From: Sasha Levin Date: Wed, 14 Aug 2019 02:33:31 +0000 (-0400) Subject: fixes for 5.2 X-Git-Tag: v5.2.9~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=706383773b598b10c0ef4dfb61b02f568205ae9f;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.2 Signed-off-by: Sasha Levin --- diff --git a/queue-5.2/acpi-iort-fix-off-by-one-check-in-iort_dev_find_its_.patch b/queue-5.2/acpi-iort-fix-off-by-one-check-in-iort_dev_find_its_.patch new file mode 100644 index 00000000000..fbaed6a580f --- /dev/null +++ b/queue-5.2/acpi-iort-fix-off-by-one-check-in-iort_dev_find_its_.patch @@ -0,0 +1,48 @@ +From 7db24d1dbde8d04329cad020882a6c0d38e107c6 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 22 Jul 2019 17:25:48 +0100 +Subject: ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() + +[ Upstream commit 5a46d3f71d5e5a9f82eabc682f996f1281705ac7 ] + +Static analysis identified that index comparison against ITS entries in +iort_dev_find_its_id() is off by one. + +Update the comparison condition and clarify the resulting error +message. + +Fixes: 4bf2efd26d76 ("ACPI: Add new IORT functions to support MSI domain handling") +Link: https://lore.kernel.org/linux-arm-kernel/20190613065410.GB16334@mwanda/ +Reviewed-by: Hanjun Guo +Reported-by: Dan Carpenter +Signed-off-by: Lorenzo Pieralisi +Cc: Dan Carpenter +Cc: Will Deacon +Cc: Hanjun Guo +Cc: Sudeep Holla +Cc: Catalin Marinas +Cc: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/acpi/arm64/iort.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c +index d4551e33fa716..8569b79e8b581 100644 +--- a/drivers/acpi/arm64/iort.c ++++ b/drivers/acpi/arm64/iort.c +@@ -611,8 +611,8 @@ static int iort_dev_find_its_id(struct device *dev, u32 req_id, + + /* Move to ITS specific data */ + its = (struct acpi_iort_its_group *)node->node_data; +- if (idx > its->its_count) { +- dev_err(dev, "requested ITS ID index [%d] is greater than available [%d]\n", ++ if (idx >= its->its_count) { ++ dev_err(dev, "requested ITS ID index [%d] overruns ITS entries [%d]\n", + idx, its->its_count); + return -ENXIO; + } +-- +2.20.1 + diff --git a/queue-5.2/allocate_flower_entry-should-check-for-null-deref.patch b/queue-5.2/allocate_flower_entry-should-check-for-null-deref.patch new file mode 100644 index 00000000000..fb414ff78ce --- /dev/null +++ b/queue-5.2/allocate_flower_entry-should-check-for-null-deref.patch @@ -0,0 +1,35 @@ +From 65038394b045a77a3d27a8aafeb2640a76540ec0 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sun, 21 Jul 2019 01:37:31 -0500 +Subject: allocate_flower_entry: should check for null deref + +[ Upstream commit bb1320834b8a80c6ac2697ab418d066981ea08ba ] + +allocate_flower_entry does not check for allocation success, but tries +to deref the result. I only moved the spin_lock under null check, because + the caller is checking allocation's status at line 652. + +Signed-off-by: Navid Emamdoost +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c +index cfaf8f618d1f3..56742fa0c1af6 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c +@@ -67,7 +67,8 @@ static struct ch_tc_pedit_fields pedits[] = { + static struct ch_tc_flower_entry *allocate_flower_entry(void) + { + struct ch_tc_flower_entry *new = kzalloc(sizeof(*new), GFP_KERNEL); +- spin_lock_init(&new->lock); ++ if (new) ++ spin_lock_init(&new->lock); + return new; + } + +-- +2.20.1 + diff --git a/queue-5.2/alsa-compress-be-more-restrictive-about-when-a-drain.patch b/queue-5.2/alsa-compress-be-more-restrictive-about-when-a-drain.patch new file mode 100644 index 00000000000..6485522bad9 --- /dev/null +++ b/queue-5.2/alsa-compress-be-more-restrictive-about-when-a-drain.patch @@ -0,0 +1,49 @@ +From 914a71de183948418ca3c32874e1abf1c938504d Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 22 Jul 2019 10:24:36 +0100 +Subject: ALSA: compress: Be more restrictive about when a drain is allowed + +[ Upstream commit 3b8179944cb0dd53e5223996966746cdc8a60657 ] + +Draining makes little sense in the situation of hardware overrun, as the +hardware will have consumed all its available samples. Additionally, +draining whilst the stream is paused would presumably get stuck as no +data is being consumed on the DSP side. + +Signed-off-by: Charles Keepax +Acked-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 6cf5b8440cf30..41905afada63f 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -811,7 +811,10 @@ static int snd_compr_drain(struct snd_compr_stream *stream) + case SNDRV_PCM_STATE_OPEN: + case SNDRV_PCM_STATE_SETUP: + case SNDRV_PCM_STATE_PREPARED: ++ case SNDRV_PCM_STATE_PAUSED: + return -EPERM; ++ case SNDRV_PCM_STATE_XRUN: ++ return -EPIPE; + default: + break; + } +@@ -860,7 +863,10 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) + case SNDRV_PCM_STATE_OPEN: + case SNDRV_PCM_STATE_SETUP: + case SNDRV_PCM_STATE_PREPARED: ++ case SNDRV_PCM_STATE_PAUSED: + return -EPERM; ++ case SNDRV_PCM_STATE_XRUN: ++ return -EPIPE; + default: + break; + } +-- +2.20.1 + diff --git a/queue-5.2/alsa-compress-don-t-allow-paritial-drain-operations-.patch b/queue-5.2/alsa-compress-don-t-allow-paritial-drain-operations-.patch new file mode 100644 index 00000000000..d3f6a1ea217 --- /dev/null +++ b/queue-5.2/alsa-compress-don-t-allow-paritial-drain-operations-.patch @@ -0,0 +1,49 @@ +From a9b8e60b440b065f92343b78a14e071fcd67ed4a Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 22 Jul 2019 10:24:35 +0100 +Subject: ALSA: compress: Don't allow paritial drain operations on capture + streams + +[ Upstream commit a70ab8a8645083f3700814e757f2940a88b7ef88 ] + +Partial drain and next track are intended for gapless playback and +don't really have an obvious interpretation for a capture stream, so +makes sense to not allow those operations on capture streams. + +Signed-off-by: Charles Keepax +Acked-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 40dae723c59db..6cf5b8440cf30 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -834,6 +834,10 @@ static int snd_compr_next_track(struct snd_compr_stream *stream) + if (stream->runtime->state != SNDRV_PCM_STATE_RUNNING) + return -EPERM; + ++ /* next track doesn't have any meaning for capture streams */ ++ if (stream->direction == SND_COMPRESS_CAPTURE) ++ return -EPERM; ++ + /* you can signal next track if this is intended to be a gapless stream + * and current track metadata is set + */ +@@ -861,6 +865,10 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) + break; + } + ++ /* partial drain doesn't have any meaning for capture streams */ ++ if (stream->direction == SND_COMPRESS_CAPTURE) ++ return -EPERM; ++ + /* stream can be drained only when next track has been signalled */ + if (stream->next_track == false) + return -EPERM; +-- +2.20.1 + diff --git a/queue-5.2/alsa-compress-fix-regression-on-compressed-capture-s.patch b/queue-5.2/alsa-compress-fix-regression-on-compressed-capture-s.patch new file mode 100644 index 00000000000..5ba8f3adc29 --- /dev/null +++ b/queue-5.2/alsa-compress-fix-regression-on-compressed-capture-s.patch @@ -0,0 +1,82 @@ +From 85aa66d61e536cd76d941c290c66805b4e895971 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 22 Jul 2019 10:24:33 +0100 +Subject: ALSA: compress: Fix regression on compressed capture streams + +[ Upstream commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 ] + +A previous fix to the stop handling on compressed capture streams causes +some knock on issues. The previous fix updated snd_compr_drain_notify to +set the state back to PREPARED for capture streams. This causes some +issues however as the handling for snd_compr_poll differs between the +two states and some user-space applications were relying on the poll +failing after the stream had been stopped. + +To correct this regression whilst still fixing the original problem the +patch was addressing, update the capture handling to skip the PREPARED +state rather than skipping the SETUP state as it has done until now. + +Fixes: 4f2ab5e1d13d ("ALSA: compress: Fix stop handling on compressed capture streams") +Signed-off-by: Charles Keepax +Acked-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/compress_driver.h | 5 +---- + sound/core/compress_offload.c | 16 +++++++++++----- + 2 files changed, 12 insertions(+), 9 deletions(-) + +diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h +index c5188ff724d12..bc88d6f964da9 100644 +--- a/include/sound/compress_driver.h ++++ b/include/sound/compress_driver.h +@@ -173,10 +173,7 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) + if (snd_BUG_ON(!stream)) + return; + +- if (stream->direction == SND_COMPRESS_PLAYBACK) +- stream->runtime->state = SNDRV_PCM_STATE_SETUP; +- else +- stream->runtime->state = SNDRV_PCM_STATE_PREPARED; ++ stream->runtime->state = SNDRV_PCM_STATE_SETUP; + + wake_up(&stream->runtime->sleep); + } +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 99b8821587053..d79aee6b9edd2 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -574,10 +574,7 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) + stream->metadata_set = false; + stream->next_track = false; + +- if (stream->direction == SND_COMPRESS_PLAYBACK) +- stream->runtime->state = SNDRV_PCM_STATE_SETUP; +- else +- stream->runtime->state = SNDRV_PCM_STATE_PREPARED; ++ stream->runtime->state = SNDRV_PCM_STATE_SETUP; + } else { + return -EPERM; + } +@@ -693,8 +690,17 @@ static int snd_compr_start(struct snd_compr_stream *stream) + { + int retval; + +- if (stream->runtime->state != SNDRV_PCM_STATE_PREPARED) ++ switch (stream->runtime->state) { ++ case SNDRV_PCM_STATE_SETUP: ++ if (stream->direction != SND_COMPRESS_CAPTURE) ++ return -EPERM; ++ break; ++ case SNDRV_PCM_STATE_PREPARED: ++ break; ++ default: + return -EPERM; ++ } ++ + retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_START); + if (!retval) + stream->runtime->state = SNDRV_PCM_STATE_RUNNING; +-- +2.20.1 + diff --git a/queue-5.2/alsa-compress-prevent-bypasses-of-set_params.patch b/queue-5.2/alsa-compress-prevent-bypasses-of-set_params.patch new file mode 100644 index 00000000000..d8480e6fe02 --- /dev/null +++ b/queue-5.2/alsa-compress-prevent-bypasses-of-set_params.patch @@ -0,0 +1,83 @@ +From bb6585aff70343562f156c09bc749047a56dd021 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 22 Jul 2019 10:24:34 +0100 +Subject: ALSA: compress: Prevent bypasses of set_params + +[ Upstream commit 26c3f1542f5064310ad26794c09321780d00c57d ] + +Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call +snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which +allow a transition to SNDRV_PCM_STATE_SETUP. The stream should +only be able to move to the setup state once it has received a +SNDRV_COMPRESS_SET_PARAMS ioctl. Fix this issue by not allowing +those ioctls whilst in the open state. + +Signed-off-by: Charles Keepax +Acked-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index d79aee6b9edd2..40dae723c59db 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -711,9 +711,15 @@ static int snd_compr_stop(struct snd_compr_stream *stream) + { + int retval; + +- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || +- stream->runtime->state == SNDRV_PCM_STATE_SETUP) ++ switch (stream->runtime->state) { ++ case SNDRV_PCM_STATE_OPEN: ++ case SNDRV_PCM_STATE_SETUP: ++ case SNDRV_PCM_STATE_PREPARED: + return -EPERM; ++ default: ++ break; ++ } ++ + retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); + if (!retval) { + snd_compr_drain_notify(stream); +@@ -801,9 +807,14 @@ static int snd_compr_drain(struct snd_compr_stream *stream) + { + int retval; + +- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || +- stream->runtime->state == SNDRV_PCM_STATE_SETUP) ++ switch (stream->runtime->state) { ++ case SNDRV_PCM_STATE_OPEN: ++ case SNDRV_PCM_STATE_SETUP: ++ case SNDRV_PCM_STATE_PREPARED: + return -EPERM; ++ default: ++ break; ++ } + + retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN); + if (retval) { +@@ -840,9 +851,16 @@ static int snd_compr_next_track(struct snd_compr_stream *stream) + static int snd_compr_partial_drain(struct snd_compr_stream *stream) + { + int retval; +- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || +- stream->runtime->state == SNDRV_PCM_STATE_SETUP) ++ ++ switch (stream->runtime->state) { ++ case SNDRV_PCM_STATE_OPEN: ++ case SNDRV_PCM_STATE_SETUP: ++ case SNDRV_PCM_STATE_PREPARED: + return -EPERM; ++ default: ++ break; ++ } ++ + /* stream can be drained only when next track has been signalled */ + if (stream->next_track == false) + return -EPERM; +-- +2.20.1 + diff --git a/queue-5.2/arm-davinci-fix-sleep.s-build-error-on-armv4.patch b/queue-5.2/arm-davinci-fix-sleep.s-build-error-on-armv4.patch new file mode 100644 index 00000000000..8e0b7bc3b05 --- /dev/null +++ b/queue-5.2/arm-davinci-fix-sleep.s-build-error-on-armv4.patch @@ -0,0 +1,40 @@ +From 49273a91ae2af15821660d768815a2c61d302a7e Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Jul 2019 16:51:50 +0200 +Subject: ARM: davinci: fix sleep.S build error on ARMv4 + +[ Upstream commit d64b212ea960db4276a1d8372bd98cb861dfcbb0 ] + +When building a multiplatform kernel that includes armv4 support, +the default target CPU does not support the blx instruction, +which leads to a build failure: + +arch/arm/mach-davinci/sleep.S: Assembler messages: +arch/arm/mach-davinci/sleep.S:56: Error: selected processor does not support `blx ip' in ARM mode + +Add a .arch statement in the sources to make this file build. + +Link: https://lore.kernel.org/r/20190722145211.1154785-1-arnd@arndb.de +Acked-by: Sekhar Nori +Signed-off-by: Arnd Bergmann +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-davinci/sleep.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S +index 05d03f09ff54b..71262dcdbca32 100644 +--- a/arch/arm/mach-davinci/sleep.S ++++ b/arch/arm/mach-davinci/sleep.S +@@ -24,6 +24,7 @@ + #define DEEPSLEEP_SLEEPENABLE_BIT BIT(31) + + .text ++ .arch armv5te + /* + * Move DaVinci into deep sleep state + * +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-bcm-bcm47094-add-missing-cells-for-mdio-bus-.patch b/queue-5.2/arm-dts-bcm-bcm47094-add-missing-cells-for-mdio-bus-.patch new file mode 100644 index 00000000000..7e7e5659ede --- /dev/null +++ b/queue-5.2/arm-dts-bcm-bcm47094-add-missing-cells-for-mdio-bus-.patch @@ -0,0 +1,45 @@ +From 8eb680bc4afa7fbfdade4ddf247771f11e2cd9ac Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Jul 2019 16:55:52 +0200 +Subject: ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux + +[ Upstream commit 3a9d2569e45cb02769cda26fee4a02126867c934 ] + +The mdio-bus-mux has no #address-cells/#size-cells property, +which causes a few dtc warnings: + +arch/arm/boot/dts/bcm47094-linksys-panamera.dts:129.4-18: Warning (reg_format): /mdio-bus-mux/mdio@200:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1) +arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format' +arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format' +arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format' +arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #address-cells value +arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #size-cells value + +Add the normal cell numbers. + +Link: https://lore.kernel.org/r/20190722145618.1155492-1-arnd@arndb.de +Fixes: 2bebdfcdcd0f ("ARM: dts: BCM5301X: Add support for Linksys EA9500") +Signed-off-by: Arnd Bergmann +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm47094-linksys-panamera.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts +index 5fd47eec4407e..1679959a3654d 100644 +--- a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts ++++ b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts +@@ -126,6 +126,9 @@ + }; + + mdio-bus-mux { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + /* BIT(9) = 1 => external mdio */ + mdio_ext: mdio@200 { + reg = <0x200>; +-- +2.20.1 + diff --git a/queue-5.2/arm-dts-imx6ul-fix-clock-frequency-property-name-of-.patch b/queue-5.2/arm-dts-imx6ul-fix-clock-frequency-property-name-of-.patch new file mode 100644 index 00000000000..eb390e1dd8c --- /dev/null +++ b/queue-5.2/arm-dts-imx6ul-fix-clock-frequency-property-name-of-.patch @@ -0,0 +1,103 @@ +From bf73bbc8296ce3cdca9cf837d79e2c90ddb73ed0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?= + +Date: Thu, 4 Jul 2019 13:00:53 +0200 +Subject: ARM: dts: imx6ul: fix clock frequency property name of I2C buses +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 2ca99396333999b9b5c5b91b36cbccacfe571aaf ] + +A few boards set clock frequency of their I2C buses with +"clock_frequency" property. The right property is "clock-frequency". + +Signed-off-by: Sébastien Szymanski +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- + arch/arm/boot/dts/imx6ul-geam.dts | 2 +- + arch/arm/boot/dts/imx6ul-isiot.dtsi | 2 +- + arch/arm/boot/dts/imx6ul-pico-hobbit.dts | 2 +- + arch/arm/boot/dts/imx6ul-pico-pi.dts | 4 ++-- + 5 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +index 9207d5d071f11..d556f7c541ce6 100644 +--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi ++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +@@ -112,7 +112,7 @@ + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6ul-geam.dts b/arch/arm/boot/dts/imx6ul-geam.dts +index bc77f26a2f1de..6157a058feec9 100644 +--- a/arch/arm/boot/dts/imx6ul-geam.dts ++++ b/arch/arm/boot/dts/imx6ul-geam.dts +@@ -156,7 +156,7 @@ + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6ul-isiot.dtsi b/arch/arm/boot/dts/imx6ul-isiot.dtsi +index 213e802bf35c5..23e6e2e7ace9d 100644 +--- a/arch/arm/boot/dts/imx6ul-isiot.dtsi ++++ b/arch/arm/boot/dts/imx6ul-isiot.dtsi +@@ -148,7 +148,7 @@ + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts +index 39eeeddac39e3..09f7ffa9ad8c4 100644 +--- a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts ++++ b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts +@@ -43,7 +43,7 @@ + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx6ul-pico-pi.dts b/arch/arm/boot/dts/imx6ul-pico-pi.dts +index de07357b27fc2..6cd7d5877d20c 100644 +--- a/arch/arm/boot/dts/imx6ul-pico-pi.dts ++++ b/arch/arm/boot/dts/imx6ul-pico-pi.dts +@@ -43,7 +43,7 @@ + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +@@ -58,7 +58,7 @@ + }; + + &i2c3 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c3>; + status = "okay"; +-- +2.20.1 + diff --git a/queue-5.2/arm64-dts-imx8mm-correct-sai3-rxc-txfs-pin-s-mux-opt.patch b/queue-5.2/arm64-dts-imx8mm-correct-sai3-rxc-txfs-pin-s-mux-opt.patch new file mode 100644 index 00000000000..11b05c7c5dd --- /dev/null +++ b/queue-5.2/arm64-dts-imx8mm-correct-sai3-rxc-txfs-pin-s-mux-opt.patch @@ -0,0 +1,45 @@ +From 814f5c32c7a475d8cb4abe6268873b903b538ca7 Mon Sep 17 00:00:00 2001 +From: Anson Huang +Date: Tue, 16 Jul 2019 11:09:33 +0800 +Subject: arm64: dts: imx8mm: Correct SAI3 RXC/TXFS pin's mux option #1 + +[ Upstream commit 52d09014bb104a9157c0f5530700291052d2955c ] + +According to i.MX8MM reference manual Rev.1, 03/2019: + +SAI3_RXC pin's mux option #1 should be GPT1_CLK, NOT GPT1_CAPTURE2; +SAI3_TXFS pin's mux option #1 should be GPT1_CAPTURE2, NOT GPT1_CLK. + +Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm") +Signed-off-by: Anson Huang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +index e25f7fcd79975..cffa8991880d1 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h ++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +@@ -462,7 +462,7 @@ + #define MX8MM_IOMUXC_SAI3_RXFS_GPIO4_IO28 0x1CC 0x434 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SAI3_RXFS_TPSMP_HTRANS0 0x1CC 0x434 0x000 0x7 0x0 + #define MX8MM_IOMUXC_SAI3_RXC_SAI3_RX_BCLK 0x1D0 0x438 0x000 0x0 0x0 +-#define MX8MM_IOMUXC_SAI3_RXC_GPT1_CAPTURE2 0x1D0 0x438 0x000 0x1 0x0 ++#define MX8MM_IOMUXC_SAI3_RXC_GPT1_CLK 0x1D0 0x438 0x000 0x1 0x0 + #define MX8MM_IOMUXC_SAI3_RXC_SAI5_RX_BCLK 0x1D0 0x438 0x4D0 0x2 0x2 + #define MX8MM_IOMUXC_SAI3_RXC_GPIO4_IO29 0x1D0 0x438 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SAI3_RXC_TPSMP_HTRANS1 0x1D0 0x438 0x000 0x7 0x0 +@@ -472,7 +472,7 @@ + #define MX8MM_IOMUXC_SAI3_RXD_GPIO4_IO30 0x1D4 0x43C 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SAI3_RXD_TPSMP_HDATA0 0x1D4 0x43C 0x000 0x7 0x0 + #define MX8MM_IOMUXC_SAI3_TXFS_SAI3_TX_SYNC 0x1D8 0x440 0x000 0x0 0x0 +-#define MX8MM_IOMUXC_SAI3_TXFS_GPT1_CLK 0x1D8 0x440 0x000 0x1 0x0 ++#define MX8MM_IOMUXC_SAI3_TXFS_GPT1_CAPTURE2 0x1D8 0x440 0x000 0x1 0x0 + #define MX8MM_IOMUXC_SAI3_TXFS_SAI5_RX_DATA1 0x1D8 0x440 0x4D8 0x2 0x2 + #define MX8MM_IOMUXC_SAI3_TXFS_GPIO4_IO31 0x1D8 0x440 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SAI3_TXFS_TPSMP_HDATA1 0x1D8 0x440 0x000 0x7 0x0 +-- +2.20.1 + diff --git a/queue-5.2/arm64-dts-imx8mq-fix-sai-compatible.patch b/queue-5.2/arm64-dts-imx8mq-fix-sai-compatible.patch new file mode 100644 index 00000000000..982e11b4f69 --- /dev/null +++ b/queue-5.2/arm64-dts-imx8mq-fix-sai-compatible.patch @@ -0,0 +1,37 @@ +From 507c3b57bd2e42efcfd166570f86ffafb1be9403 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Wed, 17 Jul 2019 11:54:36 +0200 +Subject: arm64: dts: imx8mq: fix SAI compatible + +[ Upstream commit 8d0148473dece51675d11dd59b8db5fe4b5d2e7e ] + +The i.MX8M SAI block is not compatible with the i.MX6SX one, as the +register layout has changed due to two version registers being added +at the beginning of the address map. Remove the bogus compatible. + +Fixes: 8c61538dc945 ("arm64: dts: imx8mq: Add SAI2 node") +Signed-off-by: Lucas Stach +Reviewed-by: Daniel Baluta +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 6d635ba0904c5..6632cbd88bed3 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -675,8 +675,7 @@ + + sai2: sai@308b0000 { + #sound-dai-cells = <0>; +- compatible = "fsl,imx8mq-sai", +- "fsl,imx6sx-sai"; ++ compatible = "fsl,imx8mq-sai"; + reg = <0x308b0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MQ_CLK_SAI2_IPG>, +-- +2.20.1 + diff --git a/queue-5.2/arm64-entry-sp-alignment-fault-doesn-t-write-to-far_.patch b/queue-5.2/arm64-entry-sp-alignment-fault-doesn-t-write-to-far_.patch new file mode 100644 index 00000000000..ffc45d90d8c --- /dev/null +++ b/queue-5.2/arm64-entry-sp-alignment-fault-doesn-t-write-to-far_.patch @@ -0,0 +1,103 @@ +From aa1075d5ca12e511a2f2ee2aa6e27fb66399bb4a Mon Sep 17 00:00:00 2001 +From: James Morse +Date: Mon, 22 Jul 2019 16:11:48 +0100 +Subject: arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 + +[ Upstream commit 40ca0ce56d4bb889dc43b455c55398468115569a ] + +Comparing the arm-arm's pseudocode for AArch64.PCAlignmentFault() with +AArch64.SPAlignmentFault() shows that SP faults don't copy the faulty-SP +to FAR_EL1, but this is where we read from, and the address we provide +to user-space with the BUS_ADRALN signal. + +For user-space this value will be UNKNOWN due to the previous ERET to +user-space. If the last value is preserved, on systems with KASLR or KPTI +this will be the user-space link-register left in FAR_EL1 by tramp_exit(). +Fix this to retrieve the original sp_el0 value, and pass this to +do_sp_pc_fault(). + +SP alignment faults from EL1 will cause us to take the fault again when +trying to store the pt_regs. This eventually takes us to the overflow +stack. Remove the ESR_ELx_EC_SP_ALIGN check as we will never make it +this far. + +Fixes: 60ffc30d5652 ("arm64: Exception handling") +Signed-off-by: James Morse +[will: change label name and fleshed out comment] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/entry.S | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 9cdc4592da3ef..320a30dbe35ef 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -586,10 +586,8 @@ el1_sync: + b.eq el1_ia + cmp x24, #ESR_ELx_EC_SYS64 // configurable trap + b.eq el1_undef +- cmp x24, #ESR_ELx_EC_SP_ALIGN // stack alignment exception +- b.eq el1_sp_pc + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el1_sp_pc ++ b.eq el1_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL1 + b.eq el1_undef + cmp x24, #ESR_ELx_EC_BREAKPT_CUR // debug exception in EL1 +@@ -611,9 +609,11 @@ el1_da: + bl do_mem_abort + + kernel_exit 1 +-el1_sp_pc: ++el1_pc: + /* +- * Stack or PC alignment exception handling ++ * PC alignment exception handling. We don't handle SP alignment faults, ++ * since we will have hit a recursive exception when trying to push the ++ * initial pt_regs. + */ + mrs x0, far_el1 + inherit_daif pstate=x23, tmp=x2 +@@ -732,9 +732,9 @@ el0_sync: + ccmp x24, #ESR_ELx_EC_WFx, #4, ne + b.eq el0_sys + cmp x24, #ESR_ELx_EC_SP_ALIGN // stack alignment exception +- b.eq el0_sp_pc ++ b.eq el0_sp + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el0_sp_pc ++ b.eq el0_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL0 + b.eq el0_undef + cmp x24, #ESR_ELx_EC_BREAKPT_LOW // debug exception in EL0 +@@ -758,7 +758,7 @@ el0_sync_compat: + cmp x24, #ESR_ELx_EC_FP_EXC32 // FP/ASIMD exception + b.eq el0_fpsimd_exc + cmp x24, #ESR_ELx_EC_PC_ALIGN // pc alignment exception +- b.eq el0_sp_pc ++ b.eq el0_pc + cmp x24, #ESR_ELx_EC_UNKNOWN // unknown exception in EL0 + b.eq el0_undef + cmp x24, #ESR_ELx_EC_CP15_32 // CP15 MRC/MCR trap +@@ -858,11 +858,15 @@ el0_fpsimd_exc: + mov x1, sp + bl do_fpsimd_exc + b ret_to_user ++el0_sp: ++ ldr x26, [sp, #S_SP] ++ b el0_sp_pc ++el0_pc: ++ mrs x26, far_el1 + el0_sp_pc: + /* + * Stack or PC alignment exception handling + */ +- mrs x26, far_el1 + gic_prio_kentry_setup tmp=x0 + enable_da_f + #ifdef CONFIG_TRACE_IRQFLAGS +-- +2.20.1 + diff --git a/queue-5.2/arm64-force-ssbs-on-context-switch.patch b/queue-5.2/arm64-force-ssbs-on-context-switch.patch new file mode 100644 index 00000000000..20d97b9c9f7 --- /dev/null +++ b/queue-5.2/arm64-force-ssbs-on-context-switch.patch @@ -0,0 +1,119 @@ +From 41ce57c6b2f1bad301733188ee2f846c35175e88 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 22 Jul 2019 14:53:09 +0100 +Subject: arm64: Force SSBS on context switch + +[ Upstream commit cbdf8a189a66001c36007bf0f5c975d0376c5c3a ] + +On a CPU that doesn't support SSBS, PSTATE[12] is RES0. In a system +where only some of the CPUs implement SSBS, we end-up losing track of +the SSBS bit across task migration. + +To address this issue, let's force the SSBS bit on context switch. + +Fixes: 8f04e8e6e29c ("arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3") +Signed-off-by: Marc Zyngier +[will: inverted logic and added comments] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/processor.h | 14 ++++++++++++-- + arch/arm64/kernel/process.c | 29 ++++++++++++++++++++++++++++- + 2 files changed, 40 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index fd5b1a4efc70e..844e2964b0f5e 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -193,6 +193,16 @@ static inline void start_thread_common(struct pt_regs *regs, unsigned long pc) + regs->pmr_save = GIC_PRIO_IRQON; + } + ++static inline void set_ssbs_bit(struct pt_regs *regs) ++{ ++ regs->pstate |= PSR_SSBS_BIT; ++} ++ ++static inline void set_compat_ssbs_bit(struct pt_regs *regs) ++{ ++ regs->pstate |= PSR_AA32_SSBS_BIT; ++} ++ + static inline void start_thread(struct pt_regs *regs, unsigned long pc, + unsigned long sp) + { +@@ -200,7 +210,7 @@ static inline void start_thread(struct pt_regs *regs, unsigned long pc, + regs->pstate = PSR_MODE_EL0t; + + if (arm64_get_ssbd_state() != ARM64_SSBD_FORCE_ENABLE) +- regs->pstate |= PSR_SSBS_BIT; ++ set_ssbs_bit(regs); + + regs->sp = sp; + } +@@ -219,7 +229,7 @@ static inline void compat_start_thread(struct pt_regs *regs, unsigned long pc, + #endif + + if (arm64_get_ssbd_state() != ARM64_SSBD_FORCE_ENABLE) +- regs->pstate |= PSR_AA32_SSBS_BIT; ++ set_compat_ssbs_bit(regs); + + regs->compat_sp = sp; + } +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 6a869d9f304f7..b0c859ca63201 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -398,7 +398,7 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, + childregs->pstate |= PSR_UAO_BIT; + + if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE) +- childregs->pstate |= PSR_SSBS_BIT; ++ set_ssbs_bit(childregs); + + if (system_uses_irq_prio_masking()) + childregs->pmr_save = GIC_PRIO_IRQON; +@@ -442,6 +442,32 @@ void uao_thread_switch(struct task_struct *next) + } + } + ++/* ++ * Force SSBS state on context-switch, since it may be lost after migrating ++ * from a CPU which treats the bit as RES0 in a heterogeneous system. ++ */ ++static void ssbs_thread_switch(struct task_struct *next) ++{ ++ struct pt_regs *regs = task_pt_regs(next); ++ ++ /* ++ * Nothing to do for kernel threads, but 'regs' may be junk ++ * (e.g. idle task) so check the flags and bail early. ++ */ ++ if (unlikely(next->flags & PF_KTHREAD)) ++ return; ++ ++ /* If the mitigation is enabled, then we leave SSBS clear. */ ++ if ((arm64_get_ssbd_state() == ARM64_SSBD_FORCE_ENABLE) || ++ test_tsk_thread_flag(next, TIF_SSBD)) ++ return; ++ ++ if (compat_user_mode(regs)) ++ set_compat_ssbs_bit(regs); ++ else if (user_mode(regs)) ++ set_ssbs_bit(regs); ++} ++ + /* + * We store our current task in sp_el0, which is clobbered by userspace. Keep a + * shadow copy so that we can restore this upon entry from userspace. +@@ -471,6 +497,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, + entry_task_switch(next); + uao_thread_switch(next); + ptrauth_thread_switch(next); ++ ssbs_thread_switch(next); + + /* + * Complete any pending TLB or cache maintenance on this CPU in case +-- +2.20.1 + diff --git a/queue-5.2/cpufreq-pasemi-fix-use-after-free-in-pas_cpufreq_cpu.patch b/queue-5.2/cpufreq-pasemi-fix-use-after-free-in-pas_cpufreq_cpu.patch new file mode 100644 index 00000000000..e05b7d85692 --- /dev/null +++ b/queue-5.2/cpufreq-pasemi-fix-use-after-free-in-pas_cpufreq_cpu.patch @@ -0,0 +1,73 @@ +From 440fbf2d361590cbe8cd6ff29e86ca98fa2bc7f7 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 17 Jul 2019 11:55:04 +0800 +Subject: cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() + +[ Upstream commit e0a12445d1cb186d875410d093a00d215bec6a89 ] + +The cpu variable is still being used in the of_get_property() call +after the of_node_put() call, which may result in use-after-free. + +Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak") +Signed-off-by: Wen Yang +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/pasemi-cpufreq.c | 23 +++++++++-------------- + 1 file changed, 9 insertions(+), 14 deletions(-) + +diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c +index 6b1e4abe32483..d2f061015323d 100644 +--- a/drivers/cpufreq/pasemi-cpufreq.c ++++ b/drivers/cpufreq/pasemi-cpufreq.c +@@ -131,10 +131,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) + int err = -ENODEV; + + cpu = of_get_cpu_node(policy->cpu, NULL); ++ if (!cpu) ++ goto out; + ++ max_freqp = of_get_property(cpu, "clock-frequency", NULL); + of_node_put(cpu); +- if (!cpu) ++ if (!max_freqp) { ++ err = -EINVAL; + goto out; ++ } ++ ++ /* we need the freq in kHz */ ++ max_freq = *max_freqp / 1000; + + dn = of_find_compatible_node(NULL, NULL, "1682m-sdc"); + if (!dn) +@@ -171,16 +179,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) + } + + pr_debug("init cpufreq on CPU %d\n", policy->cpu); +- +- max_freqp = of_get_property(cpu, "clock-frequency", NULL); +- if (!max_freqp) { +- err = -EINVAL; +- goto out_unmap_sdcpwr; +- } +- +- /* we need the freq in kHz */ +- max_freq = *max_freqp / 1000; +- + pr_debug("max clock-frequency is at %u kHz\n", max_freq); + pr_debug("initializing frequency table\n"); + +@@ -198,9 +196,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) + + return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency()); + +-out_unmap_sdcpwr: +- iounmap(sdcpwr_mapbase); +- + out_unmap_sdcasr: + iounmap(sdcasr_mapbase); + out: +-- +2.20.1 + diff --git a/queue-5.2/drbd-dynamically-allocate-shash-descriptor.patch b/queue-5.2/drbd-dynamically-allocate-shash-descriptor.patch new file mode 100644 index 00000000000..8521342601c --- /dev/null +++ b/queue-5.2/drbd-dynamically-allocate-shash-descriptor.patch @@ -0,0 +1,69 @@ +From b8b47d7d3017b6be9739293ced94abf930cf86ff Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Jul 2019 14:26:34 +0200 +Subject: drbd: dynamically allocate shash descriptor + +[ Upstream commit 77ce56e2bfaa64127ae5e23ef136c0168b818777 ] + +Building with clang and KASAN, we get a warning about an overly large +stack frame on 32-bit architectures: + +drivers/block/drbd/drbd_receiver.c:921:31: error: stack frame size of 1280 bytes in function 'conn_connect' + [-Werror,-Wframe-larger-than=] + +We already allocate other data dynamically in this function, so +just do the same for the shash descriptor, which makes up most of +this memory. + +Link: https://lore.kernel.org/lkml/20190617132440.2721536-1-arnd@arndb.de/ +Reviewed-by: Kees Cook +Reviewed-by: Roland Kammerer +Signed-off-by: Arnd Bergmann +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_receiver.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 90ebfcae0ce6e..2b3103c308573 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -5417,7 +5417,7 @@ static int drbd_do_auth(struct drbd_connection *connection) + unsigned int key_len; + char secret[SHARED_SECRET_MAX]; /* 64 byte */ + unsigned int resp_size; +- SHASH_DESC_ON_STACK(desc, connection->cram_hmac_tfm); ++ struct shash_desc *desc; + struct packet_info pi; + struct net_conf *nc; + int err, rv; +@@ -5430,6 +5430,13 @@ static int drbd_do_auth(struct drbd_connection *connection) + memcpy(secret, nc->shared_secret, key_len); + rcu_read_unlock(); + ++ desc = kmalloc(sizeof(struct shash_desc) + ++ crypto_shash_descsize(connection->cram_hmac_tfm), ++ GFP_KERNEL); ++ if (!desc) { ++ rv = -1; ++ goto fail; ++ } + desc->tfm = connection->cram_hmac_tfm; + + rv = crypto_shash_setkey(connection->cram_hmac_tfm, (u8 *)secret, key_len); +@@ -5571,7 +5578,10 @@ static int drbd_do_auth(struct drbd_connection *connection) + kfree(peers_ch); + kfree(response); + kfree(right_response); +- shash_desc_zero(desc); ++ if (desc) { ++ shash_desc_zero(desc); ++ kfree(desc); ++ } + + return rv; + } +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-allocate-4-ddc-engines-for-rv2.patch b/queue-5.2/drm-amd-display-allocate-4-ddc-engines-for-rv2.patch new file mode 100644 index 00000000000..a2198851968 --- /dev/null +++ b/queue-5.2/drm-amd-display-allocate-4-ddc-engines-for-rv2.patch @@ -0,0 +1,39 @@ +From 8b1dde1447e8e284bfb52078fcd0f98f4819f08a Mon Sep 17 00:00:00 2001 +From: Derek Lai +Date: Tue, 2 Jul 2019 17:50:41 +0800 +Subject: drm/amd/display: allocate 4 ddc engines for RV2 + +[ Upstream commit 67fd6c0d2de8e51e84ff3fa6e68bbd524f823e49 ] + +[Why] +Driver will create 0, 1, and 2 ddc engines for RV2, +but some platforms used 0, 1, and 3. + +[How] +Still allocate 4 ddc engines for RV2. + +Signed-off-by: Derek Lai +Reviewed-by: Aric Cyr +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +index 7eccb54c421d9..aac52eed6b2aa 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +@@ -512,7 +512,7 @@ static const struct resource_caps rv2_res_cap = { + .num_audio = 3, + .num_stream_encoder = 3, + .num_pll = 3, +- .num_ddc = 3, ++ .num_ddc = 4, + }; + #endif + +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-clock-does-not-lower-in-updateplanes.patch b/queue-5.2/drm-amd-display-clock-does-not-lower-in-updateplanes.patch new file mode 100644 index 00000000000..52582ed24dd --- /dev/null +++ b/queue-5.2/drm-amd-display-clock-does-not-lower-in-updateplanes.patch @@ -0,0 +1,44 @@ +From 5b64f32931b04e1d7828f6683d60411ca091258f Mon Sep 17 00:00:00 2001 +From: Murton Liu +Date: Mon, 10 Jun 2019 17:55:28 -0400 +Subject: drm/amd/display: Clock does not lower in Updateplanes + +[ Upstream commit 492d9ec244923420af96db6b69ad7d575859aa92 ] + +[why] +We reset the optimized_required in atomic_plane_disable +flag immediately after it is set in atomic_plane_disconnect, causing us to +never have flag set during next flip in UpdatePlanes. + +[how] +Optimize directly after each time plane is removed. + +Signed-off-by: Murton Liu +Reviewed-by: Tony Cheng +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 9e4d70a0055e1..c7b4c3048b71d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2416,6 +2416,12 @@ static void dcn10_apply_ctx_for_surface( + if (removed_pipe[i]) + dcn10_disable_plane(dc, &dc->current_state->res_ctx.pipe_ctx[i]); + ++ for (i = 0; i < dc->res_pool->pipe_count; i++) ++ if (removed_pipe[i]) { ++ dc->hwss.optimize_bandwidth(dc, context); ++ break; ++ } ++ + if (dc->hwseq->wa.DEGVIDCN10_254) + hubbub1_wm_change_req_wa(dc->res_pool->hubbub); + } +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-fix-dc_create-failure-handling-and-6.patch b/queue-5.2/drm-amd-display-fix-dc_create-failure-handling-and-6.patch new file mode 100644 index 00000000000..9fae63571b1 --- /dev/null +++ b/queue-5.2/drm-amd-display-fix-dc_create-failure-handling-and-6.patch @@ -0,0 +1,63 @@ +From 743139f2f47904c647372993ea50c4ff53e518b3 Mon Sep 17 00:00:00 2001 +From: Julian Parkin +Date: Tue, 25 Jun 2019 14:55:53 -0400 +Subject: drm/amd/display: Fix dc_create failure handling and 666 color depths + +[ Upstream commit 0905f32977268149f06e3ce6ea4bd6d374dd891f ] + +[Why] +It is possible (but very unlikely) that constructing dc fails +before current_state is created. + +We support 666 color depth in some scenarios, but this +isn't handled in get_norm_pix_clk. It uses exactly the +same pixel clock as the 888 case. + +[How] +Check for non null current_state before destructing. + +Add case for 666 color depth to get_norm_pix_clk to +avoid assertion. + +Signed-off-by: Julian Parkin +Reviewed-by: Charlene Liu +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 6 ++++-- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 1 + + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index ee6b646180b66..0a7adc2925e35 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -608,8 +608,10 @@ const struct dc_link_settings *dc_link_get_link_cap( + + static void destruct(struct dc *dc) + { +- dc_release_state(dc->current_state); +- dc->current_state = NULL; ++ if (dc->current_state) { ++ dc_release_state(dc->current_state); ++ dc->current_state = NULL; ++ } + + destroy_links(dc); + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 6ad7b54812f1c..b2525ab8a95f6 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1872,6 +1872,7 @@ static int get_norm_pix_clk(const struct dc_crtc_timing *timing) + pix_clk /= 2; + if (timing->pixel_encoding != PIXEL_ENCODING_YCBCR422) { + switch (timing->display_color_depth) { ++ case COLOR_DEPTH_666: + case COLOR_DEPTH_888: + normalized_pix_clk = pix_clk; + break; +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-fix-dmcu-hang-when-going-into-modern.patch b/queue-5.2/drm-amd-display-fix-dmcu-hang-when-going-into-modern.patch new file mode 100644 index 00000000000..82e04daea68 --- /dev/null +++ b/queue-5.2/drm-amd-display-fix-dmcu-hang-when-going-into-modern.patch @@ -0,0 +1,58 @@ +From 8bc1440117247c273c7702f853c6651da8e9494c Mon Sep 17 00:00:00 2001 +From: Zi Yu Liao +Date: Thu, 20 Jun 2019 10:55:26 -0400 +Subject: drm/amd/display: fix DMCU hang when going into Modern Standby + +[ Upstream commit 1ca068ed34d6b39d336c1b0d618ed73ba8f04548 ] + +[why] +When the system is going into suspend, set_backlight gets called +after the eDP got blanked. Since smooth brightness is enabled, +the driver will make a call into the DMCU to ramp the brightness. +The DMCU would try to enable ABM to do so. But since the display is +blanked, this ends up causing ABM1_ACE_DBUF_REG_UPDATE_PENDING to +get stuck at 1, which results in a dead lock in the DMCU firmware. + +[how] +Disable brightness ramping when the eDP display is blanked. + +Signed-off-by: Zi Yu Liao +Reviewed-by: Eric Yang +Acked-by: Anthony Koo +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index a3ff33ff6da16..adf39e3b8d29d 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2284,7 +2284,7 @@ bool dc_link_set_backlight_level(const struct dc_link *link, + if (core_dc->current_state->res_ctx.pipe_ctx[i].stream) { + if (core_dc->current_state->res_ctx. + pipe_ctx[i].stream->link +- == link) ++ == link) { + /* DMCU -1 for all controller id values, + * therefore +1 here + */ +@@ -2292,6 +2292,13 @@ bool dc_link_set_backlight_level(const struct dc_link *link, + core_dc->current_state-> + res_ctx.pipe_ctx[i].stream_res.tg->inst + + 1; ++ ++ /* Disable brightness ramping when the display is blanked ++ * as it can hang the DMCU ++ */ ++ if (core_dc->current_state->res_ctx.pipe_ctx[i].plane_state == NULL) ++ frame_ramp = 0; ++ } + } + } + abm->funcs->set_backlight_level_pwm( +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-increase-size-of-audios-array.patch b/queue-5.2/drm-amd-display-increase-size-of-audios-array.patch new file mode 100644 index 00000000000..b5e1593ce59 --- /dev/null +++ b/queue-5.2/drm-amd-display-increase-size-of-audios-array.patch @@ -0,0 +1,53 @@ +From 87e338efbb66d0756bcc063bf2cdae6d1d100885 Mon Sep 17 00:00:00 2001 +From: Tai Man +Date: Fri, 28 Jun 2019 11:40:38 -0400 +Subject: drm/amd/display: Increase size of audios array + +[ Upstream commit 7352193a33dfc9b69ba3bf6a8caea925b96243b1 ] + +[Why] +The audios array defined in "struct resource_pool" is only 6 (MAX_PIPES) +but the max number of audio devices (num_audio) is 7. In some projects, +it will run out of audios array. + +[How] +Incraese the audios array size to 7. + +Signed-off-by: Tai Man +Reviewed-by: Joshua Aberback +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/inc/core_types.h | 2 +- + drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h +index 6f5ab05d64677..6f0cc718fbd75 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h +@@ -169,7 +169,7 @@ struct resource_pool { + struct clock_source *clock_sources[MAX_CLOCK_SOURCES]; + unsigned int clk_src_count; + +- struct audio *audios[MAX_PIPES]; ++ struct audio *audios[MAX_AUDIOS]; + unsigned int audio_count; + struct audio_support audio_support; + +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h +index 4c8e2c6fb6dbc..72266efd826cf 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h +@@ -34,6 +34,7 @@ + * Data types shared between different Virtual HW blocks + ******************************************************************************/ + ++#define MAX_AUDIOS 7 + #define MAX_PIPES 6 + + struct gamma_curve { +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-no-audio-endpoint-for-dell-mst-displ.patch b/queue-5.2/drm-amd-display-no-audio-endpoint-for-dell-mst-displ.patch new file mode 100644 index 00000000000..c9f241c1e8f --- /dev/null +++ b/queue-5.2/drm-amd-display-no-audio-endpoint-for-dell-mst-displ.patch @@ -0,0 +1,58 @@ +From d9897cbb2edc99d0f26a34a5e483d843b925daa4 Mon Sep 17 00:00:00 2001 +From: Harmanprit Tatla +Date: Tue, 4 Jun 2019 14:12:21 -0400 +Subject: drm/amd/display: No audio endpoint for Dell MST display + +[ Upstream commit 5b25e5f1a97284020abee7348427f89abdb674e8 ] + +[Why] +There are certain MST displays (i.e. Dell P2715Q) +that although have the MST feature set to off may still +report it is a branch device and a non-zero +value for downstream port present. +This can lead to us incorrectly classifying a +dp dongle connection as being active and +disabling the audio endpoint for the display. + +[How] +Modified the placement and +condition used to assign +the is_branch_dev bit. + +Signed-off-by: Harmanprit Tatla +Reviewed-by: Aric Cyr +Acked-by: Anthony Koo +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 253311864cdd5..966aa3b754c5b 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2218,11 +2218,18 @@ static void get_active_converter_info( + link->dpcd_caps.dongle_type = DISPLAY_DONGLE_NONE; + ddc_service_set_dongle_type(link->ddc, + link->dpcd_caps.dongle_type); ++ link->dpcd_caps.is_branch_dev = false; + return; + } + + /* DPCD 0x5 bit 0 = 1, it indicate it's branch device */ +- link->dpcd_caps.is_branch_dev = ds_port.fields.PORT_PRESENT; ++ if (ds_port.fields.PORT_TYPE == DOWNSTREAM_DP) { ++ link->dpcd_caps.is_branch_dev = false; ++ } ++ ++ else { ++ link->dpcd_caps.is_branch_dev = ds_port.fields.PORT_PRESENT; ++ } + + switch (ds_port.fields.PORT_TYPE) { + case DOWNSTREAM_VGA: +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-only-enable-audio-if-speaker-allocat.patch b/queue-5.2/drm-amd-display-only-enable-audio-if-speaker-allocat.patch new file mode 100644 index 00000000000..6a39c80909e --- /dev/null +++ b/queue-5.2/drm-amd-display-only-enable-audio-if-speaker-allocat.patch @@ -0,0 +1,44 @@ +From c9f0813824a17a909dfaf4b91c171376e0741e20 Mon Sep 17 00:00:00 2001 +From: Alvin Lee +Date: Thu, 4 Jul 2019 15:17:42 -0400 +Subject: drm/amd/display: Only enable audio if speaker allocation exists + +[ Upstream commit 6ac25e6d5b2fbf251e9fa2f4131d42c815b43867 ] + +[Why] + +In dm_helpers_parse_edid_caps, there is a corner case where no speakers +can be allocated even though the audio mode count is greater than 0. +Enabling audio when no speaker allocations exists can cause issues in +the video stream. + +[How] + +Add a check to not enable audio unless one or more speaker allocations +exist (since doing this can cause issues in the video stream). + +Signed-off-by: Alvin Lee +Reviewed-by: Jun Lei +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index b2525ab8a95f6..b459ce056b609 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -2019,7 +2019,7 @@ enum dc_status resource_map_pool_resources( + /* TODO: Add check if ASIC support and EDID audio */ + if (!stream->converter_disable_audio && + dc_is_audio_capable_signal(pipe_ctx->stream->signal) && +- stream->audio_info.mode_count) { ++ stream->audio_info.mode_count && stream->audio_info.flags.all) { + pipe_ctx->stream_res.audio = find_first_free_audio( + &context->res_ctx, pool, pipe_ctx->stream_res.stream_enc->id); + +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-put-back-front-end-initialization-se.patch b/queue-5.2/drm-amd-display-put-back-front-end-initialization-se.patch new file mode 100644 index 00000000000..3f8088f6dc5 --- /dev/null +++ b/queue-5.2/drm-amd-display-put-back-front-end-initialization-se.patch @@ -0,0 +1,62 @@ +From 4ea5257875c1f7ead353242b90a0f222023cef63 Mon Sep 17 00:00:00 2001 +From: Eric Yang +Date: Mon, 24 Jun 2019 18:18:58 -0400 +Subject: drm/amd/display: put back front end initialization sequence + +[ Upstream commit feb7eb522e0a7a22c1e60d386bd3c3bfa1d5e4f7 ] + +[Why] +Seamless boot optimization removed proper front end power off sequence. +In driver disable enable case, this causes driver to power gate hubp +and dpp while there is still memory fetching going on, this can cause +invalid memory requests to be generated which will hang data fabric. + +[How] +Put back proper front end power off sequence + +Signed-off-by: Eric Yang +Reviewed-by: Anthony Koo +Acked-by: Leo Li +Acked-by: Tony Cheng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index c7b4c3048b71d..5cc5dabf4d652 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -1120,16 +1120,7 @@ static void dcn10_init_hw(struct dc *dc) + * everything down. + */ + if (dcb->funcs->is_accelerated_mode(dcb) || dc->config.power_down_display_on_boot) { +- for (i = 0; i < dc->res_pool->pipe_count; i++) { +- struct hubp *hubp = dc->res_pool->hubps[i]; +- struct dpp *dpp = dc->res_pool->dpps[i]; +- +- hubp->funcs->hubp_init(hubp); +- dc->res_pool->opps[i]->mpc_tree_params.opp_id = dc->res_pool->opps[i]->inst; +- plane_atomic_power_down(dc, dpp, hubp); +- } +- +- apply_DEGVIDCN10_253_wa(dc); ++ dc->hwss.init_pipes(dc, dc->current_state); + } + + for (i = 0; i < dc->res_pool->audio_count; i++) { +@@ -1298,10 +1289,6 @@ static bool dcn10_set_input_transfer_func(struct pipe_ctx *pipe_ctx, + return result; + } + +- +- +- +- + static bool + dcn10_set_output_transfer_func(struct pipe_ctx *pipe_ctx, + const struct dc_stream_state *stream) +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-use-encoder-s-engine-id-to-find-matc.patch b/queue-5.2/drm-amd-display-use-encoder-s-engine-id-to-find-matc.patch new file mode 100644 index 00000000000..5429da3cf16 --- /dev/null +++ b/queue-5.2/drm-amd-display-use-encoder-s-engine-id-to-find-matc.patch @@ -0,0 +1,57 @@ +From 9575fc3523825b52e54df717192a992b5182b995 Mon Sep 17 00:00:00 2001 +From: Tai Man +Date: Fri, 7 Jun 2019 17:32:27 -0400 +Subject: drm/amd/display: use encoder's engine id to find matched free audio + device + +[ Upstream commit 74eda776d7a4e69ec7aa1ce30a87636f14220fbb ] + +[Why] +On some platforms, the encoder id 3 is not populated. So the encoders +are not stored in right order as index (id: 0, 1, 2, 4, 5) at pool. This +would cause encoders id 4 & id 5 to fail when finding corresponding +audio device, defaulting to the first available audio device. As result, +we cannot stream audio into two DP ports with encoders id 4 & id 5. + +[How] +It need to create enough audio device objects (0 - 5) to perform matching. +Then use encoder engine id to find matched audio device. + +Signed-off-by: Tai Man +Reviewed-by: Charlene Liu +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 12142d13f22f2..6ad7b54812f1c 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -254,7 +254,7 @@ bool resource_construct( + * PORT_CONNECTIVITY == 1 (as instructed by HW team). + */ + update_num_audio(&straps, &num_audio, &pool->audio_support); +- for (i = 0; i < pool->pipe_count && i < num_audio; i++) { ++ for (i = 0; i < caps->num_audio; i++) { + struct audio *aud = create_funcs->create_audio(ctx, i); + + if (aud == NULL) { +@@ -1702,6 +1702,12 @@ static struct audio *find_first_free_audio( + return pool->audios[i]; + } + } ++ ++ /* use engine id to find free audio */ ++ if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) { ++ return pool->audios[id]; ++ } ++ + /*not found the matching one, first come first serve*/ + for (i = 0; i < pool->audio_count; i++) { + if (res_ctx->is_audio_acquired[i] == false) { +-- +2.20.1 + diff --git a/queue-5.2/drm-amd-display-wait-for-backlight-programming-compl.patch b/queue-5.2/drm-amd-display-wait-for-backlight-programming-compl.patch new file mode 100644 index 00000000000..40473294900 --- /dev/null +++ b/queue-5.2/drm-amd-display-wait-for-backlight-programming-compl.patch @@ -0,0 +1,43 @@ +From 3623f0644ae21cbf87d6261ab64ed966d6e5b8fe Mon Sep 17 00:00:00 2001 +From: SivapiriyanKumarasamy +Date: Fri, 14 Jun 2019 15:04:00 -0400 +Subject: drm/amd/display: Wait for backlight programming completion in set + backlight level + +[ Upstream commit c7990daebe71d11a9e360b5c3b0ecd1846a3a4bb ] + +[WHY] +Currently we don't wait for blacklight programming completion in DMCU +when setting backlight level. Some sequences such as PSR static screen +event trigger reprogramming requires it to be complete. + +[How] +Add generic wait for dmcu command completion in set backlight level. + +Signed-off-by: SivapiriyanKumarasamy +Reviewed-by: Anthony Koo +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +index 2959c3c9390b9..da30ae04e82bb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c +@@ -234,6 +234,10 @@ static void dmcu_set_backlight_level( + s2 |= (backlight_8_bit << ATOM_S2_CURRENT_BL_LEVEL_SHIFT); + + REG_WRITE(BIOS_SCRATCH_2, s2); ++ ++ /* waitDMCUReadyForCmd */ ++ REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, ++ 0, 1, 80000); + } + + static void dce_abm_init(struct abm *abm) +-- +2.20.1 + diff --git a/queue-5.2/drm-msm-dpu-correct-dpu-encoder-spinlock-initializat.patch b/queue-5.2/drm-msm-dpu-correct-dpu-encoder-spinlock-initializat.patch new file mode 100644 index 00000000000..65df409241d --- /dev/null +++ b/queue-5.2/drm-msm-dpu-correct-dpu-encoder-spinlock-initializat.patch @@ -0,0 +1,43 @@ +From 4e8ca8d3627e9e4a2753f04a2ec285292744b841 Mon Sep 17 00:00:00 2001 +From: Shubhashree Dhar +Date: Mon, 24 Jun 2019 11:57:12 +0530 +Subject: drm/msm/dpu: Correct dpu encoder spinlock initialization + +[ Upstream commit 2e7b801eadbf327bf61041c943e5c44a5de4b0e5 ] + +dpu encoder spinlock should be initialized during dpu encoder +init instead of dpu encoder setup which is part of modeset init. + +Signed-off-by: Shubhashree Dhar +[seanpaul resolved conflict in old init removal and revised the commit message] +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/1561357632-15361-1-git-send-email-dhar@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 0ea1501966594..c62f7abcf509c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -2226,8 +2226,6 @@ int dpu_encoder_setup(struct drm_device *dev, struct drm_encoder *enc, + if (ret) + goto fail; + +- spin_lock_init(&dpu_enc->enc_spinlock); +- + atomic_set(&dpu_enc->frame_done_timeout_ms, 0); + timer_setup(&dpu_enc->frame_done_timer, + dpu_encoder_frame_done_timeout, 0); +@@ -2281,6 +2279,7 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev, + + drm_encoder_helper_add(&dpu_enc->base, &dpu_encoder_helper_funcs); + ++ spin_lock_init(&dpu_enc->enc_spinlock); + dpu_enc->enabled = false; + + return &dpu_enc->base; +-- +2.20.1 + diff --git a/queue-5.2/drm-silence-variable-conn-set-but-not-used.patch b/queue-5.2/drm-silence-variable-conn-set-but-not-used.patch new file mode 100644 index 00000000000..cb8af76f819 --- /dev/null +++ b/queue-5.2/drm-silence-variable-conn-set-but-not-used.patch @@ -0,0 +1,41 @@ +From c855e1164870909ed9534d931e2be884d11a2a9a Mon Sep 17 00:00:00 2001 +From: Qian Cai +Date: Mon, 22 Jul 2019 15:14:46 -0400 +Subject: drm: silence variable 'conn' set but not used + +[ Upstream commit bbb6fc43f131f77fcb7ae8081f6d7c51396a2120 ] + +The "struct drm_connector" iteration cursor from +"for_each_new_connector_in_state" is never used in atomic_remove_fb() +which generates a compilation warning, + +drivers/gpu/drm/drm_framebuffer.c: In function 'atomic_remove_fb': +drivers/gpu/drm/drm_framebuffer.c:838:24: warning: variable 'conn' set +but not used [-Wunused-but-set-variable] + +Silence it by marking "conn" __maybe_unused. + +Signed-off-by: Qian Cai +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/1563822886-13570-1-git-send-email-cai@lca.pw +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_framebuffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c +index d8d75e25f6fb8..45f6f11a88a74 100644 +--- a/drivers/gpu/drm/drm_framebuffer.c ++++ b/drivers/gpu/drm/drm_framebuffer.c +@@ -830,7 +830,7 @@ static int atomic_remove_fb(struct drm_framebuffer *fb) + struct drm_device *dev = fb->dev; + struct drm_atomic_state *state; + struct drm_plane *plane; +- struct drm_connector *conn; ++ struct drm_connector *conn __maybe_unused; + struct drm_connector_state *conn_state; + int i, ret; + unsigned plane_mask; +-- +2.20.1 + diff --git a/queue-5.2/gen_compile_commands-lower-the-entry-count-threshold.patch b/queue-5.2/gen_compile_commands-lower-the-entry-count-threshold.patch new file mode 100644 index 00000000000..8fc386aa910 --- /dev/null +++ b/queue-5.2/gen_compile_commands-lower-the-entry-count-threshold.patch @@ -0,0 +1,38 @@ +From 7d868eaed47aec60f822a83556f67e29a130d5df Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Sat, 27 Jul 2019 12:01:10 +0900 +Subject: gen_compile_commands: lower the entry count threshold + +[ Upstream commit cb36955a5569f1ff17a42ae93264ef391c013a97 ] + +Running gen_compile_commands.py after building the kernel with +allnoconfig gave this: + +$ ./scripts/gen_compile_commands.py +WARNING: Found 449 entries. Have you compiled the kernel? + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/gen_compile_commands.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/gen_compile_commands.py b/scripts/gen_compile_commands.py +index 7915823b92a5e..c458696ef3a79 100755 +--- a/scripts/gen_compile_commands.py ++++ b/scripts/gen_compile_commands.py +@@ -21,9 +21,9 @@ _LINE_PATTERN = r'^cmd_[^ ]*\.o := (.* )([^ ]*\.c)$' + _VALID_LOG_LEVELS = ['DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'] + + # A kernel build generally has over 2000 entries in its compile_commands.json +-# database. If this code finds 500 or fewer, then warn the user that they might ++# database. If this code finds 300 or fewer, then warn the user that they might + # not have all the .cmd files, and they might need to compile the kernel. +-_LOW_COUNT_THRESHOLD = 500 ++_LOW_COUNT_THRESHOLD = 300 + + + def parse_arguments(): +-- +2.20.1 + diff --git a/queue-5.2/hwmon-nct6775-fix-register-address-and-added-missed-.patch b/queue-5.2/hwmon-nct6775-fix-register-address-and-added-missed-.patch new file mode 100644 index 00000000000..b4827e6c0be --- /dev/null +++ b/queue-5.2/hwmon-nct6775-fix-register-address-and-added-missed-.patch @@ -0,0 +1,43 @@ +From f63d15f7d66553096f2c90525f3259b99b21f265 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B6rn=20Gerhart?= +Date: Mon, 15 Jul 2019 18:33:55 +0200 +Subject: hwmon: (nct6775) Fix register address and added missed tolerance for + nct6106 + +[ Upstream commit f3d43e2e45fd9d44ba52d20debd12cd4ee9c89bf ] + +Fixed address of third NCT6106_REG_WEIGHT_DUTY_STEP, and +added missed NCT6106_REG_TOLERANCE_H. + +Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D") +Signed-off-by: Bjoern Gerhart +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct6775.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index e7dff5febe161..d42bc0883a32b 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -852,7 +852,7 @@ static const u16 NCT6106_REG_TARGET[] = { 0x111, 0x121, 0x131 }; + static const u16 NCT6106_REG_WEIGHT_TEMP_SEL[] = { 0x168, 0x178, 0x188 }; + static const u16 NCT6106_REG_WEIGHT_TEMP_STEP[] = { 0x169, 0x179, 0x189 }; + static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL[] = { 0x16a, 0x17a, 0x18a }; +-static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x17c }; ++static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x18b }; + static const u16 NCT6106_REG_WEIGHT_TEMP_BASE[] = { 0x16c, 0x17c, 0x18c }; + static const u16 NCT6106_REG_WEIGHT_DUTY_BASE[] = { 0x16d, 0x17d, 0x18d }; + +@@ -3764,6 +3764,7 @@ static int nct6775_probe(struct platform_device *pdev) + data->REG_FAN_TIME[0] = NCT6106_REG_FAN_STOP_TIME; + data->REG_FAN_TIME[1] = NCT6106_REG_FAN_STEP_UP_TIME; + data->REG_FAN_TIME[2] = NCT6106_REG_FAN_STEP_DOWN_TIME; ++ data->REG_TOLERANCE_H = NCT6106_REG_TOLERANCE_H; + data->REG_PWM[0] = NCT6106_REG_PWM; + data->REG_PWM[1] = NCT6106_REG_FAN_START_OUTPUT; + data->REG_PWM[2] = NCT6106_REG_FAN_STOP_OUTPUT; +-- +2.20.1 + diff --git a/queue-5.2/hwmon-occ-fix-division-by-zero-issue.patch b/queue-5.2/hwmon-occ-fix-division-by-zero-issue.patch new file mode 100644 index 00000000000..a2dad3801e3 --- /dev/null +++ b/queue-5.2/hwmon-occ-fix-division-by-zero-issue.patch @@ -0,0 +1,43 @@ +From 79d6758528a92de7aa08b1106418a887367c714b Mon Sep 17 00:00:00 2001 +From: Lei YU +Date: Thu, 11 Jul 2019 10:44:48 +0800 +Subject: hwmon: (occ) Fix division by zero issue + +[ Upstream commit 211186cae14de09573b062e478eb9fe215aed8d9 ] + +The code in occ_get_powr_avg() invokes div64_u64() without checking the +divisor. In case the divisor is zero, kernel gets an "Division by zero +in kernel" error. + +Check the divisor and make it return 0 if the divisor is 0. + +Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") +Signed-off-by: Lei YU +Reviewed-by: Eddie James +Link: https://lore.kernel.org/r/1562813088-23708-1-git-send-email-mine260309@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/occ/common.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c +index 13a6290c8d254..f02aa403332c2 100644 +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -402,8 +402,10 @@ static ssize_t occ_show_power_1(struct device *dev, + + static u64 occ_get_powr_avg(u64 *accum, u32 *samples) + { +- return div64_u64(get_unaligned_be64(accum) * 1000000ULL, +- get_unaligned_be32(samples)); ++ u64 divisor = get_unaligned_be32(samples); ++ ++ return (divisor == 0) ? 0 : ++ div64_u64(get_unaligned_be64(accum) * 1000000ULL, divisor); + } + + static ssize_t occ_show_power_2(struct device *dev, +-- +2.20.1 + diff --git a/queue-5.2/iommu-vt-d-check-if-domain-pgd-was-allocated.patch b/queue-5.2/iommu-vt-d-check-if-domain-pgd-was-allocated.patch new file mode 100644 index 00000000000..ab6af238ad4 --- /dev/null +++ b/queue-5.2/iommu-vt-d-check-if-domain-pgd-was-allocated.patch @@ -0,0 +1,57 @@ +From 754c69a8ec60bdcfab87aee2c2b7d9869b43b94d Mon Sep 17 00:00:00 2001 +From: Dmitry Safonov +Date: Tue, 16 Jul 2019 22:38:06 +0100 +Subject: iommu/vt-d: Check if domain->pgd was allocated + +[ Upstream commit 3ee9eca760e7d0b68c55813243de66bbb499dc3b ] + +There is a couple of places where on domain_init() failure domain_exit() +is called. While currently domain_init() can fail only if +alloc_pgtable_page() has failed. + +Make domain_exit() check if domain->pgd present, before calling +domain_unmap(), as it theoretically should crash on clearing pte entries +in dma_pte_clear_level(). + +Cc: David Woodhouse +Cc: Joerg Roedel +Cc: Lu Baolu +Cc: iommu@lists.linux-foundation.org +Signed-off-by: Dmitry Safonov +Reviewed-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 2101601adf57d..1ad24367373f4 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1900,7 +1900,6 @@ static int domain_init(struct dmar_domain *domain, struct intel_iommu *iommu, + + static void domain_exit(struct dmar_domain *domain) + { +- struct page *freelist; + + /* Remove associated devices and clear attached or cached domains */ + rcu_read_lock(); +@@ -1910,9 +1909,12 @@ static void domain_exit(struct dmar_domain *domain) + /* destroy iovas */ + put_iova_domain(&domain->iovad); + +- freelist = domain_unmap(domain, 0, DOMAIN_MAX_PFN(domain->gaw)); ++ if (domain->pgd) { ++ struct page *freelist; + +- dma_free_pagelist(freelist); ++ freelist = domain_unmap(domain, 0, DOMAIN_MAX_PFN(domain->gaw)); ++ dma_free_pagelist(freelist); ++ } + + free_domain_mem(domain); + } +-- +2.20.1 + diff --git a/queue-5.2/iscsi_ibft-make-iscsi_ibft-dependson-acpi-instead-of.patch b/queue-5.2/iscsi_ibft-make-iscsi_ibft-dependson-acpi-instead-of.patch new file mode 100644 index 00000000000..a0e9ee28db3 --- /dev/null +++ b/queue-5.2/iscsi_ibft-make-iscsi_ibft-dependson-acpi-instead-of.patch @@ -0,0 +1,70 @@ +From c7966804247f0cf33897ba952eb581af7eaf6d87 Mon Sep 17 00:00:00 2001 +From: Thomas Tai +Date: Thu, 18 Jul 2019 18:37:34 +0000 +Subject: iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND + +[ Upstream commit 94bccc34071094c165c79b515d21b63c78f7e968 ] + +iscsi_ibft can use ACPI to find the iBFT entry during bootup, +currently, ISCSI_IBFT depends on ISCSI_IBFT_FIND which is +a X86 legacy way to find the iBFT by searching through the +low memory. This patch changes the dependency so that other +arch like ARM64 can use ISCSI_IBFT as long as the arch supports +ACPI. + +ibft_init() needs to use the global variable ibft_addr declared +in iscsi_ibft_find.c. A #ifndef CONFIG_ISCSI_IBFT_FIND is needed +to declare the variable if CONFIG_ISCSI_IBFT_FIND is not selected. +Moving ibft_addr into the iscsi_ibft.c does not work because if +ISCSI_IBFT is selected as a module, the arch/x86/kernel/setup.c won't +be able to find the variable at compile time. + +Signed-off-by: Thomas Tai +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Sasha Levin +--- + drivers/firmware/Kconfig | 5 +++-- + drivers/firmware/iscsi_ibft.c | 4 ++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig +index d40ccc3af9e26..fa7ed01415b72 100644 +--- a/drivers/firmware/Kconfig ++++ b/drivers/firmware/Kconfig +@@ -157,7 +157,7 @@ config DMI_SCAN_MACHINE_NON_EFI_FALLBACK + + config ISCSI_IBFT_FIND + bool "iSCSI Boot Firmware Table Attributes" +- depends on X86 && ACPI ++ depends on X86 && ISCSI_IBFT + default n + help + This option enables the kernel to find the region of memory +@@ -168,7 +168,8 @@ config ISCSI_IBFT_FIND + config ISCSI_IBFT + tristate "iSCSI Boot Firmware Table Attributes module" + select ISCSI_BOOT_SYSFS +- depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL ++ select ISCSI_IBFT_FIND if X86 ++ depends on ACPI && SCSI && SCSI_LOWLEVEL + default n + help + This option enables support for detection and exposing of iSCSI +diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c +index ab3aa39838338..7e12cbdf957cc 100644 +--- a/drivers/firmware/iscsi_ibft.c ++++ b/drivers/firmware/iscsi_ibft.c +@@ -84,6 +84,10 @@ MODULE_DESCRIPTION("sysfs interface to BIOS iBFT information"); + MODULE_LICENSE("GPL"); + MODULE_VERSION(IBFT_ISCSI_VERSION); + ++#ifndef CONFIG_ISCSI_IBFT_FIND ++struct acpi_table_ibft *ibft_addr; ++#endif ++ + struct ibft_hdr { + u8 id; + u8 version; +-- +2.20.1 + diff --git a/queue-5.2/mac80211-don-t-warn-about-cw-params-when-not-using-t.patch b/queue-5.2/mac80211-don-t-warn-about-cw-params-when-not-using-t.patch new file mode 100644 index 00000000000..c378f6ad0ff --- /dev/null +++ b/queue-5.2/mac80211-don-t-warn-about-cw-params-when-not-using-t.patch @@ -0,0 +1,52 @@ +From 091b16c8139cd3ebbab00355e9a53c01091b0348 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 17 Jul 2019 18:57:12 -0700 +Subject: mac80211: don't warn about CW params when not using them + +[ Upstream commit d2b3fe42bc629c2d4002f652b3abdfb2e72991c7 ] + +ieee80211_set_wmm_default() normally sets up the initial CW min/max for +each queue, except that it skips doing this if the driver doesn't +support ->conf_tx. We still end up calling drv_conf_tx() in some cases +(e.g., ieee80211_reconfig()), which also still won't do anything +useful...except it complains here about the invalid CW parameters. + +Let's just skip the WARN if we weren't going to do anything useful with +the parameters. + +Signed-off-by: Brian Norris +Link: https://lore.kernel.org/r/20190718015712.197499-1-briannorris@chromium.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/driver-ops.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c +index acd4afb4944b8..c9a8a2433e8ac 100644 +--- a/net/mac80211/driver-ops.c ++++ b/net/mac80211/driver-ops.c +@@ -187,11 +187,16 @@ int drv_conf_tx(struct ieee80211_local *local, + if (!check_sdata_in_driver(sdata)) + return -EIO; + +- if (WARN_ONCE(params->cw_min == 0 || +- params->cw_min > params->cw_max, +- "%s: invalid CW_min/CW_max: %d/%d\n", +- sdata->name, params->cw_min, params->cw_max)) ++ if (params->cw_min == 0 || params->cw_min > params->cw_max) { ++ /* ++ * If we can't configure hardware anyway, don't warn. We may ++ * never have initialized the CW parameters. ++ */ ++ WARN_ONCE(local->ops->conf_tx, ++ "%s: invalid CW_min/CW_max: %d/%d\n", ++ sdata->name, params->cw_min, params->cw_max); + return -EINVAL; ++ } + + trace_drv_conf_tx(local, sdata, ac, params); + if (local->ops->conf_tx) +-- +2.20.1 + diff --git a/queue-5.2/mac80211-fix-possible-memory-leak-in-ieee80211_assig.patch b/queue-5.2/mac80211-fix-possible-memory-leak-in-ieee80211_assig.patch new file mode 100644 index 00000000000..69254d27e3e --- /dev/null +++ b/queue-5.2/mac80211-fix-possible-memory-leak-in-ieee80211_assig.patch @@ -0,0 +1,51 @@ +From f853846e4817068efe86cb3516d59ae0e51cf953 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Wed, 3 Jul 2019 00:29:47 +0200 +Subject: mac80211: fix possible memory leak in ieee80211_assign_beacon + +[ Upstream commit bcc27fab8cc673ddc95452674373cce618ccb3a3 ] + +Free new beacon_data in ieee80211_assign_beacon whenever +ieee80211_assign_beacon fails + +Fixes: 8860020e0be1 ("cfg80211: restructure AP/GO mode API") +Fixes: bc847970f432 ("mac80211: support FTM responder configuration/statistic") +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/770285772543c9fca33777bb4ad4760239e56256.1562105631.git.lorenzo@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index a1973a26c7fc4..b8288125e05db 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -935,8 +935,10 @@ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata, + + err = ieee80211_set_probe_resp(sdata, params->probe_resp, + params->probe_resp_len, csa); +- if (err < 0) ++ if (err < 0) { ++ kfree(new); + return err; ++ } + if (err == 0) + changed |= BSS_CHANGED_AP_PROBE_RESP; + +@@ -948,8 +950,10 @@ static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata, + params->civicloc, + params->civicloc_len); + +- if (err < 0) ++ if (err < 0) { ++ kfree(new); + return err; ++ } + + changed |= BSS_CHANGED_FTM_RESPONDER; + } +-- +2.20.1 + diff --git a/queue-5.2/netfilter-conntrack-always-store-window-size-un-scal.patch b/queue-5.2/netfilter-conntrack-always-store-window-size-un-scal.patch new file mode 100644 index 00000000000..923c9a5714a --- /dev/null +++ b/queue-5.2/netfilter-conntrack-always-store-window-size-un-scal.patch @@ -0,0 +1,80 @@ +From 6e9fd39a4d9abee317a106bc6affb0543b881da8 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 12 Jul 2019 00:29:05 +0200 +Subject: netfilter: conntrack: always store window size un-scaled + +[ Upstream commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 ] + +Jakub Jankowski reported following oddity: + +After 3 way handshake completes, timeout of new connection is set to +max_retrans (300s) instead of established (5 days). + +shortened excerpt from pcap provided: +25.070622 IP (flags [DF], proto TCP (6), length 52) +10.8.5.4.1025 > 10.8.1.2.80: Flags [S], seq 11, win 64240, [wscale 8] +26.070462 IP (flags [DF], proto TCP (6), length 48) +10.8.1.2.80 > 10.8.5.4.1025: Flags [S.], seq 82, ack 12, win 65535, [wscale 3] +27.070449 IP (flags [DF], proto TCP (6), length 40) +10.8.5.4.1025 > 10.8.1.2.80: Flags [.], ack 83, win 512, length 0 + +Turns out the last_win is of u16 type, but we store the scaled value: +512 << 8 (== 0x20000) becomes 0 window. + +The Fixes tag is not correct, as the bug has existed forever, but +without that change all that this causes might cause is to mistake a +window update (to-nonzero-from-zero) for a retransmit. + +Fixes: fbcd253d2448b8 ("netfilter: conntrack: lower timeout to RETRANS seconds if window is 0") +Reported-by: Jakub Jankowski +Tested-by: Jakub Jankowski +Signed-off-by: Florian Westphal +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 1e2cc83ff5da8..ae1f8c6b3a974 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -472,6 +472,7 @@ static bool tcp_in_window(const struct nf_conn *ct, + struct ip_ct_tcp_state *receiver = &state->seen[!dir]; + const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; + __u32 seq, ack, sack, end, win, swin; ++ u16 win_raw; + s32 receiver_offset; + bool res, in_recv_win; + +@@ -480,7 +481,8 @@ static bool tcp_in_window(const struct nf_conn *ct, + */ + seq = ntohl(tcph->seq); + ack = sack = ntohl(tcph->ack_seq); +- win = ntohs(tcph->window); ++ win_raw = ntohs(tcph->window); ++ win = win_raw; + end = segment_seq_plus_len(seq, skb->len, dataoff, tcph); + + if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM) +@@ -655,14 +657,14 @@ static bool tcp_in_window(const struct nf_conn *ct, + && state->last_seq == seq + && state->last_ack == ack + && state->last_end == end +- && state->last_win == win) ++ && state->last_win == win_raw) + state->retrans++; + else { + state->last_dir = dir; + state->last_seq = seq; + state->last_ack = ack; + state->last_end = end; +- state->last_win = win; ++ state->last_win = win_raw; + state->retrans = 0; + } + } +-- +2.20.1 + diff --git a/queue-5.2/netfilter-fix-rpfilter-dropping-vrf-packets-by-mista.patch b/queue-5.2/netfilter-fix-rpfilter-dropping-vrf-packets-by-mista.patch new file mode 100644 index 00000000000..078ef63081d --- /dev/null +++ b/queue-5.2/netfilter-fix-rpfilter-dropping-vrf-packets-by-mista.patch @@ -0,0 +1,64 @@ +From 2278f5afb7b31bb926445dee4bdcae0c66f5454f Mon Sep 17 00:00:00 2001 +From: Miaohe Lin +Date: Tue, 2 Jul 2019 03:59:36 +0000 +Subject: netfilter: Fix rpfilter dropping vrf packets by mistake + +[ Upstream commit b575b24b8eee37f10484e951b62ce2a31c579775 ] + +When firewalld is enabled with ipv4/ipv6 rpfilter, vrf +ipv4/ipv6 packets will be dropped. Vrf device will pass +through netfilter hook twice. One with enslaved device +and another one with l3 master device. So in device may +dismatch witch out device because out device is always +enslaved device.So failed with the check of the rpfilter +and drop the packets by mistake. + +Signed-off-by: Miaohe Lin +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/ipt_rpfilter.c | 1 + + net/ipv6/netfilter/ip6t_rpfilter.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c +index 59031670b16a0..cc23f1ce239c2 100644 +--- a/net/ipv4/netfilter/ipt_rpfilter.c ++++ b/net/ipv4/netfilter/ipt_rpfilter.c +@@ -78,6 +78,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) + flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; + flow.flowi4_tos = RT_TOS(iph->tos); + flow.flowi4_scope = RT_SCOPE_UNIVERSE; ++ flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); + + return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; + } +diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c +index 6bcaf73571834..d800801a5dd27 100644 +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -55,7 +55,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + if (rpfilter_addr_linklocal(&iph->saddr)) { + lookup_flags |= RT6_LOOKUP_F_IFACE; + fl6.flowi6_oif = dev->ifindex; +- } else if ((flags & XT_RPFILTER_LOOSE) == 0) ++ /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */ ++ } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) || ++ (flags & XT_RPFILTER_LOOSE) == 0) + fl6.flowi6_oif = dev->ifindex; + + rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); +@@ -70,7 +72,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + goto out; + } + +- if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE)) ++ if (rt->rt6i_idev->dev == dev || ++ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex || ++ (flags & XT_RPFILTER_LOOSE)) + ret = true; + out: + ip6_rt_put(rt); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nf_tables-fix-module-autoload-for-redir.patch b/queue-5.2/netfilter-nf_tables-fix-module-autoload-for-redir.patch new file mode 100644 index 00000000000..56b20bef374 --- /dev/null +++ b/queue-5.2/netfilter-nf_tables-fix-module-autoload-for-redir.patch @@ -0,0 +1,30 @@ +From 7ec4dff61219351559f97e3069d7c3ba5f22e699 Mon Sep 17 00:00:00 2001 +From: Christian Hesse +Date: Thu, 11 Jul 2019 01:31:12 +0200 +Subject: netfilter: nf_tables: fix module autoload for redir + +[ Upstream commit f41828ee10b36644bb2b2bfa9dd1d02f55aa0516 ] + +Fix expression for autoloading. + +Fixes: 5142967ab524 ("netfilter: nf_tables: fix module autoload with inet family") +Signed-off-by: Christian Hesse +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_redir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c +index 8487eeff5c0ec..43eeb1f609f13 100644 +--- a/net/netfilter/nft_redir.c ++++ b/net/netfilter/nft_redir.c +@@ -291,4 +291,4 @@ module_exit(nft_redir_module_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Arturo Borrero Gonzalez "); +-MODULE_ALIAS_NFT_EXPR("nat"); ++MODULE_ALIAS_NFT_EXPR("redir"); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nf_tables-support-auto-loading-for-inet-na.patch b/queue-5.2/netfilter-nf_tables-support-auto-loading-for-inet-na.patch new file mode 100644 index 00000000000..2866c1fda6d --- /dev/null +++ b/queue-5.2/netfilter-nf_tables-support-auto-loading-for-inet-na.patch @@ -0,0 +1,34 @@ +From a97cd61ddd01218f2032c7590837a4581d119363 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 17 Jul 2019 21:38:19 +0200 +Subject: netfilter: nf_tables: Support auto-loading for inet nat + +[ Upstream commit b4f1483cbfa5fafca4874e90063f75603edbc210 ] + +Trying to create an inet family nat chain would not cause +nft_chain_nat.ko module to auto-load due to missing module alias. Add a +proper one with hard-coded family value 1 for the pseudo-family +NFPROTO_INET. + +Fixes: d164385ec572 ("netfilter: nat: add inet family nat support") +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_chain_nat.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nft_chain_nat.c b/net/netfilter/nft_chain_nat.c +index 2f89bde3c61cb..ff9ac8ae0031f 100644 +--- a/net/netfilter/nft_chain_nat.c ++++ b/net/netfilter/nft_chain_nat.c +@@ -142,3 +142,6 @@ MODULE_ALIAS_NFT_CHAIN(AF_INET, "nat"); + #ifdef CONFIG_NF_TABLES_IPV6 + MODULE_ALIAS_NFT_CHAIN(AF_INET6, "nat"); + #endif ++#ifdef CONFIG_NF_TABLES_INET ++MODULE_ALIAS_NFT_CHAIN(1, "nat"); /* NFPROTO_INET */ ++#endif +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nfnetlink-avoid-deadlock-due-to-synchronou.patch b/queue-5.2/netfilter-nfnetlink-avoid-deadlock-due-to-synchronou.patch new file mode 100644 index 00000000000..8a4c8ad9250 --- /dev/null +++ b/queue-5.2/netfilter-nfnetlink-avoid-deadlock-due-to-synchronou.patch @@ -0,0 +1,75 @@ +From 5e8c91336edf4e9579af4d30d0ea96b08a257111 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 2 Jul 2019 21:41:40 +0200 +Subject: netfilter: nfnetlink: avoid deadlock due to synchronous + request_module + +[ Upstream commit 1b0890cd60829bd51455dc5ad689ed58c4408227 ] + +Thomas and Juliana report a deadlock when running: + +(rmmod nf_conntrack_netlink/xfrm_user) + + conntrack -e NEW -E & + modprobe -v xfrm_user + +They provided following analysis: + +conntrack -e NEW -E + netlink_bind() + netlink_lock_table() -> increases "nl_table_users" + nfnetlink_bind() + # does not unlock the table as it's locked by netlink_bind() + __request_module() + call_usermodehelper_exec() + +This triggers "modprobe nf_conntrack_netlink" from kernel, netlink_bind() +won't return until modprobe process is done. + +"modprobe xfrm_user": + xfrm_user_init() + register_pernet_subsys() + -> grab pernet_ops_rwsem + .. + netlink_table_grab() + calls schedule() as "nl_table_users" is non-zero + +so modprobe is blocked because netlink_bind() increased +nl_table_users while also holding pernet_ops_rwsem. + +"modprobe nf_conntrack_netlink" runs and inits nf_conntrack_netlink: + ctnetlink_init() + register_pernet_subsys() + -> blocks on "pernet_ops_rwsem" thanks to xfrm_user module + +both modprobe processes wait on one another -- neither can make +progress. + +Switch netlink_bind() to "nowait" modprobe -- this releases the netlink +table lock, which then allows both modprobe instances to complete. + +Reported-by: Thomas Jarosch +Reported-by: Juliana Rodrigueiro +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 92077d4591090..4abbb452cf6c6 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -578,7 +578,7 @@ static int nfnetlink_bind(struct net *net, int group) + ss = nfnetlink_get_subsys(type << 8); + rcu_read_unlock(); + if (!ss) +- request_module("nfnetlink-subsys-%d", type); ++ request_module_nowait("nfnetlink-subsys-%d", type); + return 0; + } + #endif +-- +2.20.1 + diff --git a/queue-5.2/netfilter-nft_hash-fix-symhash-with-modulus-one.patch b/queue-5.2/netfilter-nft_hash-fix-symhash-with-modulus-one.patch new file mode 100644 index 00000000000..66629481bc0 --- /dev/null +++ b/queue-5.2/netfilter-nft_hash-fix-symhash-with-modulus-one.patch @@ -0,0 +1,39 @@ +From 2256d81acd09d5989c2e30df56d5682887d1f134 Mon Sep 17 00:00:00 2001 +From: Laura Garcia Liebana +Date: Mon, 15 Jul 2019 13:23:37 +0200 +Subject: netfilter: nft_hash: fix symhash with modulus one + +[ Upstream commit 28b1d6ef53e3303b90ca8924bb78f31fa527cafb ] + +The rule below doesn't work as the kernel raises -ERANGE. + +nft add rule netdev nftlb lb01 ip daddr set \ + symhash mod 1 map { 0 : 192.168.0.10 } fwd to "eth0" + +This patch allows to use the symhash modulus with one +element, in the same way that the other types of hashes and +algorithms that uses the modulus parameter. + +Signed-off-by: Laura Garcia Liebana +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c +index fe93e731dc7fb..b836d550b9199 100644 +--- a/net/netfilter/nft_hash.c ++++ b/net/netfilter/nft_hash.c +@@ -129,7 +129,7 @@ static int nft_symhash_init(const struct nft_ctx *ctx, + priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); + + priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); +- if (priv->modulus <= 1) ++ if (priv->modulus < 1) + return -ERANGE; + + if (priv->offset + priv->modulus - 1 < priv->offset) +-- +2.20.1 + diff --git a/queue-5.2/nl80211-fix-nl80211_he_max_capability_len.patch b/queue-5.2/nl80211-fix-nl80211_he_max_capability_len.patch new file mode 100644 index 00000000000..3c7e1355495 --- /dev/null +++ b/queue-5.2/nl80211-fix-nl80211_he_max_capability_len.patch @@ -0,0 +1,34 @@ +From fdb96f632a931ca2f80743803c6067fc93f098de Mon Sep 17 00:00:00 2001 +From: John Crispin +Date: Thu, 27 Jun 2019 11:58:32 +0200 +Subject: nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN + +[ Upstream commit 5edaac063bbf1267260ad2a5b9bb803399343e58 ] + +NL80211_HE_MAX_CAPABILITY_LEN has changed between D2.0 and D4.0. It is now +MAC (6) + PHY (11) + MCS (12) + PPE (25) = 54. + +Signed-off-by: John Crispin +Link: https://lore.kernel.org/r/20190627095832.19445-1-john@phrozen.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/uapi/linux/nl80211.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h +index 6f09d1500960d..70da1c6cdd073 100644 +--- a/include/uapi/linux/nl80211.h ++++ b/include/uapi/linux/nl80211.h +@@ -2844,7 +2844,7 @@ enum nl80211_attrs { + #define NL80211_HT_CAPABILITY_LEN 26 + #define NL80211_VHT_CAPABILITY_LEN 12 + #define NL80211_HE_MIN_CAPABILITY_LEN 16 +-#define NL80211_HE_MAX_CAPABILITY_LEN 51 ++#define NL80211_HE_MAX_CAPABILITY_LEN 54 + #define NL80211_MAX_NR_CIPHER_SUITES 5 + #define NL80211_MAX_NR_AKM_SUITES 2 + +-- +2.20.1 + diff --git a/queue-5.2/nvme-fix-memory-leak-caused-by-incorrect-subsystem-f.patch b/queue-5.2/nvme-fix-memory-leak-caused-by-incorrect-subsystem-f.patch new file mode 100644 index 00000000000..bd386f06b34 --- /dev/null +++ b/queue-5.2/nvme-fix-memory-leak-caused-by-incorrect-subsystem-f.patch @@ -0,0 +1,87 @@ +From 92dcbc1af931de5b076e8b3fda9daf84bfd7adcc Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe +Date: Thu, 18 Jul 2019 17:53:50 -0600 +Subject: nvme: fix memory leak caused by incorrect subsystem free + +[ Upstream commit e654dfd38c1ecf58d8d019f3c053189413484a5b ] + +When freeing the subsystem after finding another match with +__nvme_find_get_subsystem(), use put_device() instead of +__nvme_release_subsystem() which calls kfree() directly. + +Per the documentation, put_device() should always be used +after device_initialization() is called. Otherwise, leaks +like the one below which was detected by kmemleak may occur. + +Once the call of __nvme_release_subsystem() is removed it no +longer makes sense to keep the helper, so fold it back +into nvme_release_subsystem(). + +unreferenced object 0xffff8883d12bfbc0 (size 16): + comm "nvme", pid 2635, jiffies 4294933602 (age 739.952s) + hex dump (first 16 bytes): + 6e 76 6d 65 2d 73 75 62 73 79 73 32 00 88 ff ff nvme-subsys2.... + backtrace: + [<000000007d8fc208>] __kmalloc_track_caller+0x16d/0x2a0 + [<0000000081169e5f>] kvasprintf+0xad/0x130 + [<0000000025626f25>] kvasprintf_const+0x47/0x120 + [<00000000fa66ad36>] kobject_set_name_vargs+0x44/0x120 + [<000000004881f8b3>] dev_set_name+0x98/0xc0 + [<000000007124dae3>] nvme_init_identify+0x1995/0x38e0 + [<000000009315020a>] nvme_loop_configure_admin_queue+0x4fa/0x5e0 + [<000000001a63e766>] nvme_loop_create_ctrl+0x489/0xf80 + [<00000000a46ecc23>] nvmf_dev_write+0x1a12/0x2220 + [<000000002259b3d5>] __vfs_write+0x66/0x120 + [<000000002f6df81e>] vfs_write+0x154/0x490 + [<000000007e8cfc19>] ksys_write+0x10a/0x240 + [<00000000ff5c7b85>] __x64_sys_write+0x73/0xb0 + [<00000000fee6d692>] do_syscall_64+0xaa/0x470 + [<00000000997e1ede>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fixes: ab9e00cc72fa ("nvme: track subsystems") +Signed-off-by: Logan Gunthorpe +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 4a1d2ab4d1612..5deb4deb38209 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2264,17 +2264,15 @@ static void nvme_init_subnqn(struct nvme_subsystem *subsys, struct nvme_ctrl *ct + memset(subsys->subnqn + off, 0, sizeof(subsys->subnqn) - off); + } + +-static void __nvme_release_subsystem(struct nvme_subsystem *subsys) ++static void nvme_release_subsystem(struct device *dev) + { ++ struct nvme_subsystem *subsys = ++ container_of(dev, struct nvme_subsystem, dev); ++ + ida_simple_remove(&nvme_subsystems_ida, subsys->instance); + kfree(subsys); + } + +-static void nvme_release_subsystem(struct device *dev) +-{ +- __nvme_release_subsystem(container_of(dev, struct nvme_subsystem, dev)); +-} +- + static void nvme_destroy_subsystem(struct kref *ref) + { + struct nvme_subsystem *subsys = +@@ -2429,7 +2427,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + mutex_lock(&nvme_subsystems_lock); + found = __nvme_find_get_subsystem(subsys->subnqn); + if (found) { +- __nvme_release_subsystem(subsys); ++ put_device(&subsys->dev); + subsys = found; + + if (!nvme_validate_cntlid(subsys, ctrl, id)) { +-- +2.20.1 + diff --git a/queue-5.2/nvme-ignore-subnqn-for-adata-sx6000lnp.patch b/queue-5.2/nvme-ignore-subnqn-for-adata-sx6000lnp.patch new file mode 100644 index 00000000000..75997181e33 --- /dev/null +++ b/queue-5.2/nvme-ignore-subnqn-for-adata-sx6000lnp.patch @@ -0,0 +1,46 @@ +From 12806b40c1e76b1c3b44142d8a0a529a98993727 Mon Sep 17 00:00:00 2001 +From: Misha Nasledov +Date: Mon, 15 Jul 2019 00:11:49 -0700 +Subject: nvme: ignore subnqn for ADATA SX6000LNP + +[ Upstream commit 08b903b5fd0c49e5f224a9bf085b6329ec3c55c0 ] + +The ADATA SX6000LNP NVMe SSDs have the same subnqn and, due to this, a +system with more than one of these SSDs will only have one usable. + +[ 0.942706] nvme nvme1: ignoring ctrl due to duplicate subnqn (nqn.2018-05.com.example:nvme:nvm-subsystem-OUI00E04C). +[ 0.943017] nvme nvme1: Removing after probe failure status: -22 + +02:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01) +71:00.0 Non-Volatile memory controller [0108]: Realtek Semiconductor Co., Ltd. Device [10ec:5762] (rev 01) + +There are no firmware updates available from the vendor, unfortunately. +Applying the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk for these SSDs resolves +the issue, and they all work after this patch: + +/dev/nvme0n1 2J1120050420 ADATA SX6000LNP [...] +/dev/nvme1n1 2J1120050540 ADATA SX6000LNP [...] + +Signed-off-by: Misha Nasledov +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 7fbcd72c438f6..f9959eaaa185e 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2959,6 +2959,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, ++ { PCI_DEVICE(0x10ec, 0x5762), /* ADATA SX6000LNP */ ++ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, +-- +2.20.1 + diff --git a/queue-5.2/perf-core-fix-creating-kernel-counters-for-pmus-that.patch b/queue-5.2/perf-core-fix-creating-kernel-counters-for-pmus-that.patch new file mode 100644 index 00000000000..c7e1b1fe6f2 --- /dev/null +++ b/queue-5.2/perf-core-fix-creating-kernel-counters-for-pmus-that.patch @@ -0,0 +1,61 @@ +From c8acee7299a1a622324e479e982ac015687a0762 Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Wed, 24 Jul 2019 15:53:24 +0300 +Subject: perf/core: Fix creating kernel counters for PMUs that override + event->cpu + +[ Upstream commit 4ce54af8b33d3e21ca935fc1b89b58cbba956051 ] + +Some hardware PMU drivers will override perf_event.cpu inside their +event_init callback. This causes a lockdep splat when initialized through +the kernel API: + + WARNING: CPU: 0 PID: 250 at kernel/events/core.c:2917 ctx_sched_out+0x78/0x208 + pc : ctx_sched_out+0x78/0x208 + Call trace: + ctx_sched_out+0x78/0x208 + __perf_install_in_context+0x160/0x248 + remote_function+0x58/0x68 + generic_exec_single+0x100/0x180 + smp_call_function_single+0x174/0x1b8 + perf_install_in_context+0x178/0x188 + perf_event_create_kernel_counter+0x118/0x160 + +Fix this by calling perf_install_in_context with event->cpu, just like +perf_event_open + +Signed-off-by: Leonard Crestez +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Mark Rutland +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Frank Li +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Link: https://lkml.kernel.org/r/c4ebe0503623066896d7046def4d6b1e06e0eb2e.1563972056.git.leonard.crestez@nxp.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f851934d55d48..4bc15cff1026a 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -11266,7 +11266,7 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu, + goto err_unlock; + } + +- perf_install_in_context(ctx, event, cpu); ++ perf_install_in_context(ctx, event, event->cpu); + perf_unpin_context(ctx); + mutex_unlock(&ctx->mutex); + +-- +2.20.1 + diff --git a/queue-5.2/perf-probe-avoid-calling-freeing-routine-multiple-ti.patch b/queue-5.2/perf-probe-avoid-calling-freeing-routine-multiple-ti.patch new file mode 100644 index 00000000000..c049794f475 --- /dev/null +++ b/queue-5.2/perf-probe-avoid-calling-freeing-routine-multiple-ti.patch @@ -0,0 +1,50 @@ +From 7368d71aa5cf1251d8c34db37b22393d6b4587d4 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 18 Jul 2019 11:28:37 -0300 +Subject: perf probe: Avoid calling freeing routine multiple times for same + pointer + +[ Upstream commit d95daf5accf4a72005daa13fbb1d1bd8709f2861 ] + +When perf_add_probe_events() we call cleanup_perf_probe_events() for the +pev pointer it receives, then, as part of handling this failure the main +'perf probe' goes on and calls cleanup_params() and that will again call +cleanup_perf_probe_events()for the same pointer, so just set nevents to +zero when handling the failure of perf_add_probe_events() to avoid the +double free. + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Link: https://lkml.kernel.org/n/tip-x8qgma4g813z96dvtw9w219q@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-probe.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c +index 8bb124e55c6d2..2c376f5b21200 100644 +--- a/tools/perf/builtin-probe.c ++++ b/tools/perf/builtin-probe.c +@@ -698,6 +698,16 @@ __cmd_probe(int argc, const char **argv) + + ret = perf_add_probe_events(params.events, params.nevents); + if (ret < 0) { ++ ++ /* ++ * When perf_add_probe_events() fails it calls ++ * cleanup_perf_probe_events(pevs, npevs), i.e. ++ * cleanup_perf_probe_events(params.events, params.nevents), which ++ * will call clear_perf_probe_event(), so set nevents to zero ++ * to avoid cleanup_params() to call clear_perf_probe_event() again ++ * on the same pevs. ++ */ ++ params.nevents = 0; + pr_err_with_code(" Error: Failed to add events.", ret); + return ret; + } +-- +2.20.1 + diff --git a/queue-5.2/perf-script-fix-off-by-one-in-brstackinsn-ipc-comput.patch b/queue-5.2/perf-script-fix-off-by-one-in-brstackinsn-ipc-comput.patch new file mode 100644 index 00000000000..89752808d46 --- /dev/null +++ b/queue-5.2/perf-script-fix-off-by-one-in-brstackinsn-ipc-comput.patch @@ -0,0 +1,59 @@ +From 7fa44dff5ea15d7a95027148affb1196e5758c5c Mon Sep 17 00:00:00 2001 +From: Andi Kleen +Date: Thu, 11 Jul 2019 11:19:21 -0700 +Subject: perf script: Fix off by one in brstackinsn IPC computation + +[ Upstream commit dde4e732a5b02fa5599c2c0e6c48a0c11789afc4 ] + +When we hit the end of a program block, need to count the last +instruction too for the IPC computation. This caused large errors for +small blocks. + + % perf script -b ls / > /dev/null + +Before: + + % perf script -F +brstackinsn --xed + ... + 00007f94c9ac70d8 jz 0x7f94c9ac70e3 # PRED 3 cycles [36] 4.33 IPC + 00007f94c9ac70e3 testb $0x20, 0x31d(%rbx) + 00007f94c9ac70ea jnz 0x7f94c9ac70b0 + 00007f94c9ac70ec testb $0x8, 0x205ad(%rip) + 00007f94c9ac70f3 jz 0x7f94c9ac6ff0 # PRED 1 cycles [37] 3.00 IPC + +After: + + % perf script -F +brstackinsn --xed + ... + 00007f94c9ac70d8 jz 0x7f94c9ac70e3 # PRED 3 cycles [15] 4.67 IPC + 00007f94c9ac70e3 testb $0x20, 0x31d(%rbx) + 00007f94c9ac70ea jnz 0x7f94c9ac70b0 + 00007f94c9ac70ec testb $0x8, 0x205ad(%rip) + 00007f94c9ac70f3 jz 0x7f94c9ac6ff0 # PRED 1 cycles [16] 4.00 IPC + +Suggested-by: Denis Bakhvalov +Signed-off-by: Andi Kleen +Cc: Jiri Olsa +Link: http://lkml.kernel.org/r/20190711181922.18765-2-andi@firstfloor.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-script.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index d089eb706d188..4380474c8c35a 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1057,7 +1057,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + + printed += ip__fprintf_sym(ip, thread, x.cpumode, x.cpu, &lastsym, attr, fp); + if (ip == end) { +- printed += ip__fprintf_jump(ip, &br->entries[i], &x, buffer + off, len - off, insn, fp, ++ printed += ip__fprintf_jump(ip, &br->entries[i], &x, buffer + off, len - off, ++insn, fp, + &total_cycles); + if (PRINT_FIELD(SRCCODE)) + printed += print_srccode(thread, x.cpumode, ip); +-- +2.20.1 + diff --git a/queue-5.2/perf-session-fix-loading-of-compressed-data-split-ac.patch b/queue-5.2/perf-session-fix-loading-of-compressed-data-split-ac.patch new file mode 100644 index 00000000000..c87603b671b --- /dev/null +++ b/queue-5.2/perf-session-fix-loading-of-compressed-data-split-ac.patch @@ -0,0 +1,134 @@ +From 884ed46849bffb36f10d0d210a1d5463e7ccf526 Mon Sep 17 00:00:00 2001 +From: Alexey Budankov +Date: Tue, 9 Jul 2019 17:48:14 +0300 +Subject: perf session: Fix loading of compressed data split across adjacent + records + +[ Upstream commit 872c8ee8f0f47222f7b10da96eea84d0486540a3 ] + +Fix decompression failure found during the loading of compressed trace +collected on larger scale systems (>48 cores). + +The error happened due to lack of decompression space for a mmaped +buffer data chunk split across adjacent PERF_RECORD_COMPRESSED records. + + $ perf report -i bt.16384.data --stats + failed to decompress (B): 63869 -> 0 : Destination buffer is too small + user stack dump failure + Can't parse sample, err = -14 + 0x2637e436 [0x4080]: failed to process type: 9 + Error: + failed to process sample + + $ perf test 71 + 71: Zstd perf.data compression/decompression : Ok + +Signed-off-by: Alexey Budankov +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/4d839e1b-9c48-89c4-9702-a12217420611@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/session.c | 22 ++++++++++++++-------- + tools/perf/util/session.h | 1 + + tools/perf/util/zstd.c | 4 ++-- + 3 files changed, 17 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 2e61dd6a3574e..d789840960444 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -36,10 +36,16 @@ static int perf_session__process_compressed_event(struct perf_session *session, + void *src; + size_t decomp_size, src_size; + u64 decomp_last_rem = 0; +- size_t decomp_len = session->header.env.comp_mmap_len; ++ size_t mmap_len, decomp_len = session->header.env.comp_mmap_len; + struct decomp *decomp, *decomp_last = session->decomp_last; + +- decomp = mmap(NULL, sizeof(struct decomp) + decomp_len, PROT_READ|PROT_WRITE, ++ if (decomp_last) { ++ decomp_last_rem = decomp_last->size - decomp_last->head; ++ decomp_len += decomp_last_rem; ++ } ++ ++ mmap_len = sizeof(struct decomp) + decomp_len; ++ decomp = mmap(NULL, mmap_len, PROT_READ|PROT_WRITE, + MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); + if (decomp == MAP_FAILED) { + pr_err("Couldn't allocate memory for decompression\n"); +@@ -47,10 +53,10 @@ static int perf_session__process_compressed_event(struct perf_session *session, + } + + decomp->file_pos = file_offset; ++ decomp->mmap_len = mmap_len; + decomp->head = 0; + +- if (decomp_last) { +- decomp_last_rem = decomp_last->size - decomp_last->head; ++ if (decomp_last_rem) { + memcpy(decomp->data, &(decomp_last->data[decomp_last->head]), decomp_last_rem); + decomp->size = decomp_last_rem; + } +@@ -61,7 +67,7 @@ static int perf_session__process_compressed_event(struct perf_session *session, + decomp_size = zstd_decompress_stream(&(session->zstd_data), src, src_size, + &(decomp->data[decomp_last_rem]), decomp_len - decomp_last_rem); + if (!decomp_size) { +- munmap(decomp, sizeof(struct decomp) + decomp_len); ++ munmap(decomp, mmap_len); + pr_err("Couldn't decompress data\n"); + return -1; + } +@@ -255,15 +261,15 @@ static void perf_session__delete_threads(struct perf_session *session) + static void perf_session__release_decomp_events(struct perf_session *session) + { + struct decomp *next, *decomp; +- size_t decomp_len; ++ size_t mmap_len; + next = session->decomp; +- decomp_len = session->header.env.comp_mmap_len; + do { + decomp = next; + if (decomp == NULL) + break; + next = decomp->next; +- munmap(decomp, decomp_len + sizeof(struct decomp)); ++ mmap_len = decomp->mmap_len; ++ munmap(decomp, mmap_len); + } while (1); + } + +diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h +index dd8920b745bce..863dbad878496 100644 +--- a/tools/perf/util/session.h ++++ b/tools/perf/util/session.h +@@ -46,6 +46,7 @@ struct perf_session { + struct decomp { + struct decomp *next; + u64 file_pos; ++ size_t mmap_len; + u64 head; + size_t size; + char data[]; +diff --git a/tools/perf/util/zstd.c b/tools/perf/util/zstd.c +index 23bdb98845760..d2202392ffdbb 100644 +--- a/tools/perf/util/zstd.c ++++ b/tools/perf/util/zstd.c +@@ -99,8 +99,8 @@ size_t zstd_decompress_stream(struct zstd_data *data, void *src, size_t src_size + while (input.pos < input.size) { + ret = ZSTD_decompressStream(data->dstream, &output, &input); + if (ZSTD_isError(ret)) { +- pr_err("failed to decompress (B): %ld -> %ld : %s\n", +- src_size, output.size, ZSTD_getErrorName(ret)); ++ pr_err("failed to decompress (B): %ld -> %ld, dst_size %ld : %s\n", ++ src_size, output.size, dst_size, ZSTD_getErrorName(ret)); + break; + } + output.dst = dst + output.pos; +-- +2.20.1 + diff --git a/queue-5.2/perf-stat-fix-segfault-for-event-group-in-repeat-mod.patch b/queue-5.2/perf-stat-fix-segfault-for-event-group-in-repeat-mod.patch new file mode 100644 index 00000000000..1edb5e2a6ea --- /dev/null +++ b/queue-5.2/perf-stat-fix-segfault-for-event-group-in-repeat-mod.patch @@ -0,0 +1,90 @@ +From c0a276ecc189ac411d619713ef838597ea51f5c4 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Mon, 15 Jul 2019 16:21:21 +0200 +Subject: perf stat: Fix segfault for event group in repeat mode + +[ Upstream commit 08ef3af1579d0446db1c1bd08e2c42565addf10f ] + +Numfor Mbiziwo-Tiapo reported segfault on stat of event group in repeat +mode: + + # perf stat -e '{cycles,instructions}' -r 10 ls + +It's caused by memory corruption due to not cleaned evsel's id array and +index, which needs to be rebuilt in every stat iteration. Currently the +ids index grows, while the array (which is also not freed) has the same +size. + +Fixing this by releasing id array and zeroing ids index in +perf_evsel__close function. + +We also need to keep the evsel_list alive for stat record (which is +disabled in repeat mode). + +Reported-by: Numfor Mbiziwo-Tiapo +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Mark Drayton +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Link: http://lkml.kernel.org/r/20190715142121.GC6032@krava +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 9 ++++++++- + tools/perf/util/evsel.c | 2 ++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index e28002d905738..c6c550dbb9479 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -607,7 +607,13 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx) + * group leaders. + */ + read_counters(&(struct timespec) { .tv_nsec = t1-t0 }); +- perf_evlist__close(evsel_list); ++ ++ /* ++ * We need to keep evsel_list alive, because it's processed ++ * later the evsel_list will be closed after. ++ */ ++ if (!STAT_RECORD) ++ perf_evlist__close(evsel_list); + + return WEXITSTATUS(status); + } +@@ -1922,6 +1928,7 @@ int cmd_stat(int argc, const char **argv) + perf_session__write_header(perf_stat.session, evsel_list, fd, true); + } + ++ perf_evlist__close(evsel_list); + perf_session__delete(perf_stat.session); + } + +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 2c46f9aa416c6..b854541604df5 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1282,6 +1282,7 @@ static void perf_evsel__free_id(struct perf_evsel *evsel) + xyarray__delete(evsel->sample_id); + evsel->sample_id = NULL; + zfree(&evsel->id); ++ evsel->ids = 0; + } + + static void perf_evsel__free_config_terms(struct perf_evsel *evsel) +@@ -2074,6 +2075,7 @@ void perf_evsel__close(struct perf_evsel *evsel) + + perf_evsel__close_fd(evsel); + perf_evsel__free_fd(evsel); ++ perf_evsel__free_id(evsel); + } + + int perf_evsel__open_per_cpu(struct perf_evsel *evsel, +-- +2.20.1 + diff --git a/queue-5.2/perf-tools-fix-proper-buffer-size-for-feature-proces.patch b/queue-5.2/perf-tools-fix-proper-buffer-size-for-feature-proces.patch new file mode 100644 index 00000000000..5ca75bf1c19 --- /dev/null +++ b/queue-5.2/perf-tools-fix-proper-buffer-size-for-feature-proces.patch @@ -0,0 +1,50 @@ +From 3354c28448dadd44d98817091156e0e34f17723e Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Mon, 15 Jul 2019 16:04:26 +0200 +Subject: perf tools: Fix proper buffer size for feature processing + +[ Upstream commit 79b2fe5e756163897175a8f57d66b26cd9befd59 ] + +After Song Liu's segfault fix for pipe mode, Arnaldo reported following +error: + + # perf record -o - | perf script + 0x514 [0x1ac]: failed to process type: 80 + +It's caused by wrong buffer size setup in feature processing, which +makes cpu topology feature fail, because it's using buffer size to +recognize its header version. + +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: David Carrillo-Cisneros +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Fixes: e9def1b2e74e ("perf tools: Add feature header record to pipe-mode") +Link: http://lkml.kernel.org/r/20190715140426.32509-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index b82d4577d9694..e84b70be3fc11 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3666,7 +3666,7 @@ int perf_event__process_feature(struct perf_session *session, + return 0; + + ff.buf = (void *)fe->data; +- ff.size = event->header.size - sizeof(event->header); ++ ff.size = event->header.size - sizeof(*fe); + ff.ph = &session->header; + + if (feat_ops[feat].process(&ff, NULL)) +-- +2.20.1 + diff --git a/queue-5.2/perf-x86-apply-more-accurate-check-on-hypervisor-pla.patch b/queue-5.2/perf-x86-apply-more-accurate-check-on-hypervisor-pla.patch new file mode 100644 index 00000000000..5816c9407d5 --- /dev/null +++ b/queue-5.2/perf-x86-apply-more-accurate-check-on-hypervisor-pla.patch @@ -0,0 +1,59 @@ +From f1094678f07c76af1b2dd4850164c24c500cf6f9 Mon Sep 17 00:00:00 2001 +From: Zhenzhong Duan +Date: Thu, 25 Jul 2019 10:39:26 +0800 +Subject: perf/x86: Apply more accurate check on hypervisor platform + +[ Upstream commit 5ea3f6fb37b79da33ac9211df336fd2b9f47c39f ] + +check_msr is used to fix a bug report in guest where KVM doesn't support +LBR MSR and cause #GP. + +The msr check is bypassed on real HW to workaround a false failure, +see commit d0e1a507bdc7 ("perf/x86/intel: Disable check_msr for real HW") + +When running a guest with CONFIG_HYPERVISOR_GUEST not set or "nopv" +enabled, current check isn't enough and #GP could trigger. + +Signed-off-by: Zhenzhong Duan +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Boris Ostrovsky +Cc: Borislav Petkov +Cc: Jiri Olsa +Cc: Juergen Gross +Cc: Linus Torvalds +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/1564022366-18293-1-git-send-email-zhenzhong.duan@oracle.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index e9042e3f3052c..6179be624f357 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -20,7 +20,6 @@ + #include + #include + #include +-#include + + #include "../perf_event.h" + +@@ -4057,7 +4056,7 @@ static bool check_msr(unsigned long msr, u64 mask) + * Disable the check for real HW, so we don't + * mess with potentionaly enabled registers: + */ +- if (hypervisor_is_type(X86_HYPER_NATIVE)) ++ if (!boot_cpu_has(X86_FEATURE_HYPERVISOR)) + return true; + + /* +-- +2.20.1 + diff --git a/queue-5.2/perf-x86-intel-fix-invalid-bit-13-for-icelake-msr_of.patch b/queue-5.2/perf-x86-intel-fix-invalid-bit-13-for-icelake-msr_of.patch new file mode 100644 index 00000000000..e940c43f44c --- /dev/null +++ b/queue-5.2/perf-x86-intel-fix-invalid-bit-13-for-icelake-msr_of.patch @@ -0,0 +1,59 @@ +From 326baaf9a0b95a20a93cee616625a48c7579394a Mon Sep 17 00:00:00 2001 +From: Yunying Sun +Date: Wed, 24 Jul 2019 16:29:32 +0800 +Subject: perf/x86/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x + register + +[ Upstream commit 3b238a64c3009fed36eaea1af629d9377759d87d ] + +The Intel SDM states that bit 13 of Icelake's MSR_OFFCORE_RSP_x +register is valid, and used for counting hardware generated prefetches +of L3 cache. Update the bitmask to allow bit 13. + +Before: +$ perf stat -e cpu/event=0xb7,umask=0x1,config1=0x1bfff/u sleep 3 + Performance counter stats for 'sleep 3': + cpu/event=0xb7,umask=0x1,config1=0x1bfff/u + +After: +$ perf stat -e cpu/event=0xb7,umask=0x1,config1=0x1bfff/u sleep 3 + Performance counter stats for 'sleep 3': + 9,293 cpu/event=0xb7,umask=0x1,config1=0x1bfff/u + +Signed-off-by: Yunying Sun +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: acme@kernel.org +Cc: alexander.shishkin@linux.intel.com +Cc: bp@alien8.de +Cc: hpa@zytor.com +Cc: jolsa@redhat.com +Cc: namhyung@kernel.org +Link: https://lkml.kernel.org/r/20190724082932.12833-1-yunying.sun@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 2889dd0235668..e9042e3f3052c 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -263,8 +263,8 @@ static struct event_constraint intel_icl_event_constraints[] = { + }; + + static struct extra_reg intel_icl_extra_regs[] __read_mostly = { +- INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3fffff9fffull, RSP_0), +- INTEL_UEVENT_EXTRA_REG(0x01bb, MSR_OFFCORE_RSP_1, 0x3fffff9fffull, RSP_1), ++ INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3fffffbfffull, RSP_0), ++ INTEL_UEVENT_EXTRA_REG(0x01bb, MSR_OFFCORE_RSP_1, 0x3fffffbfffull, RSP_1), + INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd), + INTEL_UEVENT_EXTRA_REG(0x01c6, MSR_PEBS_FRONTEND, 0x7fff17, FE), + EVENT_EXTRA_END +-- +2.20.1 + diff --git a/queue-5.2/perf-x86-intel-fix-slots-pebs-event-constraint.patch b/queue-5.2/perf-x86-intel-fix-slots-pebs-event-constraint.patch new file mode 100644 index 00000000000..df38f1f0f9a --- /dev/null +++ b/queue-5.2/perf-x86-intel-fix-slots-pebs-event-constraint.patch @@ -0,0 +1,44 @@ +From e76a069392db432729859fd8fe7d5c738a02f3e8 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Tue, 23 Jul 2019 13:04:29 -0700 +Subject: perf/x86/intel: Fix SLOTS PEBS event constraint + +[ Upstream commit 3d0c3953601d250175c7684ec0d9df612061dae5 ] + +Sampling SLOTS event and ref-cycles event in a group on Icelake gives +EINVAL. + +SLOTS event is the event stands for the fixed counter 3, not fixed +counter 2. Wrong mask was set to SLOTS event in +intel_icl_pebs_event_constraints[]. + +Reported-by: Andi Kleen +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") +Link: https://lkml.kernel.org/r/20190723200429.8180-1-kan.liang@linux.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/ds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 505c73dc6a730..6601b8759c92f 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -851,7 +851,7 @@ struct event_constraint intel_skl_pebs_event_constraints[] = { + + struct event_constraint intel_icl_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x1c0, 0x100000000ULL), /* INST_RETIRED.PREC_DIST */ +- INTEL_FLAGS_UEVENT_CONSTRAINT(0x0400, 0x400000000ULL), /* SLOTS */ ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x0400, 0x800000000ULL), /* SLOTS */ + + INTEL_PLD_CONSTRAINT(0x1cd, 0xff), /* MEM_TRANS_RETIRED.LOAD_LATENCY */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x1d0, 0xf), /* MEM_INST_RETIRED.LOAD */ +-- +2.20.1 + diff --git a/queue-5.2/powerpc-fix-off-by-one-in-max_zone_pfn-initializatio.patch b/queue-5.2/powerpc-fix-off-by-one-in-max_zone_pfn-initializatio.patch new file mode 100644 index 00000000000..704ee0607a5 --- /dev/null +++ b/queue-5.2/powerpc-fix-off-by-one-in-max_zone_pfn-initializatio.patch @@ -0,0 +1,47 @@ +From 0c288086bb9272c7abbadb6c44e96418a4e4c2c2 Mon Sep 17 00:00:00 2001 +From: Andrea Arcangeli +Date: Tue, 25 Jun 2019 10:17:27 -0400 +Subject: powerpc: fix off by one in max_zone_pfn initialization for ZONE_DMA + +[ Upstream commit 03800e0526ee25ed7c843ca1e57b69ac2a5af642 ] + +25078dc1f74be16b858e914f52cc8f4d03c2271a first introduced an off by +one error in the ZONE_DMA initialization of PPC_BOOK3E_64=y and since +9739ab7eda459f0669ec9807e0d9be5020bab88c the off by one applies to +PPC32=y too. This simply corrects the off by one and should resolve +crashes like below: + +[ 65.179101] page 0x7fff outside node 0 zone DMA [ 0x0 - 0x7fff ] + +Unfortunately in various MM places "max" means a non inclusive end of +range. free_area_init_nodes max_zone_pfn parameter is one case and +MAX_ORDER is another one (unrelated) that comes by memory. + +Reported-by: Zorro Lang +Fixes: 25078dc1f74b ("powerpc: use mm zones more sensibly") +Fixes: 9739ab7eda45 ("powerpc: enable a 30-bit ZONE_DMA for 32-bit pmac") +Signed-off-by: Andrea Arcangeli +Reviewed-by: Christoph Hellwig +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20190625141727.2883-1-aarcange@redhat.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 2540d3b2588c3..2eda1ec36f552 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -249,7 +249,7 @@ void __init paging_init(void) + + #ifdef CONFIG_ZONE_DMA + max_zone_pfns[ZONE_DMA] = min(max_low_pfn, +- ((1UL << ARCH_ZONE_DMA_BITS) - 1) >> PAGE_SHIFT); ++ 1UL << (ARCH_ZONE_DMA_BITS - PAGE_SHIFT)); + #endif + max_zone_pfns[ZONE_NORMAL] = max_low_pfn; + #ifdef CONFIG_HIGHMEM +-- +2.20.1 + diff --git a/queue-5.2/powerpc-papr_scm-force-a-scm-unbind-if-initial-scm-b.patch b/queue-5.2/powerpc-papr_scm-force-a-scm-unbind-if-initial-scm-b.patch new file mode 100644 index 00000000000..43cb95ebd81 --- /dev/null +++ b/queue-5.2/powerpc-papr_scm-force-a-scm-unbind-if-initial-scm-b.patch @@ -0,0 +1,73 @@ +From 3f110c0da72beef6fde3ea0f8c226f0d13094103 Mon Sep 17 00:00:00 2001 +From: Vaibhav Jain +Date: Sat, 29 Jun 2019 21:36:10 +0530 +Subject: powerpc/papr_scm: Force a scm-unbind if initial scm-bind fails + +[ Upstream commit 3a855b7ac7d5021674aa3e1cc9d3bfd6b604e9c0 ] + +In some cases initial bind of scm memory for an lpar can fail if +previously it wasn't released using a scm-unbind hcall. This situation +can arise due to panic of the previous kernel or forced lpar +fadump. In such cases the H_SCM_BIND_MEM return a H_OVERLAP error. + +To mitigate such cases the patch updates papr_scm_probe() to force a +call to drc_pmem_unbind() in case the initial bind of scm memory fails +with EBUSY error. In case scm-bind operation again fails after the +forced scm-unbind then we follow the existing error path. We also +update drc_pmem_bind() to handle the H_OVERLAP error returned by phyp +and indicate it as a EBUSY error back to the caller. + +Suggested-by: "Oliver O'Halloran" +Signed-off-by: Vaibhav Jain +Reviewed-by: Oliver O'Halloran +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20190629160610.23402-4-vaibhav@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/papr_scm.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 96c53b23e58f9..dad9825e40874 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -42,8 +42,9 @@ struct papr_scm_priv { + static int drc_pmem_bind(struct papr_scm_priv *p) + { + unsigned long ret[PLPAR_HCALL_BUFSIZE]; +- uint64_t rc, token; + uint64_t saved = 0; ++ uint64_t token; ++ int64_t rc; + + /* + * When the hypervisor cannot map all the requested memory in a single +@@ -63,6 +64,10 @@ static int drc_pmem_bind(struct papr_scm_priv *p) + } while (rc == H_BUSY); + + if (rc) { ++ /* H_OVERLAP needs a separate error path */ ++ if (rc == H_OVERLAP) ++ return -EBUSY; ++ + dev_err(&p->pdev->dev, "bind err: %lld\n", rc); + return -ENXIO; + } +@@ -316,6 +321,14 @@ static int papr_scm_probe(struct platform_device *pdev) + + /* request the hypervisor to bind this region to somewhere in memory */ + rc = drc_pmem_bind(p); ++ ++ /* If phyp says drc memory still bound then force unbound and retry */ ++ if (rc == -EBUSY) { ++ dev_warn(&pdev->dev, "Retrying bind after unbinding\n"); ++ drc_pmem_unbind(p); ++ rc = drc_pmem_bind(p); ++ } ++ + if (rc) + goto err; + +-- +2.20.1 + diff --git a/queue-5.2/rq-qos-don-t-reset-has_sleepers-on-spurious-wakeups.patch b/queue-5.2/rq-qos-don-t-reset-has_sleepers-on-spurious-wakeups.patch new file mode 100644 index 00000000000..425fe6d60f7 --- /dev/null +++ b/queue-5.2/rq-qos-don-t-reset-has_sleepers-on-spurious-wakeups.patch @@ -0,0 +1,39 @@ +From 008c4e339153bd803a6ba6998fc7418eff7a4a1d Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Tue, 16 Jul 2019 16:19:27 -0400 +Subject: rq-qos: don't reset has_sleepers on spurious wakeups + +[ Upstream commit 64e7ea875ef63b2801be7954cf7257d1bfccc266 ] + +If we raced with somebody else getting an inflight counter we could fail +to get an inflight counter with no sleepers on the list, and thus need +to go to sleep. In this case has_sleepers should be true because we are +now relying on the waker to get our inflight counter for us. And in the +case of spurious wakeups we'd still want this to be the case. So set +has_sleepers to true if we went to sleep to make sure we're woken up the +proper way. + +Reviewed-by: Oleg Nesterov +Signed-off-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-rq-qos.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c +index 659ccb8b693fa..e5d75280b431e 100644 +--- a/block/blk-rq-qos.c ++++ b/block/blk-rq-qos.c +@@ -260,7 +260,7 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data, + break; + } + io_schedule(); +- has_sleeper = false; ++ has_sleeper = true; + } while (1); + finish_wait(&rqw->wait, &data.wq); + } +-- +2.20.1 + diff --git a/queue-5.2/rq-qos-set-ourself-task_uninterruptible-after-we-sch.patch b/queue-5.2/rq-qos-set-ourself-task_uninterruptible-after-we-sch.patch new file mode 100644 index 00000000000..80d191df640 --- /dev/null +++ b/queue-5.2/rq-qos-set-ourself-task_uninterruptible-after-we-sch.patch @@ -0,0 +1,33 @@ +From 39188374b35fbad5786487d4a52520264c1f4c59 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Tue, 16 Jul 2019 16:19:28 -0400 +Subject: rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule + +[ Upstream commit d14a9b389a86a5154b704bc88ce8dd37c701456a ] + +In case we get a spurious wakeup we need to make sure to re-set +ourselves to TASK_UNINTERRUPTIBLE so we don't busy wait. + +Reviewed-by: Oleg Nesterov +Signed-off-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-rq-qos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c +index e5d75280b431e..e3ab75e4df9ea 100644 +--- a/block/blk-rq-qos.c ++++ b/block/blk-rq-qos.c +@@ -261,6 +261,7 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data, + } + io_schedule(); + has_sleeper = true; ++ set_current_state(TASK_UNINTERRUPTIBLE); + } while (1); + finish_wait(&rqw->wait, &data.wq); + } +-- +2.20.1 + diff --git a/queue-5.2/rq-qos-use-a-mb-for-got_token.patch b/queue-5.2/rq-qos-use-a-mb-for-got_token.patch new file mode 100644 index 00000000000..154c301b6c5 --- /dev/null +++ b/queue-5.2/rq-qos-use-a-mb-for-got_token.patch @@ -0,0 +1,51 @@ +From 3d2705463d9712cc805a7a5bc5f1b029b5b1531f Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Tue, 16 Jul 2019 16:19:29 -0400 +Subject: rq-qos: use a mb for got_token + +[ Upstream commit ac38297f7038cd5b80d66f8809c7bbf5b70031f3 ] + +Oleg noticed that our checking of data.got_token is unsafe in the +cleanup case, and should really use a memory barrier. Use a wmb on the +write side, and a rmb() on the read side. We don't need one in the main +loop since we're saved by set_current_state(). + +Reviewed-by: Oleg Nesterov +Signed-off-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-rq-qos.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c +index e3ab75e4df9ea..06d024204f504 100644 +--- a/block/blk-rq-qos.c ++++ b/block/blk-rq-qos.c +@@ -202,6 +202,7 @@ static int rq_qos_wake_function(struct wait_queue_entry *curr, + return -1; + + data->got_token = true; ++ smp_wmb(); + list_del_init(&curr->entry); + wake_up_process(data->task); + return 1; +@@ -245,6 +246,7 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data, + + prepare_to_wait_exclusive(&rqw->wait, &data.wq, TASK_UNINTERRUPTIBLE); + do { ++ /* The memory barrier in set_task_state saves us here. */ + if (data.got_token) + break; + if (!has_sleeper && acquire_inflight_cb(rqw, private_data)) { +@@ -255,6 +257,7 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data, + * which means we now have two. Put our local token + * and wake anyone else potentially waiting for one. + */ ++ smp_rmb(); + if (data.got_token) + cleanup_cb(rqw, private_data); + break; +-- +2.20.1 + diff --git a/queue-5.2/s390-dma-provide-proper-arch_zone_dma_bits-value.patch b/queue-5.2/s390-dma-provide-proper-arch_zone_dma_bits-value.patch new file mode 100644 index 00000000000..0d76b9dd30c --- /dev/null +++ b/queue-5.2/s390-dma-provide-proper-arch_zone_dma_bits-value.patch @@ -0,0 +1,38 @@ +From e61073e49af45f29da4ce5a621f691417117d671 Mon Sep 17 00:00:00 2001 +From: Halil Pasic +Date: Wed, 24 Jul 2019 00:51:55 +0200 +Subject: s390/dma: provide proper ARCH_ZONE_DMA_BITS value + +[ Upstream commit 1a2dcff881059dedc14fafc8a442664c8dbd60f1 ] + +On s390 ZONE_DMA is up to 2G, i.e. ARCH_ZONE_DMA_BITS should be 31 bits. +The current value is 24 and makes __dma_direct_alloc_pages() take a +wrong turn first (but __dma_direct_alloc_pages() recovers then). + +Let's correct ARCH_ZONE_DMA_BITS value and avoid wrong turns. + +Signed-off-by: Halil Pasic +Reported-by: Petr Tesarik +Fixes: c61e9637340e ("dma-direct: add support for allocation from ZONE_DMA and ZONE_DMA32") +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/page.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h +index a4d38092530ab..823578c6b9e2c 100644 +--- a/arch/s390/include/asm/page.h ++++ b/arch/s390/include/asm/page.h +@@ -177,6 +177,8 @@ static inline int devmem_is_allowed(unsigned long pfn) + #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | \ + VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) + ++#define ARCH_ZONE_DMA_BITS 31 ++ + #include + #include + +-- +2.20.1 + diff --git a/queue-5.2/s390-qdio-add-sanity-checks-to-the-fast-requeue-path.patch b/queue-5.2/s390-qdio-add-sanity-checks-to-the-fast-requeue-path.patch new file mode 100644 index 00000000000..7477589029f --- /dev/null +++ b/queue-5.2/s390-qdio-add-sanity-checks-to-the-fast-requeue-path.patch @@ -0,0 +1,50 @@ +From 76ebb7d31fd924f1aa7f549c9fb11586766b5f55 Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Thu, 11 Jul 2019 18:17:36 +0200 +Subject: s390/qdio: add sanity checks to the fast-requeue path + +[ Upstream commit a6ec414a4dd529eeac5c3ea51c661daba3397108 ] + +If the device driver were to send out a full queue's worth of SBALs, +current code would end up discovering the last of those SBALs as PRIMED +and erroneously skip the SIGA-w. This immediately stalls the queue. + +Add a check to not attempt fast-requeue in this case. While at it also +make sure that the state of the previous SBAL was successfully extracted +before inspecting it. + +Signed-off-by: Julian Wiedmann +Reviewed-by: Jens Remus +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/qdio_main.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index 730c4e68094ba..7f5adf02f0959 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -1558,13 +1558,13 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags, + rc = qdio_kick_outbound_q(q, phys_aob); + } else if (need_siga_sync(q)) { + rc = qdio_siga_sync_q(q); ++ } else if (count < QDIO_MAX_BUFFERS_PER_Q && ++ get_buf_state(q, prev_buf(bufnr), &state, 0) > 0 && ++ state == SLSB_CU_OUTPUT_PRIMED) { ++ /* The previous buffer is not processed yet, tack on. */ ++ qperf_inc(q, fast_requeue); + } else { +- /* try to fast requeue buffers */ +- get_buf_state(q, prev_buf(bufnr), &state, 0); +- if (state != SLSB_CU_OUTPUT_PRIMED) +- rc = qdio_kick_outbound_q(q, 0); +- else +- qperf_inc(q, fast_requeue); ++ rc = qdio_kick_outbound_q(q, 0); + } + + /* in case of SIGA errors we must process the error immediately */ +-- +2.20.1 + diff --git a/queue-5.2/scripts-sphinx-pre-install-don-t-use-latex-with-cent.patch b/queue-5.2/scripts-sphinx-pre-install-don-t-use-latex-with-cent.patch new file mode 100644 index 00000000000..2084c844e98 --- /dev/null +++ b/queue-5.2/scripts-sphinx-pre-install-don-t-use-latex-with-cent.patch @@ -0,0 +1,167 @@ +From ab2ea620300931a286217bef2182a3a36ed6e440 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Sat, 13 Jul 2019 09:37:16 -0300 +Subject: scripts/sphinx-pre-install: don't use LaTeX with CentOS 7 + +[ Upstream commit 56e5a633923793b31515795ad30156a307572c1e ] + +There aren't enough texlive packages for LaTeX-based builds +to work on CentOS/RHEL <= 7. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + scripts/sphinx-pre-install | 68 ++++++++++++++++++++++++++++---------- + 1 file changed, 50 insertions(+), 18 deletions(-) + +diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install +index 778f3ae918775..4cc2b3ee5209f 100755 +--- a/scripts/sphinx-pre-install ++++ b/scripts/sphinx-pre-install +@@ -77,6 +77,17 @@ sub check_missing(%) + foreach my $prog (sort keys %missing) { + my $is_optional = $missing{$prog}; + ++ # At least on some LTS distros like CentOS 7, texlive doesn't ++ # provide all packages we need. When such distros are ++ # detected, we have to disable PDF output. ++ # ++ # So, we need to ignore the packages that distros would ++ # need for LaTeX to work ++ if ($is_optional == 2 && !$pdf) { ++ $optional--; ++ next; ++ } ++ + if ($is_optional) { + print "Warning: better to also install \"$prog\".\n"; + } else { +@@ -326,10 +337,10 @@ sub give_debian_hints() + + if ($pdf) { + check_missing_file("/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", +- "fonts-dejavu", 1); ++ "fonts-dejavu", 2); + } + +- check_program("dvipng", 1) if ($pdf); ++ check_program("dvipng", 2) if ($pdf); + check_missing(\%map); + + return if (!$need && !$optional); +@@ -364,22 +375,40 @@ sub give_redhat_hints() + # + # Checks valid for RHEL/CentOS version 7.x. + # ++ my $old = 0; ++ my $rel; ++ $rel = $1 if ($system_release =~ /release\s+(\d+)/); ++ + if (!($system_release =~ /Fedora/)) { + $map{"virtualenv"} = "python-virtualenv"; +- } + +- my $release; ++ if ($rel && $rel < 8) { ++ $old = 1; ++ $pdf = 0; + +- $release = $1 if ($system_release =~ /Fedora\s+release\s+(\d+)/); ++ printf("Note: texlive packages on RHEL/CENTOS <= 7 are incomplete. Can't support PDF output\n"); ++ printf("If you want to build PDF, please read:\n"); ++ printf("\thttps://www.systutorials.com/241660/how-to-install-tex-live-on-centos-7-linux/\n"); ++ } ++ } else { ++ if ($rel && $rel < 26) { ++ $old = 1; ++ } ++ } ++ if (!$rel) { ++ printf("Couldn't identify release number\n"); ++ $old = 1; ++ $pdf = 0; ++ } + +- check_rpm_missing(\@fedora26_opt_pkgs, 1) if ($pdf && $release >= 26); +- check_rpm_missing(\@fedora_tex_pkgs, 1) if ($pdf); +- check_missing_tex(1) if ($pdf); ++ check_rpm_missing(\@fedora26_opt_pkgs, 2) if ($pdf && !$old); ++ check_rpm_missing(\@fedora_tex_pkgs, 2) if ($pdf); ++ check_missing_tex(2) if ($pdf); + check_missing(\%map); + + return if (!$need && !$optional); + +- if ($release >= 18) { ++ if (!$old) { + # dnf, for Fedora 18+ + printf("You should run:\n\n\tsudo dnf install -y $install\n"); + } else { +@@ -418,8 +447,8 @@ sub give_opensuse_hints() + "texlive-zapfding", + ); + +- check_rpm_missing(\@suse_tex_pkgs, 1) if ($pdf); +- check_missing_tex(1) if ($pdf); ++ check_rpm_missing(\@suse_tex_pkgs, 2) if ($pdf); ++ check_missing_tex(2) if ($pdf); + check_missing(\%map); + + return if (!$need && !$optional); +@@ -443,7 +472,7 @@ sub give_mageia_hints() + "texlive-fontsextra", + ); + +- check_rpm_missing(\@tex_pkgs, 1) if ($pdf); ++ check_rpm_missing(\@tex_pkgs, 2) if ($pdf); + check_missing(\%map); + + return if (!$need && !$optional); +@@ -466,7 +495,8 @@ sub give_arch_linux_hints() + "texlive-latexextra", + "ttf-dejavu", + ); +- check_pacman_missing(\@archlinux_tex_pkgs, 1) if ($pdf); ++ check_pacman_missing(\@archlinux_tex_pkgs, 2) if ($pdf); ++ + check_missing(\%map); + + return if (!$need && !$optional); +@@ -485,7 +515,7 @@ sub give_gentoo_hints() + ); + + check_missing_file("/usr/share/fonts/dejavu/DejaVuSans.ttf", +- "media-fonts/dejavu", 1) if ($pdf); ++ "media-fonts/dejavu", 2) if ($pdf); + + check_missing(\%map); + +@@ -553,7 +583,7 @@ sub check_distros() + my %map = ( + "sphinx-build" => "sphinx" + ); +- check_missing_tex(1) if ($pdf); ++ check_missing_tex(2) if ($pdf); + check_missing(\%map); + print "I don't know distro $system_release.\n"; + print "So, I can't provide you a hint with the install procedure.\n"; +@@ -591,11 +621,13 @@ sub check_needs() + check_program("make", 0); + check_program("gcc", 0); + check_python_module("sphinx_rtd_theme", 1) if (!$virtualenv); +- check_program("xelatex", 1) if ($pdf); + check_program("dot", 1); + check_program("convert", 1); +- check_program("rsvg-convert", 1) if ($pdf); +- check_program("latexmk", 1) if ($pdf); ++ ++ # Extra PDF files - should use 2 for is_optional ++ check_program("xelatex", 2) if ($pdf); ++ check_program("rsvg-convert", 2) if ($pdf); ++ check_program("latexmk", 2) if ($pdf); + + check_distros(); + +-- +2.20.1 + diff --git a/queue-5.2/scripts-sphinx-pre-install-fix-latexmk-dependencies.patch b/queue-5.2/scripts-sphinx-pre-install-fix-latexmk-dependencies.patch new file mode 100644 index 00000000000..cdc755b310f --- /dev/null +++ b/queue-5.2/scripts-sphinx-pre-install-fix-latexmk-dependencies.patch @@ -0,0 +1,44 @@ +From 01224bb7bd4edc104d5dc553c503766f0a7eff79 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Sat, 13 Jul 2019 08:19:44 -0300 +Subject: scripts/sphinx-pre-install: fix latexmk dependencies + +[ Upstream commit 353290a9eb5362a80bc8e52fcd7eb77a30f48afc ] + +The name of the package with carries latexmk is different +on two distros: + +- On OpenSUSE, latexmk is packaged as "texlive-latexmk-bin" +- On Mageia, latexmk is packaged at "texlive-collection-basic" + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + scripts/sphinx-pre-install | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install +index 4cc2b3ee5209f..1f9f0a334c24f 100755 +--- a/scripts/sphinx-pre-install ++++ b/scripts/sphinx-pre-install +@@ -447,6 +447,8 @@ sub give_opensuse_hints() + "texlive-zapfding", + ); + ++ $map{"latexmk"} = "texlive-latexmk-bin"; ++ + check_rpm_missing(\@suse_tex_pkgs, 2) if ($pdf); + check_missing_tex(2) if ($pdf); + check_missing(\%map); +@@ -472,6 +474,8 @@ sub give_mageia_hints() + "texlive-fontsextra", + ); + ++ $map{"latexmk"} = "texlive-collection-basic"; ++ + check_rpm_missing(\@tex_pkgs, 2) if ($pdf); + check_missing(\%map); + +-- +2.20.1 + diff --git a/queue-5.2/scripts-sphinx-pre-install-fix-script-for-rhel-cento.patch b/queue-5.2/scripts-sphinx-pre-install-fix-script-for-rhel-cento.patch new file mode 100644 index 00000000000..d13c13d37b6 --- /dev/null +++ b/queue-5.2/scripts-sphinx-pre-install-fix-script-for-rhel-cento.patch @@ -0,0 +1,34 @@ +From 537382e88da799b912aced1323cbe9891ace5385 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Sat, 13 Jul 2019 08:50:24 -0300 +Subject: scripts/sphinx-pre-install: fix script for RHEL/CentOS + +[ Upstream commit b308467c916aa7acc5069802ab76a9f657434701 ] + +There's a missing parenthesis at the script, with causes it to +fail to detect non-Fedora releases (e. g. RHEL/CentOS). + +Tested with Centos 7.6.1810. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + scripts/sphinx-pre-install | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install +index 9be208db88d3a..778f3ae918775 100755 +--- a/scripts/sphinx-pre-install ++++ b/scripts/sphinx-pre-install +@@ -364,7 +364,7 @@ sub give_redhat_hints() + # + # Checks valid for RHEL/CentOS version 7.x. + # +- if (! $system_release =~ /Fedora/) { ++ if (!($system_release =~ /Fedora/)) { + $map{"virtualenv"} = "python-virtualenv"; + } + +-- +2.20.1 + diff --git a/queue-5.2/scsi-ibmvfc-fix-warn_on-during-event-pool-release.patch b/queue-5.2/scsi-ibmvfc-fix-warn_on-during-event-pool-release.patch new file mode 100644 index 00000000000..9d9fd44a0f4 --- /dev/null +++ b/queue-5.2/scsi-ibmvfc-fix-warn_on-during-event-pool-release.patch @@ -0,0 +1,73 @@ +From abc78ec00f9311ddb354dc074497c6be3ead8405 Mon Sep 17 00:00:00 2001 +From: Tyrel Datwyler +Date: Wed, 17 Jul 2019 14:48:27 -0500 +Subject: scsi: ibmvfc: fix WARN_ON during event pool release + +[ Upstream commit 5578257ca0e21056821e6481bd534ba267b84e58 ] + +While removing an ibmvfc client adapter a WARN_ON like the following +WARN_ON is seen in the kernel log: + +WARNING: CPU: 6 PID: 5421 at ./include/linux/dma-mapping.h:541 +ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc] +CPU: 6 PID: 5421 Comm: rmmod Tainted: G E 4.17.0-rc1-next-20180419-autotest #1 +NIP: d00000000290328c LR: d00000000290325c CTR: c00000000036ee20 +REGS: c000000288d1b7e0 TRAP: 0700 Tainted: G E (4.17.0-rc1-next-20180419-autotest) +MSR: 800000010282b033 CR: 44008828 XER: 20000000 +CFAR: c00000000036e408 SOFTE: 1 +GPR00: d00000000290325c c000000288d1ba60 d000000002917900 c000000289d75448 +GPR04: 0000000000000071 c0000000ff870000 0000000018040000 0000000000000001 +GPR08: 0000000000000000 c00000000156e838 0000000000000001 d00000000290c640 +GPR12: c00000000036ee20 c00000001ec4dc00 0000000000000000 0000000000000000 +GPR16: 0000000000000000 0000000000000000 00000100276901e0 0000000010020598 +GPR20: 0000000010020550 0000000010020538 0000000010020578 00000000100205b0 +GPR24: 0000000000000000 0000000000000000 0000000010020590 5deadbeef0000100 +GPR28: 5deadbeef0000200 d000000002910b00 0000000000000071 c0000002822f87d8 +NIP [d00000000290328c] ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc] +LR [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] +Call Trace: +[c000000288d1ba60] [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] (unreliable) +[c000000288d1baf0] [d000000002909390] ibmvfc_abort_task_set+0x7b0/0x8b0 [ibmvfc] +[c000000288d1bb70] [c0000000000d8c68] vio_bus_remove+0x68/0x100 +[c000000288d1bbb0] [c0000000007da7c4] device_release_driver_internal+0x1f4/0x2d0 +[c000000288d1bc00] [c0000000007da95c] driver_detach+0x7c/0x100 +[c000000288d1bc40] [c0000000007d8af4] bus_remove_driver+0x84/0x140 +[c000000288d1bcb0] [c0000000007db6ac] driver_unregister+0x4c/0xa0 +[c000000288d1bd20] [c0000000000d6e7c] vio_unregister_driver+0x2c/0x50 +[c000000288d1bd50] [d00000000290ba0c] cleanup_module+0x24/0x15e0 [ibmvfc] +[c000000288d1bd70] [c0000000001dadb0] sys_delete_module+0x220/0x2d0 +[c000000288d1be30] [c00000000000b284] system_call+0x58/0x6c +Instruction dump: +e8410018 e87f0068 809f0078 e8bf0080 e8df0088 2fa30000 419e008c e9230200 +2fa90000 419e0080 894d098a 794a07e0 <0b0a0000> e9290008 2fa90000 419e0028 + +This is tripped as a result of irqs being disabled during the call to +dma_free_coherent() by ibmvfc_free_event_pool(). At this point in the code path +we have quiesced the adapter and its overly paranoid anyways to be holding the +host lock. + +Reported-by: Abdul Haleem +Signed-off-by: Tyrel Datwyler +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index acd16e0d52cfe..8cdbac076a1b6 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4864,8 +4864,8 @@ static int ibmvfc_remove(struct vio_dev *vdev) + + spin_lock_irqsave(vhost->host->host_lock, flags); + ibmvfc_purge_requests(vhost, DID_ERROR); +- ibmvfc_free_event_pool(vhost); + spin_unlock_irqrestore(vhost->host->host_lock, flags); ++ ibmvfc_free_event_pool(vhost); + + ibmvfc_free_mem(vhost); + spin_lock(&ibmvfc_driver_lock); +-- +2.20.1 + diff --git a/queue-5.2/scsi-megaraid_sas-fix-panic-on-loading-firmware-cras.patch b/queue-5.2/scsi-megaraid_sas-fix-panic-on-loading-firmware-cras.patch new file mode 100644 index 00000000000..07fb74be0dc --- /dev/null +++ b/queue-5.2/scsi-megaraid_sas-fix-panic-on-loading-firmware-cras.patch @@ -0,0 +1,43 @@ +From 73f40c88050c3dacbe331234303eca2e873232f6 Mon Sep 17 00:00:00 2001 +From: Junxiao Bi +Date: Mon, 22 Jul 2019 09:15:24 -0700 +Subject: scsi: megaraid_sas: fix panic on loading firmware crashdump + +[ Upstream commit 3b5f307ef3cb5022bfe3c8ca5b8f2114d5bf6c29 ] + +While loading fw crashdump in function fw_crash_buffer_show(), left bytes +in one dma chunk was not checked, if copying size over it, overflow access +will cause kernel panic. + +Signed-off-by: Junxiao Bi +Acked-by: Sumit Saxena +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 7237114a1d534..5f30016e9b64f 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3045,6 +3045,7 @@ megasas_fw_crash_buffer_show(struct device *cdev, + u32 size; + unsigned long buff_addr; + unsigned long dmachunk = CRASH_DMA_BUF_SIZE; ++ unsigned long chunk_left_bytes; + unsigned long src_addr; + unsigned long flags; + u32 buff_offset; +@@ -3070,6 +3071,8 @@ megasas_fw_crash_buffer_show(struct device *cdev, + } + + size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset; ++ chunk_left_bytes = dmachunk - (buff_offset % dmachunk); ++ size = (size > chunk_left_bytes) ? chunk_left_bytes : size; + size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size; + + src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] + +-- +2.20.1 + diff --git a/queue-5.2/scsi-scsi_dh_alua-always-use-a-2-second-delay-before.patch b/queue-5.2/scsi-scsi_dh_alua-always-use-a-2-second-delay-before.patch new file mode 100644 index 00000000000..7faa828ffc3 --- /dev/null +++ b/queue-5.2/scsi-scsi_dh_alua-always-use-a-2-second-delay-before.patch @@ -0,0 +1,61 @@ +From 00c828645a172a3eb721c6a7f6d0f4e589308263 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Fri, 12 Jul 2019 08:53:47 +0200 +Subject: scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG + +[ Upstream commit 20122994e38aef0ae50555884d287adde6641c94 ] + +Retrying immediately after we've received a 'transitioning' sense code is +pretty much pointless, we should always use a delay before retrying. So +ensure the default delay is applied before retrying. + +Signed-off-by: Hannes Reinecke +Tested-by: Zhangguanghui +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index f0066f8a17864..4971104b1817b 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -40,6 +40,7 @@ + #define ALUA_FAILOVER_TIMEOUT 60 + #define ALUA_FAILOVER_RETRIES 5 + #define ALUA_RTPG_DELAY_MSECS 5 ++#define ALUA_RTPG_RETRY_DELAY 2 + + /* device handler flags */ + #define ALUA_OPTIMIZE_STPG 0x01 +@@ -682,7 +683,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + case SCSI_ACCESS_STATE_TRANSITIONING: + if (time_before(jiffies, pg->expiry)) { + /* State transition, retry */ +- pg->interval = 2; ++ pg->interval = ALUA_RTPG_RETRY_DELAY; + err = SCSI_DH_RETRY; + } else { + struct alua_dh_data *h; +@@ -807,6 +808,8 @@ static void alua_rtpg_work(struct work_struct *work) + spin_lock_irqsave(&pg->lock, flags); + pg->flags &= ~ALUA_PG_RUNNING; + pg->flags |= ALUA_PG_RUN_RTPG; ++ if (!pg->interval) ++ pg->interval = ALUA_RTPG_RETRY_DELAY; + spin_unlock_irqrestore(&pg->lock, flags); + queue_delayed_work(kaluad_wq, &pg->rtpg_work, + pg->interval * HZ); +@@ -818,6 +821,8 @@ static void alua_rtpg_work(struct work_struct *work) + spin_lock_irqsave(&pg->lock, flags); + if (err == SCSI_DH_RETRY || pg->flags & ALUA_PG_RUN_RTPG) { + pg->flags &= ~ALUA_PG_RUNNING; ++ if (!pg->interval && !(pg->flags & ALUA_PG_RUN_RTPG)) ++ pg->interval = ALUA_RTPG_RETRY_DELAY; + pg->flags |= ALUA_PG_RUN_RTPG; + spin_unlock_irqrestore(&pg->lock, flags); + queue_delayed_work(kaluad_wq, &pg->rtpg_work, +-- +2.20.1 + diff --git a/queue-5.2/series b/queue-5.2/series index 27703bdc6f5..e543fabd46c 100644 --- a/queue-5.2/series +++ b/queue-5.2/series @@ -46,3 +46,72 @@ can-rcar_canfd-fix-possible-irq-storm-on-high-load.patch can-flexcan-fix-stop-mode-acknowledgment.patch can-flexcan-fix-an-use-after-free-in-flexcan_setup_stop_mode.patch can-peak_usb-fix-potential-double-kfree_skb.patch +powerpc-fix-off-by-one-in-max_zone_pfn-initializatio.patch +netfilter-nfnetlink-avoid-deadlock-due-to-synchronou.patch +vfio-ccw-set-pa_nr-to-0-if-memory-allocation-fails-f.patch +vfio-ccw-don-t-call-cp_free-if-we-are-processing-a-c.patch +netfilter-fix-rpfilter-dropping-vrf-packets-by-mista.patch +netfilter-nf_tables-fix-module-autoload-for-redir.patch +netfilter-conntrack-always-store-window-size-un-scal.patch +netfilter-nft_hash-fix-symhash-with-modulus-one.patch +scripts-sphinx-pre-install-fix-script-for-rhel-cento.patch +scripts-sphinx-pre-install-don-t-use-latex-with-cent.patch +scripts-sphinx-pre-install-fix-latexmk-dependencies.patch +rq-qos-don-t-reset-has_sleepers-on-spurious-wakeups.patch +rq-qos-set-ourself-task_uninterruptible-after-we-sch.patch +rq-qos-use-a-mb-for-got_token.patch +netfilter-nf_tables-support-auto-loading-for-inet-na.patch +drm-amd-display-no-audio-endpoint-for-dell-mst-displ.patch +drm-amd-display-clock-does-not-lower-in-updateplanes.patch +drm-amd-display-wait-for-backlight-programming-compl.patch +drm-amd-display-fix-dmcu-hang-when-going-into-modern.patch +drm-amd-display-use-encoder-s-engine-id-to-find-matc.patch +drm-amd-display-put-back-front-end-initialization-se.patch +drm-amd-display-allocate-4-ddc-engines-for-rv2.patch +drm-amd-display-fix-dc_create-failure-handling-and-6.patch +drm-amd-display-only-enable-audio-if-speaker-allocat.patch +drm-amd-display-increase-size-of-audios-array.patch +iscsi_ibft-make-iscsi_ibft-dependson-acpi-instead-of.patch +nl80211-fix-nl80211_he_max_capability_len.patch +mac80211-fix-possible-memory-leak-in-ieee80211_assig.patch +mac80211-don-t-warn-about-cw-params-when-not-using-t.patch +allocate_flower_entry-should-check-for-null-deref.patch +hwmon-occ-fix-division-by-zero-issue.patch +hwmon-nct6775-fix-register-address-and-added-missed-.patch +arm-dts-imx6ul-fix-clock-frequency-property-name-of-.patch +powerpc-papr_scm-force-a-scm-unbind-if-initial-scm-b.patch +arm64-force-ssbs-on-context-switch.patch +arm64-entry-sp-alignment-fault-doesn-t-write-to-far_.patch +iommu-vt-d-check-if-domain-pgd-was-allocated.patch +drm-msm-dpu-correct-dpu-encoder-spinlock-initializat.patch +drm-silence-variable-conn-set-but-not-used.patch +arm64-dts-imx8mm-correct-sai3-rxc-txfs-pin-s-mux-opt.patch +arm64-dts-imx8mq-fix-sai-compatible.patch +cpufreq-pasemi-fix-use-after-free-in-pas_cpufreq_cpu.patch +s390-qdio-add-sanity-checks-to-the-fast-requeue-path.patch +alsa-compress-fix-regression-on-compressed-capture-s.patch +alsa-compress-prevent-bypasses-of-set_params.patch +alsa-compress-don-t-allow-paritial-drain-operations-.patch +alsa-compress-be-more-restrictive-about-when-a-drain.patch +perf-script-fix-off-by-one-in-brstackinsn-ipc-comput.patch +perf-tools-fix-proper-buffer-size-for-feature-proces.patch +perf-stat-fix-segfault-for-event-group-in-repeat-mod.patch +perf-session-fix-loading-of-compressed-data-split-ac.patch +perf-probe-avoid-calling-freeing-routine-multiple-ti.patch +drbd-dynamically-allocate-shash-descriptor.patch +acpi-iort-fix-off-by-one-check-in-iort_dev_find_its_.patch +nvme-ignore-subnqn-for-adata-sx6000lnp.patch +nvme-fix-memory-leak-caused-by-incorrect-subsystem-f.patch +arm-davinci-fix-sleep.s-build-error-on-armv4.patch +arm-dts-bcm-bcm47094-add-missing-cells-for-mdio-bus-.patch +scsi-megaraid_sas-fix-panic-on-loading-firmware-cras.patch +scsi-ibmvfc-fix-warn_on-during-event-pool-release.patch +scsi-scsi_dh_alua-always-use-a-2-second-delay-before.patch +test_firmware-fix-a-memory-leak-bug.patch +tty-ldsem-locking-rwsem-add-missing-acquire-to-read_.patch +perf-x86-intel-fix-slots-pebs-event-constraint.patch +perf-x86-intel-fix-invalid-bit-13-for-icelake-msr_of.patch +perf-x86-apply-more-accurate-check-on-hypervisor-pla.patch +perf-core-fix-creating-kernel-counters-for-pmus-that.patch +s390-dma-provide-proper-arch_zone_dma_bits-value.patch +gen_compile_commands-lower-the-entry-count-threshold.patch diff --git a/queue-5.2/test_firmware-fix-a-memory-leak-bug.patch b/queue-5.2/test_firmware-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..c3c84d4b243 --- /dev/null +++ b/queue-5.2/test_firmware-fix-a-memory-leak-bug.patch @@ -0,0 +1,46 @@ +From fc1adefb97e12d8a403a608884edb95bfc4c2ffb Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Sun, 14 Jul 2019 01:11:35 -0500 +Subject: test_firmware: fix a memory leak bug + +[ Upstream commit d4fddac5a51c378c5d3e68658816c37132611e1f ] + +In test_firmware_init(), the buffer pointed to by the global pointer +'test_fw_config' is allocated through kzalloc(). Then, the buffer is +initialized in __test_firmware_config_init(). In the case that the +initialization fails, the following execution in test_firmware_init() needs +to be terminated with an error code returned to indicate this failure. +However, the allocated buffer is not freed on this execution path, leading +to a memory leak bug. + +To fix the above issue, free the allocated buffer before returning from +test_firmware_init(). + +Signed-off-by: Wenwen Wang +Link: https://lore.kernel.org/r/1563084696-6865-1-git-send-email-wang6495@umn.edu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 83ea6c4e623cf..6ca97a63b3d6b 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -886,8 +886,11 @@ static int __init test_firmware_init(void) + return -ENOMEM; + + rc = __test_firmware_config_init(); +- if (rc) ++ if (rc) { ++ kfree(test_fw_config); ++ pr_err("could not init firmware test config: %d\n", rc); + return rc; ++ } + + rc = misc_register(&test_fw_misc_device); + if (rc) { +-- +2.20.1 + diff --git a/queue-5.2/tty-ldsem-locking-rwsem-add-missing-acquire-to-read_.patch b/queue-5.2/tty-ldsem-locking-rwsem-add-missing-acquire-to-read_.patch new file mode 100644 index 00000000000..1ac681dc5b4 --- /dev/null +++ b/queue-5.2/tty-ldsem-locking-rwsem-add-missing-acquire-to-read_.patch @@ -0,0 +1,75 @@ +From 4b75834db938271f6c3aa92f5621d97292f83853 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 18 Jul 2019 15:03:15 +0200 +Subject: tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep + loop + +[ Upstream commit 952041a8639a7a3a73a2b6573cb8aa8518bc39f8 ] + +While reviewing rwsem down_slowpath, Will noticed ldsem had a copy of +a bug we just found for rwsem. + + X = 0; + + CPU0 CPU1 + + rwsem_down_read() + for (;;) { + set_current_state(TASK_UNINTERRUPTIBLE); + + X = 1; + rwsem_up_write(); + rwsem_mark_wake() + atomic_long_add(adjustment, &sem->count); + smp_store_release(&waiter->task, NULL); + + if (!waiter.task) + break; + + ... + } + + r = X; + +Allows 'r == 0'. + +Reported-by: Will Deacon +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Will Deacon +Cc: Linus Torvalds +Cc: Peter Hurley +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 4898e640caf0 ("tty: Add timed, writer-prioritized rw semaphore") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_ldsem.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c +index 717292c1c0dfc..60ff236a3d63d 100644 +--- a/drivers/tty/tty_ldsem.c ++++ b/drivers/tty/tty_ldsem.c +@@ -93,8 +93,7 @@ static void __ldsem_wake_readers(struct ld_semaphore *sem) + + list_for_each_entry_safe(waiter, next, &sem->read_wait, list) { + tsk = waiter->task; +- smp_mb(); +- waiter->task = NULL; ++ smp_store_release(&waiter->task, NULL); + wake_up_process(tsk); + put_task_struct(tsk); + } +@@ -194,7 +193,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout) + for (;;) { + set_current_state(TASK_UNINTERRUPTIBLE); + +- if (!waiter.task) ++ if (!smp_load_acquire(&waiter.task)) + break; + if (!timeout) + break; +-- +2.20.1 + diff --git a/queue-5.2/vfio-ccw-don-t-call-cp_free-if-we-are-processing-a-c.patch b/queue-5.2/vfio-ccw-don-t-call-cp_free-if-we-are-processing-a-c.patch new file mode 100644 index 00000000000..bba14a9da96 --- /dev/null +++ b/queue-5.2/vfio-ccw-don-t-call-cp_free-if-we-are-processing-a-c.patch @@ -0,0 +1,44 @@ +From 1af5c6e7b7c9cb0ebbe2f2d696a7b4272ce3bc25 Mon Sep 17 00:00:00 2001 +From: Farhan Ali +Date: Thu, 11 Jul 2019 10:28:54 -0400 +Subject: vfio-ccw: Don't call cp_free if we are processing a channel program + +[ Upstream commit f4c9939433bd396d0b08e803b2b880a9d02682b9 ] + +There is a small window where it's possible that we could be working +on an interrupt (queued in the workqueue) and setting up a channel +program (i.e allocating memory, pinning pages, translating address). +This can lead to allocating and freeing the channel program at the +same time and can cause memory corruption. + +Let's not call cp_free if we are currently processing a channel program. +The only way we know for sure that we don't have a thread setting +up a channel program is when the state is set to VFIO_CCW_STATE_CP_PENDING. + +Fixes: d5afd5d135c8 ("vfio-ccw: add handling for async channel instructions") +Signed-off-by: Farhan Ali +Reviewed-by: Cornelia Huck +Message-Id: <62e87bf67b38dc8d5760586e7c96d400db854ebe.1562854091.git.alifm@linux.ibm.com> +Reviewed-by: Eric Farman +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index 9125f7f4e64c9..8a8fbde7e1867 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + if (scsw_is_solicited(&irb->scsw)) { + cp_update_scsw(&private->cp, &irb->scsw); +- if (is_final) ++ if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) + cp_free(&private->cp); + } + mutex_lock(&private->io_mutex); +-- +2.20.1 + diff --git a/queue-5.2/vfio-ccw-set-pa_nr-to-0-if-memory-allocation-fails-f.patch b/queue-5.2/vfio-ccw-set-pa_nr-to-0-if-memory-allocation-fails-f.patch new file mode 100644 index 00000000000..6ad939a8524 --- /dev/null +++ b/queue-5.2/vfio-ccw-set-pa_nr-to-0-if-memory-allocation-fails-f.patch @@ -0,0 +1,39 @@ +From 40b97089c8657143ace60289afeca9bb733464fc Mon Sep 17 00:00:00 2001 +From: Farhan Ali +Date: Thu, 11 Jul 2019 10:28:53 -0400 +Subject: vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn + +[ Upstream commit c1ab69268d124ebdbb3864580808188ccd3ea355 ] + +So we don't call try to call vfio_unpin_pages() incorrectly. + +Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces") +Signed-off-by: Farhan Ali +Reviewed-by: Eric Farman +Reviewed-by: Cornelia Huck +Message-Id: <33a89467ad6369196ae6edf820cbcb1e2d8d050c.1562854091.git.alifm@linux.ibm.com> +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_cp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c +index 0e79799e9a719..79eb40bdaf9f4 100644 +--- a/drivers/s390/cio/vfio_ccw_cp.c ++++ b/drivers/s390/cio/vfio_ccw_cp.c +@@ -89,8 +89,10 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev, + sizeof(*pa->pa_iova_pfn) + + sizeof(*pa->pa_pfn), + GFP_KERNEL); +- if (unlikely(!pa->pa_iova_pfn)) ++ if (unlikely(!pa->pa_iova_pfn)) { ++ pa->pa_nr = 0; + return -ENOMEM; ++ } + pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr; + + pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT; +-- +2.20.1 +