From: Sasha Levin Date: Thu, 19 Sep 2019 18:08:16 +0000 (-0400) Subject: fixes for 5.2 X-Git-Tag: v4.4.194~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=61a6770da6f527923150b0a533eeef4c125d2de5;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.2 Signed-off-by: Sasha Levin --- diff --git a/queue-5.2/amd-xgbe-fix-error-path-in-xgbe_mod_init.patch b/queue-5.2/amd-xgbe-fix-error-path-in-xgbe_mod_init.patch new file mode 100644 index 00000000000..19a3285a4a3 --- /dev/null +++ b/queue-5.2/amd-xgbe-fix-error-path-in-xgbe_mod_init.patch @@ -0,0 +1,50 @@ +From 25bb14ba0b6a77cde5225aed2885e15cd53bd996 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 10:46:00 +0800 +Subject: amd-xgbe: Fix error path in xgbe_mod_init() + +From: YueHaibing + +[ Upstream commit b6b4dc4c1fa7f1c99398e7dc85758049645e9588 ] + +In xgbe_mod_init(), we should do cleanup if some error occurs + +Reported-by: Hulk Robot +Fixes: efbaa828330a ("amd-xgbe: Add support to handle device renaming") +Fixes: 47f164deab22 ("amd-xgbe: Add PCI device support") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-main.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +index b41f23679a087..7ce9c69e9c44f 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +@@ -469,13 +469,19 @@ static int __init xgbe_mod_init(void) + + ret = xgbe_platform_init(); + if (ret) +- return ret; ++ goto err_platform_init; + + ret = xgbe_pci_init(); + if (ret) +- return ret; ++ goto err_pci_init; + + return 0; ++ ++err_pci_init: ++ xgbe_platform_exit(); ++err_platform_init: ++ unregister_netdevice_notifier(&xgbe_netdev_notifier); ++ return ret; + } + + static void __exit xgbe_mod_exit(void) +-- +2.20.1 + diff --git a/queue-5.2/arm-8874-1-mm-only-adjust-sections-of-valid-mm-struc.patch b/queue-5.2/arm-8874-1-mm-only-adjust-sections-of-valid-mm-struc.patch new file mode 100644 index 00000000000..70b6b9f7688 --- /dev/null +++ b/queue-5.2/arm-8874-1-mm-only-adjust-sections-of-valid-mm-struc.patch @@ -0,0 +1,52 @@ +From 27f753a2f6fdf4416ddbde3f9cbdc87cb82f6346 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2019 18:50:11 +0100 +Subject: ARM: 8874/1: mm: only adjust sections of valid mm structures + +From: Doug Berger + +[ Upstream commit c51bc12d06b3a5494fbfcbd788a8e307932a06e9 ] + +A timing hazard exists when an early fork/exec thread begins +exiting and sets its mm pointer to NULL while a separate core +tries to update the section information. + +This commit ensures that the mm pointer is not NULL before +setting its section parameters. The arguments provided by +commit 11ce4b33aedc ("ARM: 8672/1: mm: remove tasklist locking +from update_sections_early()") are equally valid for not +requiring grabbing the task_lock around this check. + +Fixes: 08925c2f124f ("ARM: 8464/1: Update all mm structures with section adjustments") +Signed-off-by: Doug Berger +Acked-by: Laura Abbott +Cc: Mike Rapoport +Cc: Andrew Morton +Cc: Florian Fainelli +Cc: Rob Herring +Cc: "Steven Rostedt (VMware)" +Cc: Peng Fan +Cc: Geert Uytterhoeven +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c +index 749a5a6f61433..8e793cddac661 100644 +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -613,7 +613,8 @@ static void update_sections_early(struct section_perm perms[], int n) + if (t->flags & PF_KTHREAD) + continue; + for_each_thread(t, s) +- set_section_perms(perms, n, true, s->mm); ++ if (s->mm) ++ set_section_perms(perms, n, true, s->mm); + } + set_section_perms(perms, n, true, current->active_mm); + set_section_perms(perms, n, true, &init_mm); +-- +2.20.1 + diff --git a/queue-5.2/arm-8901-1-add-a-criteria-for-pfn_valid-of-arm.patch b/queue-5.2/arm-8901-1-add-a-criteria-for-pfn_valid-of-arm.patch new file mode 100644 index 00000000000..9c340c99769 --- /dev/null +++ b/queue-5.2/arm-8901-1-add-a-criteria-for-pfn_valid-of-arm.patch @@ -0,0 +1,50 @@ +From d8711950c63fa202dda45cf077d49c6d3ed7560a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 04:07:37 +0100 +Subject: ARM: 8901/1: add a criteria for pfn_valid of arm + +From: zhaoyang + +[ Upstream commit 5b3efa4f1479c91cb8361acef55f9c6662feba57 ] + +pfn_valid can be wrong when parsing a invalid pfn whose phys address +exceeds BITS_PER_LONG as the MSB will be trimed when shifted. + +The issue originally arise from bellowing call stack, which corresponding to +an access of the /proc/kpageflags from userspace with a invalid pfn parameter +and leads to kernel panic. + +[46886.723249] c7 [] (stable_page_flags) from [] +[46886.723264] c7 [] (kpageflags_read) from [] +[46886.723280] c7 [] (proc_reg_read) from [] +[46886.723290] c7 [] (__vfs_read) from [] +[46886.723301] c7 [] (vfs_read) from [] +[46886.723315] c7 [] (SyS_pread64) from [] +(ret_fast_syscall+0x0/0x28) + +Signed-off-by: Zhaoyang Huang +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/init.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c +index 8e793cddac661..98e17388a563f 100644 +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -174,6 +174,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low, + #ifdef CONFIG_HAVE_ARCH_PFN_VALID + int pfn_valid(unsigned long pfn) + { ++ phys_addr_t addr = __pfn_to_phys(pfn); ++ ++ if (__phys_to_pfn(addr) != pfn) ++ return 0; ++ + return memblock_is_map_memory(__pfn_to_phys(pfn)); + } + EXPORT_SYMBOL(pfn_valid); +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-am335x-fix-uarts-length.patch b/queue-5.2/arm-dts-am335x-fix-uarts-length.patch new file mode 100644 index 00000000000..55995d2f4cc --- /dev/null +++ b/queue-5.2/arm-dts-am335x-fix-uarts-length.patch @@ -0,0 +1,80 @@ +From 92ead4922f3a3f9ba35996924edb0da2964a3642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 14:23:29 +0200 +Subject: ARM: dts: am335x: Fix UARTs length + +From: Emmanuel Vadot + +[ Upstream commit 8613e2ca4fff764f23785eadfa54a08631ee682a ] + +As seen on the AM335x TRM all the UARTs controller only are 0x1000 in size. +Fix this in the DTS. + +Signed-off-by: Emmanuel Vadot +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am33xx-l4.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi +index 4bd22c1edf963..46849d6ecb3e2 100644 +--- a/arch/arm/boot/dts/am33xx-l4.dtsi ++++ b/arch/arm/boot/dts/am33xx-l4.dtsi +@@ -185,7 +185,7 @@ + uart0: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <72>; + status = "disabled"; + dmas = <&edma 26 0>, <&edma 27 0>; +@@ -934,7 +934,7 @@ + uart1: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <73>; + status = "disabled"; + dmas = <&edma 28 0>, <&edma 29 0>; +@@ -966,7 +966,7 @@ + uart2: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <74>; + status = "disabled"; + dmas = <&edma 30 0>, <&edma 31 0>; +@@ -1614,7 +1614,7 @@ + uart3: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <44>; + status = "disabled"; + }; +@@ -1644,7 +1644,7 @@ + uart4: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <45>; + status = "disabled"; + }; +@@ -1674,7 +1674,7 @@ + uart5: serial@0 { + compatible = "ti,am3352-uart", "ti,omap3-uart"; + clock-frequency = <48000000>; +- reg = <0x0 0x2000>; ++ reg = <0x0 0x1000>; + interrupts = <46>; + status = "disabled"; + }; +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-am57xx-disable-voltage-switching-for-sd-card.patch b/queue-5.2/arm-dts-am57xx-disable-voltage-switching-for-sd-card.patch new file mode 100644 index 00000000000..2854b1f5594 --- /dev/null +++ b/queue-5.2/arm-dts-am57xx-disable-voltage-switching-for-sd-card.patch @@ -0,0 +1,154 @@ +From 85359583bf3db6af5082682f9a919c2680266c89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2019 15:54:54 +0530 +Subject: ARM: dts: am57xx: Disable voltage switching for SD card + +From: Faiz Abbas + +[ Upstream commit fb59ee37cfe20d10d19568899d1458a58361246c ] + +If UHS speed modes are enabled, a compatible SD card switches down to +1.8V during enumeration. If after this a software reboot/crash takes +place and on-chip ROM tries to enumerate the SD card, the difference in +IO voltages (host @ 3.3V and card @ 1.8V) may end up damaging the card. + +The fix for this is to have support for power cycling the card in +hardware (with a PORz/soft-reset line causing a power cycle of the +card). Because the beaglebone X15 (rev A,B and C), am57xx-idks and +am57xx-evms don't have this capability, disable voltage switching for +these boards. + +The major effect of this is that the maximum supported speed +mode is now high speed(50 MHz) down from SDR104(200 MHz). + +commit 88a748419b84 ("ARM: dts: am57xx-idk: Remove support for voltage +switching for SD card") did this only for idk boards. Do it for all +affected boards. + +Signed-off-by: Faiz Abbas +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am571x-idk.dts | 7 +------ + arch/arm/boot/dts/am572x-idk.dts | 7 +------ + arch/arm/boot/dts/am574x-idk.dts | 7 +------ + arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 1 + + arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts | 7 +------ + arch/arm/boot/dts/am57xx-beagle-x15-revc.dts | 7 +------ + 6 files changed, 6 insertions(+), 30 deletions(-) + +diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts +index 1d5e99964bbf8..0aaacea1d887b 100644 +--- a/arch/arm/boot/dts/am571x-idk.dts ++++ b/arch/arm/boot/dts/am571x-idk.dts +@@ -175,14 +175,9 @@ + }; + + &mmc1 { +- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104"; ++ pinctrl-names = "default", "hs"; + pinctrl-0 = <&mmc1_pins_default_no_clk_pu>; + pinctrl-1 = <&mmc1_pins_hs>; +- pinctrl-2 = <&mmc1_pins_sdr12>; +- pinctrl-3 = <&mmc1_pins_sdr25>; +- pinctrl-4 = <&mmc1_pins_sdr50>; +- pinctrl-5 = <&mmc1_pins_ddr50_rev20 &mmc1_iodelay_ddr50_conf>; +- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>; + }; + + &mmc2 { +diff --git a/arch/arm/boot/dts/am572x-idk.dts b/arch/arm/boot/dts/am572x-idk.dts +index c65d7f6d3b5a6..ea1c119feaa57 100644 +--- a/arch/arm/boot/dts/am572x-idk.dts ++++ b/arch/arm/boot/dts/am572x-idk.dts +@@ -16,14 +16,9 @@ + }; + + &mmc1 { +- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104"; ++ pinctrl-names = "default", "hs"; + pinctrl-0 = <&mmc1_pins_default_no_clk_pu>; + pinctrl-1 = <&mmc1_pins_hs>; +- pinctrl-2 = <&mmc1_pins_sdr12>; +- pinctrl-3 = <&mmc1_pins_sdr25>; +- pinctrl-4 = <&mmc1_pins_sdr50>; +- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>; +- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>; + }; + + &mmc2 { +diff --git a/arch/arm/boot/dts/am574x-idk.dts b/arch/arm/boot/dts/am574x-idk.dts +index dc5141c35610e..7935d70874ce2 100644 +--- a/arch/arm/boot/dts/am574x-idk.dts ++++ b/arch/arm/boot/dts/am574x-idk.dts +@@ -24,14 +24,9 @@ + }; + + &mmc1 { +- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104"; ++ pinctrl-names = "default", "hs"; + pinctrl-0 = <&mmc1_pins_default_no_clk_pu>; + pinctrl-1 = <&mmc1_pins_hs>; +- pinctrl-2 = <&mmc1_pins_default>; +- pinctrl-3 = <&mmc1_pins_hs>; +- pinctrl-4 = <&mmc1_pins_sdr50>; +- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_conf>; +- pinctrl-6 = <&mmc1_pins_ddr50 &mmc1_iodelay_sdr104_conf>; + }; + + &mmc2 { +diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +index d02f5fa61e5f5..d50de7a6ea6c5 100644 +--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi ++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +@@ -430,6 +430,7 @@ + + bus-width = <4>; + cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */ ++ no-1-8-v; + }; + + &mmc2 { +diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts +index a374b5cd6db0e..7b113b52c3fb6 100644 +--- a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts ++++ b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts +@@ -16,14 +16,9 @@ + }; + + &mmc1 { +- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104"; ++ pinctrl-names = "default", "hs"; + pinctrl-0 = <&mmc1_pins_default>; + pinctrl-1 = <&mmc1_pins_hs>; +- pinctrl-2 = <&mmc1_pins_sdr12>; +- pinctrl-3 = <&mmc1_pins_sdr25>; +- pinctrl-4 = <&mmc1_pins_sdr50>; +- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev11_conf>; +- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev11_conf>; + vmmc-supply = <&vdd_3v3>; + vqmmc-supply = <&ldo1_reg>; + }; +diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts +index 4badd2144db9a..30c500b15b219 100644 +--- a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts ++++ b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts +@@ -16,14 +16,9 @@ + }; + + &mmc1 { +- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104"; ++ pinctrl-names = "default", "hs"; + pinctrl-0 = <&mmc1_pins_default>; + pinctrl-1 = <&mmc1_pins_hs>; +- pinctrl-2 = <&mmc1_pins_sdr12>; +- pinctrl-3 = <&mmc1_pins_sdr25>; +- pinctrl-4 = <&mmc1_pins_sdr50>; +- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>; +- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>; + vmmc-supply = <&vdd_3v3>; + vqmmc-supply = <&ldo1_reg>; + }; +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-dra74x-fix-iodelay-configuration-for-mmc3.patch b/queue-5.2/arm-dts-dra74x-fix-iodelay-configuration-for-mmc3.patch new file mode 100644 index 00000000000..7fa1f7dba8b --- /dev/null +++ b/queue-5.2/arm-dts-dra74x-fix-iodelay-configuration-for-mmc3.patch @@ -0,0 +1,110 @@ +From 59fd116f5b10213f645fe8f39fc7ba6a0c889518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2019 16:22:38 +0530 +Subject: ARM: dts: dra74x: Fix iodelay configuration for mmc3 + +From: Faiz Abbas + +[ Upstream commit 07f9a8be66a9bd86f9eaedf8f8aeb416195adab8 ] + +According to the latest am572x[1] and dra74x[2] data manuals, mmc3 +default, hs, sdr12 and sdr25 modes use iodelay values given in +MMC3_MANUAL1. Set the MODE_SELECT bit for these so that manual mode is +selected and correct iodelay values can be configured. + +[1] http://www.ti.com/lit/ds/symlink/am5728.pdf +[2] http://www.ti.com/lit/ds/symlink/dra746.pdf + +Signed-off-by: Faiz Abbas +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi | 50 +++++++++++------------ + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi +index 28ebb4eb884a9..214b9e6de2c35 100644 +--- a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi ++++ b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi +@@ -32,7 +32,7 @@ + * + * Datamanual Revisions: + * +- * AM572x Silicon Revision 2.0: SPRS953B, Revised November 2016 ++ * AM572x Silicon Revision 2.0: SPRS953F, Revised May 2019 + * AM572x Silicon Revision 1.1: SPRS915R, Revised November 2016 + * + */ +@@ -229,45 +229,45 @@ + + mmc3_pins_default: mmc3_pins_default { + pinctrl-single,pins = < +- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ +- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ +- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ +- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ +- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ +- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ ++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ ++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ ++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ ++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ ++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ ++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ + >; + }; + + mmc3_pins_hs: mmc3_pins_hs { + pinctrl-single,pins = < +- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ +- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ +- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ +- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ +- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ +- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ ++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ ++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ ++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ ++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ ++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ ++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ + >; + }; + + mmc3_pins_sdr12: mmc3_pins_sdr12 { + pinctrl-single,pins = < +- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ +- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ +- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ +- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ +- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ +- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ ++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ ++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ ++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ ++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ ++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ ++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ + >; + }; + + mmc3_pins_sdr25: mmc3_pins_sdr25 { + pinctrl-single,pins = < +- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ +- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ +- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ +- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ +- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ +- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ ++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */ ++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */ ++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */ ++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */ ++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */ ++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */ + >; + }; + +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-fix-flags-for-gpio7.patch b/queue-5.2/arm-dts-fix-flags-for-gpio7.patch new file mode 100644 index 00000000000..7627a29e694 --- /dev/null +++ b/queue-5.2/arm-dts-fix-flags-for-gpio7.patch @@ -0,0 +1,68 @@ +From 6495ff4f834e0220112fdb2ef783b5d9997f33f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 03:44:47 -0700 +Subject: ARM: dts: Fix flags for gpio7 + +From: Tony Lindgren + +[ Upstream commit 2e8647bbe1c8233a20c32fd2648258f2c05c7335 ] + +The ti,no-idle-on-init and ti,no-reset-on-init flags need to be at +the interconnect target module level for the modules that have it +defined. Otherwise we get the following warnings: + +dts flag should be at module level for ti,no-idle-on-init +dts flag should be at module level for ti,no-reset-on-init + +Reviewed-by: Suman Anna +Tested-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 2 +- + arch/arm/boot/dts/dra7-evm.dts | 2 +- + arch/arm/boot/dts/dra7-l4.dtsi | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +index d50de7a6ea6c5..bc76f1705c0f6 100644 +--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi ++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +@@ -379,7 +379,7 @@ + }; + }; + +-&gpio7 { ++&gpio7_target { + ti,no-reset-on-init; + ti,no-idle-on-init; + }; +diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts +index 714e971b912a4..de7f85efaa512 100644 +--- a/arch/arm/boot/dts/dra7-evm.dts ++++ b/arch/arm/boot/dts/dra7-evm.dts +@@ -498,7 +498,7 @@ + phy-supply = <&ldousb_reg>; + }; + +-&gpio7 { ++&gpio7_target { + ti,no-reset-on-init; + ti,no-idle-on-init; + }; +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 23faedec08abd..63628e166c0cd 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -1261,7 +1261,7 @@ + }; + }; + +- target-module@51000 { /* 0x48051000, ap 45 2e.0 */ ++ gpio7_target: target-module@51000 { /* 0x48051000, ap 45 2e.0 */ + compatible = "ti,sysc-omap2", "ti,sysc"; + ti,hwmods = "gpio7"; + reg = <0x51000 0x4>, +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-fix-incomplete-dts-data-for-am3-and-am4-mmc.patch b/queue-5.2/arm-dts-fix-incomplete-dts-data-for-am3-and-am4-mmc.patch new file mode 100644 index 00000000000..4992b725803 --- /dev/null +++ b/queue-5.2/arm-dts-fix-incomplete-dts-data-for-am3-and-am4-mmc.patch @@ -0,0 +1,125 @@ +From 784673ce65ad1cbc2a1f1be857797afa4f78a1fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2019 00:29:23 -0700 +Subject: ARM: dts: Fix incomplete dts data for am3 and am4 mmc + +From: Tony Lindgren + +[ Upstream commit 5b63fb90adb95a178ad403e1703f59bf1ff2c16b ] + +Commit 4e27f752ab8c ("ARM: OMAP2+: Drop mmc platform data for am330x and +am43xx") dropped legacy mmc platform data for am3 and am4, but missed the +fact that we never updated the dts files for mmc3 that is directly on l3 +interconnect instead of l4 interconnect. This leads to a situation with +no legacy platform data and incomplete dts data. + +Let's update the mmc instances on l3 interconnect to probe properly with +ti-sysc interconnect target module driver to make mmc3 work again. Let's +still keep legacy "ti,hwmods" property around for v5.2 kernel and only +drop it later on. + +Note that there is no need to use property status = "disabled" for mmc3. +The default for dts is enabled, and runtime PM will idle unused instances +just fine. + +Fixes: 4e27f752ab8c ("ARM: OMAP2+: Drop mmc platform data for am330x and am43xx") +Reported-by: David Lechner +Tested-by: David Lechner +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am33xx.dtsi | 32 ++++++++++++++++++++++++++------ + arch/arm/boot/dts/am4372.dtsi | 32 ++++++++++++++++++++++++++------ + 2 files changed, 52 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi +index e5c2f71a7c77d..fb6b8aa12cc56 100644 +--- a/arch/arm/boot/dts/am33xx.dtsi ++++ b/arch/arm/boot/dts/am33xx.dtsi +@@ -234,13 +234,33 @@ + interrupt-names = "edma3_tcerrint"; + }; + +- mmc3: mmc@47810000 { +- compatible = "ti,omap4-hsmmc"; ++ target-module@47810000 { ++ compatible = "ti,sysc-omap2", "ti,sysc"; + ti,hwmods = "mmc3"; +- ti,needs-special-reset; +- interrupts = <29>; +- reg = <0x47810000 0x1000>; +- status = "disabled"; ++ reg = <0x478102fc 0x4>, ++ <0x47810110 0x4>, ++ <0x47810114 0x4>; ++ reg-names = "rev", "sysc", "syss"; ++ ti,sysc-mask = <(SYSC_OMAP2_CLOCKACTIVITY | ++ SYSC_OMAP2_ENAWAKEUP | ++ SYSC_OMAP2_SOFTRESET | ++ SYSC_OMAP2_AUTOIDLE)>; ++ ti,sysc-sidle = , ++ , ++ ; ++ ti,syss-mask = <1>; ++ clocks = <&l3s_clkctrl AM3_L3S_MMC3_CLKCTRL 0>; ++ clock-names = "fck"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x47810000 0x1000>; ++ ++ mmc3: mmc@0 { ++ compatible = "ti,omap4-hsmmc"; ++ ti,needs-special-reset; ++ interrupts = <29>; ++ reg = <0x0 0x1000>; ++ }; + }; + + usb: usb@47400000 { +diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi +index 55aff4db9c7c2..848e2a8884e2c 100644 +--- a/arch/arm/boot/dts/am4372.dtsi ++++ b/arch/arm/boot/dts/am4372.dtsi +@@ -228,13 +228,33 @@ + interrupt-names = "edma3_tcerrint"; + }; + +- mmc3: mmc@47810000 { +- compatible = "ti,omap4-hsmmc"; +- reg = <0x47810000 0x1000>; ++ target-module@47810000 { ++ compatible = "ti,sysc-omap2", "ti,sysc"; + ti,hwmods = "mmc3"; +- ti,needs-special-reset; +- interrupts = ; +- status = "disabled"; ++ reg = <0x478102fc 0x4>, ++ <0x47810110 0x4>, ++ <0x47810114 0x4>; ++ reg-names = "rev", "sysc", "syss"; ++ ti,sysc-mask = <(SYSC_OMAP2_CLOCKACTIVITY | ++ SYSC_OMAP2_ENAWAKEUP | ++ SYSC_OMAP2_SOFTRESET | ++ SYSC_OMAP2_AUTOIDLE)>; ++ ti,sysc-sidle = , ++ , ++ ; ++ ti,syss-mask = <1>; ++ clocks = <&l3s_clkctrl AM4_L3S_MMC3_CLKCTRL 0>; ++ clock-names = "fck"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges = <0x0 0x47810000 0x1000>; ++ ++ mmc3: mmc@0 { ++ compatible = "ti,omap4-hsmmc"; ++ ti,needs-special-reset; ++ interrupts = ; ++ reg = <0x0 0x1000>; ++ }; + }; + + sham: sham@53100000 { +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-fix-incorrect-dcan-register-mapping-for-am3-.patch b/queue-5.2/arm-dts-fix-incorrect-dcan-register-mapping-for-am3-.patch new file mode 100644 index 00000000000..b6eb03f265e --- /dev/null +++ b/queue-5.2/arm-dts-fix-incorrect-dcan-register-mapping-for-am3-.patch @@ -0,0 +1,106 @@ +From 67b0afd2f0ab245140a089707b83373af17e7965 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 03:44:42 -0700 +Subject: ARM: dts: Fix incorrect dcan register mapping for am3, am4 and dra7 + +From: Tony Lindgren + +[ Upstream commit 89bbc6f1eb90809b1538b3a9c54030c558180e3b ] + +We are currently using a wrong register for dcan revision. Although +this is currently only used for detecting the dcan module, let's +fix it to avoid confusion. + +Tested-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am33xx-l4.dtsi | 4 ++++ + arch/arm/boot/dts/am437x-l4.dtsi | 4 ++++ + arch/arm/boot/dts/dra7-l4.dtsi | 4 ++-- + drivers/bus/ti-sysc.c | 3 ++- + 4 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi +index ced1a19d5f898..4bd22c1edf963 100644 +--- a/arch/arm/boot/dts/am33xx-l4.dtsi ++++ b/arch/arm/boot/dts/am33xx-l4.dtsi +@@ -1758,6 +1758,8 @@ + + target-module@cc000 { /* 0x481cc000, ap 60 46.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; ++ reg = <0xcc020 0x4>; ++ reg-names = "rev"; + ti,hwmods = "d_can0"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ + clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN0_CLKCTRL 0>, +@@ -1780,6 +1782,8 @@ + + target-module@d0000 { /* 0x481d0000, ap 62 42.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; ++ reg = <0xd0020 0x4>; ++ reg-names = "rev"; + ti,hwmods = "d_can1"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ + clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN1_CLKCTRL 0>, +diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi +index 989cb60b90295..04bee4ff9dcb8 100644 +--- a/arch/arm/boot/dts/am437x-l4.dtsi ++++ b/arch/arm/boot/dts/am437x-l4.dtsi +@@ -1574,6 +1574,8 @@ + + target-module@cc000 { /* 0x481cc000, ap 50 46.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; ++ reg = <0xcc020 0x4>; ++ reg-names = "rev"; + ti,hwmods = "d_can0"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ + clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>; +@@ -1593,6 +1595,8 @@ + + target-module@d0000 { /* 0x481d0000, ap 52 3a.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; ++ reg = <0xd0020 0x4>; ++ reg-names = "rev"; + ti,hwmods = "d_can1"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ + clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>; +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 63628e166c0cd..21e5914fdd620 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -3025,7 +3025,7 @@ + + target-module@80000 { /* 0x48480000, ap 31 16.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; +- reg = <0x80000 0x4>; ++ reg = <0x80020 0x4>; + reg-names = "rev"; + clocks = <&l4per2_clkctrl DRA7_L4PER2_DCAN2_CLKCTRL 0>; + clock-names = "fck"; +@@ -4577,7 +4577,7 @@ + + target-module@c000 { /* 0x4ae3c000, ap 30 04.0 */ + compatible = "ti,sysc-omap4", "ti,sysc"; +- reg = <0xc000 0x4>; ++ reg = <0xc020 0x4>; + reg-names = "rev"; + clocks = <&wkupaon_clkctrl DRA7_WKUPAON_DCAN1_CLKCTRL 0>; + clock-names = "fck"; +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 56a2399f341e8..58b38630171ff 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1127,7 +1127,8 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK("control", 0, 0, 0x10, -1, 0x40000900, 0xffffffff, 0), + SYSC_QUIRK("cpgmac", 0, 0x1200, 0x1208, 0x1204, 0x4edb1902, + 0xffff00f0, 0), +- SYSC_QUIRK("dcan", 0, 0, -1, -1, 0xffffffff, 0xffffffff, 0), ++ SYSC_QUIRK("dcan", 0, 0x20, -1, -1, 0xa3170504, 0xffffffff, 0), ++ SYSC_QUIRK("dcan", 0, 0x20, -1, -1, 0x4edb1902, 0xffffffff, 0), + SYSC_QUIRK("dmic", 0, 0, 0x10, -1, 0x50010000, 0xffffffff, 0), + SYSC_QUIRK("dwc3", 0, 0, 0x10, -1, 0x500a0200, 0xffffffff, 0), + SYSC_QUIRK("epwmss", 0, 0, 0x4, -1, 0x47400001, 0xffffffff, 0), +-- +2.20.1 + diff --git a/queue-5.2/arm-omap1-ams-delta-fiq-fix-missing-irq_ack.patch b/queue-5.2/arm-omap1-ams-delta-fiq-fix-missing-irq_ack.patch new file mode 100644 index 00000000000..0b0fd46c7a2 --- /dev/null +++ b/queue-5.2/arm-omap1-ams-delta-fiq-fix-missing-irq_ack.patch @@ -0,0 +1,65 @@ +From 78c215b34d4274486654613ab363124bddfbebed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2019 10:48:02 +0200 +Subject: ARM: OMAP1: ams-delta-fiq: Fix missing irq_ack + +From: Janusz Krzysztofik + +[ Upstream commit fa8397e45c64e60c80373bc19ee56e42a6bed9b6 ] + +Non-serio path of Amstrad Delta FIQ deferred handler depended on +irq_ack() method provided by OMAP GPIO driver. That method has been +removed by commit 693de831c6e5 ("gpio: omap: remove irq_ack method"). +Remove useless code from the deferred handler and reimplement the +missing operation inside the base FIQ handler. + +Should another dependency - irq_unmask() - be ever removed from the OMAP +GPIO driver, WARN once if missing. + +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/ams-delta-fiq-handler.S | 3 ++- + arch/arm/mach-omap1/ams-delta-fiq.c | 4 +--- + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mach-omap1/ams-delta-fiq-handler.S b/arch/arm/mach-omap1/ams-delta-fiq-handler.S +index 81159af44862e..14a6c3eb32985 100644 +--- a/arch/arm/mach-omap1/ams-delta-fiq-handler.S ++++ b/arch/arm/mach-omap1/ams-delta-fiq-handler.S +@@ -126,6 +126,8 @@ restart: + orr r11, r11, r13 @ mask all requested interrupts + str r11, [r12, #OMAP1510_GPIO_INT_MASK] + ++ str r13, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack all requested interrupts ++ + ands r10, r13, #KEYBRD_CLK_MASK @ extract keyboard status - set? + beq hksw @ no - try next source + +@@ -133,7 +135,6 @@ restart: + @@@@@@@@@@@@@@@@@@@@@@ + @ Keyboard clock FIQ mode interrupt handler + @ r10 now contains KEYBRD_CLK_MASK, use it +- str r10, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack the interrupt + bic r11, r11, r10 @ unmask it + str r11, [r12, #OMAP1510_GPIO_INT_MASK] + +diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c +index 0af2bf6f99331..fd87382a3f183 100644 +--- a/arch/arm/mach-omap1/ams-delta-fiq.c ++++ b/arch/arm/mach-omap1/ams-delta-fiq.c +@@ -69,9 +69,7 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id) + * interrupts default to since commit 80ac93c27441 + * requires interrupt already acked and unmasked. + */ +- if (irq_chip->irq_ack) +- irq_chip->irq_ack(d); +- if (irq_chip->irq_unmask) ++ if (!WARN_ON_ONCE(!irq_chip->irq_unmask)) + irq_chip->irq_unmask(d); + } + for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++) +-- +2.20.1 + diff --git a/queue-5.2/arm-omap2-fix-missing-sysc_has_reset_status-for-dra7.patch b/queue-5.2/arm-omap2-fix-missing-sysc_has_reset_status-for-dra7.patch new file mode 100644 index 00000000000..983503c5778 --- /dev/null +++ b/queue-5.2/arm-omap2-fix-missing-sysc_has_reset_status-for-dra7.patch @@ -0,0 +1,40 @@ +From 294f5cf5757de549134b740180bb207df47a47dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 03:44:52 -0700 +Subject: ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss + +From: Tony Lindgren + +[ Upstream commit afd58b162e48076e3fe66d08a69eefbd6fe71643 ] + +TRM says PWMSS_SYSCONFIG bit for SOFTRESET changes to zero when +reset is completed. Let's configure it as otherwise we get warnings +on boot when we check the data against dts provided data. Eventually +the legacy platform data will be just dropped, but let's fix the +warning first. + +Reviewed-by: Suman Anna +Tested-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +index 4a5b4aee6615a..1ec21e9ba1e99 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +@@ -379,7 +379,8 @@ static struct omap_hwmod dra7xx_dcan2_hwmod = { + static struct omap_hwmod_class_sysconfig dra7xx_epwmss_sysc = { + .rev_offs = 0x0, + .sysc_offs = 0x4, +- .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET, ++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET | ++ SYSC_HAS_RESET_STATUS, + .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART), + .sysc_fields = &omap_hwmod_sysc_type2, + }; +-- +2.20.1 + diff --git a/queue-5.2/arm-omap2-fix-omap4-errata-warning-on-other-socs.patch b/queue-5.2/arm-omap2-fix-omap4-errata-warning-on-other-socs.patch new file mode 100644 index 00000000000..eabe75f73ce --- /dev/null +++ b/queue-5.2/arm-omap2-fix-omap4-errata-warning-on-other-socs.patch @@ -0,0 +1,45 @@ +From ac5a0efce171468a7b0ff22235b5ff3544ae993a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2019 04:37:45 -0700 +Subject: ARM: OMAP2+: Fix omap4 errata warning on other SoCs + +From: Tony Lindgren + +[ Upstream commit 45da5e09dd32fa98c32eaafe2513db6bd75e2f4f ] + +We have errata i688 workaround produce warnings on SoCs other than +omap4 and omap5: + +omap4_sram_init:Unable to allocate sram needed to handle errata I688 +omap4_sram_init:Unable to get sram pool needed to handle errata I688 + +This is happening because there is no ti,omap4-mpu node, or no SRAM +to configure for the other SoCs, so let's remove the warning based +on the SoC revision checks. + +As nobody has complained it seems that the other SoC variants do not +need this workaround. + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap4-common.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c +index f9c02f9f1c921..5c3845730dbf5 100644 +--- a/arch/arm/mach-omap2/omap4-common.c ++++ b/arch/arm/mach-omap2/omap4-common.c +@@ -127,6 +127,9 @@ static int __init omap4_sram_init(void) + struct device_node *np; + struct gen_pool *sram_pool; + ++ if (!soc_is_omap44xx() && !soc_is_omap54xx()) ++ return 0; ++ + np = of_find_compatible_node(NULL, NULL, "ti,omap4-mpu"); + if (!np) + pr_warn("%s:Unable to allocate sram needed to handle errata I688\n", +-- +2.20.1 + diff --git a/queue-5.2/arm64-dts-meson-g12a-add-missing-dwc2-phy-names.patch b/queue-5.2/arm64-dts-meson-g12a-add-missing-dwc2-phy-names.patch new file mode 100644 index 00000000000..65289873c8f --- /dev/null +++ b/queue-5.2/arm64-dts-meson-g12a-add-missing-dwc2-phy-names.patch @@ -0,0 +1,43 @@ +From e6ae2d9f1257a9b5e252c2609b8a969a09d26f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2019 14:36:47 +0200 +Subject: arm64: dts: meson-g12a: add missing dwc2 phy-names + +From: Neil Armstrong + +[ Upstream commit 3d4bacdc207a7b62941700b374e7199cbb184a43 ] + +The G12A USB2 OTG capable PHY uses a 8bit large UTMI bus, and the OTG +controller gets the PHY but width by probing the associated phy. + +By default it will use 16bit wide settings if a phy is not specified, +in our case we specified the phy, but not the phy-names. + +The dwc2 bindings specifies that if phys is present, phy-names shall be +"usb2-phy". + +Adding phy-names = "usb2-phy" solves the OTG PHY bus configuration. + +Fixes: 9baf7d6be730 ("arm64: dts: meson: g12a: Add G12A USB nodes") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +index 9f72396ba7103..4c92c197aeb8a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +@@ -591,6 +591,7 @@ + clocks = <&clkc CLKID_USB1_DDR_BRIDGE>; + clock-names = "ddr"; + phys = <&usb2_phy1>; ++ phy-names = "usb2-phy"; + dr_mode = "peripheral"; + g-rx-fifo-size = <192>; + g-np-tx-fifo-size = <128>; +-- +2.20.1 + diff --git a/queue-5.2/arm64-dts-renesas-r8a77995-draak-fix-backlight-regul.patch b/queue-5.2/arm64-dts-renesas-r8a77995-draak-fix-backlight-regul.patch new file mode 100644 index 00000000000..d59ba4ba840 --- /dev/null +++ b/queue-5.2/arm64-dts-renesas-r8a77995-draak-fix-backlight-regul.patch @@ -0,0 +1,59 @@ +From 8f4191f0953ce77389af720dae281c27e7fdceb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 09:48:01 +0200 +Subject: arm64: dts: renesas: r8a77995: draak: Fix backlight regulator name + +From: Geert Uytterhoeven + +[ Upstream commit 45f5d5a9e34d3fe4140a9a3b5f7ebe86c252440a ] + +Currently there are two nodes named "regulator1" in the Draak DTS: a +3.3V regulator for the eMMC and the LVDS decoder, and a 12V regulator +for the backlight. This causes the former to be overwritten by the +latter. + +Fix this by renaming all regulators with numerical suffixes to use named +suffixes, which are less likely to conflict. + +Fixes: 4fbd4158fe8967e9 ("arm64: dts: renesas: r8a77995: draak: Add backlight") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts +index a7dc11e36fd9d..071f66d8719e7 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts +@@ -97,7 +97,7 @@ + reg = <0x0 0x48000000 0x0 0x18000000>; + }; + +- reg_1p8v: regulator0 { ++ reg_1p8v: regulator-1p8v { + compatible = "regulator-fixed"; + regulator-name = "fixed-1.8V"; + regulator-min-microvolt = <1800000>; +@@ -106,7 +106,7 @@ + regulator-always-on; + }; + +- reg_3p3v: regulator1 { ++ reg_3p3v: regulator-3p3v { + compatible = "regulator-fixed"; + regulator-name = "fixed-3.3V"; + regulator-min-microvolt = <3300000>; +@@ -115,7 +115,7 @@ + regulator-always-on; + }; + +- reg_12p0v: regulator1 { ++ reg_12p0v: regulator-12p0v { + compatible = "regulator-fixed"; + regulator-name = "D12.0V"; + regulator-min-microvolt = <12000000>; +-- +2.20.1 + diff --git a/queue-5.2/batman-adv-only-read-ogm2-tvlv_len-after-buffer-len-.patch b/queue-5.2/batman-adv-only-read-ogm2-tvlv_len-after-buffer-len-.patch new file mode 100644 index 00000000000..51a00346f8f --- /dev/null +++ b/queue-5.2/batman-adv-only-read-ogm2-tvlv_len-after-buffer-len-.patch @@ -0,0 +1,73 @@ +From 2c7beecaa1685c72210731d91c4a4d31da76e43a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 08:55:36 +0200 +Subject: batman-adv: Only read OGM2 tvlv_len after buffer len check + +From: Sven Eckelmann + +[ Upstream commit 0ff0f15a32c093381ad1abc06abe85afb561ab28 ] + +Multiple batadv_ogm2_packet can be stored in an skbuff. The functions +batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there +is another additional batadv_ogm2_packet in the skb or not before they +continue processing the packet. + +The length for such an OGM2 is BATADV_OGM2_HLEN + +batadv_ogm2_packet->tvlv_len. The check must first check that at least +BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is +part of the header. Otherwise it might try read outside of the currently +available skbuff to get the content of tvlv_len. + +Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bat_v_ogm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index fad95ef64e01a..bc06e3cdfa84f 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -631,17 +631,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv, + * batadv_v_ogm_aggr_packet() - checks if there is another OGM aggregated + * @buff_pos: current position in the skb + * @packet_len: total length of the skb +- * @tvlv_len: tvlv length of the previously considered OGM ++ * @ogm2_packet: potential OGM2 in buffer + * + * Return: true if there is enough space for another OGM, false otherwise. + */ +-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len, +- __be16 tvlv_len) ++static bool ++batadv_v_ogm_aggr_packet(int buff_pos, int packet_len, ++ const struct batadv_ogm2_packet *ogm2_packet) + { + int next_buff_pos = 0; + +- next_buff_pos += buff_pos + BATADV_OGM2_HLEN; +- next_buff_pos += ntohs(tvlv_len); ++ /* check if there is enough space for the header */ ++ next_buff_pos += buff_pos + sizeof(*ogm2_packet); ++ if (next_buff_pos > packet_len) ++ return false; ++ ++ /* check if there is enough space for the optional TVLV */ ++ next_buff_pos += ntohs(ogm2_packet->tvlv_len); + + return (next_buff_pos <= packet_len) && + (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); +@@ -818,7 +824,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, + ogm_packet = (struct batadv_ogm2_packet *)skb->data; + + while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb), +- ogm_packet->tvlv_len)) { ++ ogm_packet)) { + batadv_v_ogm_process(skb, ogm_offset, if_incoming); + + ogm_offset += BATADV_OGM2_HLEN; +-- +2.20.1 + diff --git a/queue-5.2/bpf-allow-narrow-loads-of-some-sk_reuseport_md-field.patch b/queue-5.2/bpf-allow-narrow-loads-of-some-sk_reuseport_md-field.patch new file mode 100644 index 00000000000..adf0db78c47 --- /dev/null +++ b/queue-5.2/bpf-allow-narrow-loads-of-some-sk_reuseport_md-field.patch @@ -0,0 +1,62 @@ +From 0798eeacc1968e4e56e520cecd4e996b6ed3cac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 17:50:25 +0200 +Subject: bpf: allow narrow loads of some sk_reuseport_md fields with offset > + 0 + +From: Ilya Leoshkevich + +[ Upstream commit 2c238177bd7f4b14bdf7447cc1cd9bb791f147e6 ] + +test_select_reuseport fails on s390 due to verifier rejecting +test_select_reuseport_kern.o with the following message: + + ; data_check.eth_protocol = reuse_md->eth_protocol; + 18: (69) r1 = *(u16 *)(r6 +22) + invalid bpf_context access off=22 size=2 + +This is because on big-endian machines casts from __u32 to __u16 are +generated by referencing the respective variable as __u16 with an offset +of 2 (as opposed to 0 on little-endian machines). + +The verifier already has all the infrastructure in place to allow such +accesses, it's just that they are not explicitly enabled for +eth_protocol field. Enable them for eth_protocol field by using +bpf_ctx_range instead of offsetof. + +Ditto for ip_protocol, bind_inany and len, since they already allow +narrowing, and the same problem can arise when working with them. + +Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 534c310bb0893..7aee6f368754a 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -8553,13 +8553,13 @@ sk_reuseport_is_valid_access(int off, int size, + return size == size_default; + + /* Fields that allow narrowing */ +- case offsetof(struct sk_reuseport_md, eth_protocol): ++ case bpf_ctx_range(struct sk_reuseport_md, eth_protocol): + if (size < FIELD_SIZEOF(struct sk_buff, protocol)) + return false; + /* fall through */ +- case offsetof(struct sk_reuseport_md, ip_protocol): +- case offsetof(struct sk_reuseport_md, bind_inany): +- case offsetof(struct sk_reuseport_md, len): ++ case bpf_ctx_range(struct sk_reuseport_md, ip_protocol): ++ case bpf_ctx_range(struct sk_reuseport_md, bind_inany): ++ case bpf_ctx_range(struct sk_reuseport_md, len): + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); + +-- +2.20.1 + diff --git a/queue-5.2/bus-ti-sysc-fix-handling-of-forced-idle.patch b/queue-5.2/bus-ti-sysc-fix-handling-of-forced-idle.patch new file mode 100644 index 00000000000..cef6374e7c9 --- /dev/null +++ b/queue-5.2/bus-ti-sysc-fix-handling-of-forced-idle.patch @@ -0,0 +1,42 @@ +From c81fccbdaae254cae050e4f6a0dbd884dc25d6f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 03:44:42 -0700 +Subject: bus: ti-sysc: Fix handling of forced idle + +From: Tony Lindgren + +[ Upstream commit 6ee8241d17c68b94a91efabfd6bdfe63bb1b79c1 ] + +For some devices we can get the following warning on boot: + +ti-sysc 48485200.target-module: sysc_disable_module: invalid midlemode + +Fix this by treating SYSC_IDLE_FORCE like we do for the other bits +for idlemodes mask. + +Fixes: d59b60564cbf ("bus: ti-sysc: Add generic enable/disable functions") +Cc: Roger Quadros +Reviewed-by: Suman Anna +Tested-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index b72741668c927..f5176a5d38cd9 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -853,7 +853,7 @@ static int sysc_best_idle_mode(u32 idlemodes, u32 *best_mode) + *best_mode = SYSC_IDLE_SMART_WKUP; + else if (idlemodes & BIT(SYSC_IDLE_SMART)) + *best_mode = SYSC_IDLE_SMART; +- else if (idlemodes & SYSC_IDLE_FORCE) ++ else if (idlemodes & BIT(SYSC_IDLE_FORCE)) + *best_mode = SYSC_IDLE_FORCE; + else + return -EINVAL; +-- +2.20.1 + diff --git a/queue-5.2/bus-ti-sysc-fix-using-configured-sysc-mask-value.patch b/queue-5.2/bus-ti-sysc-fix-using-configured-sysc-mask-value.patch new file mode 100644 index 00000000000..a309626821f --- /dev/null +++ b/queue-5.2/bus-ti-sysc-fix-using-configured-sysc-mask-value.patch @@ -0,0 +1,38 @@ +From e7ba15304fbf9529fee7c97f7f940495dbf11da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 03:44:52 -0700 +Subject: bus: ti-sysc: Fix using configured sysc mask value + +From: Tony Lindgren + +[ Upstream commit e212abd452a4af3174fcd469d46656f83e135a19 ] + +We have cases where there are no softreset bits like with am335x lcdc. +In that case ti,sysc-mask = <0> needs to be handled properly. + +Tested-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index f5176a5d38cd9..56a2399f341e8 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1388,10 +1388,7 @@ static int sysc_init_sysc_mask(struct sysc *ddata) + if (error) + return 0; + +- if (val) +- ddata->cfg.sysc_val = val & ddata->cap->sysc_mask; +- else +- ddata->cfg.sysc_val = ddata->cap->sysc_mask; ++ ddata->cfg.sysc_val = val & ddata->cap->sysc_mask; + + return 0; + } +-- +2.20.1 + diff --git a/queue-5.2/bus-ti-sysc-simplify-cleanup-upon-failures-in-sysc_p.patch b/queue-5.2/bus-ti-sysc-simplify-cleanup-upon-failures-in-sysc_p.patch new file mode 100644 index 00000000000..f7b17f46c0c --- /dev/null +++ b/queue-5.2/bus-ti-sysc-simplify-cleanup-upon-failures-in-sysc_p.patch @@ -0,0 +1,76 @@ +From 81337a865262b8c8730d05ab9f8c6f5d656c6a4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2019 18:33:15 -0500 +Subject: bus: ti-sysc: Simplify cleanup upon failures in sysc_probe() + +From: Suman Anna + +[ Upstream commit a304f483b6b00d42bde41c45ca52c670945348e2 ] + +The clocks are not yet parsed and prepared until after a successful +sysc_get_clocks(), so there is no need to unprepare the clocks upon +any failure of any of the prior functions in sysc_probe(). The current +code path would have been a no-op because of the clock validity checks +within sysc_unprepare(), but let's just simplify the cleanup path by +returning the error directly. + +While at this, also fix the cleanup path for a sysc_init_resets() +failure which is executed after the clocks are prepared. + +Signed-off-by: Suman Anna +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 58b38630171ff..0d122440d1111 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -2079,27 +2079,27 @@ static int sysc_probe(struct platform_device *pdev) + + error = sysc_init_dts_quirks(ddata); + if (error) +- goto unprepare; ++ return error; + + error = sysc_map_and_check_registers(ddata); + if (error) +- goto unprepare; ++ return error; + + error = sysc_init_sysc_mask(ddata); + if (error) +- goto unprepare; ++ return error; + + error = sysc_init_idlemodes(ddata); + if (error) +- goto unprepare; ++ return error; + + error = sysc_init_syss_mask(ddata); + if (error) +- goto unprepare; ++ return error; + + error = sysc_init_pdata(ddata); + if (error) +- goto unprepare; ++ return error; + + sysc_init_early_quirks(ddata); + +@@ -2109,7 +2109,7 @@ static int sysc_probe(struct platform_device *pdev) + + error = sysc_init_resets(ddata); + if (error) +- return error; ++ goto unprepare; + + error = sysc_init_module(ddata); + if (error) +-- +2.20.1 + diff --git a/queue-5.2/cifs-set-domainname-when-a-domain-key-is-used-in-mul.patch b/queue-5.2/cifs-set-domainname-when-a-domain-key-is-used-in-mul.patch new file mode 100644 index 00000000000..45b739ceddf --- /dev/null +++ b/queue-5.2/cifs-set-domainname-when-a-domain-key-is-used-in-mul.patch @@ -0,0 +1,72 @@ +From b477bbb3648235c56f6f9289142eb9be343c0bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 08:09:50 +1000 +Subject: cifs: set domainName when a domain-key is used in multiuser + +From: Ronnie Sahlberg + +[ Upstream commit f2aee329a68f5a907bcff11a109dfe17c0b41aeb ] + +RHBZ: 1710429 + +When we use a domain-key to authenticate using multiuser we must also set +the domainnmame for the new volume as it will be used and passed to the server +in the NTLMSSP Domain-name. + +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 18c7c6b2fe08a..2beaa14519f5d 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2961,6 +2961,7 @@ static int + cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) + { + int rc = 0; ++ int is_domain = 0; + const char *delim, *payload; + char *desc; + ssize_t len; +@@ -3008,6 +3009,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) + rc = PTR_ERR(key); + goto out_err; + } ++ is_domain = 1; + } + + down_read(&key->sem); +@@ -3065,6 +3067,26 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) + goto out_key_put; + } + ++ /* ++ * If we have a domain key then we must set the domainName in the ++ * for the request. ++ */ ++ if (is_domain && ses->domainName) { ++ vol->domainname = kstrndup(ses->domainName, ++ strlen(ses->domainName), ++ GFP_KERNEL); ++ if (!vol->domainname) { ++ cifs_dbg(FYI, "Unable to allocate %zd bytes for " ++ "domain\n", len); ++ rc = -ENOMEM; ++ kfree(vol->username); ++ vol->username = NULL; ++ kfree(vol->password); ++ vol->password = NULL; ++ goto out_key_put; ++ } ++ } ++ + out_key_put: + up_read(&key->sem); + key_put(key); +-- +2.20.1 + diff --git a/queue-5.2/cifs-use-kzfree-to-zero-out-the-password.patch b/queue-5.2/cifs-use-kzfree-to-zero-out-the-password.patch new file mode 100644 index 00000000000..b9dc2e57415 --- /dev/null +++ b/queue-5.2/cifs-use-kzfree-to-zero-out-the-password.patch @@ -0,0 +1,35 @@ +From 0d15650e80145436a521cccbcc0a54fcacac960c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 13:59:17 +0300 +Subject: cifs: Use kzfree() to zero out the password + +From: Dan Carpenter + +[ Upstream commit 478228e57f81f6cb60798d54fc02a74ea7dd267e ] + +It's safer to zero out the password so that it can never be disclosed. + +Fixes: 0c219f5799c7 ("cifs: set domainName when a domain-key is used in multiuser") +Signed-off-by: Dan Carpenter +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 2beaa14519f5d..85b2107e8a3d7 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3081,7 +3081,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) + rc = -ENOMEM; + kfree(vol->username); + vol->username = NULL; +- kfree(vol->password); ++ kzfree(vol->password); + vol->password = NULL; + goto out_key_put; + } +-- +2.20.1 + diff --git a/queue-5.2/dmaengine-rcar-dmac-fix-dmachclr-handling-if-iommu-i.patch b/queue-5.2/dmaengine-rcar-dmac-fix-dmachclr-handling-if-iommu-i.patch new file mode 100644 index 00000000000..c907f0e4992 --- /dev/null +++ b/queue-5.2/dmaengine-rcar-dmac-fix-dmachclr-handling-if-iommu-i.patch @@ -0,0 +1,133 @@ +From c1a3426f06698de8cede82b618ab84ff30b344e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2019 20:44:03 +0900 +Subject: dmaengine: rcar-dmac: Fix DMACHCLR handling if iommu is mapped + +From: Yoshihiro Shimoda + +[ Upstream commit cf24aac38698bfa1d021afd3883df3c4c65143a4 ] + +The commit 20c169aceb45 ("dmaengine: rcar-dmac: clear pertinence +number of channels") forgets to clear the last channel by +DMACHCLR in rcar_dmac_init() (and doesn't need to clear the first +channel) if iommu is mapped to the device. So, this patch fixes it +by using "channels_mask" bitfield. + +Note that the hardware and driver don't support more than 32 bits +in DMACHCLR register anyway, so this patch should reject more than +32 channels in rcar_dmac_parse_of(). + +Fixes: 20c169aceb459575 ("dmaengine: rcar-dmac: clear pertinence number of channels") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Simon Horman +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/1567424643-26629-1-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sh/rcar-dmac.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c +index 54de669c38b84..f1d89bdebddab 100644 +--- a/drivers/dma/sh/rcar-dmac.c ++++ b/drivers/dma/sh/rcar-dmac.c +@@ -192,6 +192,7 @@ struct rcar_dmac_chan { + * @iomem: remapped I/O memory base + * @n_channels: number of available channels + * @channels: array of DMAC channels ++ * @channels_mask: bitfield of which DMA channels are managed by this driver + * @modules: bitmask of client modules in use + */ + struct rcar_dmac { +@@ -202,6 +203,7 @@ struct rcar_dmac { + + unsigned int n_channels; + struct rcar_dmac_chan *channels; ++ unsigned int channels_mask; + + DECLARE_BITMAP(modules, 256); + }; +@@ -438,7 +440,7 @@ static int rcar_dmac_init(struct rcar_dmac *dmac) + u16 dmaor; + + /* Clear all channels and enable the DMAC globally. */ +- rcar_dmac_write(dmac, RCAR_DMACHCLR, GENMASK(dmac->n_channels - 1, 0)); ++ rcar_dmac_write(dmac, RCAR_DMACHCLR, dmac->channels_mask); + rcar_dmac_write(dmac, RCAR_DMAOR, + RCAR_DMAOR_PRI_FIXED | RCAR_DMAOR_DME); + +@@ -814,6 +816,9 @@ static void rcar_dmac_stop_all_chan(struct rcar_dmac *dmac) + for (i = 0; i < dmac->n_channels; ++i) { + struct rcar_dmac_chan *chan = &dmac->channels[i]; + ++ if (!(dmac->channels_mask & BIT(i))) ++ continue; ++ + /* Stop and reinitialize the channel. */ + spin_lock_irq(&chan->lock); + rcar_dmac_chan_halt(chan); +@@ -1776,6 +1781,8 @@ static int rcar_dmac_chan_probe(struct rcar_dmac *dmac, + return 0; + } + ++#define RCAR_DMAC_MAX_CHANNELS 32 ++ + static int rcar_dmac_parse_of(struct device *dev, struct rcar_dmac *dmac) + { + struct device_node *np = dev->of_node; +@@ -1787,12 +1794,16 @@ static int rcar_dmac_parse_of(struct device *dev, struct rcar_dmac *dmac) + return ret; + } + +- if (dmac->n_channels <= 0 || dmac->n_channels >= 100) { ++ /* The hardware and driver don't support more than 32 bits in CHCLR */ ++ if (dmac->n_channels <= 0 || ++ dmac->n_channels >= RCAR_DMAC_MAX_CHANNELS) { + dev_err(dev, "invalid number of channels %u\n", + dmac->n_channels); + return -EINVAL; + } + ++ dmac->channels_mask = GENMASK(dmac->n_channels - 1, 0); ++ + return 0; + } + +@@ -1802,7 +1813,6 @@ static int rcar_dmac_probe(struct platform_device *pdev) + DMA_SLAVE_BUSWIDTH_2_BYTES | DMA_SLAVE_BUSWIDTH_4_BYTES | + DMA_SLAVE_BUSWIDTH_8_BYTES | DMA_SLAVE_BUSWIDTH_16_BYTES | + DMA_SLAVE_BUSWIDTH_32_BYTES | DMA_SLAVE_BUSWIDTH_64_BYTES; +- unsigned int channels_offset = 0; + struct dma_device *engine; + struct rcar_dmac *dmac; + struct resource *mem; +@@ -1831,10 +1841,8 @@ static int rcar_dmac_probe(struct platform_device *pdev) + * level we can't disable it selectively, so ignore channel 0 for now if + * the device is part of an IOMMU group. + */ +- if (device_iommu_mapped(&pdev->dev)) { +- dmac->n_channels--; +- channels_offset = 1; +- } ++ if (device_iommu_mapped(&pdev->dev)) ++ dmac->channels_mask &= ~BIT(0); + + dmac->channels = devm_kcalloc(&pdev->dev, dmac->n_channels, + sizeof(*dmac->channels), GFP_KERNEL); +@@ -1892,8 +1900,10 @@ static int rcar_dmac_probe(struct platform_device *pdev) + INIT_LIST_HEAD(&engine->channels); + + for (i = 0; i < dmac->n_channels; ++i) { +- ret = rcar_dmac_chan_probe(dmac, &dmac->channels[i], +- i + channels_offset); ++ if (!(dmac->channels_mask & BIT(i))) ++ continue; ++ ++ ret = rcar_dmac_chan_probe(dmac, &dmac->channels[i], i); + if (ret < 0) + goto error; + } +-- +2.20.1 + diff --git a/queue-5.2/dmaengine-sprd-fix-the-dma-link-list-configuration.patch b/queue-5.2/dmaengine-sprd-fix-the-dma-link-list-configuration.patch new file mode 100644 index 00000000000..97e39d4cdb5 --- /dev/null +++ b/queue-5.2/dmaengine-sprd-fix-the-dma-link-list-configuration.patch @@ -0,0 +1,66 @@ +From 34d6dc5bf3a241368dc708d8ec48f659b958015a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 15:37:45 +0800 +Subject: dmaengine: sprd: Fix the DMA link-list configuration + +From: Baolin Wang + +[ Upstream commit 689379c2f383b1fdfdff03e84cf659daf62f2088 ] + +For the Spreadtrum DMA link-list mode, when the DMA engine got a slave +hardware request, which will trigger the DMA engine to load the DMA +configuration from the link-list memory automatically. But before the +slave hardware request, the slave will get an incorrect residue due +to the first node used to trigger the link-list was configured as the +last source address and destination address. + +Thus we should make sure the first node was configured the start source +address and destination address, which can fix this issue. + +Fixes: 4ac695464763 ("dmaengine: sprd: Support DMA link-list mode") +Signed-off-by: Baolin Wang +Link: https://lore.kernel.org/r/77868edb7aff9d5cb12ac3af8827ef2e244441a6.1567150471.git.baolin.wang@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sprd-dma.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index baac476c86224..525dc7338fe3b 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -908,6 +908,7 @@ sprd_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + struct sprd_dma_chn *schan = to_sprd_dma_chan(chan); + struct dma_slave_config *slave_cfg = &schan->slave_cfg; + dma_addr_t src = 0, dst = 0; ++ dma_addr_t start_src = 0, start_dst = 0; + struct sprd_dma_desc *sdesc; + struct scatterlist *sg; + u32 len = 0; +@@ -954,6 +955,11 @@ sprd_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + dst = sg_dma_address(sg); + } + ++ if (!i) { ++ start_src = src; ++ start_dst = dst; ++ } ++ + /* + * The link-list mode needs at least 2 link-list + * configurations. If there is only one sg, it doesn't +@@ -970,8 +976,8 @@ sprd_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, + } + } + +- ret = sprd_dma_fill_desc(chan, &sdesc->chn_hw, 0, 0, src, dst, len, +- dir, flags, slave_cfg); ++ ret = sprd_dma_fill_desc(chan, &sdesc->chn_hw, 0, 0, start_src, ++ start_dst, len, dir, flags, slave_cfg); + if (ret) { + kfree(sdesc); + return NULL; +-- +2.20.1 + diff --git a/queue-5.2/dmaengine-ti-dma-crossbar-fix-a-memory-leak-bug.patch b/queue-5.2/dmaengine-ti-dma-crossbar-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..2f026189cc2 --- /dev/null +++ b/queue-5.2/dmaengine-ti-dma-crossbar-fix-a-memory-leak-bug.patch @@ -0,0 +1,43 @@ +From fd696128433c5e57fec1088a9161b65e3b03b492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 01:48:55 -0500 +Subject: dmaengine: ti: dma-crossbar: Fix a memory leak bug + +From: Wenwen Wang + +[ Upstream commit 2c231c0c1dec42192aca0f87f2dc68b8f0cbc7d2 ] + +In ti_dra7_xbar_probe(), 'rsv_events' is allocated through kcalloc(). Then +of_property_read_u32_array() is invoked to search for the property. +However, if this process fails, 'rsv_events' is not deallocated, leading to +a memory leak bug. To fix this issue, free 'rsv_events' before returning +the error. + +Signed-off-by: Wenwen Wang +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/1565938136-7249-1-git-send-email-wenwen@cs.uga.edu +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/dma-crossbar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c +index ad2f0a4cd6a4d..f255056696eec 100644 +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -391,8 +391,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev) + + ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events, + nelm * 2); +- if (ret) ++ if (ret) { ++ kfree(rsv_events); + return ret; ++ } + + for (i = 0; i < nelm; i++) { + ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1], +-- +2.20.1 + diff --git a/queue-5.2/dmaengine-ti-omap-dma-add-cleanup-in-omap_dma_probe.patch b/queue-5.2/dmaengine-ti-omap-dma-add-cleanup-in-omap_dma_probe.patch new file mode 100644 index 00000000000..337d3b4ac06 --- /dev/null +++ b/queue-5.2/dmaengine-ti-omap-dma-add-cleanup-in-omap_dma_probe.patch @@ -0,0 +1,41 @@ +From ab3a150a74e8146d8bb20906594e81ee70817d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 01:56:08 -0500 +Subject: dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe() + +From: Wenwen Wang + +[ Upstream commit 962411b05a6d3342aa649e39cda1704c1fc042c6 ] + +If devm_request_irq() fails to disable all interrupts, no cleanup is +performed before retuning the error. To fix this issue, invoke +omap_dma_free() to do the cleanup. + +Signed-off-by: Wenwen Wang +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/1565938570-7528-1-git-send-email-wenwen@cs.uga.edu +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/omap-dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c +index ba27802efcd0a..d07c0d5de7a25 100644 +--- a/drivers/dma/ti/omap-dma.c ++++ b/drivers/dma/ti/omap-dma.c +@@ -1540,8 +1540,10 @@ static int omap_dma_probe(struct platform_device *pdev) + + rc = devm_request_irq(&pdev->dev, irq, omap_dma_irq, + IRQF_SHARED, "omap-dma-engine", od); +- if (rc) ++ if (rc) { ++ omap_dma_free(od); + return rc; ++ } + } + + if (omap_dma_glbl_read(od, CAPS_0) & CAPS_0_SUPPORT_LL123) +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-powerplay-correct-vega20-dpm-level-related-s.patch b/queue-5.2/drm-amd-powerplay-correct-vega20-dpm-level-related-s.patch new file mode 100644 index 00000000000..b0f0f73f60e --- /dev/null +++ b/queue-5.2/drm-amd-powerplay-correct-vega20-dpm-level-related-s.patch @@ -0,0 +1,122 @@ +From 9c8c8d9cd20036d0474071072ca4496440ccc8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 13:17:53 +0800 +Subject: drm/amd/powerplay: correct Vega20 dpm level related settings + +From: Evan Quan + +[ Upstream commit 83e09d5bddbee749fc83063890244397896a1971 ] + +Correct the settings for auto mode and skip the unnecessary +settings for dcefclk and fclk. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 60 +++++++++++++++++-- + 1 file changed, 54 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +index 9b9f87b84910c..d98fe481cd365 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +@@ -2288,12 +2288,16 @@ static int vega20_force_dpm_highest(struct pp_hwmgr *hwmgr) + data->dpm_table.soc_table.dpm_state.soft_max_level = + data->dpm_table.soc_table.dpm_levels[soft_level].value; + +- ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF); ++ ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload boot level to highest!", + return ret); + +- ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF); ++ ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload dpm max level to highest!", + return ret); +@@ -2326,12 +2330,16 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr) + data->dpm_table.soc_table.dpm_state.soft_max_level = + data->dpm_table.soc_table.dpm_levels[soft_level].value; + +- ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF); ++ ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload boot level to highest!", + return ret); + +- ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF); ++ ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload dpm max level to highest!", + return ret); +@@ -2342,14 +2350,54 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr) + + static int vega20_unforce_dpm_levels(struct pp_hwmgr *hwmgr) + { ++ struct vega20_hwmgr *data = ++ (struct vega20_hwmgr *)(hwmgr->backend); ++ uint32_t soft_min_level, soft_max_level; + int ret = 0; + +- ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF); ++ /* gfxclk soft min/max settings */ ++ soft_min_level = ++ vega20_find_lowest_dpm_level(&(data->dpm_table.gfx_table)); ++ soft_max_level = ++ vega20_find_highest_dpm_level(&(data->dpm_table.gfx_table)); ++ ++ data->dpm_table.gfx_table.dpm_state.soft_min_level = ++ data->dpm_table.gfx_table.dpm_levels[soft_min_level].value; ++ data->dpm_table.gfx_table.dpm_state.soft_max_level = ++ data->dpm_table.gfx_table.dpm_levels[soft_max_level].value; ++ ++ /* uclk soft min/max settings */ ++ soft_min_level = ++ vega20_find_lowest_dpm_level(&(data->dpm_table.mem_table)); ++ soft_max_level = ++ vega20_find_highest_dpm_level(&(data->dpm_table.mem_table)); ++ ++ data->dpm_table.mem_table.dpm_state.soft_min_level = ++ data->dpm_table.mem_table.dpm_levels[soft_min_level].value; ++ data->dpm_table.mem_table.dpm_state.soft_max_level = ++ data->dpm_table.mem_table.dpm_levels[soft_max_level].value; ++ ++ /* socclk soft min/max settings */ ++ soft_min_level = ++ vega20_find_lowest_dpm_level(&(data->dpm_table.soc_table)); ++ soft_max_level = ++ vega20_find_highest_dpm_level(&(data->dpm_table.soc_table)); ++ ++ data->dpm_table.soc_table.dpm_state.soft_min_level = ++ data->dpm_table.soc_table.dpm_levels[soft_min_level].value; ++ data->dpm_table.soc_table.dpm_state.soft_max_level = ++ data->dpm_table.soc_table.dpm_levels[soft_max_level].value; ++ ++ ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload DPM Bootup Levels!", + return ret); + +- ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF); ++ ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK | ++ FEATURE_DPM_UCLK_MASK | ++ FEATURE_DPM_SOCCLK_MASK); + PP_ASSERT_WITH_CODE(!ret, + "Failed to upload DPM Max Levels!", + return ret); +-- +2.20.1 + diff --git a/queue-5.2/drm-amdgpu-fix-dma_fence_wait-without-reference.patch b/queue-5.2/drm-amdgpu-fix-dma_fence_wait-without-reference.patch new file mode 100644 index 00000000000..2878dbf86a7 --- /dev/null +++ b/queue-5.2/drm-amdgpu-fix-dma_fence_wait-without-reference.patch @@ -0,0 +1,66 @@ +From 9ac82a75f84d14db3f6d2d663c0354d943ddf4fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 14:56:35 +0200 +Subject: drm/amdgpu: fix dma_fence_wait without reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 42068e1ef961c719f967dbbb4ddcb394a0ba7917 ] + +We need to grab a reference to the fence we wait for. + +Signed-off-by: Christian König +Reviewed-by: Chunming Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 27 ++++++++++++++----------- + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index a28a3d722ba29..62298ae5c81c0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -535,21 +535,24 @@ int amdgpu_ctx_wait_prev_fence(struct amdgpu_ctx *ctx, + struct drm_sched_entity *entity) + { + struct amdgpu_ctx_entity *centity = to_amdgpu_ctx_entity(entity); +- unsigned idx = centity->sequence & (amdgpu_sched_jobs - 1); +- struct dma_fence *other = centity->fences[idx]; ++ struct dma_fence *other; ++ unsigned idx; ++ long r; + +- if (other) { +- signed long r; +- r = dma_fence_wait(other, true); +- if (r < 0) { +- if (r != -ERESTARTSYS) +- DRM_ERROR("Error (%ld) waiting for fence!\n", r); ++ spin_lock(&ctx->ring_lock); ++ idx = centity->sequence & (amdgpu_sched_jobs - 1); ++ other = dma_fence_get(centity->fences[idx]); ++ spin_unlock(&ctx->ring_lock); + +- return r; +- } +- } ++ if (!other) ++ return 0; + +- return 0; ++ r = dma_fence_wait(other, true); ++ if (r < 0 && r != -ERESTARTSYS) ++ DRM_ERROR("Error (%ld) waiting for fence!\n", r); ++ ++ dma_fence_put(other); ++ return r; + } + + void amdgpu_ctx_mgr_init(struct amdgpu_ctx_mgr *mgr) +-- +2.20.1 + diff --git a/queue-5.2/drm-omap-fix-port-lookup-for-sdi-output.patch b/queue-5.2/drm-omap-fix-port-lookup-for-sdi-output.patch new file mode 100644 index 00000000000..796cba6ba90 --- /dev/null +++ b/queue-5.2/drm-omap-fix-port-lookup-for-sdi-output.patch @@ -0,0 +1,53 @@ +From ef740c409724b9f8fa0bb4257a3f0eb4e29d38f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 21:32:26 +0300 +Subject: drm/omap: Fix port lookup for SDI output + +From: Laurent Pinchart + +[ Upstream commit 8090f7eb318d4241625449252db2741e7703e027 ] + +When refactoring port lookup for DSS outputs, commit d17eb4537a7e +("drm/omap: Factor out common init/cleanup code for output devices") +incorrectly hardcoded usage of DT port 0. This breaks operation for SDI +(which uses the DT port 1) and DPI outputs other than DPI0 (which are +not used in mainline DT sources). + +Fix this by using the port number from the output omap_dss_device +of_ports field. + +Fixes: d17eb4537a7e ("drm/omap: Factor out common init/cleanup code for output devices") +Signed-off-by: Laurent Pinchart +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20190821183226.13784-1-laurent.pinchart@ideasonboard.com +Tested-by: Aaro Koskinen +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/dss/output.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/omapdrm/dss/output.c b/drivers/gpu/drm/omapdrm/dss/output.c +index de0f882f0f7b0..14b41de44ebcd 100644 +--- a/drivers/gpu/drm/omapdrm/dss/output.c ++++ b/drivers/gpu/drm/omapdrm/dss/output.c +@@ -4,6 +4,7 @@ + * Author: Archit Taneja + */ + ++#include + #include + #include + #include +@@ -20,7 +21,8 @@ int omapdss_device_init_output(struct omap_dss_device *out) + { + struct device_node *remote_node; + +- remote_node = of_graph_get_remote_node(out->dev->of_node, 0, 0); ++ remote_node = of_graph_get_remote_node(out->dev->of_node, ++ ffs(out->of_ports) - 1, 0); + if (!remote_node) { + dev_dbg(out->dev, "failed to find video sink\n"); + return 0; +-- +2.20.1 + diff --git a/queue-5.2/drm-virtio-use-virtio_max_dma_size.patch b/queue-5.2/drm-virtio-use-virtio_max_dma_size.patch new file mode 100644 index 00000000000..81e104892c4 --- /dev/null +++ b/queue-5.2/drm-virtio-use-virtio_max_dma_size.patch @@ -0,0 +1,53 @@ +From ec41ccedadc44f6e5f8beaf9a6d1c539841aa157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 13:12:09 +0200 +Subject: drm/virtio: use virtio_max_dma_size + +From: Gerd Hoffmann + +[ Upstream commit 9b2a0a1ef66f96bf34921a3865581eca32ff05ec ] + +We must make sure our scatterlist segments are not too big, otherwise +we might see swiotlb failures (happens with sev, also reproducable with +swiotlb=force). + +Suggested-by: Laszlo Ersek +Signed-off-by: Gerd Hoffmann +Reviewed-by: Laszlo Ersek +Link: http://patchwork.freedesktop.org/patch/msgid/20190821111210.27165-1-kraxel@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_object.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c +index b2da31310d24c..09b526518f5a6 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_object.c ++++ b/drivers/gpu/drm/virtio/virtgpu_object.c +@@ -204,6 +204,7 @@ int virtio_gpu_object_get_sg_table(struct virtio_gpu_device *qdev, + .interruptible = false, + .no_wait_gpu = false + }; ++ size_t max_segment; + + /* wtf swapping */ + if (bo->pages) +@@ -215,8 +216,13 @@ int virtio_gpu_object_get_sg_table(struct virtio_gpu_device *qdev, + if (!bo->pages) + goto out; + +- ret = sg_alloc_table_from_pages(bo->pages, pages, nr_pages, 0, +- nr_pages << PAGE_SHIFT, GFP_KERNEL); ++ max_segment = virtio_max_dma_size(qdev->vdev); ++ max_segment &= PAGE_MASK; ++ if (max_segment > SCATTERLIST_MAX_SEGMENT) ++ max_segment = SCATTERLIST_MAX_SEGMENT; ++ ret = __sg_alloc_table_from_pages(bo->pages, pages, nr_pages, 0, ++ nr_pages << PAGE_SHIFT, ++ max_segment, GFP_KERNEL); + if (ret) + goto out; + return 0; +-- +2.20.1 + diff --git a/queue-5.2/enetc-add-missing-call-to-pci_free_irq_vectors-in-pr.patch b/queue-5.2/enetc-add-missing-call-to-pci_free_irq_vectors-in-pr.patch new file mode 100644 index 00000000000..714b2dabaac --- /dev/null +++ b/queue-5.2/enetc-add-missing-call-to-pci_free_irq_vectors-in-pr.patch @@ -0,0 +1,55 @@ +From b67ccbaf0f88bb58276cf50c2423cb8e329a3772 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 22:23:12 +0200 +Subject: enetc: Add missing call to 'pci_free_irq_vectors()' in probe and + remove functions + +From: Christophe JAILLET + +[ Upstream commit dd7078f05e1b774a9e8c9f117101d97e4ccd0691 ] + +Call to 'pci_free_irq_vectors()' are missing both in the error handling +path of the probe function, and in the remove function. +Add them. + +Fixes: 19971f5ea0ab ("enetc: add PTP clock driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_ptp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ptp.c b/drivers/net/ethernet/freescale/enetc/enetc_ptp.c +index 8c1497e7d9c5c..aa31948eac644 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_ptp.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_ptp.c +@@ -79,7 +79,7 @@ static int enetc_ptp_probe(struct pci_dev *pdev, + n = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX); + if (n != 1) { + err = -EPERM; +- goto err_irq; ++ goto err_irq_vectors; + } + + ptp_qoriq->irq = pci_irq_vector(pdev, 0); +@@ -103,6 +103,8 @@ static int enetc_ptp_probe(struct pci_dev *pdev, + err_no_clock: + free_irq(ptp_qoriq->irq, ptp_qoriq); + err_irq: ++ pci_free_irq_vectors(pdev); ++err_irq_vectors: + iounmap(base); + err_ioremap: + kfree(ptp_qoriq); +@@ -120,6 +122,7 @@ static void enetc_ptp_remove(struct pci_dev *pdev) + struct ptp_qoriq *ptp_qoriq = pci_get_drvdata(pdev); + + ptp_qoriq_free(ptp_qoriq); ++ pci_free_irq_vectors(pdev); + kfree(ptp_qoriq); + + pci_release_mem_regions(pdev); +-- +2.20.1 + diff --git a/queue-5.2/flow_dissector-fix-potential-use-after-free-on-bpf_p.patch b/queue-5.2/flow_dissector-fix-potential-use-after-free-on-bpf_p.patch new file mode 100644 index 00000000000..5f9eb9a6c27 --- /dev/null +++ b/queue-5.2/flow_dissector-fix-potential-use-after-free-on-bpf_p.patch @@ -0,0 +1,46 @@ +From d068ace7c19e243da2396a03685ca9339b18db7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 14:17:20 +0200 +Subject: flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH + +From: Jakub Sitnicki + +[ Upstream commit db38de39684dda2bf307f41797db2831deba64e9 ] + +Call to bpf_prog_put(), with help of call_rcu(), queues an RCU-callback to +free the program once a grace period has elapsed. The callback can run +together with new RCU readers that started after the last grace period. +New RCU readers can potentially see the "old" to-be-freed or already-freed +pointer to the program object before the RCU update-side NULLs it. + +Reorder the operations so that the RCU update-side resets the protected +pointer before the end of the grace period after which the program will be +freed. + +Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") +Reported-by: Lorenz Bauer +Signed-off-by: Jakub Sitnicki +Acked-by: Petar Penkov +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index edd622956083d..b15c0c0f6e557 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -138,8 +138,8 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr) + mutex_unlock(&flow_dissector_mutex); + return -ENOENT; + } +- bpf_prog_put(attached); + RCU_INIT_POINTER(net->flow_dissector_prog, NULL); ++ bpf_prog_put(attached); + mutex_unlock(&flow_dissector_mutex); + return 0; + } +-- +2.20.1 + diff --git a/queue-5.2/fpga-altera-ps-spi-fix-getting-of-optional-confd-gpi.patch b/queue-5.2/fpga-altera-ps-spi-fix-getting-of-optional-confd-gpi.patch new file mode 100644 index 00000000000..6dcc520544c --- /dev/null +++ b/queue-5.2/fpga-altera-ps-spi-fix-getting-of-optional-confd-gpi.patch @@ -0,0 +1,54 @@ +From 3604681447118728409e48fe41d94e96e8464908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2019 10:48:45 +0800 +Subject: fpga: altera-ps-spi: Fix getting of optional confd gpio + +From: Phil Reid + +[ Upstream commit dec43da46f63eb71f519d963ba6832838e4262a3 ] + +Currently the driver does not handle EPROBE_DEFER for the confd gpio. +Use devm_gpiod_get_optional() instead of devm_gpiod_get() and return +error codes from altera_ps_probe(). + +Fixes: 5692fae0742d ("fpga manager: Add altera-ps-spi driver for Altera FPGAs") +Signed-off-by: Phil Reid +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/altera-ps-spi.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c +index a13f224303c69..0221dee8dd4c6 100644 +--- a/drivers/fpga/altera-ps-spi.c ++++ b/drivers/fpga/altera-ps-spi.c +@@ -210,7 +210,7 @@ static int altera_ps_write_complete(struct fpga_manager *mgr, + return -EIO; + } + +- if (!IS_ERR(conf->confd)) { ++ if (conf->confd) { + if (!gpiod_get_raw_value_cansleep(conf->confd)) { + dev_err(&mgr->dev, "CONF_DONE is inactive!\n"); + return -EIO; +@@ -289,10 +289,13 @@ static int altera_ps_probe(struct spi_device *spi) + return PTR_ERR(conf->status); + } + +- conf->confd = devm_gpiod_get(&spi->dev, "confd", GPIOD_IN); ++ conf->confd = devm_gpiod_get_optional(&spi->dev, "confd", GPIOD_IN); + if (IS_ERR(conf->confd)) { +- dev_warn(&spi->dev, "Not using confd gpio: %ld\n", +- PTR_ERR(conf->confd)); ++ dev_err(&spi->dev, "Failed to get confd gpio: %ld\n", ++ PTR_ERR(conf->confd)); ++ return PTR_ERR(conf->confd); ++ } else if (!conf->confd) { ++ dev_warn(&spi->dev, "Not using confd gpio"); + } + + /* Register manager with unique name */ +-- +2.20.1 + diff --git a/queue-5.2/i2c-designware-synchronize-irqs-when-unregistering-s.patch b/queue-5.2/i2c-designware-synchronize-irqs-when-unregistering-s.patch new file mode 100644 index 00000000000..3f3b389feeb --- /dev/null +++ b/queue-5.2/i2c-designware-synchronize-irqs-when-unregistering-s.patch @@ -0,0 +1,39 @@ +From 8eb80a98f1c7f4867833967b36d3980b1715e300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 16:52:11 +0300 +Subject: i2c: designware: Synchronize IRQs when unregistering slave client + +From: Jarkko Nikula + +[ Upstream commit c486dcd2f1bbdd524a1e0149734b79e4ae329650 ] + +Make sure interrupt handler i2c_dw_irq_handler_slave() has finished +before clearing the the dev->slave pointer in i2c_dw_unreg_slave(). + +There is possibility for a race if i2c_dw_irq_handler_slave() is running +on another CPU while clearing the dev->slave pointer. + +Reported-by: Krzysztof Adamski +Reported-by: Wolfram Sang +Signed-off-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-slave.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index e7f9305b2dd9f..f5f001738df5e 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -94,6 +94,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) + + dev->disable_int(dev); + dev->disable(dev); ++ synchronize_irq(dev->irq); + dev->slave = NULL; + pm_runtime_put(dev->dev); + +-- +2.20.1 + diff --git a/queue-5.2/i2c-iproc-stop-advertising-support-of-smbus-quick-cm.patch b/queue-5.2/i2c-iproc-stop-advertising-support-of-smbus-quick-cm.patch new file mode 100644 index 00000000000..7c43e7ab878 --- /dev/null +++ b/queue-5.2/i2c-iproc-stop-advertising-support-of-smbus-quick-cm.patch @@ -0,0 +1,44 @@ +From ca0ab8b587a05b8f9176f7f5937ebf9322a6142a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 09:07:52 +0530 +Subject: i2c: iproc: Stop advertising support of SMBUS quick cmd + +From: Lori Hikichi + +[ Upstream commit b3d604d405166edfd4e1e6053409b85008f4f56d ] + +The driver does not support the SMBUS Quick command so remove the +flag that indicates that level of support. +By default the i2c_detect tool uses the quick command to try and +detect devices at some bus addresses. If the quick command is used +then we will not detect the device, even though it is present. + +Fixes: e6e5dd3566e0 (i2c: iproc: Add Broadcom iProc I2C Driver) +Signed-off-by: Lori Hikichi +Signed-off-by: Rayagonda Kokatanur +Reviewed-by: Ray Jui +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-bcm-iproc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c +index ad1681872e39d..b99322d83f483 100644 +--- a/drivers/i2c/busses/i2c-bcm-iproc.c ++++ b/drivers/i2c/busses/i2c-bcm-iproc.c +@@ -801,7 +801,10 @@ static int bcm_iproc_i2c_xfer(struct i2c_adapter *adapter, + + static uint32_t bcm_iproc_i2c_functionality(struct i2c_adapter *adap) + { +- u32 val = I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; ++ u32 val; ++ ++ /* We do not support the SMBUS Quick command */ ++ val = I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK); + + if (adap->algo->reg_slave) + val |= I2C_FUNC_SLAVE; +-- +2.20.1 + diff --git a/queue-5.2/i2c-mediatek-disable-zero-length-transfers-for-mt818.patch b/queue-5.2/i2c-mediatek-disable-zero-length-transfers-for-mt818.patch new file mode 100644 index 00000000000..f1571e3344b --- /dev/null +++ b/queue-5.2/i2c-mediatek-disable-zero-length-transfers-for-mt818.patch @@ -0,0 +1,62 @@ +From f818a278b067d145484a4dbbfa82f854352eeee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 17:45:17 +0800 +Subject: i2c: mediatek: disable zero-length transfers for mt8183 + +From: Hsin-Yi Wang + +[ Upstream commit abf4923e97c3abbbd1e59f0e13c7c214c93c6aaa ] + +Quoting from mt8183 datasheet, the number of transfers to be +transferred in one transaction should be set to bigger than 1, +so we should forbid zero-length transfer and update functionality. + +Reported-by: Alexandru M Stan +Signed-off-by: Hsin-Yi Wang +Reviewed-by: Qii Wang +[wsa: shortened commit message a little] +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 252edb433fdfb..29eae1bf4f861 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -234,6 +234,10 @@ static const struct i2c_adapter_quirks mt7622_i2c_quirks = { + .max_num_msgs = 255, + }; + ++static const struct i2c_adapter_quirks mt8183_i2c_quirks = { ++ .flags = I2C_AQ_NO_ZERO_LEN, ++}; ++ + static const struct mtk_i2c_compatible mt2712_compat = { + .regs = mt_i2c_regs_v1, + .pmic_i2c = 0, +@@ -298,6 +302,7 @@ static const struct mtk_i2c_compatible mt8173_compat = { + }; + + static const struct mtk_i2c_compatible mt8183_compat = { ++ .quirks = &mt8183_i2c_quirks, + .regs = mt_i2c_regs_v2, + .pmic_i2c = 0, + .dcm = 0, +@@ -870,7 +875,11 @@ static irqreturn_t mtk_i2c_irq(int irqno, void *dev_id) + + static u32 mtk_i2c_functionality(struct i2c_adapter *adap) + { +- return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; ++ if (adap->quirks->flags & I2C_AQ_NO_ZERO_LEN) ++ return I2C_FUNC_I2C | ++ (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK); ++ else ++ return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; + } + + static const struct i2c_algorithm mtk_i2c_algorithm = { +-- +2.20.1 + diff --git a/queue-5.2/ibmvnic-do-not-process-reset-during-or-after-device-.patch b/queue-5.2/ibmvnic-do-not-process-reset-during-or-after-device-.patch new file mode 100644 index 00000000000..d4397d2c205 --- /dev/null +++ b/queue-5.2/ibmvnic-do-not-process-reset-during-or-after-device-.patch @@ -0,0 +1,54 @@ +From d2692491e6f9051570a98229ac0fd13fe88bf7f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 11:10:04 -0500 +Subject: ibmvnic: Do not process reset during or after device removal + +From: Thomas Falcon + +[ Upstream commit 36f1031c51a2538e5558fb44c6d6b88f98d3c0f2 ] + +Currently, the ibmvnic driver will not schedule device resets +if the device is being removed, but does not check the device +state before the reset is actually processed. This leads to a race +where a reset is scheduled with a valid device state but is +processed after the driver has been removed, resulting in an oops. + +Fix this by checking the device state before processing a queued +reset event. + +Reported-by: Abdul Haleem +Tested-by: Abdul Haleem +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index cebd20f3128d4..fa4bb940665c2 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1983,6 +1983,10 @@ static void __ibmvnic_reset(struct work_struct *work) + + rwi = get_next_rwi(adapter); + while (rwi) { ++ if (adapter->state == VNIC_REMOVING || ++ adapter->state == VNIC_REMOVED) ++ goto out; ++ + if (adapter->force_reset_recovery) { + adapter->force_reset_recovery = false; + rc = do_hard_reset(adapter, rwi, reset_state); +@@ -2007,7 +2011,7 @@ static void __ibmvnic_reset(struct work_struct *work) + netdev_dbg(adapter->netdev, "Reset failed\n"); + free_all_rwi(adapter); + } +- ++out: + adapter->resetting = false; + if (we_lock_rtnl) + rtnl_unlock(); +-- +2.20.1 + diff --git a/queue-5.2/ieee802154-hwsim-fix-error-handle-path-in-hwsim_init.patch b/queue-5.2/ieee802154-hwsim-fix-error-handle-path-in-hwsim_init.patch new file mode 100644 index 00000000000..1ca96636ae1 --- /dev/null +++ b/queue-5.2/ieee802154-hwsim-fix-error-handle-path-in-hwsim_init.patch @@ -0,0 +1,106 @@ +From c16a8667567bf23bd5725eea5f059c3822a3bc81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2019 22:14:51 +0800 +Subject: ieee802154: hwsim: Fix error handle path in hwsim_init_module + +From: YueHaibing + +[ Upstream commit 1cbbbf39efab05fae67f59e6ed01bb85061c69e2 ] + +KASAN report this: + +BUG: unable to handle kernel paging request at fffffbfff834f001 +PGD 237fe8067 P4D 237fe8067 PUD 237e64067 PMD 1c968d067 PTE 0 +Oops: 0000 [#1] SMP KASAN PTI +CPU: 1 PID: 8871 Comm: syz-executor.0 Tainted: G C 5.0.0+ #5 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328 +Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d +RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246 +RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503 +RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008 +RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195 +R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008 +R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000 +FS: 00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + genl_family_find_byname+0x7f/0xf0 net/netlink/genetlink.c:104 + genl_register_family+0x1e1/0x1070 net/netlink/genetlink.c:333 + ? 0xffffffffc1978000 + hwsim_init_module+0x6a/0x1000 [mac802154_hwsim] + ? 0xffffffffc1978000 + ? 0xffffffffc1978000 + ? 0xffffffffc1978000 + do_one_initcall+0xbc/0x47d init/main.c:887 + do_init_module+0x1b5/0x547 kernel/module.c:3456 + load_module+0x6405/0x8c10 kernel/module.c:3804 + __do_sys_finit_module+0x162/0x190 kernel/module.c:3898 + do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x462e99 +Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007fdcc02fec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 +RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 +RBP: 00007fdcc02fec70 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdcc02ff6bc +R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004 +Modules linked in: mac802154_hwsim(+) mac802154 ieee802154 speakup(C) rc_proteus_2309 rtc_rk808 streebog_generic rds vboxguest madera_spi madera da9052_wdt mISDN_core ueagle_atm usbatm atm ir_imon_decoder scsi_transport_sas rc_dntv_live_dvb_t panel_samsung_s6d16d0 drm drm_panel_orientation_quirks lib80211 fb_agm1264k_fl(C) gspca_pac7302 gspca_main videobuf2_v4l2 soundwire_intel_init i2c_dln2 dln2 usbcore hid_gaff 88pm8607 nfnetlink axp20x_i2c axp20x uio pata_marvell pmbus_core snd_sonicvibes gameport snd_pcm snd_opl3_lib snd_timer snd_hwdep snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore rtc_ds1511 rtc_ds1742 vsock dwc_xlgmac rtc_rx8010 libphy twofish_x86_64_3way twofish_x86_64 twofish_common ad5696_i2c ad5686 lp8788_charger cxd2880_spi dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops fbtft(C) sysimgblt sysfillrect syscopyarea fb_sys_fops janz_ican3 firewire_net firewire_core crc_itu_t spi_slave_system_control i2c_matroxfb i2c_algo_bit + matroxfb_base fb fbdev matroxfb_DAC1064 matroxfb_accel cfbcopyarea cfbimgblt cfbfillrect matroxfb_Ti3026 matroxfb_g450 g450_pll matroxfb_misc leds_blinkm ti_dac7311 intel_spi_pci intel_spi spi_nor hid_elan hid async_tx rc_cinergy_1400 rc_core intel_ishtp kxcjk_1013 industrialio_triggered_buffer kfifo_buf can_dev intel_th spi_pxa2xx_platform pata_artop vme_ca91cx42 gb_gbphy(C) greybus(C) industrialio mptbase st_drv cmac ttpci_eeprom via_wdt gpio_xra1403 mtd iptable_security iptable_raw iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun joydev mousedev ppdev kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel aes_x86_64 input_leds crypto_simd cryptd glue_helper ide_pci_generic piix psmouse + ide_core serio_raw ata_generic i2c_piix4 pata_acpi parport_pc parport floppy rtc_cmos intel_agp intel_gtt agpgart sch_fq_codel ip_tables x_tables sha1_ssse3 sha1_generic ipv6 [last unloaded: speakup] +Dumping ftrace buffer: + (ftrace buffer empty) +CR2: fffffbfff834f001 +---[ end trace 5aa772c793e0e971 ]--- +RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328 +Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d +RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246 +RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503 +RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008 +RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195 +R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008 +R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000 +FS: 00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 + +The error handing path misplace the cleanup in hwsim_init_module, +switch the two cleanup functions to fix above issues. + +Reported-by: Hulk Robot +Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") +Signed-off-by: YueHaibing +Acked-by: Alexander Aring +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/mac802154_hwsim.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index b41696e16bdc8..94b9e9d775e40 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -901,9 +901,9 @@ static __init int hwsim_init_module(void) + return 0; + + platform_drv: +- genl_unregister_family(&hwsim_genl_family); +-platform_dev: + platform_device_unregister(mac802154hwsim_dev); ++platform_dev: ++ genl_unregister_family(&hwsim_genl_family); + return rc; + } + +-- +2.20.1 + diff --git a/queue-5.2/ieee802154-hwsim-unregister-hw-while-hwsim_subscribe.patch b/queue-5.2/ieee802154-hwsim-unregister-hw-while-hwsim_subscribe.patch new file mode 100644 index 00000000000..c47d8a3f94f --- /dev/null +++ b/queue-5.2/ieee802154-hwsim-unregister-hw-while-hwsim_subscribe.patch @@ -0,0 +1,101 @@ +From a31e20ae383c10df49f027c9ae5dac8604995cf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Apr 2019 23:48:10 +0800 +Subject: ieee802154: hwsim: unregister hw while hwsim_subscribe_all_others + fails + +From: YueHaibing + +[ Upstream commit de166bbe861738c8bc3e5dad5b03f45d7d6ef914 ] + +KASAN report this: + +kernel BUG at net/mac802154/main.c:130! +invalid opcode: 0000 [#1] PREEMPT SMP +CPU: 0 PID: 19932 Comm: modprobe Not tainted 5.1.0-rc6+ #22 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 +RIP: 0010:ieee802154_free_hw+0x2a/0x30 [mac802154] +Code: 55 48 8d 57 38 48 89 e5 53 48 89 fb 48 8b 47 38 48 39 c2 75 15 48 8d 7f 48 e8 82 85 16 e1 48 8b 7b 28 e8 f9 ef 83 e2 5b 5d c3 <0f> 0b 0f 1f 40 00 55 48 89 e5 53 48 89 fb 0f b6 86 80 00 00 00 88 +RSP: 0018:ffffc90001c7b9f0 EFLAGS: 00010206 +RAX: ffff88822df3aa80 RBX: ffff88823143d5c0 RCX: 0000000000000002 +RDX: ffff88823143d5f8 RSI: ffff88822b1fabc0 RDI: ffff88823143d5c0 +RBP: ffffc90001c7b9f8 R08: 0000000000000000 R09: 0000000000000001 +R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff4 +R13: ffff88822dea4f50 R14: ffff88823143d7c0 R15: 00000000fffffff4 +FS: 00007ff52e999540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fdc06dba768 CR3: 000000023160a000 CR4: 00000000000006f0 +Call Trace: + hwsim_add_one+0x2dd/0x540 [mac802154_hwsim] + hwsim_probe+0x2f/0xb0 [mac802154_hwsim] + platform_drv_probe+0x3a/0x90 + ? driver_sysfs_add+0x79/0xb0 + really_probe+0x1d4/0x2d0 + driver_probe_device+0x50/0xf0 + device_driver_attach+0x54/0x60 + __driver_attach+0x7e/0xd0 + ? device_driver_attach+0x60/0x60 + bus_for_each_dev+0x68/0xc0 + driver_attach+0x19/0x20 + bus_add_driver+0x15e/0x200 + driver_register+0x5b/0xf0 + __platform_driver_register+0x31/0x40 + hwsim_init_module+0x74/0x1000 [mac802154_hwsim] + ? 0xffffffffa00e9000 + do_one_initcall+0x6c/0x3cc + ? kmem_cache_alloc_trace+0x248/0x3b0 + do_init_module+0x5b/0x1f1 + load_module+0x1db1/0x2690 + ? m_show+0x1d0/0x1d0 + __do_sys_finit_module+0xc5/0xd0 + __x64_sys_finit_module+0x15/0x20 + do_syscall_64+0x6b/0x1d0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x7ff52e4a2839 +Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffffa7b3c08 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 00005647560a2a00 RCX: 00007ff52e4a2839 +RDX: 0000000000000000 RSI: 00005647547f3c2e RDI: 0000000000000003 +RBP: 00005647547f3c2e R08: 0000000000000000 R09: 00005647560a2a00 +R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 +R13: 00005647560a2c10 R14: 0000000000040000 R15: 00005647560a2a00 +Modules linked in: mac802154_hwsim(+) mac802154 [last unloaded: mac802154_hwsim] + +In hwsim_add_one, if hwsim_subscribe_all_others fails, we +should call ieee802154_unregister_hw to free resources. + +Reported-by: Hulk Robot +Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") +Signed-off-by: YueHaibing +Acked-by: Alexander Aring +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/mac802154_hwsim.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index 94b9e9d775e40..c20e7ef18bc95 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -802,7 +802,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev, + err = hwsim_subscribe_all_others(phy); + if (err < 0) { + mutex_unlock(&hwsim_phys_lock); +- goto err_reg; ++ goto err_subscribe; + } + } + list_add_tail(&phy->list, &hwsim_phys); +@@ -812,6 +812,8 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev, + + return idx; + ++err_subscribe: ++ ieee802154_unregister_hw(phy->hw); + err_reg: + kfree(pib); + err_pib: +-- +2.20.1 + diff --git a/queue-5.2/iommu-amd-fix-race-in-increase_address_space.patch b/queue-5.2/iommu-amd-fix-race-in-increase_address_space.patch new file mode 100644 index 00000000000..ca280fccffe --- /dev/null +++ b/queue-5.2/iommu-amd-fix-race-in-increase_address_space.patch @@ -0,0 +1,73 @@ +From f9d2b57a9105eaafafaa305f2379fda88b74a65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2019 10:39:54 +0200 +Subject: iommu/amd: Fix race in increase_address_space() + +From: Joerg Roedel + +[ Upstream commit 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 ] + +After the conversion to lock-less dma-api call the +increase_address_space() function can be called without any +locking. Multiple CPUs could potentially race for increasing +the address space, leading to invalid domain->mode settings +and invalid page-tables. This has been happening in the wild +under high IO load and memory pressure. + +Fix the race by locking this operation. The function is +called infrequently so that this does not introduce +a performance regression in the dma-api path again. + +Reported-by: Qian Cai +Fixes: 256e4621c21a ('iommu/amd: Make use of the generic IOVA allocator') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index b265062edf6c8..3e687f18b203a 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1425,18 +1425,21 @@ static void free_pagetable(struct protection_domain *domain) + * another level increases the size of the address space by 9 bits to a size up + * to 64 bits. + */ +-static bool increase_address_space(struct protection_domain *domain, ++static void increase_address_space(struct protection_domain *domain, + gfp_t gfp) + { ++ unsigned long flags; + u64 *pte; + +- if (domain->mode == PAGE_MODE_6_LEVEL) ++ spin_lock_irqsave(&domain->lock, flags); ++ ++ if (WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL)) + /* address space already 64 bit large */ +- return false; ++ goto out; + + pte = (void *)get_zeroed_page(gfp); + if (!pte) +- return false; ++ goto out; + + *pte = PM_LEVEL_PDE(domain->mode, + iommu_virt_to_phys(domain->pt_root)); +@@ -1444,7 +1447,10 @@ static bool increase_address_space(struct protection_domain *domain, + domain->mode += 1; + domain->updated = true; + +- return true; ++out: ++ spin_unlock_irqrestore(&domain->lock, flags); ++ ++ return; + } + + static u64 *alloc_pte(struct protection_domain *domain, +-- +2.20.1 + diff --git a/queue-5.2/iommu-amd-flush-old-domains-in-kdump-kernel.patch b/queue-5.2/iommu-amd-flush-old-domains-in-kdump-kernel.patch new file mode 100644 index 00000000000..243ef6c1124 --- /dev/null +++ b/queue-5.2/iommu-amd-flush-old-domains-in-kdump-kernel.patch @@ -0,0 +1,84 @@ +From 61d86c253a9309841e7a0a45d3ed943bc83630ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 12:09:48 -0500 +Subject: iommu/amd: Flush old domains in kdump kernel + +From: Stuart Hayes + +[ Upstream commit 36b7200f67dfe75b416b5281ed4ace9927b513bc ] + +When devices are attached to the amd_iommu in a kdump kernel, the old device +table entries (DTEs), which were copied from the crashed kernel, will be +overwritten with a new domain number. When the new DTE is written, the IOMMU +is told to flush the DTE from its internal cache--but it is not told to flush +the translation cache entries for the old domain number. + +Without this patch, AMD systems using the tg3 network driver fail when kdump +tries to save the vmcore to a network system, showing network timeouts and +(sometimes) IOMMU errors in the kernel log. + +This patch will flush IOMMU translation cache entries for the old domain when +a DTE gets overwritten with a new domain number. + +Signed-off-by: Stuart Hayes +Fixes: 3ac3e5ee5ed5 ('iommu/amd: Copy old trans table from old kernel') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index dce1d8d2e8a44..b265062edf6c8 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1143,6 +1143,17 @@ static void amd_iommu_flush_tlb_all(struct amd_iommu *iommu) + iommu_completion_wait(iommu); + } + ++static void amd_iommu_flush_tlb_domid(struct amd_iommu *iommu, u32 dom_id) ++{ ++ struct iommu_cmd cmd; ++ ++ build_inv_iommu_pages(&cmd, 0, CMD_INV_IOMMU_ALL_PAGES_ADDRESS, ++ dom_id, 1); ++ iommu_queue_command(iommu, &cmd); ++ ++ iommu_completion_wait(iommu); ++} ++ + static void amd_iommu_flush_all(struct amd_iommu *iommu) + { + struct iommu_cmd cmd; +@@ -1863,6 +1874,7 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, + { + u64 pte_root = 0; + u64 flags = 0; ++ u32 old_domid; + + if (domain->mode != PAGE_MODE_NONE) + pte_root = iommu_virt_to_phys(domain->pt_root); +@@ -1912,8 +1924,20 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, + flags &= ~DEV_DOMID_MASK; + flags |= domain->id; + ++ old_domid = amd_iommu_dev_table[devid].data[1] & DEV_DOMID_MASK; + amd_iommu_dev_table[devid].data[1] = flags; + amd_iommu_dev_table[devid].data[0] = pte_root; ++ ++ /* ++ * A kdump kernel might be replacing a domain ID that was copied from ++ * the previous kernel--if so, it needs to flush the translation cache ++ * entries for the old domain ID that is being overwritten ++ */ ++ if (old_domid) { ++ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid]; ++ ++ amd_iommu_flush_tlb_domid(iommu, old_domid); ++ } + } + + static void clear_dte_entry(u16 devid) +-- +2.20.1 + diff --git a/queue-5.2/iommu-vt-d-remove-global-page-flush-support.patch b/queue-5.2/iommu-vt-d-remove-global-page-flush-support.patch new file mode 100644 index 00000000000..818ab5a3db3 --- /dev/null +++ b/queue-5.2/iommu-vt-d-remove-global-page-flush-support.patch @@ -0,0 +1,144 @@ +From ed4e76d5c805bd8e4734f994aed893cd8ca1873d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 08:53:29 -0700 +Subject: iommu/vt-d: Remove global page flush support + +From: Jacob Pan + +[ Upstream commit 8744daf4b0699b724ee0a56b313a6c0c4ea289e3 ] + +Global pages support is removed from VT-d spec 3.0. Since global pages G +flag only affects first-level paging structures and because DMA request +with PASID are only supported by VT-d spec. 3.0 and onward, we can +safely remove global pages support. + +For kernel shared virtual address IOTLB invalidation, PASID +granularity and page selective within PASID will be used. There is +no global granularity supported. Without this fix, IOTLB invalidation +will cause invalid descriptor error in the queued invalidation (QI) +interface. + +Fixes: 1c4f88b7f1f9 ("iommu/vt-d: Shared virtual address in scalable mode") +Reported-by: Sanjay K Kumar +Signed-off-by: Jacob Pan +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-svm.c | 36 +++++++++++++++--------------------- + include/linux/intel-iommu.h | 3 --- + 2 files changed, 15 insertions(+), 24 deletions(-) + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index eceaa7e968ae8..641dc223c97b8 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -100,24 +100,19 @@ int intel_svm_finish_prq(struct intel_iommu *iommu) + } + + static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_dev *sdev, +- unsigned long address, unsigned long pages, int ih, int gl) ++ unsigned long address, unsigned long pages, int ih) + { + struct qi_desc desc; + +- if (pages == -1) { +- /* For global kernel pages we have to flush them in *all* PASIDs +- * because that's the only option the hardware gives us. Despite +- * the fact that they are actually only accessible through one. */ +- if (gl) +- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | +- QI_EIOTLB_DID(sdev->did) | +- QI_EIOTLB_GRAN(QI_GRAN_ALL_ALL) | +- QI_EIOTLB_TYPE; +- else +- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | +- QI_EIOTLB_DID(sdev->did) | +- QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | +- QI_EIOTLB_TYPE; ++ /* ++ * Do PASID granu IOTLB invalidation if page selective capability is ++ * not available. ++ */ ++ if (pages == -1 || !cap_pgsel_inv(svm->iommu->cap)) { ++ desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | ++ QI_EIOTLB_DID(sdev->did) | ++ QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | ++ QI_EIOTLB_TYPE; + desc.qw1 = 0; + } else { + int mask = ilog2(__roundup_pow_of_two(pages)); +@@ -127,7 +122,6 @@ static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_d + QI_EIOTLB_GRAN(QI_GRAN_PSI_PASID) | + QI_EIOTLB_TYPE; + desc.qw1 = QI_EIOTLB_ADDR(address) | +- QI_EIOTLB_GL(gl) | + QI_EIOTLB_IH(ih) | + QI_EIOTLB_AM(mask); + } +@@ -162,13 +156,13 @@ static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_d + } + + static void intel_flush_svm_range(struct intel_svm *svm, unsigned long address, +- unsigned long pages, int ih, int gl) ++ unsigned long pages, int ih) + { + struct intel_svm_dev *sdev; + + rcu_read_lock(); + list_for_each_entry_rcu(sdev, &svm->devs, list) +- intel_flush_svm_range_dev(svm, sdev, address, pages, ih, gl); ++ intel_flush_svm_range_dev(svm, sdev, address, pages, ih); + rcu_read_unlock(); + } + +@@ -180,7 +174,7 @@ static void intel_invalidate_range(struct mmu_notifier *mn, + struct intel_svm *svm = container_of(mn, struct intel_svm, notifier); + + intel_flush_svm_range(svm, start, +- (end - start + PAGE_SIZE - 1) >> VTD_PAGE_SHIFT, 0, 0); ++ (end - start + PAGE_SIZE - 1) >> VTD_PAGE_SHIFT, 0); + } + + static void intel_mm_release(struct mmu_notifier *mn, struct mm_struct *mm) +@@ -203,7 +197,7 @@ static void intel_mm_release(struct mmu_notifier *mn, struct mm_struct *mm) + rcu_read_lock(); + list_for_each_entry_rcu(sdev, &svm->devs, list) { + intel_pasid_tear_down_entry(svm->iommu, sdev->dev, svm->pasid); +- intel_flush_svm_range_dev(svm, sdev, 0, -1, 0, !svm->mm); ++ intel_flush_svm_range_dev(svm, sdev, 0, -1, 0); + } + rcu_read_unlock(); + +@@ -410,7 +404,7 @@ int intel_svm_unbind_mm(struct device *dev, int pasid) + * large and has to be physically contiguous. So it's + * hard to be as defensive as we might like. */ + intel_pasid_tear_down_entry(iommu, dev, svm->pasid); +- intel_flush_svm_range_dev(svm, sdev, 0, -1, 0, !svm->mm); ++ intel_flush_svm_range_dev(svm, sdev, 0, -1, 0); + kfree_rcu(sdev, rcu); + + if (list_empty(&svm->devs)) { +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 6a8dd4af01472..ba8dc520cc79a 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -346,7 +346,6 @@ enum { + #define QI_PC_PASID_SEL (QI_PC_TYPE | QI_PC_GRAN(1)) + + #define QI_EIOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK) +-#define QI_EIOTLB_GL(gl) (((u64)gl) << 7) + #define QI_EIOTLB_IH(ih) (((u64)ih) << 6) + #define QI_EIOTLB_AM(am) (((u64)am)) + #define QI_EIOTLB_PASID(pasid) (((u64)pasid) << 32) +@@ -378,8 +377,6 @@ enum { + #define QI_RESP_INVALID 0x1 + #define QI_RESP_FAILURE 0xf + +-#define QI_GRAN_ALL_ALL 0 +-#define QI_GRAN_NONG_ALL 1 + #define QI_GRAN_NONG_PASID 2 + #define QI_GRAN_PSI_PASID 3 + +-- +2.20.1 + diff --git a/queue-5.2/kallsyms-don-t-let-kallsyms_lookup_size_offset-fail-.patch b/queue-5.2/kallsyms-don-t-let-kallsyms_lookup_size_offset-fail-.patch new file mode 100644 index 00000000000..6885df6c12e --- /dev/null +++ b/queue-5.2/kallsyms-don-t-let-kallsyms_lookup_size_offset-fail-.patch @@ -0,0 +1,86 @@ +From 98b18e806cdf238a1373a0060f49a7140d9cb05a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Aug 2019 14:12:31 +0100 +Subject: kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving + the first symbol + +From: Marc Zyngier + +[ Upstream commit 2a1a3fa0f29270583f0e6e3100d609e09697add1 ] + +An arm64 kernel configured with + + CONFIG_KPROBES=y + CONFIG_KALLSYMS=y + # CONFIG_KALLSYMS_ALL is not set + CONFIG_KALLSYMS_BASE_RELATIVE=y + +reports the following kprobe failure: + + [ 0.032677] kprobes: failed to populate blacklist: -22 + [ 0.033376] Please take care of using kprobes. + +It appears that kprobe fails to retrieve the symbol at address +0xffff000010081000, despite this symbol being in System.map: + + ffff000010081000 T __exception_text_start + +This symbol is part of the first group of aliases in the +kallsyms_offsets array (symbol names generated using ugly hacks in +scripts/kallsyms.c): + + kallsyms_offsets: + .long 0x1000 // do_undefinstr + .long 0x1000 // efi_header_end + .long 0x1000 // _stext + .long 0x1000 // __exception_text_start + .long 0x12b0 // do_cp15instr + +Looking at the implementation of get_symbol_pos(), it returns the +lowest index for aliasing symbols. In this case, it return 0. + +But kallsyms_lookup_size_offset() considers 0 as a failure, which +is obviously wrong (there is definitely a valid symbol living there). +In turn, the kprobe blacklisting stops abruptly, hence the original +error. + +A CONFIG_KALLSYMS_ALL kernel wouldn't fail as there is always +some random symbols at the beginning of this array, which are never +looked up via kallsyms_lookup_size_offset. + +Fix it by considering that get_symbol_pos() is always successful +(which is consistent with the other uses of this function). + +Fixes: ffc5089196446 ("[PATCH] Create kallsyms_lookup_size_offset()") +Reviewed-by: Masami Hiramatsu +Cc: Arnaldo Carvalho de Melo +Cc: Peter Zijlstra +Cc: Will Deacon +Cc: Catalin Marinas +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + kernel/kallsyms.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c +index 95a260f9214b9..136ce049c4ad2 100644 +--- a/kernel/kallsyms.c ++++ b/kernel/kallsyms.c +@@ -263,8 +263,10 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize, + { + char namebuf[KSYM_NAME_LEN]; + +- if (is_ksym_addr(addr)) +- return !!get_symbol_pos(addr, symbolsize, offset); ++ if (is_ksym_addr(addr)) { ++ get_symbol_pos(addr, symbolsize, offset); ++ return 1; ++ } + return !!module_address_lookup(addr, symbolsize, offset, NULL, namebuf) || + !!__bpf_address_lookup(addr, symbolsize, offset, namebuf); + } +-- +2.20.1 + diff --git a/queue-5.2/kconfig-fix-the-reference-to-the-idt77105-phy-driver.patch b/queue-5.2/kconfig-fix-the-reference-to-the-idt77105-phy-driver.patch new file mode 100644 index 00000000000..bcb05f48eff --- /dev/null +++ b/queue-5.2/kconfig-fix-the-reference-to-the-idt77105-phy-driver.patch @@ -0,0 +1,35 @@ +From 25a59b993c521b7021dcaaa8379112561b56da64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 07:04:25 +0200 +Subject: Kconfig: Fix the reference to the IDT77105 Phy driver in the + description of ATM_NICSTAR_USE_IDT77105 + +From: Christophe JAILLET + +[ Upstream commit cd9d4ff9b78fcd0fc4708900ba3e52e71e1a7690 ] + +This should be IDT77105, not IDT77015. + +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig +index 2e2efa577437e..8c37294f1d1ee 100644 +--- a/drivers/atm/Kconfig ++++ b/drivers/atm/Kconfig +@@ -200,7 +200,7 @@ config ATM_NICSTAR_USE_SUNI + make the card work). + + config ATM_NICSTAR_USE_IDT77105 +- bool "Use IDT77015 PHY driver (25Mbps)" ++ bool "Use IDT77105 PHY driver (25Mbps)" + depends on ATM_NICSTAR + help + Support for the PHYsical layer chip in ForeRunner LE25 cards. In +-- +2.20.1 + diff --git a/queue-5.2/keys-fix-missing-null-pointer-check-in-request_key_a.patch b/queue-5.2/keys-fix-missing-null-pointer-check-in-request_key_a.patch new file mode 100644 index 00000000000..235c415eb5a --- /dev/null +++ b/queue-5.2/keys-fix-missing-null-pointer-check-in-request_key_a.patch @@ -0,0 +1,74 @@ +From 281d9337e64b9cf67a20702179936f94afedf4ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2019 13:37:29 +0100 +Subject: keys: Fix missing null pointer check in request_key_auth_describe() + +From: Hillf Danton + +[ Upstream commit d41a3effbb53b1bcea41e328d16a4d046a508381 ] + +If a request_key authentication token key gets revoked, there's a window in +which request_key_auth_describe() can see it with a NULL payload - but it +makes no check for this and something like the following oops may occur: + + BUG: Kernel NULL pointer dereference at 0x00000038 + Faulting instruction address: 0xc0000000004ddf30 + Oops: Kernel access of bad area, sig: 11 [#1] + ... + NIP [...] request_key_auth_describe+0x90/0xd0 + LR [...] request_key_auth_describe+0x54/0xd0 + Call Trace: + [...] request_key_auth_describe+0x54/0xd0 (unreliable) + [...] proc_keys_show+0x308/0x4c0 + [...] seq_read+0x3d0/0x540 + [...] proc_reg_read+0x90/0x110 + [...] __vfs_read+0x3c/0x70 + [...] vfs_read+0xb4/0x1b0 + [...] ksys_read+0x7c/0x130 + [...] system_call+0x5c/0x70 + +Fix this by checking for a NULL pointer when describing such a key. + +Also make the read routine check for a NULL pointer to be on the safe side. + +[DH: Modified to not take already-held rcu lock and modified to also check + in the read routine] + +Fixes: 04c567d9313e ("[PATCH] Keys: Fix race between two instantiators of a key") +Reported-by: Sachin Sant +Signed-off-by: Hillf Danton +Signed-off-by: David Howells +Tested-by: Sachin Sant +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + security/keys/request_key_auth.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c +index e45b5cf3b97fd..8491becb57270 100644 +--- a/security/keys/request_key_auth.c ++++ b/security/keys/request_key_auth.c +@@ -66,6 +66,9 @@ static void request_key_auth_describe(const struct key *key, + { + struct request_key_auth *rka = get_request_key_auth(key); + ++ if (!rka) ++ return; ++ + seq_puts(m, "key:"); + seq_puts(m, key->description); + if (key_is_positive(key)) +@@ -83,6 +86,9 @@ static long request_key_auth_read(const struct key *key, + size_t datalen; + long ret; + ++ if (!rka) ++ return -EKEYREVOKED; ++ + datalen = rka->callout_len; + ret = datalen; + +-- +2.20.1 + diff --git a/queue-5.2/libceph-don-t-call-crypto_free_sync_skcipher-on-a-nu.patch b/queue-5.2/libceph-don-t-call-crypto_free_sync_skcipher-on-a-nu.patch new file mode 100644 index 00000000000..5b2380aafc5 --- /dev/null +++ b/queue-5.2/libceph-don-t-call-crypto_free_sync_skcipher-on-a-nu.patch @@ -0,0 +1,51 @@ +From 8825331e3230149d601583675f54d5d5a289cf4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jul 2019 17:43:06 +0800 +Subject: libceph: don't call crypto_free_sync_skcipher() on a NULL tfm + +From: Jia-Ju Bai + +[ Upstream commit e8c99200b4d117c340c392ebd5e62d85dfeed027 ] + +In set_secret(), key->tfm is assigned to NULL on line 55, and then +ceph_crypto_key_destroy(key) is executed. + +ceph_crypto_key_destroy(key) + crypto_free_sync_skcipher(key->tfm) + crypto_free_skcipher(&tfm->base); + +This happens to work because crypto_sync_skcipher is a trivial wrapper +around crypto_skcipher: &tfm->base is still 0 and crypto_free_skcipher() +handles that. Let's not rely on the layout of crypto_sync_skcipher. + +This bug is found by a static analysis tool STCheck written by us. + +Fixes: 69d6302b65a8 ("libceph: Remove VLA usage of skcipher"). +Signed-off-by: Jia-Ju Bai +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + net/ceph/crypto.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c +index 5d6724cee38f9..4f75df40fb121 100644 +--- a/net/ceph/crypto.c ++++ b/net/ceph/crypto.c +@@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key) + if (key) { + kfree(key->key); + key->key = NULL; +- crypto_free_sync_skcipher(key->tfm); +- key->tfm = NULL; ++ if (key->tfm) { ++ crypto_free_sync_skcipher(key->tfm); ++ key->tfm = NULL; ++ } + } + } + +-- +2.20.1 + diff --git a/queue-5.2/net-aquantia-fix-out-of-memory-condition-on-rx-side.patch b/queue-5.2/net-aquantia-fix-out-of-memory-condition-on-rx-side.patch new file mode 100644 index 00000000000..da95c705df0 --- /dev/null +++ b/queue-5.2/net-aquantia-fix-out-of-memory-condition-on-rx-side.patch @@ -0,0 +1,59 @@ +From 0f922cc60ce921a0ae0eb96543a7a678f615ad45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 12:08:38 +0000 +Subject: net: aquantia: fix out of memory condition on rx side + +From: Dmitry Bogdanov + +[ Upstream commit be6cef69ba570ebb327eba1ef6438f7af49aaf86 ] + +On embedded environments with hard memory limits it is a normal although +rare case when skb can't be allocated on rx part under high traffic. + +In such OOM cases napi_complete_done() was not called. +So the napi object became in an invalid state like it is "scheduled". +Kernel do not re-schedules the poll of that napi object. + +Consequently, kernel can not remove that object the system hangs on +`ifconfig down` waiting for a poll. + +We are fixing this by gracefully closing napi poll routine with correct +invocation of napi_complete_done. + +This was reproduced with artificially failing the allocation of skb to +simulate an "out of memory" error case and check that traffic does +not get stuck. + +Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations") +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c +index 715685aa48c39..28892b8acd0e1 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c +@@ -86,6 +86,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget) + } + } + ++err_exit: + if (!was_tx_cleaned) + work_done = budget; + +@@ -95,7 +96,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget) + 1U << self->aq_ring_param.vec_idx); + } + } +-err_exit: ++ + return work_done; + } + +-- +2.20.1 + diff --git a/queue-5.2/net-aquantia-fix-removal-of-vlan-0.patch b/queue-5.2/net-aquantia-fix-removal-of-vlan-0.patch new file mode 100644 index 00000000000..274b14d170f --- /dev/null +++ b/queue-5.2/net-aquantia-fix-removal-of-vlan-0.patch @@ -0,0 +1,38 @@ +From 5be679252241766eb4657b0d856e451b9bad370d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 12:08:30 +0000 +Subject: net: aquantia: fix removal of vlan 0 + +From: Dmitry Bogdanov + +[ Upstream commit 6fdc060d7476ef73c8029b652d252c1a7b4de948 ] + +Due to absence of checking against the rx flow rule when vlan 0 is being +removed, the other rule could be removed instead of the rule with vlan 0 + +Fixes: 7975d2aff5afb ("net: aquantia: add support of rx-vlan-filter offload") +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_filters.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c +index 2c1111a7fc435..3dbf3ff1c4506 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c +@@ -431,7 +431,8 @@ int aq_del_fvlan_by_vlan(struct aq_nic_s *aq_nic, u16 vlan_id) + if (be16_to_cpu(rule->aq_fsp.h_ext.vlan_tci) == vlan_id) + break; + } +- if (rule && be16_to_cpu(rule->aq_fsp.h_ext.vlan_tci) == vlan_id) { ++ if (rule && rule->type == aq_rx_filter_vlan && ++ be16_to_cpu(rule->aq_fsp.h_ext.vlan_tci) == vlan_id) { + struct ethtool_rxnfc cmd; + + cmd.fs.location = rule->aq_fsp.location; +-- +2.20.1 + diff --git a/queue-5.2/net-aquantia-linkstate-irq-should-be-oneshot.patch b/queue-5.2/net-aquantia-linkstate-irq-should-be-oneshot.patch new file mode 100644 index 00000000000..f424a8321f0 --- /dev/null +++ b/queue-5.2/net-aquantia-linkstate-irq-should-be-oneshot.patch @@ -0,0 +1,47 @@ +From 1fe1413d856108e5a3361d4692d83ef6c52a5a3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 12:08:36 +0000 +Subject: net: aquantia: linkstate irq should be oneshot + +From: Igor Russkikh + +[ Upstream commit 5c47e3ba6fe52465603cf9d816b3371e6881d649 ] + +Declaring threaded irq handler should also indicate the irq is +oneshot. It is oneshot indeed, because HW implements irq automasking +on trigger. + +Not declaring this causes some kernel configurations to fail +on interface up, because request_threaded_irq returned an err code. + +The issue was originally hidden on normal x86_64 configuration with +latest kernel, because depending on interrupt controller, irq driver +added ONESHOT flag on its own. + +Issue was observed on older kernels (4.14) where no such logic exists. + +Fixes: 4c83f170b3ac ("net: aquantia: link status irq handling") +Signed-off-by: Igor Russkikh +Reported-by: Michael Symolkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 41172fbebddd3..1a2b090652930 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -390,7 +390,7 @@ int aq_nic_start(struct aq_nic_s *self) + self->aq_nic_cfg.link_irq_vec); + err = request_threaded_irq(irqvec, NULL, + aq_linkstate_threaded_isr, +- IRQF_SHARED, ++ IRQF_SHARED | IRQF_ONESHOT, + self->ndev->name, self); + if (err < 0) + goto err_exit; +-- +2.20.1 + diff --git a/queue-5.2/net-aquantia-reapply-vlan-filters-on-up.patch b/queue-5.2/net-aquantia-reapply-vlan-filters-on-up.patch new file mode 100644 index 00000000000..f54f30133a0 --- /dev/null +++ b/queue-5.2/net-aquantia-reapply-vlan-filters-on-up.patch @@ -0,0 +1,41 @@ +From 6ab462d4a17af28bc73095551fe97cb0e17fa3a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 12:08:35 +0000 +Subject: net: aquantia: reapply vlan filters on up + +From: Dmitry Bogdanov + +[ Upstream commit c2ef057ee775e229d3138add59f937d93a3a59d8 ] + +In case of device reconfiguration the driver may reset the device invisible +for other modules, vlan module in particular. So vlans will not be +removed&created and vlan filters will not be configured in the device. +The patch reapplies the vlan filters at device start. + +Fixes: 7975d2aff5afb ("net: aquantia: add support of rx-vlan-filter offload") +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index 5315df5ff6f83..4ebf083c51c5f 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -61,6 +61,10 @@ static int aq_ndev_open(struct net_device *ndev) + if (err < 0) + goto err_exit; + ++ err = aq_filters_vlans_update(aq_nic); ++ if (err < 0) ++ goto err_exit; ++ + err = aq_nic_start(aq_nic); + if (err < 0) + goto err_exit; +-- +2.20.1 + diff --git a/queue-5.2/net-dsa-microchip-add-ksz8563-compatibility-string.patch b/queue-5.2/net-dsa-microchip-add-ksz8563-compatibility-string.patch new file mode 100644 index 00000000000..9f815a23625 --- /dev/null +++ b/queue-5.2/net-dsa-microchip-add-ksz8563-compatibility-string.patch @@ -0,0 +1,33 @@ +From 96591fcc8e49913c5defe51720670a551cfdc582 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 10:52:02 +0300 +Subject: net: dsa: microchip: add KSZ8563 compatibility string + +From: Razvan Stefanescu + +[ Upstream commit d9033ae95cf445150fcc5856ccf024f41f0bd0b9 ] + +It is a 3-Port 10/100 Ethernet Switch with 1588v2 PTP. + +Signed-off-by: Razvan Stefanescu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477_spi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/microchip/ksz9477_spi.c b/drivers/net/dsa/microchip/ksz9477_spi.c +index 75178624d3f56..fb15f255a1db4 100644 +--- a/drivers/net/dsa/microchip/ksz9477_spi.c ++++ b/drivers/net/dsa/microchip/ksz9477_spi.c +@@ -157,6 +157,7 @@ static const struct of_device_id ksz9477_dt_ids[] = { + { .compatible = "microchip,ksz9897" }, + { .compatible = "microchip,ksz9893" }, + { .compatible = "microchip,ksz9563" }, ++ { .compatible = "microchip,ksz8563" }, + {}, + }; + MODULE_DEVICE_TABLE(of, ksz9477_dt_ids); +-- +2.20.1 + diff --git a/queue-5.2/net-seeq-fix-the-function-used-to-release-some-memor.patch b/queue-5.2/net-seeq-fix-the-function-used-to-release-some-memor.patch new file mode 100644 index 00000000000..8c037a96789 --- /dev/null +++ b/queue-5.2/net-seeq-fix-the-function-used-to-release-some-memor.patch @@ -0,0 +1,56 @@ +From 6a665aa4dca97232ec5eee8bcab6885361ab9f98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Aug 2019 09:17:51 +0200 +Subject: net: seeq: Fix the function used to release some memory in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit e1e54ec7fb55501c33b117c111cb0a045b8eded2 ] + +In commit 99cd149efe82 ("sgiseeq: replace use of dma_cache_wback_inv"), +a call to 'get_zeroed_page()' has been turned into a call to +'dma_alloc_coherent()'. Only the remove function has been updated to turn +the corresponding 'free_page()' into 'dma_free_attrs()'. +The error hndling path of the probe function has not been updated. + +Fix it now. + +Rename the corresponding label to something more in line. + +Fixes: 99cd149efe82 ("sgiseeq: replace use of dma_cache_wback_inv") +Signed-off-by: Christophe JAILLET +Reviewed-by: Thomas Bogendoerfer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/seeq/sgiseeq.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c +index 7a5e6c5abb57b..276c7cae7ceeb 100644 +--- a/drivers/net/ethernet/seeq/sgiseeq.c ++++ b/drivers/net/ethernet/seeq/sgiseeq.c +@@ -794,15 +794,16 @@ static int sgiseeq_probe(struct platform_device *pdev) + printk(KERN_ERR "Sgiseeq: Cannot register net device, " + "aborting.\n"); + err = -ENODEV; +- goto err_out_free_page; ++ goto err_out_free_attrs; + } + + printk(KERN_INFO "%s: %s %pM\n", dev->name, sgiseeqstr, dev->dev_addr); + + return 0; + +-err_out_free_page: +- free_page((unsigned long) sp->srings); ++err_out_free_attrs: ++ dma_free_attrs(&pdev->dev, sizeof(*sp->srings), sp->srings, ++ sp->srings_dma, DMA_ATTR_NON_CONSISTENT); + err_out_free_dev: + free_netdev(dev); + +-- +2.20.1 + diff --git a/queue-5.2/netfilter-conntrack-make-sysctls-per-namespace-again.patch b/queue-5.2/netfilter-conntrack-make-sysctls-per-namespace-again.patch new file mode 100644 index 00000000000..d2c6ab2ba0a --- /dev/null +++ b/queue-5.2/netfilter-conntrack-make-sysctls-per-namespace-again.patch @@ -0,0 +1,43 @@ +From 04cfcac5430c94329c0cf495ed9997fe1736e11a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 13:24:52 +0200 +Subject: netfilter: conntrack: make sysctls per-namespace again + +From: Florian Westphal + +[ Upstream commit 478553fd1b6f819390b64a2e13ac756c4d1a2836 ] + +When I merged the extension sysctl tables with the main one I forgot to +reset them on netns creation. They currently read/write init_net settings. + +Fixes: d912dec12428 ("netfilter: conntrack: merge acct and helper sysctl table with main one") +Fixes: cb2833ed0044 ("netfilter: conntrack: merge ecache and timestamp sysctl tables with main one") +Reported-by: Shmulik Ladkani +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_standalone.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index e0d392cb3075a..0006503d2da97 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -1037,8 +1037,13 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net) + table[NF_SYSCTL_CT_COUNT].data = &net->ct.count; + table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum; + table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid; ++ table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct; ++ table[NF_SYSCTL_CT_HELPER].data = &net->ct.sysctl_auto_assign_helper; + #ifdef CONFIG_NF_CONNTRACK_EVENTS + table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events; ++#endif ++#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP ++ table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp; + #endif + table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout; + table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout; +-- +2.20.1 + diff --git a/queue-5.2/netfilter-ebtables-fix-argument-order-to-add_counter.patch b/queue-5.2/netfilter-ebtables-fix-argument-order-to-add_counter.patch new file mode 100644 index 00000000000..db6e70a81a0 --- /dev/null +++ b/queue-5.2/netfilter-ebtables-fix-argument-order-to-add_counter.patch @@ -0,0 +1,60 @@ +From 7c81573d4d6fc5544309d186effed31e7aff1ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2019 10:54:16 -0400 +Subject: netfilter: ebtables: Fix argument order to ADD_COUNTER + +From: Todd Seidelmann + +[ Upstream commit f20faa06d83de440bec8e200870784c3458793c4 ] + +The ordering of arguments to the x_tables ADD_COUNTER macro +appears to be wrong in ebtables (cf. ip_tables.c, ip6_tables.c, +and arp_tables.c). + +This causes data corruption in the ebtables userspace tools +because they get incorrect packet & byte counts from the kernel. + +Fixes: d72133e628803 ("netfilter: ebtables: use ADD_COUNTER macro") +Signed-off-by: Todd Seidelmann +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebtables.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index c8177a89f52c3..4096d8a74a2bd 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -221,7 +221,7 @@ unsigned int ebt_do_table(struct sk_buff *skb, + return NF_DROP; + } + +- ADD_COUNTER(*(counter_base + i), 1, skb->len); ++ ADD_COUNTER(*(counter_base + i), skb->len, 1); + + /* these should only watch: not modify, nor tell us + * what to do with the packet +@@ -959,8 +959,8 @@ static void get_counters(const struct ebt_counter *oldcounters, + continue; + counter_base = COUNTER_BASE(oldcounters, nentries, cpu); + for (i = 0; i < nentries; i++) +- ADD_COUNTER(counters[i], counter_base[i].pcnt, +- counter_base[i].bcnt); ++ ADD_COUNTER(counters[i], counter_base[i].bcnt, ++ counter_base[i].pcnt); + } + } + +@@ -1280,7 +1280,7 @@ static int do_update_counters(struct net *net, const char *name, + + /* we add to the counters of the first cpu */ + for (i = 0; i < num_counters; i++) +- ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); ++ ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt); + + write_unlock_bh(&t->lock); + ret = 0; +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nf_conntrack_ftp-fix-debug-output.patch b/queue-5.2/netfilter-nf_conntrack_ftp-fix-debug-output.patch new file mode 100644 index 00000000000..7b65ac37f6f --- /dev/null +++ b/queue-5.2/netfilter-nf_conntrack_ftp-fix-debug-output.patch @@ -0,0 +1,47 @@ +From 02d4b998bc1a008124cab310f2d35737d513fb5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 16:14:28 +0200 +Subject: netfilter: nf_conntrack_ftp: Fix debug output + +From: Thomas Jarosch + +[ Upstream commit 3a069024d371125227de3ac8fa74223fcf473520 ] + +The find_pattern() debug output was printing the 'skip' character. +This can be a NULL-byte and messes up further pr_debug() output. + +Output without the fix: +kernel: nf_conntrack_ftp: Pattern matches! +kernel: nf_conntrack_ftp: Skipped up to `<7>nf_conntrack_ftp: find_pattern `PORT': dlen = 8 +kernel: nf_conntrack_ftp: find_pattern `EPRT': dlen = 8 + +Output with the fix: +kernel: nf_conntrack_ftp: Pattern matches! +kernel: nf_conntrack_ftp: Skipped up to 0x0 delimiter! +kernel: nf_conntrack_ftp: Match succeeded! +kernel: nf_conntrack_ftp: conntrack_ftp: match `172,17,0,100,200,207' (20 bytes at 4150681645) +kernel: nf_conntrack_ftp: find_pattern `PORT': dlen = 8 + +Signed-off-by: Thomas Jarosch +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_ftp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c +index 8c6c11bab5b67..b5df6c4c159cd 100644 +--- a/net/netfilter/nf_conntrack_ftp.c ++++ b/net/netfilter/nf_conntrack_ftp.c +@@ -322,7 +322,7 @@ static int find_pattern(const char *data, size_t dlen, + i++; + } + +- pr_debug("Skipped up to `%c'!\n", skip); ++ pr_debug("Skipped up to 0x%hhx delimiter!\n", skip); + + *numoff = i; + *numlen = getnum(data + i, dlen - i, cmd, term, numoff); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nf_flow_table-clear-skb-tstamp-before-xmit.patch b/queue-5.2/netfilter-nf_flow_table-clear-skb-tstamp-before-xmit.patch new file mode 100644 index 00000000000..cbd5526fbe7 --- /dev/null +++ b/queue-5.2/netfilter-nf_flow_table-clear-skb-tstamp-before-xmit.patch @@ -0,0 +1,51 @@ +From 89acc754ae6daead2f5bd1094932d2375e23220d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 21:23:45 +0200 +Subject: netfilter: nf_flow_table: clear skb tstamp before xmit + +From: Florian Westphal + +[ Upstream commit de20900fbe1c4fd36de25a7a5a43223254ecf0d0 ] + +If 'fq' qdisc is used and a program has requested timestamps, +skb->tstamp needs to be cleared, else fq will treat these as +'transmit time'. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_flow_table_ip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c +index d68c801dd614b..b9e7dd6e60ce2 100644 +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -228,7 +228,6 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb, + { + skb_orphan(skb); + skb_dst_set_noref(skb, dst); +- skb->tstamp = 0; + dst_output(state->net, state->sk, skb); + return NF_STOLEN; + } +@@ -284,6 +283,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; + iph = ip_hdr(skb); + ip_decrease_ttl(iph); ++ skb->tstamp = 0; + + if (unlikely(dst_xfrm(&rt->dst))) { + memset(skb->cb, 0, sizeof(struct inet_skb_parm)); +@@ -512,6 +512,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; + ip6h = ipv6_hdr(skb); + ip6h->hop_limit--; ++ skb->tstamp = 0; + + if (unlikely(dst_xfrm(&rt->dst))) { + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nft_flow_offload-missing-netlink-attribute.patch b/queue-5.2/netfilter-nft_flow_offload-missing-netlink-attribute.patch new file mode 100644 index 00000000000..024d7fab047 --- /dev/null +++ b/queue-5.2/netfilter-nft_flow_offload-missing-netlink-attribute.patch @@ -0,0 +1,45 @@ +From a8a06871f175b3345d6be7840eab651eccaad9a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 11:23:58 +0200 +Subject: netfilter: nft_flow_offload: missing netlink attribute policy + +From: Pablo Neira Ayuso + +[ Upstream commit 14c415862c0630e01712a4eeaf6159a2b1b6d2a4 ] + +The netlink attribute policy for NFTA_FLOW_TABLE_NAME is missing. + +Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 060a4ed46d5e6..01705ad74a9aa 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -149,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx, + return nft_chain_validate_hooks(ctx->chain, hook_mask); + } + ++static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = { ++ [NFTA_FLOW_TABLE_NAME] = { .type = NLA_STRING, ++ .len = NFT_NAME_MAXLEN - 1 }, ++}; ++ + static int nft_flow_offload_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -207,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = { + static struct nft_expr_type nft_flow_offload_type __read_mostly = { + .name = "flow_offload", + .ops = &nft_flow_offload_ops, ++ .policy = nft_flow_offload_policy, + .maxattr = NFTA_FLOW_MAX, + .owner = THIS_MODULE, + }; +-- +2.20.1 + diff --git a/queue-5.2/netfilter-xt_nfacct-fix-alignment-mismatch-in-xt_nfa.patch b/queue-5.2/netfilter-xt_nfacct-fix-alignment-mismatch-in-xt_nfa.patch new file mode 100644 index 00000000000..4ad0988a3e2 --- /dev/null +++ b/queue-5.2/netfilter-xt_nfacct-fix-alignment-mismatch-in-xt_nfa.patch @@ -0,0 +1,107 @@ +From 5ae21e0dcf40ee9d72cfb268c08277fa307537de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 17:02:22 +0200 +Subject: netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info + +From: Juliana Rodrigueiro + +[ Upstream commit 89a26cd4b501e9511d3cd3d22327fc76a75a38b3 ] + +When running a 64-bit kernel with a 32-bit iptables binary, the size of +the xt_nfacct_match_info struct diverges. + + kernel: sizeof(struct xt_nfacct_match_info) : 40 + iptables: sizeof(struct xt_nfacct_match_info)) : 36 + +Trying to append nfacct related rules results in an unhelpful message. +Although it is suggested to look for more information in dmesg, nothing +can be found there. + + # iptables -A -m nfacct --nfacct-name + iptables: Invalid argument. Run `dmesg' for more information. + +This patch fixes the memory misalignment by enforcing 8-byte alignment +within the struct's first revision. This solution is often used in many +other uapi netfilter headers. + +Signed-off-by: Juliana Rodrigueiro +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/xt_nfacct.h | 5 ++++ + net/netfilter/xt_nfacct.c | 36 ++++++++++++++++-------- + 2 files changed, 30 insertions(+), 11 deletions(-) + +diff --git a/include/uapi/linux/netfilter/xt_nfacct.h b/include/uapi/linux/netfilter/xt_nfacct.h +index 5c8a4d760ee34..b5123ab8d54a8 100644 +--- a/include/uapi/linux/netfilter/xt_nfacct.h ++++ b/include/uapi/linux/netfilter/xt_nfacct.h +@@ -11,4 +11,9 @@ struct xt_nfacct_match_info { + struct nf_acct *nfacct; + }; + ++struct xt_nfacct_match_info_v1 { ++ char name[NFACCT_NAME_MAX]; ++ struct nf_acct *nfacct __attribute__((aligned(8))); ++}; ++ + #endif /* _XT_NFACCT_MATCH_H */ +diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c +index d0ab1adf5bff8..5aab6df74e0f2 100644 +--- a/net/netfilter/xt_nfacct.c ++++ b/net/netfilter/xt_nfacct.c +@@ -54,25 +54,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par) + nfnl_acct_put(info->nfacct); + } + +-static struct xt_match nfacct_mt_reg __read_mostly = { +- .name = "nfacct", +- .family = NFPROTO_UNSPEC, +- .checkentry = nfacct_mt_checkentry, +- .match = nfacct_mt, +- .destroy = nfacct_mt_destroy, +- .matchsize = sizeof(struct xt_nfacct_match_info), +- .usersize = offsetof(struct xt_nfacct_match_info, nfacct), +- .me = THIS_MODULE, ++static struct xt_match nfacct_mt_reg[] __read_mostly = { ++ { ++ .name = "nfacct", ++ .revision = 0, ++ .family = NFPROTO_UNSPEC, ++ .checkentry = nfacct_mt_checkentry, ++ .match = nfacct_mt, ++ .destroy = nfacct_mt_destroy, ++ .matchsize = sizeof(struct xt_nfacct_match_info), ++ .usersize = offsetof(struct xt_nfacct_match_info, nfacct), ++ .me = THIS_MODULE, ++ }, ++ { ++ .name = "nfacct", ++ .revision = 1, ++ .family = NFPROTO_UNSPEC, ++ .checkentry = nfacct_mt_checkentry, ++ .match = nfacct_mt, ++ .destroy = nfacct_mt_destroy, ++ .matchsize = sizeof(struct xt_nfacct_match_info_v1), ++ .usersize = offsetof(struct xt_nfacct_match_info_v1, nfacct), ++ .me = THIS_MODULE, ++ }, + }; + + static int __init nfacct_mt_init(void) + { +- return xt_register_match(&nfacct_mt_reg); ++ return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg)); + } + + static void __exit nfacct_mt_exit(void) + { +- xt_unregister_match(&nfacct_mt_reg); ++ xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg)); + } + + module_init(nfacct_mt_init); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-xt_physdev-fix-spurious-error-message-in-p.patch b/queue-5.2/netfilter-xt_physdev-fix-spurious-error-message-in-p.patch new file mode 100644 index 00000000000..db086921e39 --- /dev/null +++ b/queue-5.2/netfilter-xt_physdev-fix-spurious-error-message-in-p.patch @@ -0,0 +1,46 @@ +From facd8734e6e02b238338f4fb7c05c340fa37f922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 11:47:53 -0400 +Subject: netfilter: xt_physdev: Fix spurious error message in physdev_mt_check + +From: Todd Seidelmann + +[ Upstream commit 3cf2f450fff304be9cf4868bf0df17f253bc5b1c ] + +Simplify the check in physdev_mt_check() to emit an error message +only when passed an invalid chain (ie, NF_INET_LOCAL_OUT). +This avoids cluttering up the log with errors against valid rules. + +For large/heavily modified rulesets, current behavior can quickly +overwhelm the ring buffer, because this function gets called on +every change, regardless of the rule that was changed. + +Signed-off-by: Todd Seidelmann +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_physdev.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c +index ead7c60222086..b92b22ce8abd3 100644 +--- a/net/netfilter/xt_physdev.c ++++ b/net/netfilter/xt_physdev.c +@@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) + if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) && + (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) || + info->invert & XT_PHYSDEV_OP_BRIDGED) && +- par->hook_mask & ((1 << NF_INET_LOCAL_OUT) | +- (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) { ++ par->hook_mask & (1 << NF_INET_LOCAL_OUT)) { + pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n"); +- if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) +- return -EINVAL; ++ return -EINVAL; + } + + if (!brnf_probed) { +-- +2.20.1 + diff --git a/queue-5.2/nfs-fix-initialisation-of-i-o-result-struct-in-nfs_p.patch b/queue-5.2/nfs-fix-initialisation-of-i-o-result-struct-in-nfs_p.patch new file mode 100644 index 00000000000..43c447f8206 --- /dev/null +++ b/queue-5.2/nfs-fix-initialisation-of-i-o-result-struct-in-nfs_p.patch @@ -0,0 +1,36 @@ +From 4f10bcb47252d6f020be9e9fb7bfd88af275ff8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2019 14:19:09 -0400 +Subject: NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup + +From: Trond Myklebust + +[ Upstream commit 17d8c5d145000070c581f2a8aa01edc7998582ab ] + +Initialise the result count to 0 rather than initialising it to the +argument count. The reason is that we want to ensure we record the +I/O stats correctly in the case where an error is returned (for +instance in the layoutstats). + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pagelist.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 8b62117532289..eae584dbfa085 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -590,7 +590,7 @@ static void nfs_pgio_rpcsetup(struct nfs_pgio_header *hdr, + } + + hdr->res.fattr = &hdr->fattr; +- hdr->res.count = count; ++ hdr->res.count = 0; + hdr->res.eof = 0; + hdr->res.verf = &hdr->verf; + nfs_fattr_init(&hdr->fattr); +-- +2.20.1 + diff --git a/queue-5.2/nfs-fix-spurious-eio-read-errors.patch b/queue-5.2/nfs-fix-spurious-eio-read-errors.patch new file mode 100644 index 00000000000..bcb839e6da7 --- /dev/null +++ b/queue-5.2/nfs-fix-spurious-eio-read-errors.patch @@ -0,0 +1,172 @@ +From 7daf0494bf261ae9b34c08b46962acc63f7a84c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 12:26:05 -0400 +Subject: NFS: Fix spurious EIO read errors + +From: Trond Myklebust + +[ Upstream commit 8f54c7a4babf58bbaf849e126f7ae9664bdc9e04 ] + +If the client attempts to read a page, but the read fails due to some +spurious error (e.g. an ACCESS error or a timeout, ...) then we need +to allow other processes to retry. +Also try to report errors correctly when doing a synchronous readpage. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/internal.h | 10 ++++++++++ + fs/nfs/read.c | 35 ++++++++++++++++++++++++++--------- + fs/nfs/write.c | 12 ------------ + 3 files changed, 36 insertions(+), 21 deletions(-) + +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index 81e2fdff227ed..9ab9427405f3f 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -773,3 +773,13 @@ static inline bool nfs_error_is_fatal(int err) + } + } + ++static inline bool nfs_error_is_fatal_on_server(int err) ++{ ++ switch (err) { ++ case 0: ++ case -ERESTARTSYS: ++ case -EINTR: ++ return false; ++ } ++ return nfs_error_is_fatal(err); ++} +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index c19841c82b6a3..cfe0b586eadd4 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -91,19 +91,25 @@ void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio) + } + EXPORT_SYMBOL_GPL(nfs_pageio_reset_read_mds); + +-static void nfs_readpage_release(struct nfs_page *req) ++static void nfs_readpage_release(struct nfs_page *req, int error) + { + struct inode *inode = d_inode(nfs_req_openctx(req)->dentry); ++ struct page *page = req->wb_page; + + dprintk("NFS: read done (%s/%llu %d@%lld)\n", inode->i_sb->s_id, + (unsigned long long)NFS_FILEID(inode), req->wb_bytes, + (long long)req_offset(req)); + ++ if (nfs_error_is_fatal_on_server(error) && error != -ETIMEDOUT) ++ SetPageError(page); + if (nfs_page_group_sync_on_bit(req, PG_UNLOCKPAGE)) { +- if (PageUptodate(req->wb_page)) +- nfs_readpage_to_fscache(inode, req->wb_page, 0); ++ struct address_space *mapping = page_file_mapping(page); + +- unlock_page(req->wb_page); ++ if (PageUptodate(page)) ++ nfs_readpage_to_fscache(inode, page, 0); ++ else if (!PageError(page) && !PagePrivate(page)) ++ generic_error_remove_page(mapping, page); ++ unlock_page(page); + } + nfs_release_request(req); + } +@@ -131,7 +137,7 @@ int nfs_readpage_async(struct nfs_open_context *ctx, struct inode *inode, + &nfs_async_read_completion_ops); + if (!nfs_pageio_add_request(&pgio, new)) { + nfs_list_remove_request(new); +- nfs_readpage_release(new); ++ nfs_readpage_release(new, pgio.pg_error); + } + nfs_pageio_complete(&pgio); + +@@ -153,6 +159,7 @@ static void nfs_page_group_set_uptodate(struct nfs_page *req) + static void nfs_read_completion(struct nfs_pgio_header *hdr) + { + unsigned long bytes = 0; ++ int error; + + if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) + goto out; +@@ -179,14 +186,19 @@ static void nfs_read_completion(struct nfs_pgio_header *hdr) + zero_user_segment(page, start, end); + } + } ++ error = 0; + bytes += req->wb_bytes; + if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) { + if (bytes <= hdr->good_bytes) + nfs_page_group_set_uptodate(req); ++ else { ++ error = hdr->error; ++ xchg(&nfs_req_openctx(req)->error, error); ++ } + } else + nfs_page_group_set_uptodate(req); + nfs_list_remove_request(req); +- nfs_readpage_release(req); ++ nfs_readpage_release(req, error); + } + out: + hdr->release(hdr); +@@ -213,7 +225,7 @@ nfs_async_read_error(struct list_head *head, int error) + while (!list_empty(head)) { + req = nfs_list_entry(head->next); + nfs_list_remove_request(req); +- nfs_readpage_release(req); ++ nfs_readpage_release(req, error); + } + } + +@@ -337,8 +349,13 @@ int nfs_readpage(struct file *file, struct page *page) + goto out; + } + ++ xchg(&ctx->error, 0); + error = nfs_readpage_async(ctx, inode, page); +- ++ if (!error) { ++ error = wait_on_page_locked_killable(page); ++ if (!PageUptodate(page) && !error) ++ error = xchg(&ctx->error, 0); ++ } + out: + put_nfs_open_context(ctx); + return error; +@@ -372,8 +389,8 @@ readpage_async_filler(void *data, struct page *page) + zero_user_segment(page, len, PAGE_SIZE); + if (!nfs_pageio_add_request(desc->pgio, new)) { + nfs_list_remove_request(new); +- nfs_readpage_release(new); + error = desc->pgio->pg_error; ++ nfs_readpage_release(new, error); + goto out; + } + return 0; +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index bf3a3f5e1884e..f15dda5efb741 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -599,18 +599,6 @@ static void nfs_write_error(struct nfs_page *req, int error) + nfs_release_request(req); + } + +-static bool +-nfs_error_is_fatal_on_server(int err) +-{ +- switch (err) { +- case 0: +- case -ERESTARTSYS: +- case -EINTR: +- return false; +- } +- return nfs_error_is_fatal(err); +-} +- + /* + * Find an associated nfs write request, and prepare to flush it out + * May return an error if the user signalled nfs_wait_on_request(). +-- +2.20.1 + diff --git a/queue-5.2/nfs-fix-writepage-s-error-handling-to-not-report-err.patch b/queue-5.2/nfs-fix-writepage-s-error-handling-to-not-report-err.patch new file mode 100644 index 00000000000..840361e1664 --- /dev/null +++ b/queue-5.2/nfs-fix-writepage-s-error-handling-to-not-report-err.patch @@ -0,0 +1,108 @@ +From c74eff689d66317b4a9919872cf80e0a27d51a10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Aug 2019 10:39:00 -0400 +Subject: NFS: Fix writepage(s) error handling to not report errors twice + +From: Trond Myklebust + +[ Upstream commit 96c4145599b30c0eb6cbeaa24207802452dd1872 ] + +If writepage()/writepages() saw an error, but handled it without +reporting it, we should not be re-reporting that error on exit. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index f15dda5efb741..0d6d7beb85053 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -621,12 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio, + WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags)); + + /* If there is a fatal error that covers this write, just exit */ +- ret = 0; + mapping = page_file_mapping(page); +- if (test_bit(AS_ENOSPC, &mapping->flags) || +- test_bit(AS_EIO, &mapping->flags)) ++ ret = pgio->pg_error; ++ if (nfs_error_is_fatal_on_server(ret)) + goto out_launder; + ++ ret = 0; + if (!nfs_pageio_add_request(pgio, req)) { + ret = pgio->pg_error; + /* +@@ -638,6 +638,7 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio, + } else + ret = -EAGAIN; + nfs_redirty_request(req); ++ pgio->pg_error = 0; + } else + nfs_add_stats(page_file_mapping(page)->host, + NFSIOS_WRITEPAGES, 1); +@@ -657,7 +658,7 @@ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, + ret = nfs_page_async_flush(pgio, page); + if (ret == -EAGAIN) { + redirty_page_for_writepage(wbc, page); +- ret = 0; ++ ret = AOP_WRITEPAGE_ACTIVATE; + } + return ret; + } +@@ -676,10 +677,11 @@ static int nfs_writepage_locked(struct page *page, + nfs_pageio_init_write(&pgio, inode, 0, + false, &nfs_async_write_completion_ops); + err = nfs_do_writepage(page, wbc, &pgio); ++ pgio.pg_error = 0; + nfs_pageio_complete(&pgio); + if (err < 0) + return err; +- if (pgio.pg_error < 0) ++ if (nfs_error_is_fatal(pgio.pg_error)) + return pgio.pg_error; + return 0; + } +@@ -689,7 +691,8 @@ int nfs_writepage(struct page *page, struct writeback_control *wbc) + int ret; + + ret = nfs_writepage_locked(page, wbc); +- unlock_page(page); ++ if (ret != AOP_WRITEPAGE_ACTIVATE) ++ unlock_page(page); + return ret; + } + +@@ -698,7 +701,8 @@ static int nfs_writepages_callback(struct page *page, struct writeback_control * + int ret; + + ret = nfs_do_writepage(page, wbc, data); +- unlock_page(page); ++ if (ret != AOP_WRITEPAGE_ACTIVATE) ++ unlock_page(page); + return ret; + } + +@@ -725,6 +729,7 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc) + &nfs_async_write_completion_ops); + pgio.pg_io_completion = ioc; + err = write_cache_pages(mapping, wbc, nfs_writepages_callback, &pgio); ++ pgio.pg_error = 0; + nfs_pageio_complete(&pgio); + nfs_io_completion_put(ioc); + +@@ -733,7 +738,7 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc) + if (err < 0) + goto out_err; + err = pgio.pg_error; +- if (err < 0) ++ if (nfs_error_is_fatal(err)) + goto out_err; + return 0; + out_err: +-- +2.20.1 + diff --git a/queue-5.2/nfs-on-fatal-writeback-errors-we-need-to-call-nfs_in.patch b/queue-5.2/nfs-on-fatal-writeback-errors-we-need-to-call-nfs_in.patch new file mode 100644 index 00000000000..5e3a65b600d --- /dev/null +++ b/queue-5.2/nfs-on-fatal-writeback-errors-we-need-to-call-nfs_in.patch @@ -0,0 +1,45 @@ +From 1b1160b9a4063b4c02866916e18d9cdbc5b3c01d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2019 15:42:43 -0400 +Subject: NFS: On fatal writeback errors, we need to call + nfs_inode_remove_request() + +From: Trond Myklebust + +[ Upstream commit 06c9fdf3b9f1acc6e53753c99c54c39764cc979f ] + +If the writeback error is fatal, we need to remove the tracking structures +(i.e. the nfs_page) from the inode. + +Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 059a7c38bc4fc..bf3a3f5e1884e 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -57,6 +57,7 @@ static const struct rpc_call_ops nfs_commit_ops; + static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops; + static const struct nfs_commit_completion_ops nfs_commit_completion_ops; + static const struct nfs_rw_ops nfs_rw_write_ops; ++static void nfs_inode_remove_request(struct nfs_page *req); + static void nfs_clear_request_commit(struct nfs_page *req); + static void nfs_init_cinfo_from_inode(struct nfs_commit_info *cinfo, + struct inode *inode); +@@ -591,7 +592,9 @@ release_request: + + static void nfs_write_error(struct nfs_page *req, int error) + { ++ nfs_set_pageerror(page_file_mapping(req->wb_page)); + nfs_mapping_set_error(req->wb_page, error); ++ nfs_inode_remove_request(req); + nfs_end_page_writeback(req); + nfs_release_request(req); + } +-- +2.20.1 + diff --git a/queue-5.2/nfs-remove-set-but-not-used-variable-mapping.patch b/queue-5.2/nfs-remove-set-but-not-used-variable-mapping.patch new file mode 100644 index 00000000000..09c27a418ad --- /dev/null +++ b/queue-5.2/nfs-remove-set-but-not-used-variable-mapping.patch @@ -0,0 +1,48 @@ +From fd9413bc179da16519d7129732df29f0162ed5a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 15:16:36 +0800 +Subject: NFS: remove set but not used variable 'mapping' + +From: YueHaibing + +[ Upstream commit 99300a85260c2b7febd57082a617d1062532067e ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +fs/nfs/write.c: In function nfs_page_async_flush: +fs/nfs/write.c:609:24: warning: variable mapping set but not used [-Wunused-but-set-variable] + +It is not use since commit aefb623c422e ("NFS: Fix +writepage(s) error handling to not report errors twice") + +Reported-by: Hulk Robot +Signed-off-by: YueHaibing +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 0d6d7beb85053..ee6932c9819e0 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -606,7 +606,6 @@ static void nfs_write_error(struct nfs_page *req, int error) + static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio, + struct page *page) + { +- struct address_space *mapping; + struct nfs_page *req; + int ret = 0; + +@@ -621,7 +620,6 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio, + WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags)); + + /* If there is a fatal error that covers this write, just exit */ +- mapping = page_file_mapping(page); + ret = pgio->pg_error; + if (nfs_error_is_fatal_on_server(ret)) + goto out_launder; +-- +2.20.1 + diff --git a/queue-5.2/nfsv2-fix-eof-handling.patch b/queue-5.2/nfsv2-fix-eof-handling.patch new file mode 100644 index 00000000000..d911db11d35 --- /dev/null +++ b/queue-5.2/nfsv2-fix-eof-handling.patch @@ -0,0 +1,35 @@ +From 668454077e67148b1f92c3dc7778c28e4f7bc3ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 20:41:16 -0400 +Subject: NFSv2: Fix eof handling + +From: Trond Myklebust + +[ Upstream commit 71affe9be45a5c60b9772e1b2701710712637274 ] + +If we received a reply from the server with a zero length read and +no error, then that implies we are at eof. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c +index 5552fa8b6e128..ec79d2214a78c 100644 +--- a/fs/nfs/proc.c ++++ b/fs/nfs/proc.c +@@ -594,7 +594,8 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) + /* Emulate the eof flag, which isn't normally needed in NFSv2 + * as it is guaranteed to always return the file attributes + */ +- if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size) ++ if ((hdr->res.count == 0 && hdr->args.count > 0) || ++ hdr->args.offset + hdr->res.count >= hdr->res.fattr->size) + hdr->res.eof = 1; + } + return 0; +-- +2.20.1 + diff --git a/queue-5.2/nfsv2-fix-write-regression.patch b/queue-5.2/nfsv2-fix-write-regression.patch new file mode 100644 index 00000000000..6f7dbb0a110 --- /dev/null +++ b/queue-5.2/nfsv2-fix-write-regression.patch @@ -0,0 +1,40 @@ +From f94ece81b4ee2dce2394e4e9ee522e71812e7721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 07:03:28 -0400 +Subject: NFSv2: Fix write regression + +From: Trond Myklebust + +[ Upstream commit d33d4beb522987d1c305c12500796f9be3687dee ] + +Ensure we update the write result count on success, since the +RPC call itself does not do so. + +Reported-by: Jan Stancek +Reported-by: Naresh Kamboju +Signed-off-by: Trond Myklebust +Tested-by: Jan Stancek +Signed-off-by: Sasha Levin +--- + fs/nfs/proc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c +index ec79d2214a78c..0f7288b94633b 100644 +--- a/fs/nfs/proc.c ++++ b/fs/nfs/proc.c +@@ -616,8 +616,10 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task, + + static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr) + { +- if (task->tk_status >= 0) ++ if (task->tk_status >= 0) { ++ hdr->res.count = hdr->args.count; + nfs_writeback_update_inode(hdr); ++ } + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-fix-return-value-in-nfs_finish_open.patch b/queue-5.2/nfsv4-fix-return-value-in-nfs_finish_open.patch new file mode 100644 index 00000000000..8afc55c4281 --- /dev/null +++ b/queue-5.2/nfsv4-fix-return-value-in-nfs_finish_open.patch @@ -0,0 +1,35 @@ +From 1ff09e30f9310b2fabe34da172869fbac5eaf787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 12:15:07 -0400 +Subject: NFSv4: Fix return value in nfs_finish_open() + +From: Trond Myklebust + +[ Upstream commit 9821421a291b548ef4369c6998745baa36ddecd5 ] + +If the file turns out to be of the wrong type after opening, we want +to revalidate the path and retry, so return EOPENSTALE rather than +ESTALE. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 9f44ddc34c7bf..3321cc7a7ead1 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1483,7 +1483,7 @@ static int nfs_finish_open(struct nfs_open_context *ctx, + if (S_ISREG(file->f_path.dentry->d_inode->i_mode)) + nfs_file_set_open_context(file, ctx); + else +- err = -ESTALE; ++ err = -EOPENSTALE; + out: + return err; + } +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-fix-return-values-for-nfs4_file_open.patch b/queue-5.2/nfsv4-fix-return-values-for-nfs4_file_open.patch new file mode 100644 index 00000000000..b5762ce37c7 --- /dev/null +++ b/queue-5.2/nfsv4-fix-return-values-for-nfs4_file_open.patch @@ -0,0 +1,51 @@ +From 31daab2286e52c5f5290a5e24a347ccca0ab089d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2019 15:03:11 -0400 +Subject: NFSv4: Fix return values for nfs4_file_open() + +From: Trond Myklebust + +[ Upstream commit 90cf500e338ab3f3c0f126ba37e36fb6a9058441 ] + +Currently, we are translating RPC level errors such as timeouts, +as well as interrupts etc into EOPENSTALE, which forces a single +replay of the open attempt. What we actually want to do is +force the replay only in the cases where the returned error +indicates that the file may have changed on the server. + +So the fix is to spell out the exact set of errors where we want +to return EOPENSTALE. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4file.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index 52dbd17e401ed..336643b821880 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -73,13 +73,13 @@ nfs4_file_open(struct inode *inode, struct file *filp) + if (IS_ERR(inode)) { + err = PTR_ERR(inode); + switch (err) { +- case -EPERM: +- case -EACCES: +- case -EDQUOT: +- case -ENOSPC: +- case -EROFS: +- goto out_put_ctx; + default: ++ goto out_put_ctx; ++ case -ENOENT: ++ case -ESTALE: ++ case -EISDIR: ++ case -ENOTDIR: ++ case -ELOOP: + goto out_drop; + } + } +-- +2.20.1 + diff --git a/queue-5.2/perf-x86-amd-ibs-fix-sample-bias-for-dispatched-micr.patch b/queue-5.2/perf-x86-amd-ibs-fix-sample-bias-for-dispatched-micr.patch new file mode 100644 index 00000000000..430d001b82f --- /dev/null +++ b/queue-5.2/perf-x86-amd-ibs-fix-sample-bias-for-dispatched-micr.patch @@ -0,0 +1,143 @@ +From fded9dc75cef94e538b031ba9adc73af64d2e70c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 14:57:30 -0500 +Subject: perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops + +From: Kim Phillips + +[ Upstream commit 0f4cd769c410e2285a4e9873a684d90423f03090 ] + +When counting dispatched micro-ops with cnt_ctl=1, in order to prevent +sample bias, IBS hardware preloads the least significant 7 bits of +current count (IbsOpCurCnt) with random values, such that, after the +interrupt is handled and counting resumes, the next sample taken +will be slightly perturbed. + +The current count bitfield is in the IBS execution control h/w register, +alongside the maximum count field. + +Currently, the IBS driver writes that register with the maximum count, +leaving zeroes to fill the current count field, thereby overwriting +the random bits the hardware preloaded for itself. + +Fix the driver to actually retain and carry those random bits from the +read of the IBS control register, through to its write, instead of +overwriting the lower current count bits with zeroes. + +Tested with: + +perf record -c 100001 -e ibs_op/cnt_ctl=1/pp -a -C 0 taskset -c 0 + +'perf annotate' output before: + + 15.70 65: addsd %xmm0,%xmm1 + 17.30 add $0x1,%rax + 15.88 cmp %rdx,%rax + je 82 + 17.32 72: test $0x1,%al + jne 7c + 7.52 movapd %xmm1,%xmm0 + 5.90 jmp 65 + 8.23 7c: sqrtsd %xmm1,%xmm0 + 12.15 jmp 65 + +'perf annotate' output after: + + 16.63 65: addsd %xmm0,%xmm1 + 16.82 add $0x1,%rax + 16.81 cmp %rdx,%rax + je 82 + 16.69 72: test $0x1,%al + jne 7c + 8.30 movapd %xmm1,%xmm0 + 8.13 jmp 65 + 8.24 7c: sqrtsd %xmm1,%xmm0 + 8.39 jmp 65 + +Tested on Family 15h and 17h machines. + +Machines prior to family 10h Rev. C don't have the RDWROPCNT capability, +and have the IbsOpCurCnt bitfield reserved, so this patch shouldn't +affect their operation. + +It is unknown why commit db98c5faf8cb ("perf/x86: Implement 64-bit +counter support for IBS") ignored the lower 4 bits of the IbsOpCurCnt +field; the number of preloaded random bits has always been 7, AFAICT. + +Signed-off-by: Kim Phillips +Signed-off-by: Peter Zijlstra (Intel) +Cc: "Arnaldo Carvalho de Melo" +Cc: +Cc: Ingo Molnar +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Thomas Gleixner +Cc: "Borislav Petkov" +Cc: Stephane Eranian +Cc: Alexander Shishkin +Cc: "Namhyung Kim" +Cc: "H. Peter Anvin" +Link: https://lkml.kernel.org/r/20190826195730.30614-1-kim.phillips@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/ibs.c | 13 ++++++++++--- + arch/x86/include/asm/perf_event.h | 12 ++++++++---- + 2 files changed, 18 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c +index 62f317c9113af..5b35b7ea5d728 100644 +--- a/arch/x86/events/amd/ibs.c ++++ b/arch/x86/events/amd/ibs.c +@@ -661,10 +661,17 @@ fail: + + throttle = perf_event_overflow(event, &data, ®s); + out: +- if (throttle) ++ if (throttle) { + perf_ibs_stop(event, 0); +- else +- perf_ibs_enable_event(perf_ibs, hwc, period >> 4); ++ } else { ++ period >>= 4; ++ ++ if ((ibs_caps & IBS_CAPS_RDWROPCNT) && ++ (*config & IBS_OP_CNT_CTL)) ++ period |= *config & IBS_OP_CUR_CNT_RAND; ++ ++ perf_ibs_enable_event(perf_ibs, hwc, period); ++ } + + perf_event_update_userpage(event); + +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index 1392d5e6e8d67..ee26e9215f187 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -252,16 +252,20 @@ struct pebs_lbr { + #define IBSCTL_LVT_OFFSET_VALID (1ULL<<8) + #define IBSCTL_LVT_OFFSET_MASK 0x0F + +-/* ibs fetch bits/masks */ ++/* IBS fetch bits/masks */ + #define IBS_FETCH_RAND_EN (1ULL<<57) + #define IBS_FETCH_VAL (1ULL<<49) + #define IBS_FETCH_ENABLE (1ULL<<48) + #define IBS_FETCH_CNT 0xFFFF0000ULL + #define IBS_FETCH_MAX_CNT 0x0000FFFFULL + +-/* ibs op bits/masks */ +-/* lower 4 bits of the current count are ignored: */ +-#define IBS_OP_CUR_CNT (0xFFFF0ULL<<32) ++/* ++ * IBS op bits/masks ++ * The lower 7 bits of the current count are random bits ++ * preloaded by hardware and ignored in software ++ */ ++#define IBS_OP_CUR_CNT (0xFFF80ULL<<32) ++#define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32) + #define IBS_OP_CNT_CTL (1ULL<<19) + #define IBS_OP_VAL (1ULL<<18) + #define IBS_OP_ENABLE (1ULL<<17) +-- +2.20.1 + diff --git a/queue-5.2/perf-x86-intel-restrict-period-on-nehalem.patch b/queue-5.2/perf-x86-intel-restrict-period-on-nehalem.patch new file mode 100644 index 00000000000..8c04a495c7d --- /dev/null +++ b/queue-5.2/perf-x86-intel-restrict-period-on-nehalem.patch @@ -0,0 +1,94 @@ +From 608feb987b44a416528a5c8d854d95122b8fce68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 19:13:31 -0400 +Subject: perf/x86/intel: Restrict period on Nehalem + +From: Josh Hunt + +[ Upstream commit 44d3bbb6f5e501b873218142fe08cdf62a4ac1f3 ] + +We see our Nehalem machines reporting 'perfevents: irq loop stuck!' in +some cases when using perf: + +perfevents: irq loop stuck! +WARNING: CPU: 0 PID: 3485 at arch/x86/events/intel/core.c:2282 intel_pmu_handle_irq+0x37b/0x530 +... +RIP: 0010:intel_pmu_handle_irq+0x37b/0x530 +... +Call Trace: + +? perf_event_nmi_handler+0x2e/0x50 +? intel_pmu_save_and_restart+0x50/0x50 +perf_event_nmi_handler+0x2e/0x50 +nmi_handle+0x6e/0x120 +default_do_nmi+0x3e/0x100 +do_nmi+0x102/0x160 +end_repeat_nmi+0x16/0x50 +... +? native_write_msr+0x6/0x20 +? native_write_msr+0x6/0x20 + +intel_pmu_enable_event+0x1ce/0x1f0 +x86_pmu_start+0x78/0xa0 +x86_pmu_enable+0x252/0x310 +__perf_event_task_sched_in+0x181/0x190 +? __switch_to_asm+0x41/0x70 +? __switch_to_asm+0x35/0x70 +? __switch_to_asm+0x41/0x70 +? __switch_to_asm+0x35/0x70 +finish_task_switch+0x158/0x260 +__schedule+0x2f6/0x840 +? hrtimer_start_range_ns+0x153/0x210 +schedule+0x32/0x80 +schedule_hrtimeout_range_clock+0x8a/0x100 +? hrtimer_init+0x120/0x120 +ep_poll+0x2f7/0x3a0 +? wake_up_q+0x60/0x60 +do_epoll_wait+0xa9/0xc0 +__x64_sys_epoll_wait+0x1a/0x20 +do_syscall_64+0x4e/0x110 +entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x7fdeb1e96c03 +... +Signed-off-by: Peter Zijlstra (Intel) +Cc: acme@kernel.org +Cc: Josh Hunt +Cc: bpuranda@akamai.com +Cc: mingo@redhat.com +Cc: jolsa@redhat.com +Cc: tglx@linutronix.de +Cc: namhyung@kernel.org +Cc: alexander.shishkin@linux.intel.com +Link: https://lkml.kernel.org/r/1566256411-18820-1-git-send-email-johunt@akamai.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 6179be624f357..2369ea1a1db79 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3572,6 +3572,11 @@ static u64 bdw_limit_period(struct perf_event *event, u64 left) + return left; + } + ++static u64 nhm_limit_period(struct perf_event *event, u64 left) ++{ ++ return max(left, 32ULL); ++} ++ + PMU_FORMAT_ATTR(event, "config:0-7" ); + PMU_FORMAT_ATTR(umask, "config:8-15" ); + PMU_FORMAT_ATTR(edge, "config:18" ); +@@ -4550,6 +4555,7 @@ __init int intel_pmu_init(void) + x86_pmu.pebs_constraints = intel_nehalem_pebs_event_constraints; + x86_pmu.enable_all = intel_pmu_nhm_enable_all; + x86_pmu.extra_regs = intel_nehalem_extra_regs; ++ x86_pmu.limit_period = nhm_limit_period; + + mem_attr = nhm_mem_events_attrs; + +-- +2.20.1 + diff --git a/queue-5.2/pnfs-flexfiles-don-t-time-out-requests-on-hard-mount.patch b/queue-5.2/pnfs-flexfiles-don-t-time-out-requests-on-hard-mount.patch new file mode 100644 index 00000000000..5c931470300 --- /dev/null +++ b/queue-5.2/pnfs-flexfiles-don-t-time-out-requests-on-hard-mount.patch @@ -0,0 +1,69 @@ +From 0eb5978fbab0e218d7729aa4d8f2abfc4c8cd1ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2019 08:37:50 -0400 +Subject: pNFS/flexfiles: Don't time out requests on hard mounts + +From: Trond Myklebust + +[ Upstream commit 7af46292dadcf8870946916f79fdddf79bd7267f ] + +If the mount is hard, we should ignore the 'io_maxretrans' module +parameter so that we always keep retrying. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index c67cdbb36ce7c..38d9158142219 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -8,6 +8,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -928,7 +929,9 @@ retry: + pgm = &pgio->pg_mirrors[0]; + pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize; + +- pgio->pg_maxretrans = io_maxretrans; ++ if (NFS_SERVER(pgio->pg_inode)->flags & ++ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR)) ++ pgio->pg_maxretrans = io_maxretrans; + return; + out_nolseg: + if (pgio->pg_error < 0) +@@ -936,6 +939,7 @@ out_nolseg: + out_mds: + pnfs_put_lseg(pgio->pg_lseg); + pgio->pg_lseg = NULL; ++ pgio->pg_maxretrans = 0; + nfs_pageio_reset_read_mds(pgio); + } + +@@ -996,12 +1000,15 @@ retry: + pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].wsize; + } + +- pgio->pg_maxretrans = io_maxretrans; ++ if (NFS_SERVER(pgio->pg_inode)->flags & ++ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR)) ++ pgio->pg_maxretrans = io_maxretrans; + return; + + out_mds: + pnfs_put_lseg(pgio->pg_lseg); + pgio->pg_lseg = NULL; ++ pgio->pg_maxretrans = 0; + nfs_pageio_reset_write_mds(pgio); + } + +-- +2.20.1 + diff --git a/queue-5.2/qed-add-cleanup-in-qed_slowpath_start.patch b/queue-5.2/qed-add-cleanup-in-qed_slowpath_start.patch new file mode 100644 index 00000000000..54a2a27b161 --- /dev/null +++ b/queue-5.2/qed-add-cleanup-in-qed_slowpath_start.patch @@ -0,0 +1,46 @@ +From 0be24165e652e4023f9d928c2304750cc3655c31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 23:46:36 -0500 +Subject: qed: Add cleanup in qed_slowpath_start() + +From: Wenwen Wang + +[ Upstream commit de0e4fd2f07ce3bbdb69dfb8d9426b7227451b69 ] + +If qed_mcp_send_drv_version() fails, no cleanup is executed, leading to +memory leaks. To fix this issue, introduce the label 'err4' to perform the +cleanup work before returning the error. + +Signed-off-by: Wenwen Wang +Acked-by: Sudarsana Reddy Kalluru +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 6de23b56b2945..c875a2fa75966 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1215,7 +1215,7 @@ static int qed_slowpath_start(struct qed_dev *cdev, + &drv_version); + if (rc) { + DP_NOTICE(cdev, "Failed sending drv version command\n"); +- return rc; ++ goto err4; + } + } + +@@ -1223,6 +1223,8 @@ static int qed_slowpath_start(struct qed_dev *cdev, + + return 0; + ++err4: ++ qed_ll2_dealloc_if(cdev); + err3: + qed_hw_stop(cdev); + err2: +-- +2.20.1 + diff --git a/queue-5.2/r8152-set-memory-to-all-0xffs-on-failed-reg-reads.patch b/queue-5.2/r8152-set-memory-to-all-0xffs-on-failed-reg-reads.patch new file mode 100644 index 00000000000..0ab87cc3b3b --- /dev/null +++ b/queue-5.2/r8152-set-memory-to-all-0xffs-on-failed-reg-reads.patch @@ -0,0 +1,52 @@ +From 4a39fefa88791b92e8803ffee2f447219071b042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Aug 2019 01:36:19 -0700 +Subject: r8152: Set memory to all 0xFFs on failed reg reads + +From: Prashant Malani + +[ Upstream commit f53a7ad189594a112167efaf17ea8d0242b5ac00 ] + +get_registers() blindly copies the memory written to by the +usb_control_msg() call even if the underlying urb failed. + +This could lead to junk register values being read by the driver, since +some indirect callers of get_registers() ignore the return values. One +example is: + ocp_read_dword() ignores the return value of generic_ocp_read(), which + calls get_registers(). + +So, emulate PCI "Master Abort" behavior by setting the buffer to all +0xFFs when usb_control_msg() fails. + +This patch is copied from the r8152 driver (v2.12.0) published by +Realtek (www.realtek.com). + +Signed-off-by: Prashant Malani +Acked-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1a7b7bd412f9d..f2553dff5b178 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -787,8 +787,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), + RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, + value, index, tmp, size, 500); ++ if (ret < 0) ++ memset(data, 0xff, size); ++ else ++ memcpy(data, tmp, size); + +- memcpy(data, tmp, size); + kfree(tmp); + + return ret; +-- +2.20.1 + diff --git a/queue-5.2/risc-v-fix-fixmap-area-corruption-on-rv32-systems.patch b/queue-5.2/risc-v-fix-fixmap-area-corruption-on-rv32-systems.patch new file mode 100644 index 00000000000..9bde69f9997 --- /dev/null +++ b/queue-5.2/risc-v-fix-fixmap-area-corruption-on-rv32-systems.patch @@ -0,0 +1,88 @@ +From c716ecd7f11d36f7c094a6519771ad672c8e6823 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 05:14:23 +0000 +Subject: RISC-V: Fix FIXMAP area corruption on RV32 systems + +From: Anup Patel + +[ Upstream commit a256f2e329df0773022d28df2c3d206b9aaf1e61 ] + +Currently, various virtual memory areas of Linux RISC-V are organized +in increasing order of their virtual addresses is as follows: +1. User space area (This is lowest area and starts at 0x0) +2. FIXMAP area +3. VMALLOC area +4. Kernel area (This is highest area and starts at PAGE_OFFSET) + +The maximum size of user space aread is represented by TASK_SIZE. + +On RV32 systems, TASK_SIZE is defined as VMALLOC_START which causes the +user space area to overlap the FIXMAP area. This allows user space apps +to potentially corrupt the FIXMAP area and kernel OF APIs will crash +whenever they access corrupted FDT in the FIXMAP area. + +On RV64 systems, TASK_SIZE is set to fixed 256GB and no other areas +happen to overlap so we don't see any FIXMAP area corruptions. + +This patch fixes FIXMAP area corruption on RV32 systems by setting +TASK_SIZE to FIXADDR_START. We also move FIXADDR_TOP, FIXADDR_SIZE, +and FIXADDR_START defines to asm/pgtable.h so that we can avoid cyclic +header includes. + +Signed-off-by: Anup Patel +Tested-by: Alistair Francis +Reviewed-by: Christoph Hellwig +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/fixmap.h | 4 ---- + arch/riscv/include/asm/pgtable.h | 12 ++++++++++-- + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/include/asm/fixmap.h b/arch/riscv/include/asm/fixmap.h +index c207f6634b91c..15b3edaabc280 100644 +--- a/arch/riscv/include/asm/fixmap.h ++++ b/arch/riscv/include/asm/fixmap.h +@@ -25,10 +25,6 @@ enum fixed_addresses { + __end_of_fixed_addresses + }; + +-#define FIXADDR_SIZE (__end_of_fixed_addresses * PAGE_SIZE) +-#define FIXADDR_TOP (VMALLOC_START) +-#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) +- + #define FIXMAP_PAGE_IO PAGE_KERNEL + + #define __early_set_fixmap __set_fixmap +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index f7c3f7de15f27..e6faa469c133b 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -408,14 +408,22 @@ static inline void pgtable_cache_init(void) + #define VMALLOC_END (PAGE_OFFSET - 1) + #define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) + ++#define FIXADDR_TOP VMALLOC_START ++#ifdef CONFIG_64BIT ++#define FIXADDR_SIZE PMD_SIZE ++#else ++#define FIXADDR_SIZE PGDIR_SIZE ++#endif ++#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) ++ + /* +- * Task size is 0x40000000000 for RV64 or 0xb800000 for RV32. ++ * Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32. + * Note that PGDIR_SIZE must evenly divide TASK_SIZE. + */ + #ifdef CONFIG_64BIT + #define TASK_SIZE (PGDIR_SIZE * PTRS_PER_PGD / 2) + #else +-#define TASK_SIZE VMALLOC_START ++#define TASK_SIZE FIXADDR_START + #endif + + #include +-- +2.20.1 + diff --git a/queue-5.2/s390-bpf-fix-lcgr-instruction-encoding.patch b/queue-5.2/s390-bpf-fix-lcgr-instruction-encoding.patch new file mode 100644 index 00000000000..8bf4dda3eed --- /dev/null +++ b/queue-5.2/s390-bpf-fix-lcgr-instruction-encoding.patch @@ -0,0 +1,43 @@ +From 0a4b9253dfbfaf4a00e2329ba9768cbf1cffa9ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2019 17:03:32 +0200 +Subject: s390/bpf: fix lcgr instruction encoding + +From: Ilya Leoshkevich + +[ Upstream commit bb2d267c448f4bc3a3389d97c56391cb779178ae ] + +"masking, test in bounds 3" fails on s390, because +BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0) ignores the top 32 bits of +BPF_REG_2. The reason is that JIT emits lcgfr instead of lcgr. +The associated comment indicates that the code was intended to +emit lcgr in the first place, it's just that the wrong opcode +was used. + +Fix by using the correct opcode. + +Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend") +Signed-off-by: Ilya Leoshkevich +Acked-by: Vasily Gorbik +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 5e7c630331590..9a711472cbdc0 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -853,7 +853,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + break; + case BPF_ALU64 | BPF_NEG: /* dst = -dst */ + /* lcgr %dst,%dst */ +- EMIT4(0xb9130000, dst_reg, dst_reg); ++ EMIT4(0xb9030000, dst_reg, dst_reg); + break; + /* + * BPF_FROM_BE/LE +-- +2.20.1 + diff --git a/queue-5.2/s390-bpf-use-32-bit-index-for-tail-calls.patch b/queue-5.2/s390-bpf-use-32-bit-index-for-tail-calls.patch new file mode 100644 index 00000000000..ebf4cc0ce8e --- /dev/null +++ b/queue-5.2/s390-bpf-use-32-bit-index-for-tail-calls.patch @@ -0,0 +1,62 @@ +From 7e2cd42c588011b9c5f64b28dd3f05a0869acc4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2019 18:18:07 +0200 +Subject: s390/bpf: use 32-bit index for tail calls + +From: Ilya Leoshkevich + +[ Upstream commit 91b4db5313a2c793aabc2143efb8ed0cf0fdd097 ] + +"p runtime/jit: pass > 32bit index to tail_call" fails when +bpf_jit_enable=1, because the tail call is not executed. + +This in turn is because the generated code assumes index is 64-bit, +while it must be 32-bit, and as a result prog array bounds check fails, +while it should pass. Even if bounds check would have passed, the code +that follows uses 64-bit index to compute prog array offset. + +Fix by using clrj instead of clgrj for comparing index with array size, +and also by using llgfr for truncating index to 32 bits before using it +to compute prog array offset. + +Fixes: 6651ee070b31 ("s390/bpf: implement bpf_tail_call() helper") +Reported-by: Yauheni Kaliuta +Acked-by: Vasily Gorbik +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + arch/s390/net/bpf_jit_comp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 9a711472cbdc0..fd9844f947f79 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1027,8 +1027,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + /* llgf %w1,map.max_entries(%b2) */ + EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2, + offsetof(struct bpf_array, map.max_entries)); +- /* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */ +- EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3, ++ /* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */ ++ EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3, + REG_W1, 0, 0xa); + + /* +@@ -1054,8 +1054,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + * goto out; + */ + +- /* sllg %r1,%b3,3: %r1 = index * 8 */ +- EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3); ++ /* llgfr %r1,%b3: %r1 = (u32) index */ ++ EMIT4(0xb9160000, REG_1, BPF_REG_3); ++ /* sllg %r1,%r1,3: %r1 *= 8 */ ++ EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3); + /* lg %r1,prog(%b2,%r1) */ + EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2, + REG_1, offsetof(struct bpf_array, ptrs)); +-- +2.20.1 + diff --git a/queue-5.2/selftests-bpf-add-config-fragment-bpf_jit.patch b/queue-5.2/selftests-bpf-add-config-fragment-bpf_jit.patch new file mode 100644 index 00000000000..1897a5e29bb --- /dev/null +++ b/queue-5.2/selftests-bpf-add-config-fragment-bpf_jit.patch @@ -0,0 +1,37 @@ +From a00c3fe5b1ce2a4b2dcb5c624d4ebefc81a5cf62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 15:41:34 +0200 +Subject: selftests/bpf: add config fragment BPF_JIT + +From: Anders Roxell + +[ Upstream commit 0604409df9e04cdec7b08d471c8c1c0c10b5554d ] + +When running test_kmod.sh the following shows up + + # sysctl cannot stat /proc/sys/net/core/bpf_jit_enable No such file or directory + cannot: stat_/proc/sys/net/core/bpf_jit_enable # + # sysctl cannot stat /proc/sys/net/core/bpf_jit_harden No such file or directory + cannot: stat_/proc/sys/net/core/bpf_jit_harden # + +Rework to enable CONFIG_BPF_JIT to solve "No such file or directory" + +Signed-off-by: Anders Roxell +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/config | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config +index f7a0744db31e1..5dc109f4c0970 100644 +--- a/tools/testing/selftests/bpf/config ++++ b/tools/testing/selftests/bpf/config +@@ -34,3 +34,4 @@ CONFIG_NET_MPLS_GSO=m + CONFIG_MPLS_ROUTING=m + CONFIG_MPLS_IPTUNNEL=m + CONFIG_IPV6_SIT=m ++CONFIG_BPF_JIT=y +-- +2.20.1 + diff --git a/queue-5.2/selftests-bpf-fix-bind-4-6-deny-specific-ip-port-on-.patch b/queue-5.2/selftests-bpf-fix-bind-4-6-deny-specific-ip-port-on-.patch new file mode 100644 index 00000000000..cf95c1b5953 --- /dev/null +++ b/queue-5.2/selftests-bpf-fix-bind-4-6-deny-specific-ip-port-on-.patch @@ -0,0 +1,61 @@ +From 61ac7a0519500ca2321e86f3c2ef4fa31815302f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2019 12:41:09 +0200 +Subject: selftests/bpf: fix "bind{4, 6} deny specific IP & port" on s390 + +From: Ilya Leoshkevich + +[ Upstream commit 27df5c7068bf23cab282dc64b1c9894429b3b8a0 ] + +"bind4 allow specific IP & port" and "bind6 deny specific IP & port" +fail on s390 because of endianness issue: the 4 IP address bytes are +loaded as a word and compared with a constant, but the value of this +constant should be different on big- and little- endian machines, which +is not the case right now. + +Use __bpf_constant_ntohl to generate proper value based on machine +endianness. + +Fixes: 1d436885b23b ("selftests/bpf: Selftest for sys_bind post-hooks.") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sock.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c +index fb679ac3d4b07..0e66527334623 100644 +--- a/tools/testing/selftests/bpf/test_sock.c ++++ b/tools/testing/selftests/bpf/test_sock.c +@@ -13,6 +13,7 @@ + #include + + #include "cgroup_helpers.h" ++#include "bpf_endian.h" + #include "bpf_rlimit.h" + #include "bpf_util.h" + +@@ -232,7 +233,8 @@ static struct sock_test tests[] = { + /* if (ip == expected && port == expected) */ + BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, + offsetof(struct bpf_sock, src_ip6[3])), +- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4), ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ++ __bpf_constant_ntohl(0x00000001), 4), + BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, + offsetof(struct bpf_sock, src_port)), + BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2), +@@ -261,7 +263,8 @@ static struct sock_test tests[] = { + /* if (ip == expected && port == expected) */ + BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, + offsetof(struct bpf_sock, src_ip4)), +- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4), ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, ++ __bpf_constant_ntohl(0x7F000001), 4), + BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, + offsetof(struct bpf_sock, src_port)), + BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2), +-- +2.20.1 + diff --git a/queue-5.2/selftests-bpf-fix-test_cgroup_storage-on-s390.patch b/queue-5.2/selftests-bpf-fix-test_cgroup_storage-on-s390.patch new file mode 100644 index 00000000000..186b5673b2e --- /dev/null +++ b/queue-5.2/selftests-bpf-fix-test_cgroup_storage-on-s390.patch @@ -0,0 +1,54 @@ +From e21e16f21e970a878166576d0d9dfab2ba27c8c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 16:18:04 +0200 +Subject: selftests/bpf: fix test_cgroup_storage on s390 + +From: Ilya Leoshkevich + +[ Upstream commit 806ce6e2117a42528e7bb979e04e28229b34a612 ] + +test_cgroup_storage fails on s390 with an assertion failure: packets are +dropped when they shouldn't. The problem is that BPF_DW packet count is +accessed as BPF_W with an offset of 0, which is not correct on +big-endian machines. + +Since the point of this test is not to verify narrow loads/stores, +simply use BPF_DW when working with packet counts. + +Fixes: 68cfa3ac6b8d ("selftests/bpf: add a cgroup storage test") +Fixes: 919646d2a3a9 ("selftests/bpf: extend the storage test to test per-cpu cgroup storage") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_cgroup_storage.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_cgroup_storage.c b/tools/testing/selftests/bpf/test_cgroup_storage.c +index 2fc4625c1a150..6557290043911 100644 +--- a/tools/testing/selftests/bpf/test_cgroup_storage.c ++++ b/tools/testing/selftests/bpf/test_cgroup_storage.c +@@ -20,9 +20,9 @@ int main(int argc, char **argv) + BPF_MOV64_IMM(BPF_REG_2, 0), /* flags, not used */ + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, + BPF_FUNC_get_local_storage), +- BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0), ++ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 0x1), +- BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0), ++ BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0), + + BPF_LD_MAP_FD(BPF_REG_1, 0), /* map fd */ + BPF_MOV64_IMM(BPF_REG_2, 0), /* flags, not used */ +@@ -30,7 +30,7 @@ int main(int argc, char **argv) + BPF_FUNC_get_local_storage), + BPF_MOV64_IMM(BPF_REG_1, 1), + BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_1, 0), +- BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0), ++ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0), + BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x1), + BPF_MOV64_REG(BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), +-- +2.20.1 + diff --git a/queue-5.2/series b/queue-5.2/series index 76c4174da35..6922fd127b5 100644 --- a/queue-5.2/series +++ b/queue-5.2/series @@ -24,3 +24,96 @@ serial-sprd-correct-the-wrong-sequence-of-arguments.patch tty-serial-atmel-reschedule-tx-after-rx-was-started.patch mwifiex-fix-three-heap-overflow-at-parsing-element-in-cfg80211_ap_settings.patch nl80211-fix-possible-spectre-v1-for-cqm-rssi-thresholds.patch +ieee802154-hwsim-fix-error-handle-path-in-hwsim_init.patch +ieee802154-hwsim-unregister-hw-while-hwsim_subscribe.patch +arm-dts-am57xx-disable-voltage-switching-for-sd-card.patch +arm-omap2-fix-missing-sysc_has_reset_status-for-dra7.patch +bus-ti-sysc-fix-handling-of-forced-idle.patch +bus-ti-sysc-fix-using-configured-sysc-mask-value.patch +arm-dts-fix-flags-for-gpio7.patch +arm-dts-fix-incorrect-dcan-register-mapping-for-am3-.patch +arm64-dts-meson-g12a-add-missing-dwc2-phy-names.patch +s390-bpf-fix-lcgr-instruction-encoding.patch +arm-omap2-fix-omap4-errata-warning-on-other-socs.patch +arm-dts-am335x-fix-uarts-length.patch +arm-dts-dra74x-fix-iodelay-configuration-for-mmc3.patch +arm-omap1-ams-delta-fiq-fix-missing-irq_ack.patch +bus-ti-sysc-simplify-cleanup-upon-failures-in-sysc_p.patch +arm-dts-fix-incomplete-dts-data-for-am3-and-am4-mmc.patch +s390-bpf-use-32-bit-index-for-tail-calls.patch +selftests-bpf-fix-bind-4-6-deny-specific-ip-port-on-.patch +tools-bpftool-close-prog-fd-before-exit-on-showing-a.patch +fpga-altera-ps-spi-fix-getting-of-optional-confd-gpi.patch +netfilter-ebtables-fix-argument-order-to-add_counter.patch +netfilter-nft_flow_offload-missing-netlink-attribute.patch +netfilter-xt_nfacct-fix-alignment-mismatch-in-xt_nfa.patch +nfsv4-fix-return-values-for-nfs4_file_open.patch +nfsv4-fix-return-value-in-nfs_finish_open.patch +nfs-fix-initialisation-of-i-o-result-struct-in-nfs_p.patch +nfs-on-fatal-writeback-errors-we-need-to-call-nfs_in.patch +kconfig-fix-the-reference-to-the-idt77105-phy-driver.patch +xdp-unpin-xdp-umem-pages-in-error-path.patch +selftests-bpf-fix-test_cgroup_storage-on-s390.patch +selftests-bpf-add-config-fragment-bpf_jit.patch +qed-add-cleanup-in-qed_slowpath_start.patch +drm-omap-fix-port-lookup-for-sdi-output.patch +drm-virtio-use-virtio_max_dma_size.patch +arm-8874-1-mm-only-adjust-sections-of-valid-mm-struc.patch +batman-adv-only-read-ogm2-tvlv_len-after-buffer-len-.patch +flow_dissector-fix-potential-use-after-free-on-bpf_p.patch +bpf-allow-narrow-loads-of-some-sk_reuseport_md-field.patch +r8152-set-memory-to-all-0xffs-on-failed-reg-reads.patch +x86-apic-fix-arch_dynirq_lower_bound-bug-for-dt-enab.patch +pnfs-flexfiles-don-t-time-out-requests-on-hard-mount.patch +nfs-fix-spurious-eio-read-errors.patch +nfs-fix-writepage-s-error-handling-to-not-report-err.patch +drm-amdgpu-fix-dma_fence_wait-without-reference.patch +netfilter-xt_physdev-fix-spurious-error-message-in-p.patch +netfilter-nf_conntrack_ftp-fix-debug-output.patch +nfsv2-fix-eof-handling.patch +nfsv2-fix-write-regression.patch +nfs-remove-set-but-not-used-variable-mapping.patch +kallsyms-don-t-let-kallsyms_lookup_size_offset-fail-.patch +netfilter-conntrack-make-sysctls-per-namespace-again.patch +drm-amd-powerplay-correct-vega20-dpm-level-related-s.patch +cifs-set-domainname-when-a-domain-key-is-used-in-mul.patch +cifs-use-kzfree-to-zero-out-the-password.patch +libceph-don-t-call-crypto_free_sync_skcipher-on-a-nu.patch +usb-host-xhci-tegra-set-dma-mask-correctly.patch +risc-v-fix-fixmap-area-corruption-on-rv32-systems.patch +arm-8901-1-add-a-criteria-for-pfn_valid-of-arm.patch +ibmvnic-do-not-process-reset-during-or-after-device-.patch +sky2-disable-msi-on-yet-another-asus-boards-p6xxxx.patch +i2c-designware-synchronize-irqs-when-unregistering-s.patch +perf-x86-intel-restrict-period-on-nehalem.patch +perf-x86-amd-ibs-fix-sample-bias-for-dispatched-micr.patch +i2c-iproc-stop-advertising-support-of-smbus-quick-cm.patch +i2c-mediatek-disable-zero-length-transfers-for-mt818.patch +amd-xgbe-fix-error-path-in-xgbe_mod_init.patch +netfilter-nf_flow_table-clear-skb-tstamp-before-xmit.patch +tools-power-x86_energy_perf_policy-fix-uninitialized.patch +tools-power-x86_energy_perf_policy-fix-argument-pars.patch +tools-power-turbostat-fix-leak-of-file-descriptor-on.patch +tools-power-turbostat-fix-file-descriptor-leaks.patch +tools-power-turbostat-fix-buffer-overrun.patch +tools-power-turbostat-fix-haswell-core-systems.patch +tools-power-turbostat-add-ice-lake-nnpi-support.patch +tools-power-turbostat-fix-cpu-c1-display-value.patch +net-aquantia-fix-removal-of-vlan-0.patch +net-aquantia-reapply-vlan-filters-on-up.patch +net-aquantia-linkstate-irq-should-be-oneshot.patch +net-aquantia-fix-out-of-memory-condition-on-rx-side.patch +net-dsa-microchip-add-ksz8563-compatibility-string.patch +enetc-add-missing-call-to-pci_free_irq_vectors-in-pr.patch +net-seeq-fix-the-function-used-to-release-some-memor.patch +arm64-dts-renesas-r8a77995-draak-fix-backlight-regul.patch +dmaengine-ti-dma-crossbar-fix-a-memory-leak-bug.patch +dmaengine-ti-omap-dma-add-cleanup-in-omap_dma_probe.patch +x86-uaccess-don-t-leak-the-ac-flags-into-__get_user-.patch +x86-hyper-v-fix-overflow-bug-in-fill_gva_list.patch +iommu-vt-d-remove-global-page-flush-support.patch +dmaengine-sprd-fix-the-dma-link-list-configuration.patch +dmaengine-rcar-dmac-fix-dmachclr-handling-if-iommu-i.patch +keys-fix-missing-null-pointer-check-in-request_key_a.patch +iommu-amd-flush-old-domains-in-kdump-kernel.patch +iommu-amd-fix-race-in-increase_address_space.patch diff --git a/queue-5.2/sky2-disable-msi-on-yet-another-asus-boards-p6xxxx.patch b/queue-5.2/sky2-disable-msi-on-yet-another-asus-boards-p6xxxx.patch new file mode 100644 index 00000000000..8769d08b41d --- /dev/null +++ b/queue-5.2/sky2-disable-msi-on-yet-another-asus-boards-p6xxxx.patch @@ -0,0 +1,43 @@ +From 9a6404af822a1d9266636ac754623328191256a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 08:31:19 +0200 +Subject: sky2: Disable MSI on yet another ASUS boards (P6Xxxx) + +From: Takashi Iwai + +[ Upstream commit 189308d5823a089b56e2299cd96589507dac7319 ] + +A similar workaround for the suspend/resume problem is needed for yet +another ASUS machines, P6X models. Like the previous fix, the BIOS +doesn't provide the standard DMI_SYS_* entry, so again DMI_BOARD_* +entries are used instead. + +Reported-and-tested-by: SteveM +Signed-off-by: Takashi Iwai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/sky2.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index c93a6f9b735b0..7e88446ac97a9 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -4924,6 +4924,13 @@ static const struct dmi_system_id msi_blacklist[] = { + DMI_MATCH(DMI_BOARD_NAME, "P6T"), + }, + }, ++ { ++ .ident = "ASUS P6X", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "P6X"), ++ }, ++ }, + {} + }; + +-- +2.20.1 + diff --git a/queue-5.2/tools-bpftool-close-prog-fd-before-exit-on-showing-a.patch b/queue-5.2/tools-bpftool-close-prog-fd-before-exit-on-showing-a.patch new file mode 100644 index 00000000000..ed4433d25cc --- /dev/null +++ b/queue-5.2/tools-bpftool-close-prog-fd-before-exit-on-showing-a.patch @@ -0,0 +1,41 @@ +From 9864e68ca81d892032ca7e533a49fa94be6db1d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 15:22:23 +0100 +Subject: tools: bpftool: close prog FD before exit on showing a single program + +From: Quentin Monnet + +[ Upstream commit d34b044038bfb0e19caa8b019910efc465f41d5f ] + +When showing metadata about a single program by invoking +"bpftool prog show PROG", the file descriptor referring to the program +is not closed before returning from the function. Let's close it. + +Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") +Signed-off-by: Quentin Monnet +Reviewed-by: Jakub Kicinski +Acked-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 7a4e21a315236..d41651afe5f64 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -362,7 +362,9 @@ static int do_show(int argc, char **argv) + if (fd < 0) + return -1; + +- return show_prog(fd); ++ err = show_prog(fd); ++ close(fd); ++ return err; + } + + if (argc) +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-add-ice-lake-nnpi-support.patch b/queue-5.2/tools-power-turbostat-add-ice-lake-nnpi-support.patch new file mode 100644 index 00000000000..f8e22beaf03 --- /dev/null +++ b/queue-5.2/tools-power-turbostat-add-ice-lake-nnpi-support.patch @@ -0,0 +1,34 @@ +From b897b9f4cb82d9a092cbb245b315a57693bb1a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2019 13:09:46 +0530 +Subject: tools/power turbostat: Add Ice Lake NNPI support + +From: Rajneesh Bhardwaj + +[ Upstream commit d93ea567fc4eec2d3581015e23d2c555f8b393ba ] + +This enables turbostat utility on Ice Lake NNPI SoC. + +Link: https://lkml.org/lkml/2019/6/5/1034 +Signed-off-by: Rajneesh Bhardwaj +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 56c3e041d4f93..0a80f3cc24e31 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -4586,6 +4586,7 @@ unsigned int intel_model_duplicates(unsigned int model) + return INTEL_FAM6_SKYLAKE_MOBILE; + + case INTEL_FAM6_ICELAKE_MOBILE: ++ case INTEL_FAM6_ICELAKE_NNPI: + return INTEL_FAM6_CANNONLAKE_MOBILE; + } + return model; +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-fix-buffer-overrun.patch b/queue-5.2/tools-power-turbostat-fix-buffer-overrun.patch new file mode 100644 index 00000000000..bdab9f607a9 --- /dev/null +++ b/queue-5.2/tools-power-turbostat-fix-buffer-overrun.patch @@ -0,0 +1,37 @@ +From 64c832d01f39f71b38db600446bd2e7d98836234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2019 16:02:14 +0900 +Subject: tools/power turbostat: fix buffer overrun + +From: Naoya Horiguchi + +[ Upstream commit eeb71c950bc6eee460f2070643ce137e067b234c ] + +turbostat could be terminated by general protection fault on some latest +hardwares which (for example) support 9 levels of C-states and show 18 +"tADDED" lines. That bloats the total output and finally causes buffer +overrun. So let's extend the buffer to avoid this. + +Signed-off-by: Naoya Horiguchi +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 0ffbbcac4d19d..752cb4c0fde6b 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -5125,7 +5125,7 @@ int initialize_counters(int cpu_id) + + void allocate_output_buffer() + { +- output_buffer = calloc(1, (1 + topo.num_cpus) * 1024); ++ output_buffer = calloc(1, (1 + topo.num_cpus) * 2048); + outp = output_buffer; + if (outp == NULL) + err(-1, "calloc output buffer"); +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-fix-cpu-c1-display-value.patch b/queue-5.2/tools-power-turbostat-fix-cpu-c1-display-value.patch new file mode 100644 index 00000000000..7952c1865bd --- /dev/null +++ b/queue-5.2/tools-power-turbostat-fix-cpu-c1-display-value.patch @@ -0,0 +1,124 @@ +From 66bfeffb12455ba3140df7353fa0acd117e7091c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 10:57:14 -0700 +Subject: tools/power turbostat: Fix CPU%C1 display value + +From: Srinivas Pandruvada + +[ Upstream commit 1e9042b9c8d46ada9ee7b3339a31f50d12e5d291 ] + +In some case C1% will be wrong value, when platform doesn't have MSR for +C1 residency. + +For example: +Core CPU CPU%c1 +- - 100.00 +0 0 100.00 +0 2 100.00 +1 1 100.00 +1 3 100.00 + +But adding Busy% will fix this +Core CPU Busy% CPU%c1 +- - 99.77 0.23 +0 0 99.77 0.23 +0 2 99.77 0.23 +1 1 99.77 0.23 +1 3 99.77 0.23 + +This issue can be reproduced on most of the recent systems including +Broadwell, Skylake and later. + +This is because if we don't select Busy% or Avg_MHz or Bzy_MHz then +mperf value will not be read from MSR, so it will be 0. But this +is required for C1% calculation when MSR for C1 residency is not present. +Same is true for C3, C6 and C7 column selection. + +So add another define DO_BIC_READ(), which doesn't depend on user +column selection and use for mperf, C3, C6 and C7 related counters. +So when there is no platform support for C1 residency counters, +we still read these counters, if the CPU has support and user selected +display of CPU%c1. + +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 0a80f3cc24e31..5c0154cf190cc 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -506,6 +506,7 @@ unsigned long long bic_enabled = (0xFFFFFFFFFFFFFFFFULL & ~BIC_DISABLED_BY_DEFAU + unsigned long long bic_present = BIC_USEC | BIC_TOD | BIC_sysfs | BIC_APIC | BIC_X2APIC; + + #define DO_BIC(COUNTER_NAME) (bic_enabled & bic_present & COUNTER_NAME) ++#define DO_BIC_READ(COUNTER_NAME) (bic_present & COUNTER_NAME) + #define ENABLE_BIC(COUNTER_NAME) (bic_enabled |= COUNTER_NAME) + #define BIC_PRESENT(COUNTER_BIT) (bic_present |= COUNTER_BIT) + #define BIC_NOT_PRESENT(COUNTER_BIT) (bic_present &= ~COUNTER_BIT) +@@ -1287,6 +1288,14 @@ delta_core(struct core_data *new, struct core_data *old) + } + } + ++int soft_c1_residency_display(int bic) ++{ ++ if (!DO_BIC(BIC_CPU_c1) || use_c1_residency_msr) ++ return 0; ++ ++ return DO_BIC_READ(bic); ++} ++ + /* + * old = new - old + */ +@@ -1322,7 +1331,8 @@ delta_thread(struct thread_data *new, struct thread_data *old, + + old->c1 = new->c1 - old->c1; + +- if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz)) { ++ if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz) || ++ soft_c1_residency_display(BIC_Avg_MHz)) { + if ((new->aperf > old->aperf) && (new->mperf > old->mperf)) { + old->aperf = new->aperf - old->aperf; + old->mperf = new->mperf - old->mperf; +@@ -1774,7 +1784,8 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p) + retry: + t->tsc = rdtsc(); /* we are running on local CPU of interest */ + +- if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz)) { ++ if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz) || ++ soft_c1_residency_display(BIC_Avg_MHz)) { + unsigned long long tsc_before, tsc_between, tsc_after, aperf_time, mperf_time; + + /* +@@ -1851,20 +1862,20 @@ retry: + if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE)) + goto done; + +- if (DO_BIC(BIC_CPU_c3)) { ++ if (DO_BIC(BIC_CPU_c3) || soft_c1_residency_display(BIC_CPU_c3)) { + if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3)) + return -6; + } + +- if (DO_BIC(BIC_CPU_c6) && !do_knl_cstates) { ++ if ((DO_BIC(BIC_CPU_c6) || soft_c1_residency_display(BIC_CPU_c6)) && !do_knl_cstates) { + if (get_msr(cpu, MSR_CORE_C6_RESIDENCY, &c->c6)) + return -7; +- } else if (do_knl_cstates) { ++ } else if (do_knl_cstates || soft_c1_residency_display(BIC_CPU_c6)) { + if (get_msr(cpu, MSR_KNL_CORE_C6_RESIDENCY, &c->c6)) + return -7; + } + +- if (DO_BIC(BIC_CPU_c7)) ++ if (DO_BIC(BIC_CPU_c7) || soft_c1_residency_display(BIC_CPU_c7)) + if (get_msr(cpu, MSR_CORE_C7_RESIDENCY, &c->c7)) + return -8; + +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-fix-file-descriptor-leaks.patch b/queue-5.2/tools-power-turbostat-fix-file-descriptor-leaks.patch new file mode 100644 index 00000000000..2ad21f0b270 --- /dev/null +++ b/queue-5.2/tools-power-turbostat-fix-file-descriptor-leaks.patch @@ -0,0 +1,37 @@ +From d344a65ccb4154b9815af3e7e095d6d5c14866f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2019 11:12:40 -0500 +Subject: tools/power turbostat: fix file descriptor leaks + +From: Gustavo A. R. Silva + +[ Upstream commit 605736c6929d541c78a85dffae4d33a23b6b2149 ] + +Fix file descriptor leaks by closing fp before return. + +Addresses-Coverity-ID: 1444591 ("Resource leak") +Addresses-Coverity-ID: 1444592 ("Resource leak") +Fixes: 5ea7647b333f ("tools/power turbostat: Warn on bad ACPI LPIT data") +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Prarit Bhargava +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index efc8d07364c61..0ffbbcac4d19d 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -2912,6 +2912,7 @@ int snapshot_cpu_lpi_us(void) + if (retval != 1) { + fprintf(stderr, "Disabling Low Power Idle CPU output\n"); + BIC_NOT_PRESENT(BIC_CPU_LPI); ++ fclose(fp); + return -1; + } + +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-fix-haswell-core-systems.patch b/queue-5.2/tools-power-turbostat-fix-haswell-core-systems.patch new file mode 100644 index 00000000000..52f7d9976ff --- /dev/null +++ b/queue-5.2/tools-power-turbostat-fix-haswell-core-systems.patch @@ -0,0 +1,91 @@ +From c28f18281ec6ba095995fb685d7eccbf9981c96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Aug 2019 14:09:29 -0400 +Subject: tools/power turbostat: Fix Haswell Core systems + +From: Len Brown + +[ Upstream commit cd188af5282d9f9e65f63915b13239bafc746f8d ] + +turbostat: cpu0: msr offset 0x630 read failed: Input/output error + +because Haswell Core does not have C8-C10. + +Output C8-C10 only on Haswell ULT. + +Fixes: f5a4c76ad7de ("tools/power turbostat: consolidate duplicate model numbers") + +Reported-by: Prarit Bhargava +Suggested-by: Kosuke Tatsukawa +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 752cb4c0fde6b..56c3e041d4f93 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -3211,6 +3211,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model) + break; + case INTEL_FAM6_HASWELL_CORE: /* HSW */ + case INTEL_FAM6_HASWELL_X: /* HSX */ ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_HASWELL_GT3E: /* HSW */ + case INTEL_FAM6_BROADWELL_CORE: /* BDW */ + case INTEL_FAM6_BROADWELL_GT3E: /* BDW */ +@@ -3407,6 +3408,7 @@ int has_config_tdp(unsigned int family, unsigned int model) + case INTEL_FAM6_IVYBRIDGE: /* IVB */ + case INTEL_FAM6_HASWELL_CORE: /* HSW */ + case INTEL_FAM6_HASWELL_X: /* HSX */ ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_HASWELL_GT3E: /* HSW */ + case INTEL_FAM6_BROADWELL_CORE: /* BDW */ + case INTEL_FAM6_BROADWELL_GT3E: /* BDW */ +@@ -3843,6 +3845,7 @@ void rapl_probe_intel(unsigned int family, unsigned int model) + case INTEL_FAM6_SANDYBRIDGE: + case INTEL_FAM6_IVYBRIDGE: + case INTEL_FAM6_HASWELL_CORE: /* HSW */ ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_HASWELL_GT3E: /* HSW */ + case INTEL_FAM6_BROADWELL_CORE: /* BDW */ + case INTEL_FAM6_BROADWELL_GT3E: /* BDW */ +@@ -4034,6 +4037,7 @@ void perf_limit_reasons_probe(unsigned int family, unsigned int model) + + switch (model) { + case INTEL_FAM6_HASWELL_CORE: /* HSW */ ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_HASWELL_GT3E: /* HSW */ + do_gfx_perf_limit_reasons = 1; + case INTEL_FAM6_HASWELL_X: /* HSX */ +@@ -4253,6 +4257,7 @@ int has_snb_msrs(unsigned int family, unsigned int model) + case INTEL_FAM6_IVYBRIDGE_X: /* IVB Xeon */ + case INTEL_FAM6_HASWELL_CORE: /* HSW */ + case INTEL_FAM6_HASWELL_X: /* HSW */ ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_HASWELL_GT3E: /* HSW */ + case INTEL_FAM6_BROADWELL_CORE: /* BDW */ + case INTEL_FAM6_BROADWELL_GT3E: /* BDW */ +@@ -4286,7 +4291,7 @@ int has_hsw_msrs(unsigned int family, unsigned int model) + return 0; + + switch (model) { +- case INTEL_FAM6_HASWELL_CORE: ++ case INTEL_FAM6_HASWELL_ULT: /* HSW */ + case INTEL_FAM6_BROADWELL_CORE: /* BDW */ + case INTEL_FAM6_SKYLAKE_MOBILE: /* SKL */ + case INTEL_FAM6_CANNONLAKE_MOBILE: /* CNL */ +@@ -4570,9 +4575,6 @@ unsigned int intel_model_duplicates(unsigned int model) + case INTEL_FAM6_XEON_PHI_KNM: + return INTEL_FAM6_XEON_PHI_KNL; + +- case INTEL_FAM6_HASWELL_ULT: +- return INTEL_FAM6_HASWELL_CORE; +- + case INTEL_FAM6_BROADWELL_X: + case INTEL_FAM6_BROADWELL_XEON_D: /* BDX-DE */ + return INTEL_FAM6_BROADWELL_X; +-- +2.20.1 + diff --git a/queue-5.2/tools-power-turbostat-fix-leak-of-file-descriptor-on.patch b/queue-5.2/tools-power-turbostat-fix-leak-of-file-descriptor-on.patch new file mode 100644 index 00000000000..7d192ed76eb --- /dev/null +++ b/queue-5.2/tools-power-turbostat-fix-leak-of-file-descriptor-on.patch @@ -0,0 +1,36 @@ +From a5ad6d2bc9972bda2d8c642df99f15bea8723caf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2019 10:00:44 +0100 +Subject: tools/power turbostat: fix leak of file descriptor on error return + path + +From: Colin Ian King + +[ Upstream commit 15423b958f33132152e209e98df0dedc7a78f22c ] + +Currently the error return path does not close the file fp and leaks +a file descriptor. Fix this by closing the file. + +Fixes: 5ea7647b333f ("tools/power turbostat: Warn on bad ACPI LPIT data") +Signed-off-by: Colin Ian King +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 1cd28ebf8443b..efc8d07364c61 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -2938,6 +2938,7 @@ int snapshot_sys_lpi_us(void) + if (retval != 1) { + fprintf(stderr, "Disabling Low Power Idle System output\n"); + BIC_NOT_PRESENT(BIC_SYS_LPI); ++ fclose(fp); + return -1; + } + fclose(fp); +-- +2.20.1 + diff --git a/queue-5.2/tools-power-x86_energy_perf_policy-fix-argument-pars.patch b/queue-5.2/tools-power-x86_energy_perf_policy-fix-argument-pars.patch new file mode 100644 index 00000000000..029c3390b15 --- /dev/null +++ b/queue-5.2/tools-power-x86_energy_perf_policy-fix-argument-pars.patch @@ -0,0 +1,48 @@ +From 95437d03befb5a7a7032c4dad39127cfb923c2ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Feb 2019 05:25:48 -0800 +Subject: tools/power x86_energy_perf_policy: Fix argument parsing + +From: Zephaniah E. Loss-Cutler-Hull + +[ Upstream commit 03531482402a2bc4ab93cf6dde46833775e035e9 ] + +The -w argument in x86_energy_perf_policy currently triggers an +unconditional segfault. + +This is because the argument string reads: "+a:c:dD:E:e:f:m:M:rt:u:vw" and +yet the argument handler expects an argument. + +When parse_optarg_string is called with a null argument, we then proceed to +crash in strncmp, not horribly friendly. + +The man page describes -w as taking an argument, the long form +(--hwp-window) is correctly marked as taking a required argument, and the +code expects it. + +As such, this patch simply marks the short form (-w) as requiring an +argument. + +Signed-off-by: Zephaniah E. Loss-Cutler-Hull +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +index 7663abef51e96..3fe1eed900d41 100644 +--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c ++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +@@ -545,7 +545,7 @@ void cmdline(int argc, char **argv) + + progname = argv[0]; + +- while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw", ++ while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw:", + long_options, &option_index)) != -1) { + switch (opt) { + case 'a': +-- +2.20.1 + diff --git a/queue-5.2/tools-power-x86_energy_perf_policy-fix-uninitialized.patch b/queue-5.2/tools-power-x86_energy_perf_policy-fix-uninitialized.patch new file mode 100644 index 00000000000..f023f064a33 --- /dev/null +++ b/queue-5.2/tools-power-x86_energy_perf_policy-fix-uninitialized.patch @@ -0,0 +1,105 @@ +From 806d54ab65cefb07869ecff2e60731ec75bd028d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Sep 2018 16:05:53 +0100 +Subject: tools/power x86_energy_perf_policy: Fix "uninitialized variable" + warnings at -O2 + +From: Ben Hutchings + +[ Upstream commit adb8049097a9ec4acd09fbd3aa8636199a78df8a ] + +x86_energy_perf_policy first uses __get_cpuid() to check the maximum +CPUID level and exits if it is too low. It then assumes that later +calls will succeed (which I think is architecturally guaranteed). It +also assumes that CPUID works at all (which is not guaranteed on +x86_32). + +If optimisations are enabled, gcc warns about potentially +uninitialized variables. Fix this by adding an exit-on-error after +every call to __get_cpuid() instead of just checking the maximum +level. + +Signed-off-by: Ben Hutchings +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + .../x86_energy_perf_policy.c | 26 +++++++++++-------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +index 34a796b303fe2..7663abef51e96 100644 +--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c ++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +@@ -1259,6 +1259,15 @@ void probe_dev_msr(void) + if (system("/sbin/modprobe msr > /dev/null 2>&1")) + err(-5, "no /dev/cpu/0/msr, Try \"# modprobe msr\" "); + } ++ ++static void get_cpuid_or_exit(unsigned int leaf, ++ unsigned int *eax, unsigned int *ebx, ++ unsigned int *ecx, unsigned int *edx) ++{ ++ if (!__get_cpuid(leaf, eax, ebx, ecx, edx)) ++ errx(1, "Processor not supported\n"); ++} ++ + /* + * early_cpuid() + * initialize turbo_is_enabled, has_hwp, has_epb +@@ -1266,15 +1275,10 @@ void probe_dev_msr(void) + */ + void early_cpuid(void) + { +- unsigned int eax, ebx, ecx, edx, max_level; ++ unsigned int eax, ebx, ecx, edx; + unsigned int fms, family, model; + +- __get_cpuid(0, &max_level, &ebx, &ecx, &edx); +- +- if (max_level < 6) +- errx(1, "Processor not supported\n"); +- +- __get_cpuid(1, &fms, &ebx, &ecx, &edx); ++ get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx); + family = (fms >> 8) & 0xf; + model = (fms >> 4) & 0xf; + if (family == 6 || family == 0xf) +@@ -1288,7 +1292,7 @@ void early_cpuid(void) + bdx_highest_ratio = msr & 0xFF; + } + +- __get_cpuid(0x6, &eax, &ebx, &ecx, &edx); ++ get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx); + turbo_is_enabled = (eax >> 1) & 1; + has_hwp = (eax >> 7) & 1; + has_epb = (ecx >> 3) & 1; +@@ -1306,7 +1310,7 @@ void parse_cpuid(void) + + eax = ebx = ecx = edx = 0; + +- __get_cpuid(0, &max_level, &ebx, &ecx, &edx); ++ get_cpuid_or_exit(0, &max_level, &ebx, &ecx, &edx); + + if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e) + genuine_intel = 1; +@@ -1315,7 +1319,7 @@ void parse_cpuid(void) + fprintf(stderr, "CPUID(0): %.4s%.4s%.4s ", + (char *)&ebx, (char *)&edx, (char *)&ecx); + +- __get_cpuid(1, &fms, &ebx, &ecx, &edx); ++ get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx); + family = (fms >> 8) & 0xf; + model = (fms >> 4) & 0xf; + stepping = fms & 0xf; +@@ -1340,7 +1344,7 @@ void parse_cpuid(void) + errx(1, "CPUID: no MSR"); + + +- __get_cpuid(0x6, &eax, &ebx, &ecx, &edx); ++ get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx); + /* turbo_is_enabled already set */ + /* has_hwp already set */ + has_hwp_notify = eax & (1 << 8); +-- +2.20.1 + diff --git a/queue-5.2/usb-host-xhci-tegra-set-dma-mask-correctly.patch b/queue-5.2/usb-host-xhci-tegra-set-dma-mask-correctly.patch new file mode 100644 index 00000000000..6494a1c949b --- /dev/null +++ b/queue-5.2/usb-host-xhci-tegra-set-dma-mask-correctly.patch @@ -0,0 +1,57 @@ +From c8a0bee7d32f91c1dcd5eecf50952a0b5e0a7243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 16:24:57 +0530 +Subject: usb: host: xhci-tegra: Set DMA mask correctly + +From: Nagarjuna Kristam + +[ Upstream commit 993cc8753453fccfe060a535bbe21fcf1001b626 ] + +The Falcon microcontroller that runs the XUSB firmware and which is +responsible for exposing the XHCI interface can address only 40 bits of +memory. Typically that's not a problem because Tegra devices don't have +enough system memory to exceed those 40 bits. + +However, if the ARM SMMU is enable on Tegra186 and later, the addresses +passed to the XUSB controller can be anywhere in the 48-bit IOV address +space of the ARM SMMU. Since the DMA/IOMMU API starts allocating from +the top of the IOVA space, the Falcon microcontroller is not able to +load the firmware successfully. + +Fix this by setting the DMA mask to 40 bits, which will force the DMA +API to map the buffer for the firmware to an IOVA that is addressable by +the Falcon. + +Signed-off-by: Nagarjuna Kristam +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/1566989697-13049-1-git-send-email-nkristam@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-tegra.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 294158113d62c..77142f9bf26ae 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1217,6 +1217,16 @@ static int tegra_xusb_probe(struct platform_device *pdev) + + tegra_xusb_config(tegra, regs); + ++ /* ++ * The XUSB Falcon microcontroller can only address 40 bits, so set ++ * the DMA mask accordingly. ++ */ ++ err = dma_set_mask_and_coherent(tegra->dev, DMA_BIT_MASK(40)); ++ if (err < 0) { ++ dev_err(&pdev->dev, "failed to set DMA mask: %d\n", err); ++ goto put_rpm; ++ } ++ + err = tegra_xusb_load_firmware(tegra); + if (err < 0) { + dev_err(&pdev->dev, "failed to load firmware: %d\n", err); +-- +2.20.1 + diff --git a/queue-5.2/x86-apic-fix-arch_dynirq_lower_bound-bug-for-dt-enab.patch b/queue-5.2/x86-apic-fix-arch_dynirq_lower_bound-bug-for-dt-enab.patch new file mode 100644 index 00000000000..ef5d859c0c1 --- /dev/null +++ b/queue-5.2/x86-apic-fix-arch_dynirq_lower_bound-bug-for-dt-enab.patch @@ -0,0 +1,71 @@ +From 93d13318e549fce42b178236ebb84ccb1857cc84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2019 15:16:31 +0200 +Subject: x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines + +From: Thomas Gleixner + +[ Upstream commit 3e5bedc2c258341702ddffbd7688c5e6eb01eafa ] + +Rahul Tanwar reported the following bug on DT systems: + +> 'ioapic_dynirq_base' contains the virtual IRQ base number. Presently, it is +> updated to the end of hardware IRQ numbers but this is done only when IOAPIC +> configuration type is IOAPIC_DOMAIN_LEGACY or IOAPIC_DOMAIN_STRICT. There is +> a third type IOAPIC_DOMAIN_DYNAMIC which applies when IOAPIC configuration +> comes from devicetree. +> +> See dtb_add_ioapic() in arch/x86/kernel/devicetree.c +> +> In case of IOAPIC_DOMAIN_DYNAMIC (DT/OF based system), 'ioapic_dynirq_base' +> remains to zero initialized value. This means that for OF based systems, +> virtual IRQ base will get set to zero. + +Such systems will very likely not even boot. + +For DT enabled machines ioapic_dynirq_base is irrelevant and not +updated, so simply map the IRQ base 1:1 instead. + +Reported-by: Rahul Tanwar +Tested-by: Rahul Tanwar +Tested-by: Andy Shevchenko +Signed-off-by: Thomas Gleixner +Cc: Alexander Shishkin +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: alan@linux.intel.com +Cc: bp@alien8.de +Cc: cheol.yong.kim@intel.com +Cc: qi-ming.wu@intel.com +Cc: rahul.tanwar@intel.com +Cc: rppt@linux.ibm.com +Cc: tony.luck@intel.com +Link: http://lkml.kernel.org/r/20190821081330.1187-1-rahul.tanwar@linux.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index c9fec0657eea2..e8c6466ef65ed 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2434,7 +2434,13 @@ unsigned int arch_dynirq_lower_bound(unsigned int from) + * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use + * gsi_top if ioapic_dynirq_base hasn't been initialized yet. + */ +- return ioapic_initialized ? ioapic_dynirq_base : gsi_top; ++ if (!ioapic_initialized) ++ return gsi_top; ++ /* ++ * For DT enabled machines ioapic_dynirq_base is irrelevant and not ++ * updated. So simply return @from if ioapic_dynirq_base == 0. ++ */ ++ return ioapic_dynirq_base ? : from; + } + + #ifdef CONFIG_X86_32 +-- +2.20.1 + diff --git a/queue-5.2/x86-hyper-v-fix-overflow-bug-in-fill_gva_list.patch b/queue-5.2/x86-hyper-v-fix-overflow-bug-in-fill_gva_list.patch new file mode 100644 index 00000000000..f853eb3d43b --- /dev/null +++ b/queue-5.2/x86-hyper-v-fix-overflow-bug-in-fill_gva_list.patch @@ -0,0 +1,58 @@ +From 1059ae5820a5da0a47cca8c79c80673c5f6853ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2019 20:41:43 +0800 +Subject: x86/hyper-v: Fix overflow bug in fill_gva_list() + +From: Tianyu Lan + +[ Upstream commit 4030b4c585c41eeefec7bd20ce3d0e100a0f2e4d ] + +When the 'start' parameter is >= 0xFF000000 on 32-bit +systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems, +fill_gva_list() gets into an infinite loop. + +With such inputs, 'cur' overflows after adding HV_TLB_FLUSH_UNIT +and always compares as less than end. Memory is filled with +guest virtual addresses until the system crashes. + +Fix this by never incrementing 'cur' to be larger than 'end'. + +Reported-by: Jong Hyun Park +Signed-off-by: Tianyu Lan +Reviewed-by: Michael Kelley +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 2ffd9e33ce4a ("x86/hyper-v: Use hypercall for remote TLB flush") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/mmu.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c +index e65d7fe6489f3..5208ba49c89a9 100644 +--- a/arch/x86/hyperv/mmu.c ++++ b/arch/x86/hyperv/mmu.c +@@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset, + * Lower 12 bits encode the number of additional + * pages to flush (in addition to the 'cur' page). + */ +- if (diff >= HV_TLB_FLUSH_UNIT) ++ if (diff >= HV_TLB_FLUSH_UNIT) { + gva_list[gva_n] |= ~PAGE_MASK; +- else if (diff) ++ cur += HV_TLB_FLUSH_UNIT; ++ } else if (diff) { + gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT; ++ cur = end; ++ } + +- cur += HV_TLB_FLUSH_UNIT; + gva_n++; + + } while (cur < end); +-- +2.20.1 + diff --git a/queue-5.2/x86-uaccess-don-t-leak-the-ac-flags-into-__get_user-.patch b/queue-5.2/x86-uaccess-don-t-leak-the-ac-flags-into-__get_user-.patch new file mode 100644 index 00000000000..8be702e01f9 --- /dev/null +++ b/queue-5.2/x86-uaccess-don-t-leak-the-ac-flags-into-__get_user-.patch @@ -0,0 +1,58 @@ +From e8e54c1c356fcd4b4724ed7a50cc0b6bc4452bc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 10:24:45 +0200 +Subject: x86/uaccess: Don't leak the AC flags into __get_user() argument + evaluation + +From: Peter Zijlstra + +[ Upstream commit 9b8bd476e78e89c9ea26c3b435ad0201c3d7dbf5 ] + +Identical to __put_user(); the __get_user() argument evalution will too +leak UBSAN crud into the __uaccess_begin() / __uaccess_end() region. +While uncommon this was observed to happen for: + + drivers/xen/gntdev.c: if (__get_user(old_status, batch->status[i])) + +where UBSAN added array bound checking. + +This complements commit: + + 6ae865615fc4 ("x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation") + +Tested-by Sedat Dilek +Reported-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Josh Poimboeuf +Reviewed-by: Thomas Gleixner +Cc: broonie@kernel.org +Cc: sfr@canb.auug.org.au +Cc: akpm@linux-foundation.org +Cc: Randy Dunlap +Cc: mhocko@suse.cz +Cc: Josh Poimboeuf +Link: https://lkml.kernel.org/r/20190829082445.GM2369@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/uaccess.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index c82abd6e4ca39..869794bd0fd98 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -442,8 +442,10 @@ __pu_label: \ + ({ \ + int __gu_err; \ + __inttype(*(ptr)) __gu_val; \ ++ __typeof__(ptr) __gu_ptr = (ptr); \ ++ __typeof__(size) __gu_size = (size); \ + __uaccess_begin_nospec(); \ +- __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ ++ __get_user_size(__gu_val, __gu_ptr, __gu_size, __gu_err, -EFAULT); \ + __uaccess_end(); \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ + __builtin_expect(__gu_err, 0); \ +-- +2.20.1 + diff --git a/queue-5.2/xdp-unpin-xdp-umem-pages-in-error-path.patch b/queue-5.2/xdp-unpin-xdp-umem-pages-in-error-path.patch new file mode 100644 index 00000000000..e57b6e1ee4e --- /dev/null +++ b/queue-5.2/xdp-unpin-xdp-umem-pages-in-error-path.patch @@ -0,0 +1,45 @@ +From a6bc598d106ea804a7d2588064ce573ea9f712dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 23:56:35 +0300 +Subject: xdp: unpin xdp umem pages in error path + +From: Ivan Khoronzhuk + +[ Upstream commit fb89c39455e4b49881c5a42761bd71f03d3ef888 ] + +Fix mem leak caused by missed unpin routine for umem pages. + +Fixes: 8aef7340ae9695 ("xsk: introduce xdp_umem_page") +Signed-off-by: Ivan Khoronzhuk +Acked-by: Jonathan Lemon +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/xdp/xdp_umem.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c +index 9c6de4f114f84..9bd7b96027c12 100644 +--- a/net/xdp/xdp_umem.c ++++ b/net/xdp/xdp_umem.c +@@ -368,7 +368,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL); + if (!umem->pages) { + err = -ENOMEM; +- goto out_account; ++ goto out_pin; + } + + for (i = 0; i < umem->npgs; i++) +@@ -376,6 +376,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) + + return 0; + ++out_pin: ++ xdp_umem_unpin_pages(umem); + out_account: + xdp_umem_unaccount_pages(umem); + return err; +-- +2.20.1 +