sbp = &mp->m_sb; +- if (sbp->sb_rbmino == NULLFSINO) +- return 0; + error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip); + if (error) + return error; + ASSERT(mp->m_rbmip != NULL); +- ASSERT(sbp->sb_rsumino != NULLFSINO); ++ + error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip); + if (error) { + IRELE(mp->m_rbmip); +-- +2.20.1 +